FCA compliance for a mortgage business covers more than the Mortgage Conduct of Business sourcebook (MCOB). Depending on the firm's role, it can also include the Principles for Businesses and the Consumer Duty, the systems and controls rules (SYSC), the Senior Managers and Certification Regime (SM&CR), Training and Competence (TC), prudential requirements in MIPRU, financial promotions, complaints handling (DISP), reporting (SUP) and financial crime controls.
MCOB is the central conduct sourcebook across the mortgage lifecycle, from first contact to arrears and redemption. The Consumer Duty sits on top of it and asks whether customers actually receive good outcomes. In 2026 the FCA's Mortgage Rule Review, its second charge findings and its annual supervisory priorities are shaping how firms are supervised.
The table maps each framework to what it covers and to the firms it applies to. A firm's own obligations depend on the permissions it holds and the activities it carries on.
| Framework | What it covers | Who it applies to |
|---|---|---|
| FSMA and the Regulated Activities Order | Authorisation and the permission perimeter | Lenders, brokers, arrangers, advisers, administrators |
| PERG 4 | Guidance on regulated mortgage activities | Any business assessing its perimeter |
| PRIN and the Consumer Duty | High-level conduct and retail customer outcomes | Authorised firms in scope |
| MCOB | Conduct across the customer lifecycle | Lenders, intermediaries, administrators, by activity |
| SYSC | Governance, risk management, controls, outsourcing | Authorised firms, by applicable provision |
| SM&CR, FIT and COCON | Accountability, fitness and propriety, Conduct Rules | Senior managers and relevant staff |
| TC | Training, competence and supervision | Advisers and specified activities |
| MIPRU | Capital resources and professional indemnity insurance | Non-bank mortgage and home finance firms |
| DISP | Complaints and the Financial Ombudsman Service | Firms with eligible complainants |
| SUP | Notifications and regulatory reporting | All firms, by permission |
| SYSC 15A | Operational resilience | Banks, building societies, specified firms |
| Financial crime rules | Fraud and money laundering controls | All firms; MLR scope varies |
| SUP 12 | Appointed representative oversight | Principal firms with AR networks |
Entering into a regulated mortgage contract as lender and administering one are regulated activities. Advising on regulated mortgage contracts, arranging them and making arrangements with a view to them can also require permission.
Firms should map the activities they actually carry on rather than relying on a general description such as mortgage provider. Brokers need direct authorisation or an appointed representative arrangement with a principal firm. Non-bank lenders and third-party administrators need their own permissions. Banks and building societies are regulated by both the FCA and the PRA.
The perimeter analysis comes first, because the firm's role decides which rules apply. The FCA's application fee for most intermediaries is £2,820. The general framework for FCA-regulated firms is set out in the practical guide to FCA compliance in 2026.
MCOB applies by activity, so a firm with several roles may apply different chapters at different stages of the same customer relationship. It covers financial promotions, disclosure, advice and selling standards, responsible lending, charges, servicing, and arrears and repossession, with specific provisions for execution-only sales, equity release and payment difficulty.
Policies must be turned into working systems: sales scripts, underwriting rules, decision records and customer communications. A reviewer should be able to see each MCOB requirement reflected in the live process.
| MCOB chapter | Subject |
|---|---|
| MCOB 3A | Financial promotions |
| MCOB 4 | Advising and selling standards |
| MCOB 5A and 6A | Pre-application and offer disclosure |
| MCOB 7 | Disclosure during the life of the contract |
| MCOB 8 and 9 | Equity release advice and disclosure |
| MCOB 11 | Responsible lending and affordability |
| MCOB 12 | Charges |
| MCOB 13 | Arrears, payment shortfalls and repossessions |
The FCA is reviewing the mortgage rules in stages. Firms should track the review separately from current compliance, since proposals are not rules until a policy statement is published.
PS25/11, published on 22 July 2025, took effect the same day. It removed the interaction trigger, so a conversation with a customer no longer automatically requires advice; removed the requirement for a full affordability assessment when a customer shortens the mortgage term; and withdrew two pieces of non-Handbook guidance. Firms are expected to identify execution-only customers who may need advice or support to avoid foreseeable harm.
CP26/18, published on 9 June 2026 and closed on 28 July 2026, proposes targeted changes to support first-time buyers and underserved consumers. The FCA has said the proposals keep responsible lending requirements and the duty to check affordability in place, and that it expects to publish a policy statement in the second half of 2026.
| Area | Proposal |
|---|---|
| Interest-only and part-and-part | Clearer rules on when a credible repayment strategy is required and when it is reviewed |
| Retirement interest-only | Joint applications assessed in the same way as standard joint mortgages |
| Variable and irregular income | Examples of affordability evidence and non-monthly payment schedules |
| Credit-impaired borrowers | Narrower use of the definition, so lenders set their own risk appetite |
| Foreign currency loans | A more outcomes-based approach under the Consumer Duty |
| Bridging loans | Regulated bridging loans of up to 24 months, including extensions |
Until final rules are made, current MCOB applies. Lenders should assess how the proposals would affect underwriting, models and product design, without changing live policies ahead of the final rules.
Firms must deliver good outcomes in four areas: products and services, price and value, consumer understanding and consumer support, alongside the cross-cutting obligations to act in good faith, avoid foreseeable harm and support customers to pursue their financial objectives. The Duty applies across the distribution chain, so lenders and intermediaries each need to understand how their part affects the outcome the customer receives.
Manufacturers define a target market and show that the product meets its needs. Distributors need enough product information to distribute properly. Both use outcome data to identify groups receiving poorer outcomes. The exchange of information between lender and broker is therefore a regulatory control in its own right. The wider expectations are covered in the guide to Consumer Duty compliance in 2026.
Fair value covers the overall relationship between price and benefit: interest rates, arrangement fees, intermediary charges, early repayment charges and expected performance over time. Assessments need evidence, not a general statement that a product is competitive. Second charge and debt consolidation lending deserve particular scrutiny, because fees can be large and are often added to the loan.
A complete document can still leave customers unclear if its timing, language or presentation obscures costs, risks or consequences. Key areas are fixed and variable rates, early repayment charges, interest-only repayment strategies, terms that run into retirement, and securing unsecured debt against a home. Digital journeys need the same care, and customer testing, complaints, file reviews and support data show whether communications work.
Advice is governed by the MCOB advice and selling standards. The adviser needs enough information about the customer's needs and circumstances to support a suitable recommendation, covering the term, repayment method, rate preferences and affordability.
The advice record should explain why the recommendation meets those needs. Debt consolidation can reduce monthly payments while extending the term, increasing total interest and putting the home at greater risk, so the alternatives considered and the written rationale matter. The FCA's 2026 second charge findings place particular weight on this.
MCOB permits execution-only sales in defined circumstances, but the route must not be used to avoid advice obligations. Records should show why execution-only was appropriate for the customer.
Since PS25/11, a customer who proceeds without advice after an interactive dialogue must confirm that they understand they lose the protection of a suitability assessment. Digital prompts can still steer customers towards a product even when the journey is labelled non-advised, so firms should assess the real interaction, not the label. Equity release needs particularly careful control.
MCOB requires information before application, at offer and during the life of the mortgage. Depending on the product, this includes the European Standardised Information Sheet (ESIS), the prescribed illustration that sets out costs, features and adviser remuneration in a standard format.
Post-sale duties can last for decades, covering payment information, rate changes, product transfers and variations. Record keeping and system change management matter, because the information may come from systems that have been replaced several times over the life of the loan.
Under MCOB 11, a lender must normally assess whether the customer can afford the payments, subject to specified exemptions and modified rules. Property value or expected house price growth is not a substitute for that assessment.
The assessment covers income, committed expenditure and basic living costs, and an interest rate stress test where applicable. Lenders remain responsible for their own affordability decision even where information arrives through an intermediary. CP26/18 proposes more examples of acceptable evidence for variable and irregular income; until final rules are published, current MCOB 11 applies.
On 12 March 2026 the FCA published its findings from a review of second charge mortgage advice, fees and charges, and lender affordability assessments. It found that advice standards, particularly for debt consolidation, could improve, that affordability assessments could be more robust, that record keeping was sometimes incomplete, and that intermediary fees were higher than for first charge mortgages and hard to compare.
The FCA expects second charge firms and their boards to act on the findings and is considering policy changes on debt consolidation through the Mortgage Rule Review. Intermediaries should be able to show why each transaction is suitable, and lenders should be able to show their own affordability assessment, independent of the intermediary's view.
Advertising, websites, social media, email campaigns, comparison information and lead generation can all fall within the financial promotions rules in MCOB 3A. Communications must be fair, clear and not misleading, with important information given due prominence.
The overall impression matters: a risk warning does not correct a misleading headline or illustration. Firms should know who creates promotions and who approves them, and version control should stop outdated rates or unsupported claims staying live.
MCOB 13 covers arrears, payment shortfalls and repossession. Customers should be treated fairly and given forbearance options suited to their circumstances, such as a change to the payment method, a term extension or a temporary payment reduction, rather than being moved automatically through collections.
The Consumer Duty adds the obligations to avoid foreseeable harm and provide effective support. Management information should flag products, strategies or customer groups with high arrears, repeat arrangements or repossessions, and the firm should investigate the cause.
Vulnerability can arise from illness, bereavement, divorce, job loss, low financial resilience, reduced capability or other life events. Firms should understand the likely needs of their own customer base and build support into advice, underwriting, servicing, arrears and complaints, rather than keeping it in a standalone policy.
Staff should recognise the signs and adapt their support while respecting the customer's own decisions. Vulnerability data is sensitive personal data and needs proportionate protection under data protection law.
SM&CR applies according to the firm's classification. Senior managers need clear statements of responsibilities and must take reasonable steps to control their areas; delegation does not remove accountability. The FCA's PS26/6 changes, most of which took effect on 24 April 2026, made the regime more proportionate, and firms should update responsibilities maps and certification processes accordingly.
Certified staff, including mortgage advisers, need an annual fitness and propriety assessment, and the Conduct Rules apply directly to relevant individuals. Certification should draw on competence records, file reviews, complaints and disciplinary information. More detail is in SM&CR explained.
The TC sourcebook applies to specified mortgage activities, and firms must assess and maintain the competence of the people who carry them out. An appropriate qualification is necessary but not sufficient: practical ability, supervision, product knowledge and ongoing development all count.
A strong framework links supervision to file quality, outcomes, complaints, vulnerability handling and regulatory change. Higher-risk work, such as equity release or complex debt consolidation, may need closer monitoring, and supervisors should be able to identify weak advice, not only check that documents are present.
SYSC provides the organisational framework behind MCOB: governance, staffing, systems, risk management and internal controls, in proportion to the business.
Monitoring should be risk-based and tied to actual permissions and customer journeys. Intermediaries typically test advice quality, promotions, Consumer Duty outcomes, appointed representative oversight and complaints. Lenders also test underwriting, affordability, servicing, arrears, intermediary relationships and prudential controls. Findings should be remediated at root cause, not closed file by file.
Mortgage firms commonly outsource technology, servicing, document processing and call handling, but the authorised firm remains responsible. Due diligence should cover capability, data security, resilience, customer impact and contract protections before the arrangement starts, and oversight should test real performance and outcomes, not only service levels.
SYSC 15A operational resilience rules apply to banks, building societies and certain other specified firms, which identify important business services, set impact tolerances, map dependencies and test them. Other mortgage businesses still need continuity planning for technology and third-party disruption. From 18 March 2027, the FCA's PS26/2 introduces standard operational incident reporting for all firms with a Part 4A permission.
MIPRU sets capital resources requirements and, for intermediaries, professional indemnity insurance (PII) requirements. The calculation depends on the firm's activities, so brokers, administrators and lenders can have materially different requirements.
| Firm type | Capital resources requirement |
|---|---|
| Intermediary not holding client money (MIPRU 4.2.11) | Higher of £5,000 and 2.5% of annual income from mediation activity |
| Intermediary holding client money | Higher of £10,000 and 5% of annual income from mediation activity |
| Administrator with all loans off balance sheet (MIPRU 4.2.19) | Higher of £100,000 and 10% of annual income |
| Non-bank lenders | A separate requirement linked to total assets, set in MIPRU 4.2 |
Minimum capital is not the same as financial resilience. Lenders should also consider liquidity, credit risk and the cost of an orderly wind-down, and forecasts should test realistic stress scenarios.
The Money Laundering Regulations 2017 do not apply identically across the mortgage sector. A firm that only brokers mortgages is not within the Regulations for that activity alone, but it still needs financial crime controls and remains subject to legislation such as the Proceeds of Crime Act 2002. Lenders, and firms carrying on other relevant activities, can have wider anti-money laundering obligations.
Mortgage fraud risks include false income documents, manipulated valuations, identity fraud, undisclosed borrowing, deposits from unexplained sources and collusion between parties. Controls should match the firm's role, and introducer due diligence and fraud escalation matter wherever business is sourced through third parties. The wider expectations are set out in the guide to FCA financial crime compliance in 2026.
DISP requires transparent and effective complaints handling. Mortgage complaints can concern advice, affordability, fees, administration, payment difficulty, switching or communications, and customers can refer unresolved complaints to the Financial Ombudsman Service.
Complaint handling should be independent enough to reach fair decisions and be well documented. Root-cause analysis should identify wider weaknesses, and complaint themes should feed into Consumer Duty monitoring and board reporting. The FCA's new complaints reporting rules apply from 1 January 2027, as set out in complaints handling and the new reporting requirements.
Reporting depends on permissions. Intermediaries commonly submit the retail mediation activities return (RMAR), while lenders and administrators submit mortgage lending and administration returns. The FCA also receives product sales data, which it uses to identify outliers and changes in risk.
SUP 15 event-driven notifications are needed for significant breaches, matters affecting the threshold conditions and other specified events, without waiting for periodic returns. A regulatory calendar, clear data ownership and senior review keep submissions accurate and on time.
A principal firm takes on substantial responsibility for its appointed representatives (ARs). It should assess each AR before appointment and monitor it throughout, covering the business model, people, finances, permitted activities, promotions and customer risk.
Monitoring should cover advice quality, complaints, competence, Consumer Duty outcomes and whether the AR stays within scope. Growth should be matched by compliance capacity, and poor outcomes at one AR may point to a wider network issue.
Records must show what information was obtained, what was decided and why. A competent reviewer should be able to follow the reasoning on an advice file without making assumptions, and lending files should show the evidence and the methodology used.
Quality assurance should test substance, such as internal consistency and whether the evidence supports the outcome, not only whether documents are present. The second charge findings make this a supervisory priority.
Start with an obligations map based on current permissions and the operating model, then test whether the evidence shows that each obligation is met in practice.
Boards need concise change updates that explain what has changed, what may change and what decision is required. The firm's regulatory compliance service supports lenders, brokers and administrators with monitoring, reviews and remediation.
It depends on whether the firm lends, advises, arranges or administers. The rules can include MCOB, the Principles and Consumer Duty, SYSC, SM&CR, TC, MIPRU, DISP, SUP and financial crime rules, with PRA rules for banks and building societies.
Yes, where the product or service is in scope. Lenders and intermediaries have different roles in the distribution chain, but both must evidence good outcomes across the four outcome areas.
PS25/11 took effect on 22 July 2025, removing the interaction trigger for advice and the full affordability assessment for term reductions. CP26/18 proposals closed on 28 July 2026, and current MCOB applies until final rules are published.
A firm that only brokers mortgages is not within the Regulations for that activity alone, but it still needs financial crime controls and is subject to the Proceeds of Crime Act 2002.
Under MIPRU 4.2.11, the higher of £5,000 and 2.5% of annual income from mediation activity, or £10,000 and 5% if the firm holds client money.
It found room to improve debt consolidation advice, affordability assessments and record keeping, and that intermediary fees were higher than for first charge mortgages and hard to compare.
There is no fixed interval. Firms should run a risk-based monitoring programme, with independent reviews when the business grows, runs an AR network, lends to higher-risk customers or engages with the FCA.
Buckingham Capital Consulting has supported FCA-regulated firms since 2013 with authorisation, compliance monitoring and remediation, and has obtained FCA authorisations and variations of permission for firms including Moneliq. For mortgage lenders, brokers and administrators, the firm reviews advice quality, affordability, Consumer Duty outcomes and lending controls and delivers a prioritised remediation plan.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.