Contents
The Financial Markets Authority has delivered a ‘could do better’ report after surveying around 130 financial advice providers (FAPs), and conducting more in-depth on-site monitoring of 20 FAPs and discretionary investment management service (DIMS) providers, regarding their compliance with their client money and property services (CMPS) obligations under the Financial Markets Conduct Act.
The FMA identified this as an area of future focus in its 2025 Financial Conduct Report. The review, which is linked to the recent FMA consultation on custody settings, found that, although the survey respondents were generally CMPS compliant in relation to retail clients, there remain a number of areas for improvement.
Key findings
Outsourcing does not transfer responsibility, but many providers are acting as if it does
The FMA found widespread uncertainty over who the CMPS provider was and who held ultimate responsibility when custody was outsourced. Some providers were uncertain as to what constituted outsourcing. Some providers incorrectly treated outsourcing as a transfer of legal responsibility. (Under section 431ZI of the Financial Markets Conduct Act 2013 (FMCA), the provider remains responsible to the client regardless of outsourcing).
The FMA also found instances of inadequate due diligence, over-reliance on wrap platforms for oversight, unclear contractual documentation, and limited incident tracking. Many FAPs had not reviewed their custody agreements since entering into those contractual arrangements.
Custody reports are not consistently reaching investors
Many providers relied on custodians to fulfil reporting obligations without independent checks to confirm delivery, and failures were often identified only through investor queries. System errors, platform limitations and, in some cases, reports being sent to FAPs rather than directly to investors further reduced the effectiveness and independence of custody reporting. Low investor engagement with custody reports was noted, even where online portal access was available.
Controls over client assets are not consistently robust
The FMA identified common control weaknesses including inadequate controls over withdrawals, changes to investor details, and account reconciliations. Some FAPs providing in-house CMPS were unaware of the requirement to obtain an independent assurance report under regulation 229U.
Fee disclosure is inconsistent and often incomplete
Custody fees were described inconsistently across client documents, and incidental charges (transaction fees, brokerage, FX margins) were not always clearly disclosed before being charged. The FMA expects clear fee disclosure and encourages advisers to proactively discuss fees with investors.
Actions for providers
The FMA expects all CMPS providers to self-assess against its findings and identify where improvements can be made.
Key actions include:
Custody oversight and outsourcing
- Ensuring outsourced custody arrangements are supported by adequate due diligence, clear contractual documentation, and structured, ongoing monitoring.
- Reviewing custody and wrap platform agreements to confirm they are current, clearly identify the CMPS provider, and reflect applicable obligations.
Governance and controls
- Ensuring adequate systems and processes are in place to meet CMPS obligations, and controls are proportionate to the nature, scale and complexity of the business.
- Implementing robust, multi-layered controls for investor withdrawals, changes to investor details, and fraud prevention, including segregation of duties and independent verification.
- Ensuring compliance with the requirement to obtain an independent assurance report where applicable.
Reporting and disclosure
- Ensuring custody reports are reliably delivered directly to investors and implementing independent checks to confirm delivery.
- Proactively communicating to investors how their assets are protected and clearly disclosing all fees, including incidental charges.
Next steps
The FMA has provided targeted feedback to the entities subject to the review, and will continue to test their arrangements through its supervisory and monitoring activities. It also encourages all other CMPS providers to read the report’s findings and identify where they can improve the delivery of these services.
The FMA's indication that it may deploy regulatory tools where weaknesses are not addressed means providers should treat this report as a prompt for action rather than general guidance.
If you need assistance reviewing your CMPS arrangements or oversight frameworks in light of the FMA’s report, our experts are available to assist, including with matters such as:
- CMPS gap analysis: benchmarking current arrangements against the FMA's findings and expectations;
- Custody agreement review: reviewing and updating outsourcing agreements, wrap platform terms and custodian contracts to ensure they clearly allocate responsibilities and reflect current obligations;
- Governance and controls uplift: advising on governance frameworks, incident management processes and fraud prevention controls;
- Investor reporting and disclosure: reviewing custody reporting processes and fee disclosure practices for compliance with FMCA and FMC Regulations requirements; and
- Engagement with the FMA: assisting providers that have received individual feedback from the FMA to respond appropriately.
