Appointed representative oversight: what the FCA expects from principal firms

An appointed representative (AR) carries on regulated activities under the authorisation of a principal firm, which accepts responsibility for those activities. In the mortgage market, many advisers and brokerages work as ARs of a network. The principal must oversee its ARs effectively and is responsible for making sure they comply with FCA rules in relation to their activities as ARs.

The FCA set out new rules and enhanced expectations for principals “effective from 8 December 2022”. The detailed requirements sit in chapter 12 of the Supervision manual (SUP 12), with the annual review and self-assessment requirements in SUP 12.6A.

The FCA’s guidance page for principals, last updated on 26 November 2025, lists the core responsibilities. They include the following.

The FCA states: “You must review each AR at least every 12 months.” The review must cover the fitness, propriety and competence of the AR’s senior management, the AR’s financial position, and the adequacy of the principal’s controls and resources to oversee it. Principals must keep a written record of each review, escalate significant issues to the governing body, and carry out additional reviews in some circumstances, such as when an AR changes its business model or receives a significant increase in complaints.

The annual self-assessment looks at the principal itself. The FCA describes it as “a single document designed to identify risks and gaps in compliance”, which must be reviewed and signed off by the governing body at least every 12 months and kept for at least 6 years. Annual reviews do not have to be completed for introducer ARs, but they must be included in the self-assessment.

On 6 September 2024 the FCA published its findings on how principals were embedding the rules. It tested approximately 270 firms, around 10% of the principal population. About 250 took part in a telephone questionnaire and 23 were randomly selected for an in-depth assessment of their documents.

The FCA found that 96% of principals said they were very confident they were implementing the rules effectively, but “there is likely some over-confidence”. It found that “1 in 5 firms had not done the required checks (self-assessments, annual reviews)”.

The FCA’s press release of 6 September 2024 said some firms were “taking a tick-box approach to complying with its rules, relying on basic information like website checks, or using self-declarations from their ARs, to demonstrate effective oversight”. Jane Savidge, then Interim Head of Department for Appointed Representatives, said some firms “aren’t getting the basics right”.

The review lists the patterns behind weak oversight: “Relying on limited information about the AR”, annual reviews that lacked detail “because of a poor audit trail, insufficient record-keeping or a limited review”, monitoring “completed as a tick-box exercise with little analysis of the information found”, and file reviews or calls with ARs that “are unrecorded and largely informal”. It also stresses that it is the principal’s, not the AR’s, responsibility to carry out the annual review.

A tick-box review records that something was checked without showing what was found. It gives a governing body false comfort and gives the FCA little evidence that oversight is working.

The FCA’s good practice examples point towards oversight built on evidence from the AR’s actual work. Its press release highlights using “a range of management information to assess the risk of harm to consumers or markets, such as quality assurance checks on client files, customer satisfaction surveys, in-person visits to ARs, and mystery shopping exercises”.

The review adds further examples: “Analysing monthly activity comparing the activity report the AR submits with the principal’s own data”, random file checks, quarterly and ad hoc checks that feed into the annual review, and a standard board agenda item on ARs with discussions clearly minuted. In self-assessments, it describes using management information such as staff turnover, changes in revenue and complaint rates, and a RAG rating to prioritise gaps.

Random file checks remain a useful control and appear in the FCA’s good practice examples. Their limitation is that a sample may miss the cases that matter most. Exception-based review adds a second lens: where the process requires a step and an adviser moves a case on without it, that override is recorded with who made it, when and why.

For a principal, a log of exceptions is useful management information. It shows which ARs or advisers override the process most often, which steps are skipped, and whether the reasons given are reasonable. Reviewers can then target their file checks, and the findings feed into each AR’s annual review with an audit trail rather than an informal note. This approach supports the principal’s own judgement; it does not replace the annual review, the self-assessment or the governing body’s sign-off.

The checklist below draws on the FCA’s rules summary and its good practice examples. It is written for networks and other principal firms, and may also help any group that reviews member firms’ files.

Archway is case-management software for UK mortgage, second charge, bridging and debt consolidation brokers, networks and mortgage clubs. It guides each case to the right next step and, if something required is missing, the case does not move on. Overrides are possible, and each one is recorded today with who, when and why, so reviewers can focus on exceptions rather than relying only on random samples.

A network view that brings those case-level records together across ARs is being built with our first network partners and is not yet live. Archway’s checks support your compliance process. They are not compliance sign-off. The annual review, self-assessment and governing body sign-off remain the principal’s responsibility.