Introduction: Why Compliance Calendars Matter for UK FinTechs
A UK fintech rarely answers to one regulator. FCA returns, Companies House filings, HMRC deadlines, ICO duties, sponsor-bank commitments and internal control reviews all run on different clocks. Missing one is easy.
A compliance calendar is more than a list of dates. It ties each obligation to an owner, preparation steps, evidence, approval and an escalation route.
The FCA's 2024 Final Notice on Starling Bank shows what a gap in monitoring can cost. This guide gives a UK-focused framework for defining your calendar, identifying obligations, building recurring and event-driven tasks, and keeping it current. Verify every requirement against current official sources and qualified professional advice.
Key Takeaways
- A compliance calendar gives one view of obligations, deadlines, owners, evidence and status.
- Separate annual, quarterly, recurring, event-driven and regulatory-change activities.
- Map entries to your entities, licences, products and customers; don't copy a generic template.
- Reviews, source monitoring and escalation routes keep the calendar alive.
What Is a Compliance Calendar and Why Does It Matter?
What a compliance calendar covers
A compliance calendar records the legal, regulatory, contractual and internal activities a firm must complete. Each entry states its source, entity or product scope, frequency, due-date logic, owner, evidence and status.
It works as a governance layer. Obligations link to policies, controls, reporting, training, audits, testing and management oversight. FCA rules in SYSC 6 expect firms to monitor compliance continuously, run a risk-prioritised monitoring programme and report to the management body at least annually. They don't prescribe a calendar, but a calendar is good evidence you're doing this.
How it differs from related tools
- Compliance calendar: timing, ownership and accountability.
- Checklist: the specific steps or evidence for one obligation.
- Regulatory obligations register: the full inventory of requirements and their control mapping.
- Task-management system: workflow for assigning and tracking work, with no regulatory logic of its own.
The best setups use all four, with the calendar as the timing backbone.
The business value of a well-maintained calendar
Structured deadline management reduces missed filings, overdue reviews, lapsed approvals, thin evidence and late remediation. It also supports audit readiness, board reporting, partner confidence and investor due diligence.
The Starling case is instructive. After a Voluntary Requirement took effect on 17 September 2021, the FCA found Starling had not put a formal monitoring programme in place.
The notice records 54,359 accounts opened for 49,183 high-risk or higher-risk customers in breach of that requirement. The FCA Final Notice states a penalty of £28,959,426. A recurring, evidenced testing task with a named owner is exactly what was missing.
Annual, quarterly and event-driven compliance
Annual activities may include policy reviews, risk assessments, training refreshes, corporate filings, independent reviews, Consumer Duty outcomes reporting and effectiveness assessments. Confirm which apply to your firm.
Quarterly activities may include management reporting, monitoring, control testing, risk reviews and committee reporting. There is no single quarterly FCA filing for all fintechs; take return periods from your RegData schedule.
Event-driven tasks fire on a trigger: a product launch, incident, regulatory change, new jurisdiction, ownership change or material business-model change. Leave these out and the calendar only covers the predictable half of your risk.
What Should a UK FinTech Compliance Calendar Include?
Map UK regulatory and corporate obligations
Separate mandatory obligations from sponsor-bank, investor, customer, contractual and internal commitments. Then check applicability for each item. Common UK obligations include:
- FCA payment returns: REP017 fraud reporting, REP018 operational and security risk reporting (specified PSPs), FSA056 capital adequacy for authorised PIs, EMI questionnaires. Use your RegData schedule for due dates.
- Safeguarding: the supplementary regime took effect 7 May 2026. Monthly REP027 applies to APIs, authorised EMIs and SEMIs, due within 15 business days of month-end. Audit submission timing is six months after the first audit period, then four.
- REP-CRIM: not universal. SUP 16.23 scope depends on firm type, permissions and revenue (including a £5 million limb), with filing within 60 business days of the accounting reference date.
- AML: a written business risk assessment, regularly reviewed controls and documented training. The MLRs set no universal annual interval.
- Companies House: confirmation statement every 12 months; accounts within nine months of year-end; director identity verification phased in from 18 November 2025.
- HMRC: Company Tax Return 12 months after period-end; payment for profits up to £1.5 million nine months and one day after. HMRC AML renewals apply only to HMRC-supervised businesses.
- ICO: breach notification within 72 hours of awareness, DPIAs before high-risk processing, and the data protection fee where it applies.
- Complaints and Consumer Duty: annual board-approved outcomes report; DISP reporting varies by firm type. From 1 January 2027, COM001 replaces five existing returns.
- Crypto: financial promotion rules, MLR registration and Travel Rule duties. The new FSMA cryptoasset regime starts 25 October 2027, so treat it as a future change.
Account for multiple entities and jurisdictions
Keep separate views per entity and jurisdiction. The UK uses the FCA, Companies House and HMRC. The EU runs through national authorities, with the EBA keeping a central register. The US has FinCEN MSB registration plus state licensing, and Canada has FINTRAC. Different legal bases, owners and filing systems shouldn't share a single blended deadline list.
Add fields for legal entity, regulated activity, product, customer segment, jurisdiction and regulator. A change touching one product then won't appear to apply everywhere.
Required fields for every entry
- Obligation name and legal or policy source
- Applicability rationale
- Reporting period and due date or due-date rule
- Preparation deadline
- Accountable owner, backup owner and approver
- Evidence required and linked policy or control
- Status and escalation route
- "Last verified" date and named source owner
Build in preparation time, dependencies and evidence
Don't enter only the final filing date. Break major obligations into preparation, data collection, quality assurance, compliance review, senior approval, submission, confirmation and evidence retention.
Map dependencies: transaction data, customer communications, vendor reports, board meetings, legal review, regulator portals and third-party attestations. No universal reminder period applies across obligations, so set lead times from your own filing history. A change-in-control notice, for instance, gives the FCA up to 60 working days after a complete notification, which tells you about their clock, not yours.
Assign ownership and risk priority
Name a responsible individual, an accountable executive and a backup for each obligation. Define escalation for tasks that are overdue, blocked or likely to slip. Under SM&CR, SMF16 (Compliance Oversight) and SMF17 (Money Laundering Reporting) are distinct designations, and SMF17 is not automatically the MLR nominated officer.
Prioritise by regulatory impact, financial-crime or customer risk, operational dependency, deadline rigidity, preparation effort and the effect on licensing or partnerships.
How to Build a Compliance Calendar Step by Step
1. Establish your regulatory perimeter
Start with a business-model inventory:
- Legal entities, products and payment flows
- Customer types, regulated activities and channels
- Outsourcing, jurisdictions and planned launches
Use it to decide what may apply, and send uncertain items to legal, compliance, tax or privacy specialists.
2. Gather and validate authoritative sources
Use current FCA rules, supervisory statements, official portals, legislation, HMRC and Companies House guidance, and your contracts. Each entry should carry its source, effective date, last review date and a change-monitoring owner. Flag anything needing professional confirmation.
3. Convert obligations into actionable tasks
"Review AML programme" is too vague. Rewrite it as: MLRO reviews the business risk assessment against new product launches, using the latest alert data, with CEO sign-off and a signed report filed in the compliance repository. Link each task to its policy, control, filing, training record or test result.
4. Prioritise deadlines and set escalation rules
Rank these highest, especially where correction options are limited:
- Regulatory filings
- Customer-impacting communications
- Financial-crime controls
- Licence conditions and incident-related work
Set reminder stages, escalation recipients and exception approvals by risk and preparation effort. These intervals are internal choices, not legal requirements.
5. Choose a practical operating system
| Option | Suits | Watch for |
|---|---|---|
| Controlled shared calendar | Very early-stage teams | Weak evidence and audit trail |
| Spreadsheet | Small, single-entity firms | Version control, access |
| Governance or compliance platform | Multi-entity, cross-border firms | Cost, set-up effort |
Whatever you pick, require:
- Version control and role-based access
- Recurring tasks and notifications
- Evidence links and status reporting
- Change logs and export
Tools don't replace ownership.
6. Validate and secure leadership buy-in
Run a structured review with compliance, operations, finance, legal, privacy, security, product and leadership. Test that every obligation has an owner, source, deadline, preparation window and evidence requirement.
Seed-stage and growing fintechs often lack senior compliance capacity. Fraxtional's director-led fractional model can help map obligations, set up the calendar, define ownership and provide ongoing CCO or MLRO-level oversight without a full-time hire.
How to Operate, Review and Update the Calendar
Create a review and governance rhythm
Review upcoming deadlines regularly, report to management or the board periodically, and re-baseline the full obligations inventory each year. Scale the cadence to your risk profile. Track:
- Overdue tasks and approaching high-risk deadlines
- Missing evidence and unresolved exceptions
- Repeated control failures
- Changes awaiting impact assessment
Monitor regulatory and business changes
Assign owners to watch the Regulatory Initiatives Grid, which sets out a 24-month pipeline and is published twice yearly. Also monitor:
- FCA Handbook Notices and Dear CEO letters
- legislation.gov.uk and enforcement notices
- Product changes, incidents and market expansion
When a change lands, record:
- Affected obligation and effective date
- Impacted entity or product
- Policy or control changes
- New owner, implementation task and completion evidence
Upcoming examples include new operational incident reporting and third-party notification rules from 18 March 2027.
Maintain auditability and improve continuously
Keep submissions, approvals, test records, minutes, evidence links, exceptions, remediation plans and calendar change history in a controlled location. MLR record-keeping requires retention of at least five years for covered records.
Hold periodic retrospectives to surface:
- Missed or duplicated tasks
- Unrealistic preparation windows
- Unclear ownership and recurring bottlenecks
Then update the calendar and procedures.
Frequently Asked Questions
What is a compliance calendar and what is its purpose?
A compliance calendar is a central schedule of regulatory and internal obligations. It coordinates deadlines, ownership, preparation, evidence and escalation.
What are compliance checklists?
Checklists break an obligation into specific actions or evidence requirements. The calendar organises those actions by timing, owner and review cycle.
What is annual compliance?
Annual compliance covers yearly filings, reviews, assessments, training, policy updates and attestations. The exact activities depend on your entity type, products, licences and jurisdictions.
What is quarterly compliance?
Quarterly compliance covers obligations or control reviews performed every three months, such as monitoring, reporting, testing or governance reviews. Confirm the exact frequency from the relevant official source.
What are the due dates for statutory payments in India?
These are outside this UK-focused guide. They vary by payment and entity type, so confirm them with the relevant Indian authority or a qualified local adviser rather than adapting a UK calendar.
