The appointed representative model allows an unauthorised firm to carry on regulated activities under the responsibility of an authorised principal. The commercial attraction is obvious. The regulatory consequence is that the principal assumes responsibility for activity it does not directly control, conducted by people it does not directly employ, often at a scale that makes meaningful oversight demanding.
The FCA has consistently identified weaknesses in principal oversight, and the obligations on principals were strengthened following the regulator's review of the AR regime.
This article sets out the obligations on principal firms, the requirements of the annual self-assessment, and the practical components of an oversight framework.
The scope of principal responsibility
A principal firm is responsible to the FCA for the regulated activities carried on by its appointed representatives. In relation to those activities, the principal is liable for the AR's acts and omissions as though they were its own.
That responsibility is not diluted by the contractual arrangement between the parties. A principal cannot contract out of regulatory responsibility, and the FCA will look to the principal where an AR's conduct falls short.
The obligations sit principally in SUP 12, supplemented by the firm's general obligations under SYSC and by the Principles for Businesses.
Introducer appointed representatives, whose permitted activities are limited to effecting introductions and distributing non-real-time financial promotions, are subject to a narrower regime but the principal's responsibility for the activity carried on remains.
Before appointment
Due diligence. The principal must be satisfied that the AR is solvent and suitable, and that the appointment does not prevent the principal from satisfying the Threshold Conditions. In practice this requires assessment of the AR's financial position, its business model, the individuals who will carry on regulated activity, its systems and controls, and its regulatory and disciplinary history.
Assessment of the principal's own capacity. Whether the principal has the resources, systems and controls to oversee the AR effectively. This assessment should be honest about capacity: a principal appointing ARs faster than it can oversee them creates the conditions for the failures the FCA identifies.
The contract. A written agreement setting out the scope of permitted activities, the principal's oversight rights including access to records and premises, reporting obligations, remuneration, complaint handling, termination rights and the position on run-off.
Notification. The principal must notify the FCA before the appointment takes effect, providing the prescribed information. The FCA has a period in which to object.
Ongoing oversight
Oversight should be risk-based and proportionate to the AR's activity, but it must be real. The recurring supervisory finding is that oversight exists on paper and not in practice.
Monitoring programme. A documented programme setting out what will be monitored, how often, by whom and to what standard. Frequency and depth should reflect the AR's risk: volume of business, product complexity, customer vulnerability, complaint history, and any prior findings.
File review. Sampling of advice or sales files where the AR conducts advised or non-advised sales, scored against a consistent standard, with findings fed back and evidence of improvement.
Financial monitoring. Ongoing assessment of the AR's solvency, since the principal's responsibility includes ensuring the AR remains suitable.
Complaints. Visibility of complaints made to the AR as well as to the principal, with analysis of themes.
Financial promotions. Approval and monitoring of the AR's financial promotions, which remain the principal's responsibility.
Training and competence. Assessment that individuals carrying on regulated activity are and remain competent, with the principal's own T&C scheme extending to AR staff where appropriate.
Site visits. Where the AR's activity warrants it, on-site review rather than desk-based monitoring alone.
Action. Evidence of what happened where standards fell short. Findings raised without consequence are among the clearest indicators that oversight is nominal.
The annual self-assessment
Principals must complete a self-assessment document at least annually, reviewing the adequacy of their oversight arrangements, and it must be approved by the firm's governing body.
The self-assessment is not a compliance form. It is the document through which the principal demonstrates to itself, and if asked to the FCA, that its oversight is adequate to the ARs it has appointed.
An adequate self-assessment addresses the following.
The AR population. Number, activity type, business volume, and any concentration or growth that affects the oversight burden.
The oversight framework. What monitoring is conducted, at what frequency and depth, and how the intensity of oversight is matched to risk.
Effectiveness. What the monitoring found during the period, what action followed, and whether the framework is detecting issues or missing them. A self-assessment recording that no issues were found across a substantial AR population invites the question of whether monitoring is capable of finding any.
Resource. Whether the principal has the people, systems and expertise to oversee its AR population, including as that population grows.
Complaints and redress. Themes arising, root cause, and whether they indicate systemic issues in the AR population.
Conflicts. Whether the commercial relationship, including remuneration structures, creates incentives inconsistent with good customer outcomes.
Threshold Conditions. Whether the AR relationships prevent the principal from satisfying the Threshold Conditions.
Wind-down. Whether the principal could terminate an AR relationship in an orderly way, including handling of the AR's customers.
Governing body approval. Evidence that the governing body considered and approved the assessment, rather than noting it.
Regulatory reporting
Principals are subject to reporting requirements in relation to their ARs, including annual reports on AR revenue and on complaints, and notification of specified changes to the AR relationship or to the AR's business.
Reporting should be produced from the principal's oversight records rather than requested from the AR and passed through. Where the principal's own records cannot generate the report, that is itself an indicator that oversight data is not being captured.
Termination and run-off
Where a principal terminates an AR relationship, it must notify the FCA and must consider the position of the AR's customers.
Responsibility does not end cleanly at termination. The principal retains responsibility for regulated activities carried on during the appointment, including complaints arising afterwards in relation to that activity. Termination arrangements should address record retention, complaint handling, and customer communication.
Sector context
Appointed representative oversight appears in FCA supervisory priorities across several sectors.
In mortgages, the FCA has stated that firms should review onboarding, monitoring, oversight and wind-down arrangements holistically and on an ongoing basis, and should ensure advice fees are set and monitored consistently and in line with the Consumer Duty. See our guide to FCA compliance for mortgage providers.
In insurance, principal obligations sit alongside delegated authority oversight, and firms operating both models should ensure the frameworks are coherent rather than parallel. See our guide to FCA compliance for insurers.
In wholesale markets, the FCA has identified the need for effective oversight of appointed representatives and for policies to manage financial crime risks arising from their activities. See our guides to wholesale banking compliance and FCA financial crime compliance.
Where principals most often have difficulty
Due diligence at appointment, silence afterwards. A thorough onboarding file followed by minimal ongoing monitoring.
Monitoring without outcomes. Reviews conducted and recorded, with no evidence of what changed as a result.
AR growth outpacing oversight capacity. Appointments continuing while the oversight function remains static.
The self-assessment as a form. Completed to satisfy the requirement, approved without discussion, and disconnected from what monitoring actually found.
No findings. A monitoring programme that reports consistently clean results across a substantial AR population, which usually indicates that the programme is not designed to find anything.
Financial monitoring omitted. Solvency assessed at appointment and not revisited, despite the principal's continuing responsibility for the AR's suitability.
Financial promotions unmonitored. Approval given at the outset with no ongoing review of what the AR is actually publishing.
Remuneration conflicts unexamined. Commission and fee structures that create incentives inconsistent with good outcomes, not assessed as part of the framework.
Where deficiencies have been identified, our guide to FCA policy and compliance monitoring remediation addresses how remediation programmes are structured.
Building a defensible framework
Appointment. Documented due diligence covering solvency, suitability, business model, individuals, systems and history, with a written contract granting the necessary oversight rights.
Risk assessment. Each AR risk-rated on defined criteria, with oversight intensity matched to rating.
Monitoring programme. Documented, risk-based, covering file review, financial monitoring, complaints, promotions and competence, with defined frequency and standards.
Findings and action. Findings recorded with owner, deadline and evidence of closure, and escalation where standards do not improve.
Self-assessment. Prepared annually, addressing the framework's effectiveness rather than its existence, approved by the governing body with evidence of consideration.
Reporting. Regulatory returns produced from oversight records, with notifications made within required timescales.
Capacity. Oversight resource assessed against the AR population, with growth constrained where capacity is not available.
Termination. Defined process addressing notification, customer communication, record retention and continuing complaint responsibility.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
Our appointed representative work covers principal oversight framework design and review, appointed representative due diligence and onboarding, monitoring programme development and file review, annual self-assessment preparation and challenge, AR risk rating methodology, regulatory reporting and notification review, remuneration and conflicts assessment, termination and run-off planning, remediation where deficiencies have been identified, and preparation for supervisory engagement on AR oversight.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
A principal is responsible to the FCA for the regulated activities carried on by its appointed representatives, and is liable for the AR's acts and omissions in carrying on those activities. Regulatory responsibility cannot be transferred by contract.
A document principals must complete at least annually, reviewing the adequacy of their oversight arrangements for appointed representatives. It must be approved by the firm's governing body and should address the effectiveness of the oversight framework, not merely its existence.
The self-assessment is prepared and retained by the firm and approved by the governing body. The FCA may request it, and it is a document a supervisor would expect to see during engagement on AR oversight.
The principal must be satisfied that the AR is solvent and suitable, and that the appointment will not prevent the principal from satisfying the Threshold Conditions. In practice this requires assessment of financial position, business model, the individuals carrying on regulated activity, systems and controls, and regulatory and disciplinary history.
Yes. The principal must notify the FCA before the appointment takes effect, providing the prescribed information.
An AR whose permitted activities are limited to effecting introductions and distributing non-real-time financial promotions. The regime is narrower, but the principal remains responsible for the activity carried on.
No. The principal retains responsibility for regulated activities carried on during the appointment, including complaints arising after termination in relation to that activity. Termination arrangements should address record retention, complaint handling and customer communication.
Monitoring should be risk-based, with frequency and depth reflecting the AR's business volume, product complexity, customer profile, complaint history and any prior findings. A fixed cycle applied uniformly across a diverse AR population is unlikely to be adequate.