The company has been penalised for “failings in its oversight of its outsourced providers in relation to the protection of client assets”.

The fine relates to Aviva Pension Trustees UK Limited and Aviva Wrap UK Limited.

Had they not agreed to settle at an early stage, the fine would have been £11,781,262.

Mark Steward, director of enforcement and market oversight at the FCA, said: “Aviva outsourced the administration of client money and external reconciliations in relation to custody assets, but failed to ensure that it had adequate controls and oversight arrangements to effectively control these outsourced activities.

“With outsourced arrangements firms remain fully responsible for compliance with our CASS rules. Firms are reminded that regulated activities can be delegated but not abdicated.

“Other firms with similar outsourcing arrangements should take this as a warning that there is no excuse for not having robust controls and oversight systems in place to ensure their processes comply with our rules when CASS functions are outsourced.

"This is the first CASS case in relation to oversight failures of outsourcing arrangements and we will continue to take action against firms that fall short of our CASS Rules.”

The FCA said the failings were deemed ‘serious’ in particular because CASS Rule breaches were identified in Aviva’s annual external CASS reports for consecutive years.

But there was “no actual loss of client money or custody assets in this instance”.

Had Aviva suffered “an insolvency event” during the period, customers could have suffered loss due to Aviva’s non-compliance with the CASS Rules.

The FCA reminded firms that the Client Assets Sourcebook rules are there to protect client money and custody assets if a firm becomes insolvent and to ensure money and assets can be returned to clients as quickly as possible.

Aviva breached these rules and requirements that firms should have adequate management, systems and controls (Principle 3) and properly safeguard clients’ assets (Principle 10) between 1 January 2013 and 2 September 2015, the FCA said.

In a statement, the FCA explained the breach, saying: “During the period Aviva failed to put in place appropriate controls over Third Party Administrators (TPAs) to which they had outsourced the administration of client money and external reconciliations in relation to custody assets.

“This resulted in Aviva failing to sufficiently challenge the internal controls, competence and resources of their TPAs. Aviva also failed to dedicate adequate resource and technical expertise to enable them to implement effective CASS oversight arrangements resulting in their delayed detection and rectification of CASS risks and compliance issues.

“The FCA also found deficiencies with Aviva’s internal reconciliation process which resulted in the under- and over-segregation of client money. During the period from 10 February 2014 to 9 February 2015 under-segregation peaked at £74.4m.

“The failings also meant that Aviva was unable to meet their obligations under the CASS Rules, such as the requirements to submit accurate Client Money and Asset Returns (CMAR) and maintain an adequate CASS resolution pack.”