Client Portals: What ‘Evidence of Access’ Really Means

Investment managers increasingly want to use client portals as the primary channel for periodic reporting. COBS 16A allows this in principle, but only if the portal meets the FCA’s durable medium requirements and, crucially, the firm can evidence that clients accessed the required information. This article explains what COBS 16A expects, what ‘evidence of access’ means in practice, and how to design a workable control framework that stands up to FCA scrutiny.

The COBS 16A reporting duties

For portfolio management, COBS 16A.4 requires a periodic statement in a durable medium, normally at least quarterly. Separately, COBS 16A.5 applies where the firm holds client financial instruments or client funds for the client, and it requires a quarterly statement of those assets unless the information is included in another periodic statement. In both cases, COBS 16A includes an online portal alternative, but it is conditional.

When a portal can replace sending statements

Under COBS 16A, a firm may forgo sending the quarterly statement if the client has access to an online system that qualifies as a durable medium, the required information is readily accessible, and the firm has evidence that the client accessed the valuation or statement at least once in the relevant quarter. This ‘evidence’ requirement is not a nice-to-have. If a client does not meet the requirement in a given quarter, the portal alternative is unavailable for that period, and the firm should revert to dispatching the periodic statement in a durable medium.

Durable medium, in plain English

The FCA’s durable medium guidance is helpful because it turns an abstract concept into three practical tests. A durable medium must allow information to be personally addressed to the client, stored for future reference for an adequate period, and reproduced unchanged. For portals, the ‘unchanged reproduction’ point is often the hardest. A purely live dashboard may not be enough unless clients can download or retrieve a time-stamped statement that cannot be altered later without leaving an audit trail.

What “evidence of access” should look like

COBS 16A requires evidence that the client accessed the valuation or statement, so a simple record of the client logging into the portal is usually insufficient. In practice, the firm should be able to demonstrate that the client accessed the page or document containing COBS 16A content, and that they did so at least once during the quarter.

Practical logging expectations

A proportionate approach is to log three things consistently for each client session: who accessed, when they accessed, and what content they accessed. That typically means capturing the user ID, timestamp, and a content identifier, such as the valuation screen, statement page, or PDF download event.

Portal design matters

The rule also requires that the client can “easily access” the information, which is a design and navigation question as much as it is a compliance one.

If the valuation statement is buried behind multiple clicks or split across several screens without a clear ‘statement’ view, it becomes harder to argue the client had easy access and harder to evidence what they saw.

Common implementation gaps

Firms often fall into a small number of predictable traps when building portal-based reporting. These include relying on generic login logs, offering only a live valuation without a retrievable prior-period statement, or failing to define a clear fallback process for clients who did not access during the quarter.

A workable control framework

A simple framework is often effective and proportionate for most firms. It should include a documented statement pack available through the portal, robust access logging, quarterly monitoring that flags clients with no evidence of access, and a dispatch process that issues statements to those clients promptly after quarter-end.

Where COBS 16A.5 fits

COBS 16A.5 is only relevant if your firm holds client financial instruments or client funds for the client, which typically aligns with custody and or client money permissions and operating model. If your business model uses an external platform or custodian and the firm does not hold client assets or client money, COBS 16A.5 may not apply, but COBS 16A.4 still will if you provide portfolio management. 

A practical takeaway

Portals can be an efficient and client-friendly way to meet COBS 16A reporting, but the compliance bar is not just ‘make it available’. You need a portal that behaves like a durable medium and an audit trail that proves clients accessed the valuation or statement within the quarter, with a defined process for when they do not.