Harper James advises UK businesses on the laws of England and Wales, including financial services regulation. Preparing for regulation starts with identifying whether the business carries on a regulated activity, communicates financial promotions, or provides services that fall within the Financial Services and Markets Act 2000 (FSMA) regulatory perimeter.
Map each product, service and customer journey against the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001. Common regulated activities include accepting deposits, arranging investments, advising on investments, managing investments, providing consumer credit and operating payment services. The analysis should cover the business model, revenue flows, target customers, technology, third-party suppliers and the jurisdictions involved.
The business then needs to determine whether it requires Financial Conduct Authority (FCA) or Prudential Regulation Authority (PRA) authorisation, an exemption, or an appointed representative arrangement. Operating without the required permission is a serious compliance issue. A written perimeter assessment should record the conclusions, assumptions and evidence supporting them.
An authorisation application requires more than a description of the product. The FCA examines the proposed activities, controllers, governance, financial resources, systems and controls, senior managers, outsourcing arrangements and approach to compliance. The firm should prepare documented policies for financial promotions, complaints, conflicts of interest, customer verification, anti-money laundering, record keeping and data protection.
The Consumer Duty applies to firms within scope and requires attention to customer outcomes, including products and services, price and value, consumer understanding and customer support. Businesses should connect these requirements to practical controls, such as approval processes for marketing content, management information, product reviews and evidence of customer communications.
Regulatory preparation continues after authorisation. Firms need a compliance calendar covering FCA returns, capital and liquidity requirements, training, monitoring, complaints, attestations and policy reviews. Senior managers should have clear responsibilities under the Senior Managers and Certification Regime, supported by appropriate Statements of Responsibilities and records of decisions.
The business should also assess operational resilience, cyber security, incident reporting, outsourcing and third-party risk. A documented impact tolerance, tested response plan and supplier oversight process provide evidence that important business services have been considered. Legal review is particularly useful when a product changes, a new distribution channel is introduced, or the firm begins handling a different category of customer or financial product.