Principal firms who have Credit Broking permissions: Good practice and areas for improvements

We assessed the key harms and drivers of harm caused by Appointed Representatives (ARs) and Introducer Appointed Representatives (IARs) who undertake credit broking.

Introduction

We want to improve principals’ oversight of their Appointed Representatives (ARs). Below we give examples of good practices and areas for improvement we have seen in principal firms’ due diligence checks when appointing ARs and in their ongoing monitoring of ARs.

This publication builds on our policy statement[1] and work to improve the AR regime[2]. The guidance these examples refer to are in SUP 12: Application and purpose[3].

Any references to ARs includes Introducer Appointed Representatives (IARs), unless stated otherwise.

Next steps

All principal firms who have ARs should consider these findings and address any gaps during their initial and ongoing monitoring of ARs. We looked at principal firms that introduce consumers to lenders or other brokers to provide finance. However, firms with ARs conducting other types of regulated activity will also benefit from considering our findings.

We will act where we identify firms that do not have adequate oversight of their ARs.

Initial appointment and ongoing oversight of ARs

Outcome we want

Firms have robust procedures, systems and controls to ensure they conduct appropriate due diligence checks on ARs, both on an initial and ongoing basis.

Full ARs

Firms should ensure on an initial and ongoing basis that the AR:

is solvent
is suitable to act for the firm, including whether they are fit and proper
has no close links[4] which could prevent effective supervision by the firm

Firms should also ensure:

they have adequate controls over the AR’s regulated activities
they have enough resources to monitor and enforce compliance of the relevant requirements by the AR
the AR’s activities do not or would not result in undue risk of harm to consumers or market integrity

Introducer Appointed Representatives

Firms should take reasonable care to ensure on an initial and ongoing basis that:

an IAR is suitable to act for the firm, and
the IAR’s activities do not or would not result in undue risk of harm to consumers or market integrity

Initial appointment of ARs - areas for improvements

Some firms did not have an adequate understanding of the full requirements when appointing ARs and/or had poor systems and controls when conducting initial due diligence before appointing an AR.

Areas for improvements included:

Not undertaking criminal or credit checks on their ARs.
Firms who had not onboarded ARs for some time did not maintain effective and up to date procedures.
When undertaking Companies House checks some firms were simply matching individuals to company records. They were not analysing previous links with dissolved companies and/or company accounts to identify potential problems about an AR’s financial resilience, which could create an undue risk of harm to consumers. For example, heightened risk of mis-selling where an AR is not profitable, or the risk that obligations to customers might not be fulfilled if an AR failed.
Relying simply on automated checks when undertaking background searches on the AR and not using any human judgement or oversight.
Not undertaking any internet and/or open-source checks when conducting background checks on the AR.
Where an AR had been or is currently, appointed to another principal, not making any enquiries with the other principal about the AR.
Failing to have an appropriate understanding of the required contract terms set out in Sup 12.5[5] (and legislation) for AR agreements.
Not considering the impact appointing an AR will have on their financial and non-financial resources and their ability to effectively monitor their ARs. It’s important to note that this is both an initial and ongoing requirement.

Initial appointment of ARs - good practices

Firms that demonstrated good practice in overseeing and monitoring their ARs had a good understanding of the risks and harms involved in using an AR. They were also able to identify how the regulatory requirements translate to the business model used. These firms understood SUP 12 sets out minimum requirements and used these as a starting point when designing effective approaches to onboarding ARs.

These firms also undertook robust quality assurance/auditing of their ARs and applied the same standards to the AR’s conduct as they did to their own firm.

Good practices included:

Clear, documented procedures for onboarding ARs. For example, a 'manual’ which provided a detailed step by step guide to the sign off process. This was accompanied by a clear scoring system which identified areas of concern and a hierarchy of governance approval.
Having appropriate documentary evidence and audit trail to show how they were meeting their oversight obligations.
Providing training on an initial and ongoing basis to ARs about the regulated activity they undertake and the financial products they sell, as well as the regulatory expectations before they are appointed.
Greater due diligence when onboarding their ARs, such as conducting a thorough review of financial accounts and linked individuals on Companies House, anti money-laundering and financial due diligence checks. In addition, considering what the AR’s unregulated activities will be and whether there was risk of consumer harm.
Early vetting of potential ARs using a compliance checklist. Using a compliance checklist for due diligence assessments for new ARs can help standardise these and ensure firms identify relevant concerns before an AR is appointed.
Onsite visits to ARs, particularly any considered a higher risk.
Requiring ARs to complete a compliance call and training course before they start undertaking regulated activities. For example, the regulated activities an IAR can conduct are limited to making introductions and/or non real-time financial promotions. This means firms may need to provide specific procedures and training to ensure they understand what these limits are and do not exceed them.
Some firms categorised potential ARs based on factors that affected conduct risk and used this to determine the frequency and type of monitoring they would apply after appointment.
Demonstrating through their onboarding procedures that they understand the harms posed by the regime and how the rules and guidance in Sup 12[3] aim to prevent these.

Ongoing monitoring of ARs - areas for improvements

Firms with poor systems and controls were not able to demonstrate effective ongoing oversight of their ARs. Some firms did not have enough resources to adequately monitor the number of ARs they either had, or planned to have, in the near future.

We also found a potential conflict of interest between persons who were maintaining and developing commercial relationships with ARs while simultaneously being responsible for a compliance function involving the ongoing monitoring of the ARs. There was a risk that because of commercial interests and relationships these staff may also be unable to fulfil independent compliance obligations.

In particular, some firms could not adequately demonstrate how they were monitoring the activities of their ARs, so that this did not or would not result in undue risk of harm to consumers.

Areas for improvements included:

Firms not taking proactive steps to identify harm caused by their ARs and relying only on very limited management information to monitor AR conduct. For example, only relying on complaints data instead of other metrics.
Where ARs were not undertaking any regulated activity for a long time, some firms were not analysing the reasons for this or considering whether the AR relationship remained appropriate.
Not undertaking file reviews or observing interactions between their ARs and consumers to ensure ARs were delivering good outcomes.
Some firms did not sufficiently consider potential conflicts of interest that might result in consumer harm or how to manage this. For example, from staff/employee incentives or commission arrangements between companies.
Not conducting checks to ensure their IARs were acting within the scope of their permitted activities. For example, not going further than introducing and/or distributing non-real time financial promotions. This was a particular risk where IARs had interactive engagement with consumers.
Not updating AR arrangements to reflect changes in Companies House; for example, not updating AR or trading names.
Not promptly terminating AR appointments when monitoring Companies House data showed an AR company had been dissolved.
Not monitoring websites to ensure compliance of any financial promotions or GEN 4[6] disclosures. Some examples included ARs wrongly identifying themselves as a principal firm, using the FCA logo on their website or not appropriately disclosing their AR status.
Some firms said they were actively monitoring AR websites, but these websites had non-compliant Gen 4 disclosures. This pointed to a lack of understanding of firms’ obligations.
Not using feedback forms sent to consumers to appropriately monitor the risk of potential harm from their ARs. These feedback forms simply asked very narrow questions about the service the consumer received rather than regulated activities. This would not prompt consumers to identify any ongoing harm caused by the ARs.

Ongoing monitoring of ARs - good practices

Firms with robust systems and controls to monitor their ARs could demonstrate a variety of methods by which they could satisfy themselves their ARs were complying with the relevant rules and regulations. Monitoring procedures also focused on identifying and addressing potential individual consumer harm and improving procedures more generally for the future.

These firms had dedicated oversight staff, adjusted the resource as and when required and had a clear structure around responsibilities and points of escalation. While the number of oversight staff per AR didn’t always correlate to better oversight, the experience and knowledge of the individuals involved did. Oversight staff also had clear responsibilities which favoured a compliance function rather than a relationship management function.

In one case we found that the effective use of resourcing allowed a firm to have a recorded phone call with all introduced consumers before proceeding to full application stage. This allowed the firm to ensure the particular AR had not acted outside the scope of its permissions and the consumer had received all the relevant information. Where the firm identified any incidents of this not happening, it put in place additional training or action.

Good practices included:

Direct control of relevant sections of the AR website to ensure compliance of any financial promotions or GEN 4 disclosures.
Ability to limit or block access to a firm’s systems for failure to comply with the terms of the AR agreement or relevant rules and legislation.
Contacting consumers who had been introduced to finance by an IAR to ensure the IAR did not act outside the limited regulated activities they can perform.
As part of quality audit, together with file checks, compliance staff also observing ARs’ interaction with consumers.
Getting consumer feedback to ensure ARs were not acting out of scope or mis-selling products.
Monitoring the AR’s financial position on an ongoing basis, not just at onboarding, allowing firms to react to any significant events.
Where ARs were not conducting regulated activities, firms engaged with ARs to understand the reasons for this and considered whether the AR relationship needed to continue.
Using automated processes to identify outlier behaviours by the AR, which could lead to potential consumer harm. For example, using a pre-determined set of parameters to identify and highlight any quotes which could have been poor value for further manual scrutiny.

Ending AR relationships

Outcome we want

Firms to be clear on when and how to end an AR relationship in line with the requirements in SUP 12.8[7].

Ending AR relationship - good practices

Firms with robust systems and controls had appropriate and well-documented procedures to end AR relationships when appropriate.

Some firms could show they kept significant control of the regulated services they were permitting their ARs (and in particular IARs) to conduct. This was either through having direct control of the software used to provide quotes, where they could suspend or terminate access if the AR/IAR did not follow correct procedures, or through controlling promotions literature on websites which could easily be removed.

Where an AR had not conducted regulated activities for some time and there were no valid reasons for this, firms terminated the AR relationship.

Ending AR relationship - areas for improvements

Some firms did not check an AR’s website after termination to ensure it no longer stated that it was an AR of the firm or that it could undertake regulated activities on behalf of the firm.

Some firms were not able to explain their offboarding policy and did not maintain up to date policies and procedures.

Some firms did not notify us to amend the Register immediately after terminating a contractual arrangement. This is important, to ensure consumers don’t believe an AR continues to act on the principal’s behalf.

Share

Introduction

Next steps

Initial appointment and ongoing oversight of ARs

Outcome we want

Full ARs

Introducer Appointed Representatives

Initial appointment of ARs - areas for improvements

Initial appointment of ARs - good practices

Ongoing monitoring of ARs - areas for improvements

Ongoing monitoring of ARs - good practices

Ending AR relationships

Outcome we want

Ending AR relationship - good practices

Ending AR relationship - areas for improvements