FMA publishes final guidance for client money and property service providers

The Financial Markets Authority (FMA) has released its final guidance (Guidance) for providers of “client money or client property” services, including platform custodians, DIMS custodians, and share broker and financial adviser nominee companies.

This Guidance supersedes the FMA's earlier guidance on “broker” obligations under the (now repealed) Financial Advisers Act 2008, offering updated views on compliance with the corresponding (and broadly unchanged) obligations under the “client money or client property” rules of the Financial Markets Conduct Act 2013 (FMC Act). It also suggests some recommended best practices for providers handling client funds, emphasising transparency, accountability, and record-keeping.

Overview of the Guidance

Key points addressed in the Guidance include:

• Outsourcing: Providers remain responsible for outsourced services. Due diligence is required when outsourcing to third-party providers to ensure that the provider’s obligations will be met.
• Protection of Client Identification Numbers: The Guidance emphasises secure handling of Common Shareholder Numbers (CSNs), Security Reference Numbers (SRNs), and Authorisation Codes (FINs). Providers should use encryption or two-factor authentication for protection. Where FINs are not required to be held on file, their record should be destroyed immediately after each transaction.
• Prohibition on cross-use of client money: Providers cannot use one client’s money to cover shortfalls for another client. Client money must be held and managed separately. The use of provider money as a “buffer” in accounts is only permitted in limited circumstances.
• Deducting margins: Providers must clearly and transparently disclose and obtain client approval before deducting any margins from client money. Providers should disclose the value and purpose of the margin transparently.
• Trust accounts: Best practice is to label accounts as “trust” or “client funds account” to reflect their status.
• Bank account reconciliations: Providers should perform regular reconciliations based on business nature and complexity. Variances must be addressed and resolved promptly.
• Documentation and Reporting: Providers must regularly review and update client contracts and documentation and provide regular, preferably quarterly, reporting to clients.
• Identification of wholesale clients: Providers must maintain records to distinguish between wholesale and retail clients.
• Intermediaries: The Guidance clarifies the FMA’s expectations on the application of FMC Act obligations to different types of intermediaries, including the clarification that the FMA does not consider client money and property rules under the FMC Act to apply to a “broker” within the meaning of the Insurance Intermediaries Act 1994 (IAA), and that in the FMA’s view a non-IAA broker is not providing a client money or property service.
• Identification of the provider: The Guidance assists relevant parties in identifying who is the client money or property service provider responsible under the FMC Act.
• Custodial obligations: Custodians have additional requirements, including detailed reconciliations and reporting obligations.

Changes arising from consultation

The Guidance follows a consultation carried out in 2022. The main changes in the finalised version of the Guidance are:

• Protection of Client CSNs, SRNs, and FINs: The consultation draft suggested that CSNs, SRNs, and FINs should not be sent to clients by email. The Guidance says they can be sent by email but should be sufficiently protected, eg, by encryption or two-factor authentication.
• Deducting margins: The consultation draft suggested that positive client consent was required for deductions of margins paid on client money. The Guidance softens this, stating that the requirement is to give express, clear, and unambiguous disclosure of the deduction and a client direction should be obtained.
• Account naming conventions: The consultation draft suggested that bank accounts holding client money needed to be explicitly named as “trust accounts” or “client money accounts”. The Guidance clarifies that this is not a legal requirement but is best practice, and that an acknowledgement from the bank of the account's status as a trust account should be obtained.
• Client reporting: The consultation draft said client reporting must be done quarterly. The Guidance encourages quarterly reporting but notes the legal obligation is six-monthly.
• Record keeping: The consultation draft did not provide guidance on how records should be kept. The Guidance has added a series of recommendations about record-keeping practices to meet the FMA's expectations.
• Wholesale clients: The Guidance makes it clear that the FMA expects that where providers want to give wholesale clients the regulatory protection of retail clients, the provider has to obtain an “opt-out” of wholesale status from that client.
• Nominee companies: The Guidance clarifies the FMA’s view that nominee companies are required to register on the FSPR as client money or client property service providers, but that the regulatory obligations associated with the service remain with the provider or custodian.
• Client addresses: The Guidance reinforces the view that the provider’s assurance engagement should test the processes, procedures, and controls to ensure client reporting goes to the client (and not solely to the provider or client’s financial adviser). It also suggests that providers should verify that electronic addresses for clients are those of the client (or client's nominee) and not of parties involved in the transactional chain (eg, the client financial adviser).
• Reporting via online portals: The Guidance clarifies that where client reporting is done through an online portal provided by the person involved in the transactions (ie, the client’s financial adviser), the custodian needs to be satisfied that appropriate systems and controls are in place, and that the reports/information provided by the custodian for reporting through that portal cannot be altered.

The focus on ensuring custodial reports are sent to, or made available to, the client (or client’s nominee) independent of the client’s financial adviser and without the ability for the adviser to alter the information in the report reinforces the FMA’s 2023 report on the lessons learned from the Barry Kloogh Ponzi scheme.

We recommend that providers closely assess their own business practices against the Guidance and consider whether to implement new policies and processes. We are happy to advise on what obligations apply to providers of client money or client property services on a granular level and how compliance with these obligations can be implemented by providers in a practical way.