Effective from December 2022, the FCA introduced new rules and guidance to enhance oversight of their ARs. Earlier in 2022, the FCA launched a dedicated AR department to focus on tackling harm posed by these firms and their Principals.
A recent FCA review of Principals across a range of sectors demonstrate that Principals still have some way to go to ensure adequate oversight.
The FCA noted the following concerns which are consistently observed at various points during the Principal/AR relationship:
Poor quality self-assessments and annual reviews processes.
Tick-box approaches leading to inadequate coverage of points outlined in SUP 12.6A.
Minimal or no changes to on-boarding and off-boarding procedures, indicating insufficient consideration of new rules relating to oversight responsibility and the Consumer Duty to ensure existing processes remain robust and fit for purpose.
Lack of consideration of the risk to consumers posed by an AR's non-regulated activities.
Lack of sufficient skilled resource to analyse and act upon information gathered.
We consider each of these concerns below.
Self-assessments
The FCA’s SUP 12.6A sets out the requirement for Principals to conduct self-assessments to evaluate their compliance with the requirements and identify necessary changes. Such assessments are designed to ensure Principals are proactively monitoring and documenting their adherence to rules, with internal governance being appropriately informed on AR arrangements.
Principals must maintain a written record of compliance, identify material deficiencies and concerns, and implement an action plan to address any corrective actions – the FCA believes this is best done in a single document which should be reviewed and signed off annually by the governing body. Importantly, this should include an assessment of oversight effectiveness, including systems and controls. The FCA has remained silent on the ideal ratio of Principal resources to ARs. However, Principals should carefully consider both the financial and non-financial resources necessary to effectively oversee AR arrangements.
Good practice approaches include using a broad range of management information, such as staff turnover, changes to revenue and complaints rates. Additionally, employing a RAG rating system to categorise and prioritise potential gaps in compliance is indicative of good practice.
The FCA reiterates the importance of comprehensively addressing all the requirements and guidance raised under SUP 12.6A. Additionally, approaches to self-assessments can be enhanced by ensuring consideration of risk of harm to consumers arising from the AR's activities or business, both regulated and non-regulated.
Annual Reviews
Principals must carry out an annual review of their ARs' activities and business, considering the fitness and propriety of the AR's senior management, financial position, and the adequacy of the Principal's oversight capabilities. This review ensures effective oversight and reduces potential harm. Records of these reviews must be kept for at least six years. Additional reviews may also be required in certain circumstances as set out in SUP 12.6A.3R. This includes changes to the AR's business model or target market, expansion of the AR's scope to include new regulated activity, or a significant increase in complaints about the AR.
The number and quality of reviews remains a key concern for the FCA, with issues such as poor audit trails, insufficient record-keeping and incomplete coverage of the matters required in the FCA's rules. Other areas of poor practice include overreliance on AR self-declarations – it is the Principal's responsibility, not the AR's, to carry out the annual review.
Furthermore, a lack of evidence gathering when significant issues are identified, and failure to escalate these issues for appropriate consideration, are areas needing improvement.
Good practices include demonstrating a strong understanding of ARs’ business models, including any unregulated business and embedding Consumer Duty compliance into the review.
Monitoring, oversight and acting out of scope
Principals are required to have adequate controls over an AR’s regulated activities for which they have accepted responsibility, and resources to monitor and enforce the AR’s compliance with FCA requirements. The AR agreement should clearly outline these permitted activities, and proactive monitoring should follow to ensure oversight remains appropriate.
Good practice approaches should include combination of methods such as:
Reviewing all publicly available information such as marketing materials/websites, financial accounts and consumer contracts.
Conducting in-person visits and mystery shopping exercises to observe interactions between ARs and consumers.
Having formal and regular engagement with appropriate governing bodies, with issues identified and managed to completion.
Utilising various methods taken together is likely to provide assurance that the AR remains fit and proper, complies with the rules and operates within the scope of their appointment.
Approach to onboarding ARs
Checks and due diligence on prospective ARs should, at a minimum, include financial stability, staff competence and business model suitability. An overreliance on automated checks will compromise the collection of comprehensive and accurate evidence.
Specifically, Principals should take account of the unregulated activities of the AR and consider whether there is a risk of consumer harm. Other examples of good practice include clearly documented and updated procedures, provision of training to the ARs about the regulated activity, product specific knowledge and regulatory expectations.
Finally and perhaps most importantly, Principals should consider how the appointment of an AR will impact the Principal's financial and non-financial resources and their ability to effectively manage and oversee their full population of ARs.
Termination, off-boarding and orderly wind-down
The FCA reiterates the importance of Principals taking prompt action to resolve any issues at the ARs, including terminating the relationship where necessary. Establishing clear criteria for determining whether termination is appropriate is the first step. The FCA noted various indicators, including:
Continuing and unresolved issues with the AR;
High senior management turnover without satisfactory explanation;
An AR acting outside of the scope of the AR agreement;
An AR delivering poor customer outcomes; or
When no regulated activity has been conducted over an extended period by an AR and there is no valid reason to continue using the Principal's permissions.
This risk of harm to consumers remains at the forefront of the FCA's concern. Once a decision to terminate has been made, Principals should take all reasonable steps to ensure orderly wind down. This should include considering whether direct communication with customers is appropriate to mitigate any risk of harm or further harm.
What should firms do now?
This review follows the FCA's publication in April 2024 of the FCA's findings on ARs and Introducer Appointed Representatives (IARs) who undertake Credit Broking. We discussed this review here: Principal firms who have Credit Broking permissions (dwfgroup.com). Importantly, the FCA have stated that they will continue to monitor compliance by Principals, with particular focus on annual reviews, self-assessments, and the quality of oversight over ARs.
Many of the themes raised in the FCA's April 2024 review remain relevant. While the overall results are mixed, Principal firms in all sectors are encouraged to consider the findings from both reviews and proactively apply them to current practices, addressing any identified gaps.
DWF's Regulatory Consulting team have extensive experience working with Principal firms to support them in building and discharging their oversight and monitoring frameworks. We also work with Appointed Representatives across the financial sector, helping firms understand their unique regulatory position and ensuring compliance with relevant regulations.
Our integrated Legal and Regulatory Consulting teams can help you navigate the complex and evolving FCA requirements, by deploying knowledge and resources to support the implementation of stronger measures.
Authors: Rachel Kpiki, Andrew Jacobs and Sarah Jackson.
