Chartered Institute for Securities & Investment (CISI) Qualifications Operations, Settlement and Custody Syllabus

What does CASS stand for and what does it govern?

Client Assets Sourcebook — the FCA rulebook governing how firms hold and protect client money and client safe custody assets, ensuring segregation and return to clients if the firm fails.

What is the core principle of client asset segregation under CASS?

Client assets and client money must be kept separate from the firm's own assets, so that on the firm's insolvency client assets are ring-fenced, identifiable and returnable to clients rather than available to the firm's creditors.

Under CASS, what is the purpose of the client money internal and external reconciliations?

To verify that the amount of client money the firm should be holding (its records/resource) matches the amount actually held in client bank accounts (requirement), identifying and correcting any shortfall or excess promptly.

What is a 'statutory trust' under CASS client money rules?

Client money held by a firm is held on trust for clients under a statutory trust, meaning the money legally belongs to clients and is protected from the firm's general creditors in insolvency.

Define a corporate action.

An event initiated by an issuer that affects its securities and the holders of those securities — for example dividends, coupon payments, rights issues, bonus issues, mergers, takeovers or stock splits.

What are the three classifications of corporate actions by holder choice?

Mandatory (automatic, no choice — e.g. cash dividend, stock split); Voluntary (holder must elect to participate — e.g. tender offer, optional buyback); Mandatory with options (event happens but holder chooses between outcomes — e.g. optional stock/cash dividend).

Give an example of each corporate action type: mandatory, voluntary, and mandatory-with-options.

Mandatory: cash dividend or stock split. Voluntary: tender offer or rights subscription. Mandatory with options: dividend reinvestment/scrip vs cash election, or a takeover offering cash or shares.

In dividend processing, define record date, ex-dividend date and payment date.

Record date: the date on which a holder must be on the register to receive the dividend. Ex-dividend date: the date (usually one business day before record date) from which buyers are no longer entitled to the dividend. Payment date: when the dividend is actually paid.

What is a 'coupon' and how is coupon processing handled by a custodian?

A coupon is the periodic interest payment on a bond. The custodian collects the coupon on the payment date based on holdings as at record date, credits the beneficial owner's account, and may handle withholding tax and reclaims.

What is a market claim in corporate action processing?

An automatic compensation mechanism that reallocates an entitlement (e.g. a dividend) to the rightful party when a trade settles around the record date, so the buyer/seller who is economically entitled receives the benefit despite registration timing.

What is proxy voting?

The process by which a beneficial owner (often via a custodian/nominee) instructs how their shares are to be voted at a company general meeting without attending in person, exercising their governance/entitlement rights.

Why is the nominee/custody structure relevant to proxy voting?

Because shares are registered in a nominee's name, the beneficial owner is not the registered holder. The custodian must pass meeting notices to the beneficial owner and relay their voting instructions to the issuer/registrar so the beneficial owner can vote.

Define an entitlement in custody operations.

A holder's right arising from owning a security — such as the right to receive a dividend, coupon, bonus share, vote, or to participate in a rights issue — determined by holdings as at the relevant record/entitlement date.

What is a reconciliation in operations?

The process of comparing two sets of records (e.g. internal ledger vs custodian/depot statement, or internal cash vs bank statement) to confirm they agree and to identify, investigate and resolve any differences (breaks).

What is a reconciliation 'break'?

A discrepancy identified during reconciliation where the two records being compared do not match — e.g. a difference in position, cash balance or transaction — requiring investigation and resolution.

Distinguish a stock (position) reconciliation from a cash (nostro) reconciliation.

A stock/position reconciliation compares internal securities holdings against the custodian/CSD depot records. A cash/nostro reconciliation compares the firm's internal cash records against the bank/nostro account statements.

Name three common causes of reconciliation breaks.

Timing differences (settlement not yet processed), missing or unbooked trades, incorrect or duplicated entries, fails, fees/charges not recorded, corporate action entitlements not yet applied, or fraud/error (any three).

Define operational risk.

The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk (Basel definition).

List the four Basel categories of operational risk causes.

People, Processes, Systems, and External events.

Distinguish a preventive control from a detective control.

A preventive control stops an error or loss from occurring (e.g. authorisation limits, segregation of duties, validation checks). A detective control identifies errors after they occur (e.g. reconciliations, exception reports, audits).

What is 'segregation of duties' and why is it an operational control?

Separating responsibilities so that no single individual controls all stages of a transaction (e.g. those who execute trades cannot also confirm/settle them). It reduces the risk of error and fraud going undetected.

What is the difference between the 'front office', 'middle office' and 'back office'?

Front office: client-facing trading/sales and execution. Middle office: risk management, trade validation, P&L and limit monitoring. Back office: settlement, confirmations, reconciliations, custody and corporate actions processing.

What is the 'four-eyes' principle?

A control requiring that an action or decision (e.g. a payment or trade booking) be reviewed and approved by a second authorised person before it takes effect, reducing the risk of error or fraud.

Define Business Continuity Planning (BCP).

The process of preparing an organisation to continue or rapidly resume critical operations following a disruptive event (e.g. system failure, cyber-attack, natural disaster), through documented plans, backup sites and recovery procedures.

What do RTO and RPO mean in business continuity?

RTO (Recovery Time Objective): the maximum acceptable time to restore a process/system after disruption. RPO (Recovery Point Objective): the maximum acceptable amount of data loss measured as the time between the last backup and the disruption.

What is Disaster Recovery (DR) and how does it relate to BCP?

Disaster Recovery is the subset of business continuity focused specifically on restoring IT systems, data and infrastructure after a disruption. BCP is broader, covering people, premises and all critical business processes.

Define outsourcing in a financial services operations context.

An arrangement in which a firm engages a third party to perform a function (e.g. custody, fund administration, IT) that the firm would otherwise undertake itself, while retaining regulatory responsibility for that function.

What is the key regulatory principle regarding outsourcing risk?

A firm can outsource the activity but not the responsibility/accountability — it remains responsible to regulators for the outsourced function and must exercise due diligence, oversight, governance and have contingency/exit plans.

Name three key risks introduced by outsourcing operational functions.

Loss of control/oversight, concentration risk (over-reliance on one provider), service provider failure/continuity risk, data security and confidentiality risk, and difficulty in exit/transition (any three).

What is concentration risk in the context of outsourcing and custody?

The risk arising from over-reliance on a single service provider, custodian or sub-custodian, such that the failure or disruption of that one entity would have a severe impact because exposures are not diversified across multiple providers.