The changes to the Financial Conduct Authority (FCA) Appointed Representatives (AR) regime, set out in policy statement (PS22/11), came into force on 8 December 2022.
These changes impact all firms that currently have ARs or intend to appoint ARs in the future, and also impact ARs themselves (including introducer ARs).
We set out a (non-exhaustive) summary of these changes below.
We also recently hosted a webinar on this topic. Please do contact us if you’d like a recording.
Background to the AR regime
The AR regime enables unauthorised firms to engage in regulated activity on behalf of, and under the responsibility of, a ‘principal’ firm authorised by the FCA. In essence, it provides firms with an alternative to being authorised in their own right.
Principals stand in place of their AR in the eyes of the FCA by assuming responsibility for their AR’s acts and omissions when carrying out the regulated activities agreed upon in writing.
The FCA has acknowledged that the AR regime has certain benefits, most notably that it has helped foster innovation in the financial services space by allowing firms to test products and services. Whilst this remains the case, there is growing concern that firms have been using the regime to evade FCA scrutiny, and that this has been to the detriment of consumers.
The FCA has identified that this consumer harm has stemmed from principals not undertaking adequate due diligence before appointing an AR, and subsequently having a lack of oversight and control over their ARs. The new rules therefore seek to address these concerns.
New Requirements and Guidance for Firms
Following consideration of the feedback received in relation to CP21/34, the FCA have confirmed a number of changes to the obligations and expectation of principals and ARs in the final rules.
Additional Information and Notification Requirements for Principals
Principals will be required to notify the FCA of new AR appointments at least 30 calendar days before the appointment is due to take effect. This has been reduced from the 60 days initially proposed. Alongside this notification, principals will need to provide information about the rationale behind the appointment, the financial and non-financial arrangements entered into with the AR, and details of the AR’s business.
Principals with existing ARs will need to provide additional information about their ARs. The information that principals with existing ARs will need to provide mirrors that which will be required alongside the pre-notification for new AR appointments (outlined above). The FCA issued Section 165 data requests to principals between 8 and 12 December 2022and principals have until 28 February 2023 to respond in respect of each of their existing ARs.
Principals will need to notify the FCA of any changes to their AR’s details or the regulated activities that the AR engages in. Changes to the types of regulated activity that the principal allows the AR to carry on will need to be reported at least 10 calendar days before the change takes effect, whilst any changes to the AR’s details will need to be reported within 10 business days of the change being made.
Principals will need to verify the details of their AR on an annual basis. Principals will need to annually confirm that the details on their ARs, as these appear on the FS Register, are correct. They will need to do so starting from the principal’s first accounting reference date after 12 months have passed from the rules coming into force.
Principals will have 60 business days from their accounting reference date to annually report AR complaints and revenue data. Principals will be required to provide data on all of their AR’s revenue from regulated and non-regulated financial services activities, as well as from non-financial, non-regulated activities. In an effort to reduce some of the burden on firms, the FCA will allow (i) data on revenue from regulated and non-regulated financial activities to be provided to the nearest £5k, (ii) data on revenue from non-financial, non-regulated activities to be reported in bands, and (iii) where an AR has multiple principals, for data on AR revenue from non-regulated activities to be reported to the FCA by the “lead principle”.
Principals will be required to notify the FCA as to whether they currently provide, or intend to provide, regulatory hosting services. Principals will need to provide this notification at least 60 calendar days before providing those services. The FCA have noted that the definition of “regulatory hosting services”, and the extent of a firm’s obligations who provides these services, remains subject to review.
Responsibilities of Principals and FCA Expectations
The FCA has set out new guidance for principals on how to meet FCA expectations. With a prominent focus on improving principals’ oversight of their ARs, the new guidance and rules require that principals:
Oversee their ARs effectively. Principals should enhance oversight of their ARs by ensuring the adequacy of their systems and controls, and the proficiency of their resources to continually and accurately monitor their ARs.
Take more responsibilities for their AR. In effect, this would entail enhanced assessment and monitoring of ARs to ensure that their activities do not, or would not, result in undue harm to consumers or market integrity. The FCA have stated that a principal’s oversight of ARs activities should be “of a comparable standard as if they were an individual directly employed by the principal.”
Annually review their ARs. This namely includes a review of the fitness and propriety of senior managers at ARs, the AR’s financial position, and the adequacy of the controls and resources in place to effectively oversee the AR. Principals can build these reviews into existing internal reporting processes, but they must be conducted by responsible individuals with a suitable degree of knowledge and authority. Any significant issues identified in the review in relation to specific ARs must be escalated to the principal’s governing body.
Review their ARs on an ad hoc basis where: (i) the AR changes their business model or appoints an additional principal; (ii) the scope of the AR appointment expands to include additional regulated activities; (iii) the senior management of AR with responsibility for, or involved in, regulated activities changes more than once in a 12-month period; and / or (iv) there is a significant increase in the number of complaints the principal receives about the AR.
Annually assess the information held on their ARs. Principals will need to prepare a self-assessment document that should focus on how the principal itself is meeting its responsibilities in relation to all of its ARs. This document will need to be reviewed and signed-off by the principal’s governing body at least every 12 months.
Have clarity on the circumstances in which they should terminate an AR relationship and ensure that its written contract enables it to terminate if it is no longer able to adequately oversee the activities of its AR. Principals would need to take reasonable steps to ensure they assist ARs with orderly wind down where they decide termination is necessary.
Next Steps
Although the FCA have put in place some transitional arrangements, immediate action is required by principals and ARs. For example:
Principals should
Respond to the s165 data request
Review all AR relationships and documentation, including AR contracts
Check the adequacy of their systems and processes, and controls and resources for effectively overseeing ARs
Prepare to collect and submit complaints and revenue information on an annual basis
Consider whether to arrange training for ARs / senior management
ARs should
Provide their principals with the information that they will require to comply with the s165 data request.
Establish systems and processes to enable them to provide their principal with all the information that it requires to fulfil its reporting, notification obligations, including in relation to the AR’s non-regulated business e.g. changes in business model or senior management.
Permit increased oversight from their principal e.g. permit their principal to scrutinise management information, analyse data, review call scripts and other materials, understand issue escalation and engage regularly (via calls, meetings, email).
Be aware that if their principal is unable to adequately oversee them in accordance with its regulatory obligations, the principal will be able to terminate its AR contract. In practice this could mean that the AR must cease business. The AR should therefore consider (i) how it can best help the principal oversee activities, and (ii) the precise language of the termination clause that is now required by the FCA.
Prospective ARs should also be aware that the FCA will need to be notified at least 30 days before activities commence; and 10 calendar days in advance of any change in activities.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent. Read More
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Cookie
Duration
Description
_ga
1 year 1 month 4 days
Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.
_ga_*
1 year 1 month 4 days
Google Analytics sets this cookie to store and count page views.
CONSENT
2 years
YouTube sets this cookie via embedded YouTube videos and registers anonymous statistical data.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Cookie
Duration
Description
VISITOR_INFO1_LIVE
6 months
YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface.
YSC
session
Youtube sets this cookie to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices
never
YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt-remote-device-id
never
YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
__cf_bm
1 hour
This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
cookielawinfo-checkbox-advertisement
1 year
Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category.
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent
1 year
CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie.
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.