An insurance principal does not simply allow an Appointed Representative to use its regulatory permissions. It accepts responsibility for the relevant regulated activities carried on by the AR within the scope of the appointment and must maintain controls and resources capable of overseeing that risk. This makes AR oversight materially different from the oversight an MGA applies to an independent broker.
The FCA has strengthened the AR framework significantly since 2022 and continues to test whether principals can demonstrate that the rules are embedded in practice. Its 2024 good and poor practice review found that some principals remained overly confident despite weaknesses in annual reviews, self-assessments, onboarding and monitoring. In April 2026 the FCA also published a separate review of inactive ARs, emphasising that an absence of reported regulated activity does not remove the need for active oversight.
For insurance principal firms, the practical standard is therefore evidential. Management should be able to explain why each AR was appointed, exactly what it is permitted to do, how the principal monitors customer and conduct risk, whether the principal itself has adequate resources, and why the AR remains suitable to operate under the principal's responsibility.
Define the appointment scope before the AR starts trading
The principal should identify the regulated activities for which it is accepting responsibility and ensure that both the principal's permissions and the AR agreement support that scope. Broad statements such as "insurance distribution" can be too vague where the AR is expected to advise, arrange particular products, approve or communicate promotions, collect information from customers or perform other activities with different regulatory consequences.
For insurance ARs, the principal should also define the products and customer populations within the appointment. A retail advised AR presents different risks from a business introducing customers into a narrow non-advised product journey, so scope should be specific enough to drive onboarding, competence requirements and ongoing monitoring.
The agreement should correspond with actual behaviour. An AR acting outside the written scope creates regulatory risk even if the contract contains a prohibition that nobody monitors. New products, distribution methods or business-model changes should therefore be reviewed before the AR begins carrying on the expanded activity.
Insurance distribution has an additional practical point: an AR must be included on the Financial Services Register as carrying on insurance distribution activity before it commences that activity. The onboarding process should therefore coordinate contractual approval, FCA notifications, Register status and the operational go-live rather than treat them as separate administrative tasks.
Due diligence should test whether the AR is suitable for the specific insurance activity
Pre-appointment due diligence should be proportionate to the business the AR will conduct. Relevant areas can include ownership, management, financial position, business model, regulatory history, previous principal relationships, customer population, products, competence, systems, financial promotions, complaints history and any unregulated business that could affect the principal's risk.
The assessment should be decision-focused rather than document-focused. Collecting company accounts, policies and biographies is useful only if the principal evaluates what they mean for the proposed appointment. A fast-growing retail insurance distributor with aggressive lead-generation methods may require different scrutiny from an established specialist firm serving a narrow commercial customer base.
The principal should also establish expectations that can later be monitored. Expected regulated revenue, product volumes, customer types, acquisition channels and staffing can provide useful baselines, because a material departure from the onboarding model may indicate that the AR's risk profile has changed.
The decision record should explain why the principal considers the AR suitable and what conditions or enhanced monitoring are required. Commercial importance should not be allowed to turn regulatory approval into an assumption that the relationship will proceed regardless of the evidence.
The principal needs resources proportionate to the network it oversees
SUP 12 requires principals to have adequate controls and resources for overseeing their ARs. This is not only an onboarding question. The principal needs to reassess its own capacity as the network grows, AR activity changes or the risk of the business increases.
For an insurance principal, resource adequacy can depend on the number of ARs, customer volumes, product complexity, whether advice is provided, geographic spread, complaints, financial promotions and the amount of regulatory data the principal needs to analyse. A network that doubles in size without any meaningful change in compliance capacity should be able to explain why the existing oversight remains sufficient.
Specialist knowledge also matters. Staff overseeing insurance advice, product distribution or complex customer journeys need enough understanding to challenge what the AR is doing. A principal can have sufficient headcount on paper while lacking the expertise required to assess the particular regulated activity.
Senior management should receive a clear view of resource pressure before it becomes a control failure. Growth targets, new AR appointments and changes in product strategy should therefore be considered alongside the principal's ability to supervise the resulting business.
Monitoring should be equivalent in standard to activity carried on internally
The FCA expects principals to oversee AR activity to a standard equivalent to that which would reasonably apply if the regulated activities were carried on by the principal itself. This does not mean every AR must use identical systems or processes, but it does mean the principal should not accept weaker customer or conduct controls simply because the activity sits in a separate legal entity.
For an insurance AR, monitoring may need to cover customer files, advice or demands and needs where relevant, product distribution, financial promotions, complaints, customer support, competence and Consumer Duty outcomes. The precise scope should follow the appointment rather than a generic AR checklist.
The principal should combine information supplied by the AR with evidence it can verify independently. The FCA's 2024 review criticised tick-box approaches and found that some principals were not using data or MI effectively to monitor whether ARs remained within scope. Website and marketing reviews, complaint data, file testing, financial information and direct engagement can each provide useful assurance depending on the risk.
Risk ratings should change the oversight applied. A higher-risk AR should not receive the same monitoring intensity as a stable lower-risk relationship, and a deteriorating AR should be capable of moving into enhanced oversight before the annual review date arrives.
Product governance and Consumer Duty need AR-level visibility
Where an AR distributes insurance products, the principal should ensure that product governance information reaches the AR and that the resulting distribution can be monitored. Target markets, product limitations and relevant value information should be sufficiently clear for the AR to perform the regulated activity for which the principal has accepted responsibility.
Consumer Duty increases the importance of outcome evidence where retail business is in scope. Firm-wide averages can conceal a weak AR, so the principal should be able to analyse relevant outcomes by AR where this is necessary to identify material differences. Complaints, customer support, financial promotions, product distribution and customer understanding can all provide useful indicators.
Financial promotions deserve particular attention because customer-facing communications may be produced locally by the AR. The principal should know how promotions are approved, what changes the AR can make without further review and how live websites, social media or lead-generation materials are monitored after initial approval.
The purpose is not to centralise every operational decision. It is to ensure the principal has enough control and information to meet the same regulatory standard it would expect if the business were being conducted within its own firm.
Annual reviews should be a real reassessment of the relationship
SUP 12.6A requires principals to review relevant information about each AR's activities and business at least once every 12 months, other than Introducer Appointed Representatives for which the annual review requirement does not apply in the same way. The review includes the AR's continuing suitability, its financial position, relevant fitness and propriety considerations and the adequacy of the principal's own controls and resources.
The annual review should bring together evidence gathered throughout the year rather than rely mainly on an AR questionnaire completed shortly before the meeting. Complaints, file review results, financial information, product changes, regulatory issues, growth and open remediation should inform the conclusion about whether the appointment remains appropriate.
The FCA's 2024 review found that some annual reviews were incomplete or operated as tick-box exercises. A strong review should therefore contain judgement. It should identify concerns, explain how they affect the continuing suitability assessment and record what action is required rather than automatically concluding that the relationship remains satisfactory.
Regulatory Counsel already has a separate detailed guide to the principal's annual self-assessment and AR review framework. This insurance-specific article focuses on how those obligations should operate around insurance distribution and customer outcomes rather than duplicating the broader self-assessment methodology.
The governing-body self-assessment should challenge the principal, not the ARs
The principal also has a separate obligation to prepare a self-assessment document and have it reviewed and approved by its governing body at least once every 12 months. The document assesses how the principal itself complies with SUP 12 and identifies material deficiencies or concerns in the oversight framework.
This is different from completing an annual review for each AR. The self-assessment should ask whether the principal's overall governance, resources, monitoring, data, onboarding, termination and escalation arrangements remain adequate across the network. Where individual AR reviews have identified recurring weaknesses, those themes should inform the principal-level assessment.
A useful self-assessment should contain evidence of challenge. If the network has grown substantially, complaint volumes have increased or several ARs have failed monitoring, the governing body should consider whether the principal's oversight model remains sufficiently resourced and effective rather than treating the document as an annual certification exercise.
The FCA's own review found over-confidence among some principal firms, which is why a self-assessment containing no meaningful deficiencies year after year should be challenged. The purpose is to identify weaknesses early enough for the principal to correct them, not to prove that the framework is perfect.
Inactive ARs still require active oversight
The FCA's April 2026 review is particularly relevant to principals with ARs that report little or no regulated activity. The regulator made clear that principals cannot rely on transaction monitoring where there are no transactions and should understand why the AR is inactive, whether the relationship remains appropriate and whether regulatory reporting accurately reflects the activity taking place.
For insurance firms, an inactive AR can still create customer and reputation risk through its website, marketing or association with the principal. An AR remaining on the Register can create a halo effect that leads customers to assume broader regulatory protection than actually exists, particularly where the firm presents itself inaccurately as FCA authorised.
The principal should therefore monitor regulatory status disclosures and consumer-facing materials even where new business is limited. Where an AR has no realistic intention of carrying on the regulated activity or is no longer suitable, the principal should consider termination rather than allowing the relationship to remain indefinitely for commercial convenience.
Suspension can be appropriate while a genuine issue is investigated, but it should not become a permanent substitute for deciding whether the AR relationship remains appropriate. The governance record should explain why the AR remains in the network and what conditions must be met for normal activity to resume.
Remediation and termination need regulatory consequences
When an AR fails a monitoring review, the response should address the cause. Training may be appropriate for a genuine competence issue, but repeated problems can indicate weak management, poor incentives, inadequate systems or a business model that is no longer suitable to operate under the principal's responsibility.
The principal should consider customer impact as well as future control. Where regulated activity has caused harm, the remediation may need to include a wider customer population rather than only the files sampled during monitoring. Material actions should have owners, deadlines and evidence requirements, and repeated failure to remediate should affect the continuing suitability assessment.
Termination should be treated as a regulatory process as well as a commercial one. The principal needs to manage FCA notifications, Register updates, customer communications, ongoing policies, complaints, records, financial promotions and any open remediation arising from historic activity.
Ending the appointment does not erase the principal's responsibility for regulated activity carried on while the AR operated under its umbrella. The exit plan should therefore preserve the evidence and operational arrangements needed to continue dealing with customers and regulatory enquiries after the commercial relationship ends.
How Regulatory Counsel can support
Regulatory Counsel supports insurance principal firms with AR due diligence, appointment scope, risk-rating methodology, monitoring, annual reviews, governing-body self-assessments, Consumer Duty, financial promotions, inactive ARs, remediation and termination. We can review an individual AR, a higher-risk sample or the principal's complete insurance AR oversight framework.
Speak to Regulatory Counsel to discuss insurance Appointed Representative oversight.
Frequently Asked Questions
The principal accepts regulatory responsibility for the relevant regulated activities carried on by the AR within the scope of the appointment and must maintain effective oversight under SUP 12. The exact controls should reflect the insurance activities and customer risk involved.
SUP 12.6A requires an annual review for relevant ARs, while Introducer Appointed Representatives are treated differently. The principal should confirm the status of each relationship and apply the current SUP 12 requirements accordingly.
No. Individual annual reviews assess the continuing AR relationship, while the governing-body self-assessment considers the principal's own compliance with SUP 12 and the effectiveness of its overall oversight framework.
The principal still needs active oversight and should understand why the AR is inactive, whether the relationship remains appropriate and whether its FCA reporting is accurate. The FCA's April 2026 review specifically warns against leaving inactive ARs on the Register without adequate engagement and governance.
Yes. Support can include pre-appointment due diligence, annual reviews, thematic monitoring, the principal's self-assessment, financial promotion review, Consumer Duty testing, remediation and termination support.