Appointed Representative oversight is a material investment-sector risk because the principal accepts responsibility for regulated activities carried on by the AR within the scope of the appointment. The relationship therefore needs to be governed as an extension of the principal's regulated business, not as an external distribution arrangement that compliance reviews once a year.
The FCA's March 2026 Consumer Investments Regulatory Priorities makes this particularly current. The sector contains more than 7,000 ARs, the FCA expects principals to oversee them effectively and recent FCA work found that 29 percent of principal firms had not conducted financial crime risk assessments for their ARs.
For investment and wealth principals, the practical standard is a lifecycle framework. The principal should understand why the AR was appointed, what it is permitted to do, how risk changes, whether clients receive suitable advice and good outcomes, and when restriction or termination becomes necessary.
Due diligence should test the AR's real business model
Before appointment, the principal should understand ownership, management, financial position, regulatory history, products, customer types, adviser population, lead sources, complaints, fees, financial crime risk and expected regulated activity.
The depth should reflect the proposed business. An introducer appointed representative presents a different risk from a full AR providing investment advice to retail clients, and a firm promoting mainstream investments presents a different profile from one serving high-net-worth customers or more complex products.
Previous principal relationships should be examined where relevant. Open complaints, unresolved remediation, previous restrictions or unusual changes in business can affect whether the proposed AR is suitable to appoint.
The decision should also test the principal. SUP 12 requires the principal to maintain adequate controls and resources for oversight. A commercially attractive AR should not be appointed if the principal lacks the people, systems or specialist knowledge to supervise it effectively.
Scope should be precise enough to detect business drift
The AR agreement should define the regulated activities for which the principal accepts responsibility and any restrictions on products, customers, financial promotions or distribution channels.
That scope should be operational, not merely contractual. Advisers should know what they are allowed to do, and the principal's systems and monitoring should identify when the AR expands beyond the approved model.
Business drift can occur gradually. An adviser business may add new investment products, acquire another client bank, start using a different lead generator or move into more complex customer segments without recognising that the principal needs to reassess the risk.
Material change should therefore trigger review before the new activity becomes normal. The principal should also make relevant FCA notifications in accordance with the current SUP 12 framework when required.
Advice quality should be visible at individual AR level
Investment principals need enough evidence to understand whether clients advised by each AR receive suitable recommendations. A network-wide pass rate can conceal one AR with repeated suitability problems.
File review should test the applicable COBS regime, including client information, objectives, risk, capacity for loss, recommendation reasoning and records where relevant. Higher-risk advice should receive correspondingly deeper testing.
The principal should be able to compare findings by AR, adviser, product and customer type. Repeated weaknesses should affect the AR's risk rating and monitoring plan rather than remain isolated within adviser coaching.
Ongoing advice is also relevant. Where an AR charges clients for ongoing services, the principal should have evidence that the promised service is delivered and that disengaged-client processes and fee treatment are appropriate.
Consumer Duty outcomes should not disappear inside network averages
Where relevant retail business falls within Consumer Duty, the principal should be capable of identifying material differences in outcomes across the AR population.
Advice QA, ongoing-service delivery, fees, fair value, complaints, vulnerability and customer support can each contribute to the evidence. The exact measures depend on the AR's activities and proposition.
Fee variation deserves attention. ARs can have local charging models that create materially different value outcomes even where the principal provides one network-wide service. The fair value framework should therefore understand what clients actually pay and what they receive through different ARs.
Consumer understanding can vary too. Standard templates do not guarantee that advisers explain risk, cost and service consistently in real client interactions. Call review, suitability reports and customer feedback can help test the live outcome.
Financial crime risk needs an AR-specific assessment
The FCA's 2026 Consumer Investments priorities explicitly states that 29 percent of principal firms in its recent work had not conducted financial crime risk assessments for their ARs. Investment principals should treat that as a direct prompt to review whether financial crime has been embedded into AR oversight.
The risk assessment should consider the AR's customer base, jurisdictions, products, source of wealth or funds issues where relevant, transaction patterns, online acquisition and exposure to scams or fraud. It should not assume the principal's own business-wide risk assessment automatically captures every AR-specific risk.
Controls should then reflect the allocation of activity. Where the principal performs onboarding or screening centrally, it should still understand whether the AR provides complete information and escalates concerns. Where the AR performs elements itself, the principal needs appropriate assurance over quality and consistency.
Financial crime findings should feed the overall AR risk rating. An AR with weak due diligence should not remain low risk merely because its advice QA scores are strong.
Financial promotions and online activity require live oversight
Investment ARs may acquire clients through websites, seminars, social media, affiliates and introducers. The principal should understand which channels are used and how promotions are approved and monitored.
The FCA's Consumer Investments priorities highlights online scams, finfluencers and misleading promotions. A principal should therefore test what customers actually see rather than rely only on the version originally submitted for approval.
AR websites should also describe regulatory status accurately. Being listed as an Appointed Representative does not mean the AR is itself directly authorised by the FCA. Communications should not exploit the FCA Register to create a misleading halo around unregulated activities.
Where an AR promotes both regulated and unregulated services, the boundary should be particularly clear. The principal should understand whether the regulated relationship is being used to lend credibility to activities outside the appointment.
Ongoing monitoring should be risk based and capable of intensifying
SUP 12 requires continuing oversight, and the principal should apply a level of monitoring proportionate to each AR's risk. Relevant indicators can include advice volume, products, complaints, fees, financial crime, business growth, staff turnover, customer outcomes and previous findings.
Risk ratings should have consequences. A higher-risk AR may require more frequent file reviews, deeper financial monitoring, management meetings, promotion testing or restrictions. A stable lower-risk AR may justify a lighter approach where evidence remains strong.
The rating should also change when the facts change. Rapid growth, acquisition, a new product line or deterioration in complaints should trigger reassessment rather than wait for the annual review date.
A framework in which every AR receives the same monitoring regardless of risk can be easy to administer but difficult to defend as genuinely risk based.
Annual reviews should consolidate evidence, not replace it
SUP 12 requires relevant ARs other than introducer appointed representatives to be reviewed at least every 12 months. The review should draw together evidence generated throughout the year rather than operate as the principal's only substantive oversight event.
The assessment should consider continuing suitability, financial position, relevant senior management, scope, complaints, advice QA, Consumer Duty outcomes, financial crime and open remediation.
A questionnaire completed by the AR can support the process but should not be the sole evidence source. The principal should verify material information and challenge inconsistencies where risk warrants it.
The annual conclusion should be reasoned. If significant issues remain open, management should understand why the relationship continues and which enhanced controls apply.
The principal self-assessment should challenge the whole network framework
SUP 12 also requires the principal to prepare a written self-assessment of how it meets its responsibilities as principal and to have it reviewed and approved by the governing body at least every 12 months.
This is different from individual AR reviews. The self-assessment should examine the principal's resources, risk methodology, monitoring quality, data, governance and ability to intervene across the whole population.
The FCA's 2026 Consumer Investments priorities should form part of that challenge. In particular, boards should consider whether financial crime, Consumer Duty and current distribution risks are visible at AR level.
A self-assessment that identifies no meaningful weakness year after year can indicate that the exercise is descriptive rather than testing. Its purpose is to expose areas where the principal needs to improve before the FCA does.
Inactive ARs still require active oversight
The FCA's April 2026 review of inactive ARs makes clear that a lack of reported regulated activity is not a reason to stop oversight. An unexplained absence of activity can itself indicate weaknesses in governance or reporting.
The principal should understand why the AR remains appointed, whether its status is described accurately, whether unregulated activity is using the FCA relationship for credibility and whether the relationship still serves a legitimate purpose.
REP025 information and other regulatory data should be accurate. Where an AR no longer needs the appointment, the principal should consider timely termination and notify the FCA as required.
This is especially important in investment markets because the FCA has seen concerns about firms using limited regulated activity or permissions to create an appearance of regulatory credibility around other business.
Remediation and termination should protect clients, not only the principal
When an AR fails to meet standards, the principal should determine root cause, customer impact and the controls needed to prevent recurrence. Training can be useful, but it will not solve a weak business model, unsuitable products or poor senior management.
Material findings should be retested, and the principal should consider whether clients outside the sample may also have been affected. Suitability or fee issues can require wider review or redress.
Termination should be available where the AR is no longer suitable or the risk cannot be controlled. Exit planning should address open clients, complaints, records, ongoing advice, financial promotions, remediation and regulatory notifications.
Historic responsibility does not disappear because the commercial relationship ends. The principal should retain enough evidence to manage complaints and customer impact arising from activity during the appointment.
Proposed AR reform should not be treated as current law
HM Treasury consulted in 2026 on further changes to the AR regime, including a proposed permission gateway for firms wishing to act as principal. Those proposals reinforce the regulatory focus on principal capability but should not be described as current requirements unless and until implemented.
Investment principals should continue to operate the live SUP 12 regime and use regulatory change management to track future reform.
The strategic lesson is nevertheless clear. The regulatory direction continues to place responsibility on principals to demonstrate that they have the expertise, resources, data and governance necessary to oversee ARs effectively.
How Regulatory Counsel can support
Regulatory Counsel supports investment and wealth principal firms with AR due diligence, scope, suitability QA, Consumer Duty, financial crime risk assessment, annual reviews, self-assessments and remediation.
We can review an individual higher-risk AR, a sample of the network or the principal's complete SUP 12 framework.
Principals often ask us to run appointed representative oversight reviews, including principal self-assessment preparation, for investment and wealth firms operating networks of any size.
Speak to Regulatory Counsel to discuss investment Appointed Representative oversight.
Frequently Asked Questions
The principal accepts responsibility for regulated activities carried on by the AR within the scope of the appointment and has ongoing oversight obligations under SUP 12.
SUP 12 requires at least annual review for relevant ARs, with different treatment for introducer appointed representatives. Firms should apply the current rule to the specific relationship.
The principal should have a framework that captures AR-specific financial crime risk where relevant. The FCA's 2026 Consumer Investments priorities specifically highlights weaknesses where principals had not conducted financial crime risk assessments for ARs.
No. The FCA's 2026 work says inactive ARs still require effective oversight, and unexplained inactivity can itself indicate governance or reporting weaknesses.
We can support or independently review the governing-body self-assessment, individual AR reviews, risk methodology and supporting evidence.