Authorisation and registration applications – good practice and areas for improvement

We have seen firms:

Providing their own suitability assessment of their Approved Persons[3] (in Financial Services and Market Act 2000) / Key Individuals (in Payment Services Regulations 2017 and Electronic Money Regulations 2011).

Providing a clear ownership structure chart within their application and identifying all relevant parties in a presentation format so we can clearly identify the Controllers[4] of the firm (this doesn’t apply to sole traders).

Recognising gaps in their staff resources and explaining upfront how they will be filled and over what timeframe. Some firms have included plans for recruitment, while others provided their skills gaps analysis, with detailed plans to upskill existing staff in a reasonable period after authorisation or registration.

Clearly explain the rationale behind their staff incentives to show how these will drive the provision of good customer outcomes, rather than only driving sales volume. 

We have seen firms:

Overly relying on their compliance consultant and unable to demonstrate they understand their regulatory obligations without their consultant’s support. We know that some firms benefit from the support of a compliance consultant, but applicants are responsible for their own applications and should be prepared to engage with us.

Failing to demonstrate how individuals with multiple responsibilities will allocate their time to competently fulfil their roles. We know smaller firms are more likely to face this challenge, but the application should explain in practical terms how the individual will split their time across their different responsibilities and roles.

Being unable to evidence the eligibility of staff to work in the UK or provide addresses which support an assertion that the business will be UK based. Firms should be able to prove that they have a meaningful commitment to doing business in the UK.

We have seen firms:

Using our sample business plan[5] to make sure key information is included. This is especially relevant to small firms who may not have had a documented business plan in place before applying for authorisation or registration.

Making clear within their policies how their decisions are made in the UK when their operations are located overseas. Firms should be able to demonstrate clear reporting lines and explain how they will allocate appropriate resources to the UK entity. This is important because we want to understand how decisions will be taken in the best interest of UK customers and that we can supervise the firm effectively.

Providing detailed analysis in their application of how each permission applied for is relevant for the firm’s intended activities. Firms provide their legal advice or make reference to the FCA’s Perimeter Guidance Manual[6].

Weaving in the Consumer Duty[7] throughout their policies, procedures, systems and controls, rather than simply repeating our expectations of the Duty in a separate document. 

We have seen firms:

Not tailoring their policies to their specific business. This means we cannot see how they would be implemented by the firm. This is especially relevant for small firms, who may not have the resources to implement complex compliance arrangements.

Not consider all of the likely customer scenarios when designing their systems and controls. This can mean that there are gaps where customers, especially those in vulnerable circumstances, may not get the support they need and could suffer poor outcomes as a result.

Repeat our rules within their policies, rather than focus on documenting how they intend to comply with those rules within their own setting.

Focus on the risks to the firm, rather than the risks that their business model exposes their customers to, especially when considering their compliance monitoring arrangements.

Preparing policies that are not aligned and so do not make sense when considered together. This can happen when using templated policies that have not been designed for the specific firm. When reading the firm’s policies, we should be able to join the dots to gain an understanding of how the firm will apply the policies on a day-to-day basis.

Providing unclear information on their planned IT systems and infrastructure. Firms should identify the use of off the shelf, modified or custom systems. The timelines and project plans for the intended technology should be clear and realistic. 

We have seen firms:

Using our retail firm financial analysis template[8] or our wholesale and consumer investment firm financial analysis template[9] to present their forecast information in a format that is easy for us to understand. 

Provide accompanying notes and assumptions to support the financial information given, which provides us with context and explanation.

Provide evidence of their funding arrangements and clearly highlight the funding commitments and relevant contingency plans. Smaller firms with less complex funding arrangements can include relevant evidence such as bank statements.

We have seen firms:

Failing to submit their historic financial accounts as part of their initial application. This delays our assessment.

Submitting inaccurate information that hinders our assessments and creates additional information requests.

Not including relevant information to verify they have the necessary financial resources to meet our prudential requirements where relevant. Firms should consider the applicable rules and supply us with all the information that we need.