The appointed representative model concentrates regulatory risk in one place: the principal. Where an AR causes harm, the principal is answerable, and the FCA has made clear through its enhanced regime that weak oversight of ARs is a governance failure at the principal, not a failure of the AR.
What the principal is responsible for
The principal accepts responsibility for the regulated activities the AR carries on under the contract. In practice this means responsibility for the AR's compliance with the rules applicable to those activities, for the suitability and conduct of the AR's staff, for financial promotions communicated in the course of those activities, for complaints arising from them, and for redress.
The AR is not separately authorised. From the customer's perspective and from the FCA's, the principal is the regulated firm.
Pre-appointment due diligence
Due diligence should be documented and should test more than solvency and a company search.
- The AR's business model, target market and distribution method, and whether it fits within the principal's permissions.
- The competence and regulatory history of the AR's controllers and key individuals.
- Financial standing, including the AR's ability to meet potential liabilities.
- Any conflicts arising from the AR's other business, including non-regulated activity.
- The systems and records the AR will use, and the principal's ability to access them.
- Whether the principal has the capacity and expertise to oversee the AR effectively.
That last point is the one most often skipped. A principal that appoints ARs faster than it can supervise them has created the exposure itself.
Ongoing oversight
| Oversight element | Minimum expectation |
|---|---|
| Monitoring plan | Risk-based, documented, with defined frequency per AR |
| File and call testing | Direct sampling of AR customer files by the principal |
| Financial promotions | Pre-approval process with records of approval and version |
| Complaints | Principal receives and records all AR complaints |
| Training and competence | Principal assesses AR staff competence, not just training completion |
| Data and MI | Regular reporting on volumes, revenue, complaints, cancellations |
| Site visits | Periodic, risk-based, with recorded findings |
Oversight based on AR self-certification is not oversight. Where the principal cannot independently test what the AR did, it cannot discharge its responsibility.
The annual self-assessment
Principals must prepare and retain an annual self-assessment of their compliance with the AR requirements, reviewed and approved by the governing body. A credible self-assessment covers the adequacy of the principal's own systems and controls for AR oversight, an assessment of each AR relationship and its risk, the results of monitoring, any harm identified and the action taken, and the principal's capacity to take on further ARs.
Our guidance on the principal self-assessment for appointed representatives covers the document in detail.
Data reporting and notifications
The regime requires principals to provide prescribed information about their ARs, including complaints and revenue data, and to notify the FCA of planned AR appointments in advance and of specified changes. Late or inaccurate AR data reporting is a straightforward and avoidable source of supervisory contact.
Termination
Ending an AR relationship carries obligations: notification to the FCA, ensuring the AR ceases to hold itself out as representing the principal, arrangements for handling complaints and liabilities arising from the period of appointment, and treatment of customers introduced by the AR. Liability for past conduct does not end with the contract.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
Our appointed representative work covers principal oversight framework design, pre-appointment due diligence, AR monitoring programmes and file testing, annual self-assessment preparation and independent review, AR data reporting controls, and termination and run-off arrangements.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
A firm or individual carrying on regulated activities under a contract with an authorised firm, the principal, which accepts full regulatory responsibility for those activities. The appointed representative is not separately authorised.
Risk-based monitoring set out in a documented plan, direct testing of AR customer files and calls, pre-approval of financial promotions, complaints capture, competence assessment of AR staff, regular MI and periodic site visits.
A document, reviewed and approved by the principal’s governing body, assessing the adequacy of the principal’s systems and controls for AR oversight, the risk of each AR relationship, monitoring results, harm identified and remedial action, and capacity for further appointments.
Yes. The principal is responsible to the FCA and to customers for the regulated activities the AR carries on under the contract, including financial promotions, complaints and redress.
Notify the FCA, ensure the AR stops holding itself out as representing the principal, make arrangements for complaints and liabilities arising from the appointment period, and address the treatment of customers introduced by the AR.