Appointed Representative Oversight for Consumer Credit Principal Firms in 2026

Appointed Representative oversight is a major consumer credit risk because a principal can be responsible for regulated activity carried on by businesses it does not manage day to day. The principal therefore needs more than a contract and an annual questionnaire. It needs a framework that allows it to understand what each AR does, identify weak customer outcomes and intervene before harm becomes systemic.

The FCA's 2026 Consumer Finance Regulatory Priorities makes this particularly current. The AR population in consumer finance has grown faster than in other sectors, and the regulator says weak oversight can create Consumer Duty failures. It is using data to target the highest-risk principals and ARs rather than relying only on periodic broad supervision.

For consumer credit principal firms, the practical standard is evidence across the full AR lifecycle: appointment, scope, ongoing monitoring, annual review, event-driven escalation and termination.

Due diligence should reflect the business the AR will actually conduct

Before appointment, the principal should establish whether the proposed AR is suitable for the activities for which it will accept responsibility. The depth should reflect the risk rather than one standard onboarding pack.

Relevant areas can include ownership, management, financial position, business model, products, customer types, lead generation, fees, previous principal relationships, complaints, staff competence and expected volumes. A small introducer model presents a different risk from an AR giving explanations or carrying on broader credit broking activity.

The principal should understand how the AR makes money. Incentives can affect customer acquisition, lender selection and fees, and a structure that rewards volume may require stronger monitoring where there is a risk of poor outcomes.

Previous relationships also matter. An AR moving from another principal may have open complaints, previous monitoring findings or unresolved customer remediation. The new principal should understand that history rather than treat a move between networks as a clean slate.

The decision should explain why the AR is suitable and what monitoring follows from the identified risks.

The principal's own permissions and resources set the boundary

The activities covered by the AR appointment need to sit within the relevant principal permission or other lawful basis under the AR framework. Scope should therefore be considered before the commercial agreement is finalised.

A consumer credit AR can create particular complexity where the principal or AR also holds limited permissions in its own right. SUP 12 contains specific provisions for credit-related activity, and firms should map the legal structure carefully rather than assume every AR relationship works in the same way as an insurance or investment network.

The principal also needs adequate resources. Compliance headcount, systems, product expertise, geographic spread, adviser numbers and customer volume can all affect whether the firm can supervise the network effectively.

Growth should therefore trigger reassessment. A principal that doubles the AR population without changing its monitoring capability should be able to explain why its resources remain adequate.

The FCA's direction is increasingly towards assessing the principal itself, not only the AR. A well-run AR cannot compensate for a principal that lacks the capability to understand or challenge the activity.

Scope should be precise and monitored for drift

The written agreement should describe the business for which the principal accepts responsibility. AR staff should understand what they are permitted to do and what sits outside the appointment.

Scope drift can happen gradually. A motor dealer may add a new finance product, a broker may introduce a new lender or fee, or an AR may begin using a different lead-generation channel without recognising that the change affects the principal's risk.

The monitoring framework should therefore compare live activity with the approved scope. Regulatory notifications should also be made in accordance with the current SUP 12 requirements when relevant information changes.

A contractual restriction provides limited assurance if the principal never tests whether the AR complies with it. Sales data, website review, file sampling and business discussions can each help identify activity outside the agreed model.

Material scope changes should be approved before implementation rather than regularised after the principal discovers them.

Ongoing monitoring should be genuinely risk based

SUP 12 requires principals to maintain adequate controls and resources and to oversee AR activity appropriately. The FCA expects risk-based monitoring rather than one identical process for every AR.

For consumer credit ARs, relevant indicators can include transaction volume, products, customer type, complaints, fees, financial promotions, Consumer Duty outcomes, business growth, staff turnover, previous findings and financial stability.

Higher-risk ARs should receive deeper oversight. This can include more frequent file review, live promotion checks, management meetings or additional data. Lower-risk ARs may justify a lighter approach where the evidence remains stable.

The risk rating should be capable of changing. If an AR has growing complaints or repeated monitoring findings but stays low risk because the annual scorecard is static, the framework is not responding to the evidence.

The principal should also be able to explain the link between risk and action. A high-risk rating that produces the same monitoring as a low-risk rating provides limited regulatory value.

Financial promotions and lead generation deserve direct testing

Consumer credit ARs often acquire customers through digital advertising, social media, dealers, affiliates or lead generators. Promotions can therefore create harm before a customer reaches the principal's systems.

The principal should understand which channels each AR uses and what controls apply to financial promotions. CONC 3 remains the current detailed rulebook for consumer credit promotions while the FCA's 2026 simplification proposals remain subject to the final rule-making process.

The control should extend to live communications. An approved template can be compliant while the AR's website or social account contains altered wording, outdated representative examples or claims that credit is available regardless of customer circumstances.

Lead generators also create risk. The principal should know what customers are told before their information is passed to the AR and whether the acquisition method is consistent with the Consumer Duty and the firm's approved business model.

Complaints about marketing or unexpected fees should feed the AR risk assessment.

Consumer Duty should be visible at AR level

A principal cannot demonstrate Consumer Duty simply through a network-wide average. It should be able to identify whether particular ARs create materially different customer outcomes.

The relevant evidence depends on the activity. Complaints, fees, customer understanding, conversion, support, product distribution and file review can each be useful depending on the AR model.

Price and value can be particularly important where ARs have discretion over customer fees. The principal should understand material variation and ensure its fair value framework captures the service customers actually receive through different ARs.

Consumer understanding is another practical risk. A standard principal disclosure does not guarantee that an AR explains the service clearly in calls or face-to-face interactions.

The FCA's 2026 credit broker guide provides a useful small-firm benchmark and includes a section on ARs. Principal firms should use that material alongside the Handbook rather than treat it as a replacement for SUP 12.

Annual reviews should bring together the year's evidence

SUP 12 requires a review at least once every 12 months for relevant ARs other than introducer appointed representatives. The review includes matters such as suitability, solvency, fitness and propriety of relevant individuals and the adequacy of the principal's own controls and resources.

A questionnaire can support the process, but it should not be the conclusion. The principal should bring together monitoring results, complaints, financial information, scope changes, Consumer Duty outcomes and open remediation.

The review should reach a reasoned continuing-suitability decision. If an AR has repeated findings, material financial weakness or poor customer outcomes, the principal should explain why the relationship remains acceptable and what additional controls are being applied.

Event-driven review is equally important. Significant growth, ownership change, complaints or changes in the business model should not wait for the next annual anniversary.

The annual review is therefore a formal minimum point within continuing oversight, not the only time the AR is assessed.

The governing-body self-assessment should challenge the network

Principals also need a written self-assessment of how they meet the SUP 12 requirements, reviewed and approved by the governing body at least every 12 months.

This should assess the principal-level framework rather than repeat individual AR files. Management should consider whether resources remain adequate, whether the risk methodology identifies the right ARs, whether escalation works and whether the network is changing in ways that create new risk.

The 2026 Consumer Finance priorities should form part of that challenge. If the FCA is using AR data to target higher-risk principals, the board should understand how the firm's own data would look from the regulator's perspective.

A self-assessment that contains no meaningful weakness for several years can indicate that the process is descriptive rather than critical. The purpose is to identify what needs improvement while the firm still has time to fix it.

CCR009 and other data can expose AR oversight weaknesses

The FCA is becoming more data led in consumer finance. CCR009 is especially relevant to in-scope ancillary credit firms, and current reporting rules require firms with ARs to provide consolidated data including relevant activity of the principal and its ARs unless otherwise stated.

This creates a direct connection between AR governance and regulatory reporting. The principal should know whether it can collect reliable data from the network and whether the numbers submitted to the FCA agree with internal MI.

Data inconsistencies can reveal more than a reporting problem. If the principal cannot explain AR volumes, revenue or activity, it may not have the oversight needed to assess the risk of the network.

Management should therefore use regulatory reporting data as an assurance source. Outliers should be investigated internally before they become the basis for FCA questions.

Remediation and termination should have real consequences

When monitoring identifies a weakness, the response should reflect the seriousness and cause. Training can be appropriate where the issue is knowledge, but it will not solve poor incentives, weak management or a business model that repeatedly creates harm.

The principal should consider customer impact as part of remediation. A repeated promotion or fee problem may have affected customers beyond the sample reviewed.

Action plans should have owners, deadlines and closure evidence. Material findings should be retested where appropriate rather than closed because the AR confirms that the action is complete.

Termination should be an available consequence where the AR is no longer suitable or the principal cannot control the risk. The exit process should cover open customers, complaints, records, promotions, remediation and regulatory notifications.

Historic responsibility does not disappear because the AR relationship ends.

How Regulatory Counsel can support

Regulatory Counsel supports consumer credit principal firms with AR due diligence, scope, risk-rating frameworks, monitoring, Consumer Duty, annual reviews, governing-body self-assessments and remediation.

We can review one higher-risk AR, a sample of the network or the complete SUP 12 framework.

Speak to Regulatory Counsel to discuss consumer credit AR oversight.