A chief executive should be able to show that the business stays within its permissions, controls its material risks and treats customers as the rules require. Compliance works best when it is built into how the firm operates, rather than reviewed after decisions have been made.
In practice, that means knowing the firm's permissions, the rules that apply to them, who owns each obligation, the control that meets it and the evidence that the control operated. The FCA's systems and controls rules (SYSC) require firms in scope to maintain adequate policies and procedures for compliance and for countering financial crime, scaled to the nature, size and complexity of the business.
No single checklist fits every firm. This guide sets out the controls senior management should expect in most FCA-regulated firms, with sector-specific rules noted where they apply.
The list below is the core of a working compliance framework. A firm that can evidence each item is in a strong position for supervisory engagement.
The FCA Handbook applies different sourcebooks to different sectors. The framework in this guide sits on top of the rules for the firm's own sector, which set the detailed conduct, prudential and reporting requirements.
| Sector | Main rules |
|---|---|
| Payment institutions and EMIs | Payment Services Regulations 2017, Electronic Money Regulations 2011, CASS 15, SUP 16, the FCA Approach Document |
| Investment firms | COBS for conduct, MIFIDPRU for capital and liquidity, CASS for client money and assets |
| Consumer credit firms | CONC for conduct, with the Consumer Credit Act 1974 |
| Mortgage lenders and brokers | MCOB for conduct, MIPRU for prudential requirements |
| Insurers and intermediaries | ICOBS and PROD for conduct; PRA rules for insurers' capital |
| Cryptoasset firms | Money Laundering Regulations 2017 registration until 25 October 2027, then FCA authorisation under the new regime |
| All firms | PRIN, including the Consumer Duty, SYSC, COND threshold conditions, SUP, and DISP for complaints |
Several changes have taken effect in 2026 and more apply in 2027. The table lists the dates most firms need in their plan.
| Date | Change | Who it affects |
|---|---|---|
| 24 April 2026 | Most SM&CR changes under PS26/6 take effect; further stages on 10 July, 30 July and 1 September 2026 | Firms under SM&CR |
| 7 May 2026 | CASS 15 safeguarding rules in force (PS25/12) | Payment and e-money firms |
| 30 September 2026 to 28 February 2027 | Application window for the new cryptoasset regime | Cryptoasset firms |
| 1 January 2027 | First complaints reporting period under PS25/19 begins, running to 30 June 2027 | Firms reporting complaints to the FCA |
| 18 March 2027 | Operational incident and third-party reporting rules apply (PS26/2) | Part 4A firms and payment firms |
| 25 October 2027 | Cryptoasset regime under the FSMA 2000 (Cryptoassets) Regulations 2026 commences | Cryptoasset firms |
Material changes need a perimeter check before launch. New products, new revenue lines, new partners and expansion overseas can each take a firm into activities its permissions do not cover.
The check asks four questions: is the activity already permitted, does it need a variation of permission, is it carried on by another regulated entity in the arrangement, and does it require a notification to the FCA. The check belongs in change governance, before contracts are signed.
Evidence to hold: a permissions map that links each product to the permission it relies on, and a signed perimeter assessment for every material change approved in the last year.
Senior managers should be able to name the owner of each material regulatory risk. Formal accountability applies under the Senior Managers and Certification Regime (SM&CR), but clear ownership matters equally in firms outside it, such as payment and e-money institutions.
The FCA's PS26/6 made the regime more proportionate. Most changes took effect on 24 April 2026, covering areas including the 12-week rule for temporary cover, statements of responsibilities, the certification regime, regulatory references, the Conduct Rules and the thresholds for enhanced firms. Firms under SM&CR should update responsibilities maps and certification processes to the new rules.
Every material issue needs an owner, a decision route and an escalation point. Evidence to hold: a current responsibilities map, terms of reference for each committee, and minutes that show decisions being taken where the map says they are.
Monitoring should test whether controls work, not only whether policy review dates have been met. Higher-risk areas receive deeper or more frequent testing.
Each review should record the requirement tested, the sample, the method, the findings, their severity, the root cause, the action owner and the deadline. An issue closes only when there is evidence that the remedial action has been implemented; a management assurance on its own is not closure evidence.
The plan itself should be approved by the board or its risk committee each year, show the risk ranking that drove it, and record any reviews that were deferred and why. Testing should mix file reviews, walk-throughs of live processes and data analysis, since each finds different issues.
The business-wide risk assessment should drive the controls. It covers products, customers, countries, delivery channels and transaction behaviour, and it is refreshed when any of these change.
Controls typically include customer and business verification (KYC and KYB), beneficial ownership checks, customer risk scoring, enhanced due diligence, sanctions screening, transaction monitoring, suspicious activity escalation, record keeping, training and MI. Customer files should show the policy operating in practice, and the MLRO's annual report should give the board a clear view of the firm's exposure and the effectiveness of its controls. The full set of expectations is covered in the guide to FCA financial crime compliance in 2026.
Firms in scope must deliver good outcomes across four areas: products and services, price and value, consumer understanding, and consumer support. The Duty has applied to open products since 31 July 2023 and to closed products since 31 July 2024.
Management must now evidence outcomes and act when they deteriorate. Useful MI includes complaints, cancellations, unsuccessful transactions, support response times, product usage, outcomes for customers with characteristics of vulnerability, fee data and customer testing. The board's annual assessment of outcomes is the central document: it should state whether customers are receiving good outcomes, where they are not, and what the firm is changing as a result. More detail is in the guide to Consumer Duty compliance in 2026.
Complaints handling covers more than timely final responses. Firms should analyse themes and root causes and use them to fix processes.
Senior management should see trends, upheld rates, repeat issues, themes affecting customers with characteristics of vulnerability, Financial Ombudsman outcomes where relevant, and remediation status. Recurring complaints point to a process that needs to change. The FCA's new complaints reporting rules under PS25/19 apply from the reporting period starting 1 January 2027, so data capture should be aligned before then.
Evidence to hold: a monthly complaints MI pack with root-cause categories, a log of process changes made in response, and the results of quality checks on final response letters.
Websites, advertising, social media, onboarding journeys, sales material and customer notices all carry regulatory content. Promotional material must be fair, clear and not misleading, suited to its audience and compliant with the sector rules.
The approval process needs a practical route for sign-off, version control and a standard for when a change requires fresh review. It should be fast enough that the business uses it, with compliance and marketing working from the same calendar.
Firms that approve promotions for unauthorised third parties need the separate section 21 approver permission, and cryptoasset promotions have their own rules in COBS 4. Evidence to hold: a promotions log with the approver, date, version and any conditions attached.
Returns should be produced from controlled source data, reviewed before submission and reconciled to the books, customer data or regulatory calculations. A reviewer should be able to trace each figure back to its source.
Event-driven notifications need clear triggers. These include material breaches, financial difficulty, changes in control, significant operational incidents and changes in senior management. Staff should know what to escalate and to whom. From 18 March 2027, PS26/2 introduces standard thresholds and a single submission for operational incidents, so incident classification should be mapped to those thresholds now.
Evidence to hold: a reporting calendar with an owner for each return, a reconciliation file for each submission and a notifications log recording what was escalated and the decision taken.
Firms rely on third parties for cloud hosting, payment processing, screening, customer support and compliance systems, but remain accountable to customers and the FCA. Outsourcing a task does not transfer the responsibility for it.
Material providers need proportionate due diligence, written contracts, service monitoring, incident escalation and exit planning. The board should know which third parties create the greatest dependency. Under PS26/2, firms in scope, including authorised payment and e-money institutions, will notify the FCA of material third-party arrangements and submit a register of them annually from 18 March 2027.
Evidence to hold: a third-party register ranked by criticality, due diligence files for material providers, service reviews and a tested exit plan for each critical arrangement.
For firms in scope of the operational resilience rules, the implementation deadline of 31 March 2025 has passed. Firms should now show that important business services are identified, impact tolerances are set, scenario testing takes place and the lessons lead to improvements.
Firms outside those rules still need business continuity planning and incident management. Plans should cover cyber events, system outages, the loss of a critical provider and access to customer records, and they should be tested, not only documented.
Evidence to hold: the self-assessment approved by the board, scenario test results, and the remediation log for any vulnerabilities the tests identified.
Capital, liquidity and own funds should be tracked continuously against current levels, headroom and forecasts, not only at return deadlines. Warning thresholds allow action before a breach.
Calculations differ by sector. Investment firms apply MIFIDPRU, payment and e-money firms apply the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, and insurers and banks apply PRA rules. The monitoring plan should reflect the firm's actual permissions and sourcebook.
A wind-down plan, setting out how the firm would close in an orderly way with customers protected, is expected of payment and e-money firms and of investment firms under MIFIDPRU. It should be updated whenever the business model or financial position changes materially.
The FCA's CASS 15 safeguarding rules, introduced by PS25/12, came into force on 7 May 2026. They apply to authorised payment institutions, e-money institutions and small payment institutions that choose to safeguard.
The rules cover governance, due diligence on safeguarding banks and insurers, books and records, daily reconciliations, discrepancies and unidentified funds, a resolution pack, a monthly safeguarding return and an annual safeguarding audit. Boards should be able to show, every day, what must be safeguarded, where the money is held and whether any shortfall exists. The practical position is set out in CASS 15 after implementation.
Policies must reflect current products, systems, suppliers and rules. A gap between written and actual controls creates evidence that does not hold up under review.
Reviews should be triggered by business change and by incidents, not only by an annual calendar. A material change to payment flows, a new onboarding provider or entry into a new country each warrants a review of the policies they touch.
Staff need the knowledge to apply the policies in their roles. Training should be tailored to the role, refreshed when rules change and tested, with records kept as evidence for supervisory review.
Customer data must be protected under UK data protection law, with access controls, encryption and clear data retention. Information security sits alongside operational resilience, since a data incident can also be an operational incident the FCA expects to hear about.
A useful board report answers six questions: what changed, which controls did not operate as intended, what is getting worse, what customer harm may exist, what is overdue and what decision the board needs to make.
Core dashboard areas are monitoring findings, breaches, complaints, Consumer Duty outcomes, financial crime, reporting, prudential headroom, safeguarding, outsourcing, incidents and overdue remediation. Trend and exception reporting serves the board better than large volumes of static data.
Firms do not need to act on every consultation. They need to identify the changes that affect their permissions and products, assess the impact, assign owners and track implementation.
The Regulatory Initiatives Grid, whose tenth edition was published in May 2026, gives forward visibility of planned work across the UK regulators. The firm's approach to tracking UK regulatory change sets out a dated calendar.
The calendar below gives a baseline rhythm. Frequencies should be increased for higher-risk areas.
| Frequency | Activity |
|---|---|
| Daily | Safeguarding reconciliation (payment and e-money firms); sanctions screening and transaction monitoring alerts |
| Monthly | Breach, incident and complaint trends; overdue actions; financial crime and sanctions MI; upcoming reporting deadlines; prudential and safeguarding position; monthly safeguarding return |
| Monthly | Escalation of material changes in products, ownership, outsourcing or finances |
| Quarterly | Planned monitoring reviews; high-risk outsourcing review; board MI refresh; Consumer Duty outcomes; material regulatory change |
| Annually | Compliance risk assessment and monitoring plan; financial crime risk assessment; core policy review; fitness and propriety and certification; Consumer Duty board report |
| Annually | Permissions against current and planned products; adequacy of compliance resources; safeguarding audit (payment and e-money firms) |
Principle 11 of the FCA's Principles for Businesses requires firms to deal with the FCA in an open and cooperative way and to disclose anything the FCA would reasonably expect to know. The notification rules in SUP 15 give specific triggers, such as a significant breach of a rule, a matter that could affect the firm's ability to meet the threshold conditions, or a significant change in the business.
The FCA can require information under section 165 of the Financial Services and Markets Act 2000 and sets deadlines for responses. It also writes to the chief executives of firms in a sector setting out its supervisory priorities. These letters should be tabled at board level, with a written gap assessment against each priority.
Under section 166, the FCA can require a firm to appoint a skilled person to review an area of its business. Firms with a tested monitoring programme and clear remediation records are best placed to show the FCA that their own controls are already addressing the issue.
External support is most valuable where the firm needs specialist expertise, independent testing or senior judgement it cannot justify hiring full time. Typical uses are authorisation, compliance monitoring, regulatory reviews, remediation, Consumer Duty, financial crime, safeguarding, change in control and support during FCA engagement.
Senior management must understand the advice, approve material decisions and keep ownership. A small, capable internal team supported by external specialists is often the most effective model. The firm's regulatory compliance service is built around that model.
The best engagements have a written scope, named people, a defined reporting line to the compliance officer or board, and a handover plan so that the knowledge stays in the firm when the engagement ends.
Supervisory reviews and independent testing tend to find the same themes. Each one is a useful self-assessment question.
No. Requirements depend on permissions, sector, products, customers and size, and the framework should be proportionate to them.
Not necessarily. The FCA expects adequate resources and clear responsibility; a proportionate mix of internal and outsourced support can work, with senior management remaining responsible.
A structured, risk-based plan that tests whether controls work, records findings and tracks remediation to evidenced closure.
Many activities can be supported or performed externally, but responsibility stays with the firm and its senior management, so scope, oversight and escalation must be clear.
Common themes are Consumer Duty evidence, financial crime, operational resilience, regulatory reporting, governance and accountability, and CASS 15 for payment and e-money firms.
Assess it promptly, contain any continuing harm, establish the cause and impact, record decisions, remediate, and consider whether the FCA or another authority must be notified.
PS26/2 applies from 18 March 2027 to all firms with a Part 4A permission and to payment firms, with a single standard submission for incidents above set thresholds.
Pick a material obligation and trace it from the rule to the responsible person, control, evidence, monitoring and remediation. If any link is missing, the framework relies on policy rather than demonstrable control.
Buckingham Capital Consulting has supported FCA-regulated firms since 2013 with compliance monitoring, governance, financial crime, Consumer Duty, safeguarding and regulatory reporting, and has obtained FCA authorisations for firms including Dzing Finance, Nexpay and Moneliq. The firm turns each firm's obligations into operating controls, tests them and shows senior management where risk sits.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.