Financial advice providers are being told they could do better when it comes to protecting client money and property.

The Financial Markets Authority has published a review which found most financial advice providers and discretionary investment management service providers were meeting their obligations.

But it said there were some weaknesses when it came to oversight, governance, custody reporting and investor information, which could increase the risk of harm to investors if the problems were not addressed.

The FMA said it observed a lack of understanding about who was ultimately responsible for safeguarding investor assets when custody was outsourced to third parties, and some examples of insufficient or absent processes and controls.

“We also heard that investors have limited understanding of how their assets are safeguarded, which increases the risk of issues or harm going undetected.”

When custody was outsourced, there was sometimes uncertainty about who the provider was and who was responsible for that service, the FMA said, including who would hold the legal obligations.

“Oversight of custodians by licensed providers was often insufficient. We identified inadequate due diligence practices, overreliance on wrap platforms to conduct oversight, unclear contractual documentation, infrequent review of custody agreements, insufficient oversight of reconciliations and assurance reporting, and limited incident tracking.”

The FMA said while regular reporting to investors by custodians allowed them to verify the security of their assets, many providers did not have the systems to ensure those reports were delivered.

“Some licensed providers had structured risk management frameworks that included regular control testing, oversight of service providers, and board reporting. Others lacked formal policies and procedures, effective monitoring and incident management processes, clear escalation protocols, and documented governance or oversight arrangements.”

It said there were common control weaknesses across providers, including inadequate controls on withdrawals and fraud prevention measures.

“In some cases, key controls relied on adviser judgement or manual processes, with limited segregation of duties and no independent review. This increased the risk of errors, fraud and control failures going undetected.

“Information about fees, charges, and roles and responsibilities relating to custody of assets was generally included in disclosure documents; however, it was often not explained to the investor.”

It said licensed providers needed to maintain effective oversight of custody arrangements, whether it was outsourced or not.

“There is also uncertainty regarding what constitutes ‘outsourcing’. Many licensed providers did not conduct due diligence on the third-party provider because they did not consider this was an outsourcing arrangement. Some licensed providers are uncertain of what constitutes the performance of a regulated service and what is the use of external support services.”

The FMA said it gathered information from 130 financial advice providers, and conducted more in-depth monitoring inspections of 20 licensed providers.

“We examined client money and property service arrangements, including custody arrangements, oversight practices, governance and investor reporting,” says Romil Ghelani, head of financial advice. 

“Protecting client assets is fundamental to investor confidence and market integrity. Licensed providers must understand their obligations and maintain effective oversight, governance and controls to ensure client money and property remain protected regardless of whether services are provided in-house or outsourced.” 

The report encouraged all licensed providers to review their arrangements for protecting client assets and ensure they have effective systems, controls, and oversight in place.  

The FMA said it expects providers to understand their obligations, maintain appropriate oversight of outsourced services, and ensure their systems, controls and governance arrangements are effective and proportionate to the nature, scale, and complexity of their business. 

“Providers of client money or property services (CMPS) should clearly understand their obligations and be able to demonstrate they have adequate systems and processes. Where CMPS are outsourced to a third party, adequate oversight arrangements should be in place.

“All licensed providers should ensure their existing systems, controls and oversight arrangements are effective and proportionate to the nature, scale and complexity of their business.  We encourage licensed providers to proactively ensure that investors understand how their assets are protected.”

It said feedback had been given to the providers reviewed.

“Most were receptive to our findings and have reflected on the services they provide and how their CMPS is delivered. We may consider the use of regulatory tools if weaknesses identified are not addressed.”

Law firm Minter Ellison Rudd Watts said the report was a chance for providers to review their processes and procedures. “We would encourage providers to identify any gaps or areas where they could improve to better align their oversight and service delivery procedures with the FMA’s expectations. Any key learnings should be implemented with a view to mitigate the risk of consumer harm and ultimately aim to ensure more effective asset protection.”