CACEIS and WealthTek: testing the control chain behind client-asset protection

At a Glance

The FCA censured CACEIS UK for failing to act on information that left WealthTek clients exposed to financial-crime risk. CACEIS UK agreed to make a voluntary payment of £31.7m, and the FCA said its extensive co-operation and the payment were why it did not impose a fine.

The FCA says CACEIS UK became WealthTek's sub-custodian in November 2020 and was responsible for keeping client assets safe. Register checks showed that WealthTek lacked permissions to hold certain client assets and client money, yet CACEIS UK did not take sufficient action and later failed to review and resolve monitoring alerts promptly. The lesson is an end-to-end control question, not a finding that every custodian has the same facts.

The FCA said CACEIS UK's extensive co-operation and voluntary payment were why it did not impose a fine. That sanction decision is separate from the underlying control lesson: Register information, onboarding decisions, monitoring alerts and escalation need to operate as one connected chain.

Where the control chain failed

Failure to act on Financial Services Register information

CACEIS UK checked the Financial Services Register on three occasions, which showed that WealthTek was not authorised to hold certain client assets and was not permitted to hold client money. Despite this, CACEIS UK opened client accounts for WealthTek and failed to take sufficient remedial action. Firms should assess their onboarding and ongoing due diligence processes to ensure they effectively verify client permissions and escalate discrepancies promptly, distinguishing regulatory requirements from MEMA recommendations for control chain integration.

Inadequate transaction monitoring and alert resolution

CACEIS UK’s transaction monitoring system generated alerts based on thresholds linked to client risk ratings and transaction profiles. However, the firm failed to review and resolve 16 alerts over more than two years, leaving significant risks unaddressed. This highlights the importance of timely and thorough investigation of monitoring alerts. MEMA recommends that firms ensure their monitoring systems are supported by effective governance and escalation protocols, beyond just automated triggers.

Voluntary payment and regulatory cooperation as mitigation

The FCA decided not to impose a financial penalty on CACEIS UK because of its full and significant co-operation and agreement to make a voluntary ex-gratia payment of £31,714,068 to WealthTek clients. Firms should consider the benefits of early cooperation and remediation in enforcement scenarios, while maintaining robust controls to prevent breaches.

Evidence another firm can test

Firms should critically evaluate whether their control chain, from client onboarding and due diligence through transaction monitoring and alert management to client-asset protection, functions as integrated safeguards. The FCA’s findings show that CACEIS UK’s failure was not only in individual control elements but in the lack of connection and escalation between them. Practical steps include verifying that Financial Services Register checks are acted upon promptly, that KYC files are complete and up to date, and that transaction alerts are investigated and resolved within defined timeframes.

The case also highlights the importance of governance and oversight in ensuring controls are effective in practice, not just on paper. Firms should review their policies and procedures to confirm they meet SYSC 6.1.1R and 6.3.1R requirements for financial crime controls, and that ongoing monitoring is proportionate and responsive to risk. MEMA recommends conducting scenario testing and control chain walkthroughs to identify potential gaps in escalation and remediation processes before regulatory scrutiny.

MEMA recommends sampling the hand-offs as well as the individual controls: whether a Register discrepancy changed the onboarding decision, whether missing KYC information affected alert review, whether ageing triggered escalation and whether the final decision and remediation can be reconstructed from the record.

Where the read-across is strongest

This case primarily affects firms providing custody and asset servicing functions, particularly those acting as sub-custodians for other regulated entities. Firms with permissions to hold client money or assets, including those offering transaction monitoring and AML controls, should carefully review their client onboarding, due diligence, and ongoing monitoring frameworks. The WealthTek client journey, from onboarding through transaction processing to client-asset protection, is a critical focus area for CASS oversight leads, MLROs, and operations managers.

Other authorised firms can use the case as a control-design prompt, but should not present CACEIS UK's facts as if they automatically apply to a different business model. The Final Notice expressly limits its criticism to CACEIS UK.

Board challenge after an enforcement case

The FCA’s censure of CACEIS UK for weak financial crime controls in the WealthTek case underscores the critical need for boards to scrutinise the effectiveness of the entire control chain protecting client assets. Boards should ask whether onboarding due diligence, transaction monitoring, alert escalation, and client-asset protection operate as connected and responsive processes rather than isolated checklists. Evidence such as timely alert resolution reports, documented escalation decisions, and updated KYC files can help a firm demonstrate that controls operate with due skill, care and diligence in line with Principle 2.

MEMA recommends that boards also consider the implications of regulatory cooperation and remediation in enforcement outcomes. The FCA’s decision not to impose a financial penalty on CACEIS UK was influenced by its full and significant co-operation and voluntary payment to clients. This highlights the value of proactive engagement with regulators and swift remedial action. Boards should ensure that senior management is empowered and resourced to respond effectively to regulatory inquiries and that lessons from enforcement cases are embedded in firm-wide control improvements.

MEMA helps firms apply regulatory developments through its financial-crime compliance support.

Further reading: a related surveillance-controls case study.

Control Lessons for Firms

Source Evidence

Plain English Glossary

• SYSC - Senior Management Arrangements, Systems and Controls. FCA Handbook section covering governance, risk management, and operational control expectations.
• CASS - Client Assets sourcebook. FCA Handbook section governing how firms must hold, safeguard, and reconcile client money and assets.
• AML - Anti-Money Laundering. Controls and processes firms must operate to detect, prevent, and report money laundering activity.
• KYC - Know Your Customer. Customer identity, ownership, and source-of-funds checks required at onboarding and during the relationship.

Disclaimer

This article is for general information only and does not constitute legal or regulatory advice. Firms should assess the application of regulatory requirements by reference to their permissions, products, customers and operating model.

How MEMA Can Help

MEMA can help firms translate regulatory change into practical controls, policies, monitoring activity and board evidence. Book a free scoping call to discuss what this development means for your firm.