Mortgage Compliance Monitoring Programme 2026: What Should Firms Actually Test?

A mortgage compliance monitoring programme should tell senior management whether the firm's regulatory controls work in practice. It should not be a calendar that automatically repeats the same reviews because those reviews appeared in last year's plan.

The FCA's 2026 Mortgage Regulatory Priorities provide a particularly clear basis for reviewing the programme. The regulator's headline priorities are improving consumer outcomes through the Mortgage Rule Review, encouraging responsible lending and support for borrowers in financial difficulty, and ensuring the quality of advice. It also identifies Appointed Representatives, incentives and conflicts, fraud, operational resilience, SMCR and AI as additional areas of focus.

For a mortgage broker, lender or network, those priorities need to be translated into the risks actually present in the business. The correct monitoring plan depends on permissions, products, customer types, distribution, advice model and whether the firm is a lender, intermediary, administrator or principal. A generic mortgage checklist will usually either test irrelevant controls or miss the areas that matter most.

Build the programme from the current regulatory risk assessment

The monitoring programme should begin with a documented view of where regulatory failure or poor customer outcomes are most likely to occur and where the consequences would be most significant. The risk assessment should reflect the business as it operates today rather than the model described when the firm was authorised.

For a mortgage broker, advice suitability, fees, customer understanding, financial promotions, vulnerability, complaints and introducer arrangements may be central. A lender has additional responsible lending and affordability risks. A network principal needs a substantial AR oversight programme, while a mortgage administrator may place more weight on servicing, financial difficulty and operational controls.

Business change should alter the assessment. Rapid growth, new products, a move into second charge or later-life advice, a larger AR population, a new estate-agent partnership or increasing complaint volumes can each justify a different monitoring priority.

The FCA itself expects applicants in the mortgage and consumer finance sectors to explain their compliance monitoring procedures, including quality assurance and audit proposals. Once authorised, the same principle should continue: monitoring should be designed around the firm's actual regulated business rather than a static template.

Mortgage advice quality should be a core monitoring theme

The FCA identifies quality of advice as a headline mortgage priority for 2026. Firms providing advice are expected to ensure advisers recommend products suitable for customer needs, test outcomes across the journey and review the FCA's recent findings on record keeping and quality assurance.

The compliance programme should therefore contain meaningful advice assurance. File reviews need to assess fact-finding, suitability reasoning, customer understanding and record keeping rather than focus primarily on whether a lender issued an offer.

Sampling should reflect risk. Debt consolidation, vulnerable customers, later-life borrowing, interest-only, high fees, complaints and advisers with previous findings may justify additional testing. The programme should also be able to respond when a new theme emerges rather than wait for the next annual review cycle.

The FCA's second charge work is useful even for firms outside that market because it identifies weaknesses capable of appearing more widely. Eligibility was sometimes treated as a substitute for suitability, important customer information was not always fully documented and QA could become too focused on lender documentation rather than the advice outcome.

Monitoring should therefore ask whether the firm's sales process is capable of producing those weaknesses and whether existing controls would detect them.

Consumer Duty monitoring should assess outcomes, not implementation activity

Consumer Duty should form part of the monitoring universe for relevant retail business. By 2026, checking that policies and board reports exist provides limited assurance. The stronger question is whether the firm can identify where customers receive poor outcomes and show that management acts on the evidence.

For mortgage firms, the four outcomes can be tested through existing processes. Products and services can connect with target markets and the firm's service proposition. Price and value can include broker fees. Consumer understanding can be tested through customer communications, advice and digital journeys. Consumer support can involve access to help, vulnerability and treatment when circumstances change.

The FCA's July 2026 outcomes-monitoring work is important because it rejects the idea that a long list of metrics is enough. The firm should understand what each measure tells management, what good looks like and which thresholds or patterns require action.

Compliance monitoring can test both the design and use of this framework. It should assess whether MI identifies differences by product, adviser, AR or customer segment and whether adverse results are investigated.

The annual governing-body report should be part of that evidence chain. Monitoring should be able to trace important board conclusions back to the underlying data.

Financial promotions, referrals and incentives need thematic testing

The FCA's mortgage priorities identify incentives and conflicts of interest as a current focus. It has seen evidence of estate agents requiring consumers to use specific mortgage intermediaries and is examining incentives across first and second charge firms and estate-agent-based brokers.

A monitoring programme should therefore assess relevant referral and acquisition channels. This can include websites, estate-agent scripts, lead generators, social media, introducer communications and other material promotions.

The test should be wider than whether the promotion contains required wording. Compliance should consider whether the overall communication is fair, clear and not misleading, whether consumers understand their freedom to choose another broker and whether incentives create foreseeable harm.

Where a firm uses connected estate agents or introducers, call or mystery-shopping style testing can sometimes reveal customer experience that is not visible from approved templates. Complaints and customer feedback should also be reviewed for indications that consumers believed they were required to use the broker.

The precise methodology should reflect the firm's model, but the programme should not ignore acquisition simply because the eventual advice file appears compliant.

AR oversight needs a separate monitoring layer for principal firms

A principal firm's compliance monitoring programme should distinguish its own direct business from the oversight of Appointed Representatives. SUP 12 requires an ongoing framework, and the FCA's mortgage priorities specifically expect holistic review of AR onboarding, monitoring, oversight and wind-down.

Monitoring should test whether due diligence is substantive, whether risk ratings change with evidence, whether advice QA is visible at AR level and whether the principal has adequate resources for the current size and complexity of the network.

Fees and Consumer Duty are important. The FCA expects mortgage principals to ensure advice fees are set and monitored consistently and in line with the Duty. A network-wide fair value conclusion should therefore not conceal material fee differences between ARs.

Annual AR reviews and the governing-body self-assessment should also be included in the assurance framework. Compliance should test whether those processes use real evidence and identify genuine weaknesses rather than operate as administrative annual exercises.

A high-risk AR should receive a different monitoring response from a stable lower-risk AR. If the methodology produces the same result regardless of risk, the framework needs challenge.

Vulnerable customers should be tested through real cases

Vulnerability is particularly relevant in mortgages because health, life events, financial resilience and capability can materially affect both the advice decision and the support a customer needs.

Monitoring should therefore use real customer evidence. File reviews can test whether advisers identify relevant vulnerability indicators, whether the information influences the advice or communication and whether additional support is provided where needed.

The firm should avoid a process in which vulnerability is simply recorded as a field. A customer may need more time, a different channel, additional explanation or another adjustment, and compliance should be able to see whether the firm's process supports those outcomes.

The FCA's second charge work found instances where intermediaries appeared to overlook potential indicators of vulnerability. Firms should consider whether their fact-find, training and QA are capable of identifying the same problem.

Outcome data can provide another perspective. Complaints, abandoned journeys, failed contacts or repeated requests for clarification may show that customers with particular needs are receiving weaker support.

Complaints and root cause should influence the monitoring plan

Complaints are a regulatory evidence source rather than a separate customer-service process. Mortgage complaints can reveal weaknesses in advice, fees, promotions, AR oversight, customer support or lender relationships.

The compliance programme should therefore consider complaint themes and root causes when setting future reviews. A rise in complaints about one adviser, AR or fee model may justify targeted testing rather than waiting for the next scheduled review of that area.

Upheld Financial Ombudsman cases can also provide useful insight where relevant. A decision may reveal a weakness in the firm's evidence or customer treatment that should be tested across similar cases.

The strongest monitoring frameworks use complaints to ask whether the problem could affect customers who did not complain. If the root cause is systemic, broader remediation may be required.

This feedback loop also improves sampling. Monitoring becomes more effective when it follows live evidence rather than operating independently from the issues customers are reporting.

Fraud, financial crime and data controls should reflect the mortgage model

The FCA's Mortgage Regulatory Priorities identify fraud as an area of focus and state that poor systems and controls can result in more fraudulent applications and loss of consumer data. Mortgage intermediaries and lenders should therefore assess the financial crime and data risks specific to their business.

For brokers, monitoring can examine identity and application fraud controls, suspicious introducer activity, data handling and whether advisers or staff bypass verification processes. Lenders will have additional underwriting and fraud detection controls appropriate to their role.

The firm should avoid importing a generic banking AML monitoring plan without considering the mortgage journey. The relevant risks may sit in application manipulation, document fraud, introducers, property transactions or misuse of customer information.

Where technology or AI is used, governance should consider both opportunity and risk. The FCA encourages experimentation but expects firms to keep Consumer Duty and customer needs central and maintain appropriate governance and controls.

Compliance testing should therefore understand what automated tools do, where human judgement remains necessary and what happens when the system produces unusual results.

Lenders and administrators need additional affordability and financial difficulty testing

A mortgage lender's monitoring programme has responsibilities that do not sit with an intermediary in the same way. MCOB 11.6 places affordability obligations on lenders, and the FCA's 2026 priorities expect lenders to monitor and oversee affordability assessments so they remain appropriate and deliver good outcomes.

The FCA's second charge work identified weaknesses in expenditure assumptions and information flows. A lender's monitoring can therefore test statistical expenditure models, treatment of relevant costs, manual overrides, intermediary information and whether assumptions remain realistic for the customer population.

Administrators and lenders also need to support customers through financial difficulty and consider appropriate forbearance under the current MCOB framework. Monitoring should assess actual customer treatment, not rely only on a policy or the number of arrangements offered.

Intermediaries should understand the distinction. They may gather affordability information or support the customer, but the formal lender affordability assessment is not transferred to the broker simply because the intermediary collects data.

A group compliance programme should therefore allocate testing to the entity and regulatory role that actually owns the obligation.

Findings should change the programme and the business

A compliance monitoring programme is only valuable if its findings lead to decisions. Each material finding should identify the regulatory issue, customer impact, root cause, owner, action and evidence required for closure.

Risk ratings should distinguish material customer harm from lower-level administrative improvement. A missing record and unsuitable advice should not receive identical treatment simply because both are exceptions.

The programme should also learn from repeated findings. If several reviews identify the same weakness, the problem may sit in systems, training, incentives or management rather than the individual cases reviewed.

Material remediation should be retested. Completing an action does not prove that the underlying control works. Follow-up testing should establish whether adviser behaviour, customer outcomes or system performance actually changed.

The annual monitoring plan should then be updated in response. A programme that remains unchanged after identifying significant new risks is not genuinely risk based.

Senior management should see risk, outcomes and overdue action

The board or senior management should receive enough information to understand the firm's current compliance position. Reporting should therefore focus on significant findings, customer outcomes, trends, repeat issues, overdue actions and areas where evidence is insufficient.

The number of reviews completed is useful operational information but should not dominate. Management needs to know what the reviews found and what it means for the business.

The FCA's 2026 approach is increasingly data led and risk based. Firms demonstrating strong controls may receive less intensive attention, while outliers and areas of harm can attract faster intervention. A good internal monitoring framework should identify those issues before the regulator does.

The practical test is whether senior management can answer three questions: where are our most significant regulatory risks, what evidence shows whether those risks are controlled, and what are we doing about the weaknesses we have found?

How Regulatory Counsel can support

Regulatory Counsel supports mortgage brokers, lenders and networks with compliance monitoring programme design, risk assessments, thematic reviews, advice QA, Consumer Duty, AR oversight and remediation.

We can build or review the monitoring universe, testing methodology, sampling, finding ratings, management reporting and closure process, or provide independent thematic assurance on higher-risk areas.

Speak to Regulatory Counsel to discuss a mortgage compliance monitoring programme.