That's hard for fintechs, payment firms, banks, crypto businesses and embedded finance providers. Teams struggle to interpret the Handbook, assign ownership, keep controls running and track regulatory change.
This guide covers five steps: define your regulatory scope, build a risk-based framework, establish accountable leadership, operationalise monitoring and reporting, and keep evidence that it all works in practice.
Key Takeaways
- Map activities, permissions, products, customers, channels and third parties before choosing controls.
- Join up governance, financial crime, customer outcomes, promotions, resilience, records and reporting.
- Senior management stays accountable, even when work is outsourced, automated or advised externally.
- Test regularly, document remediation and scan the horizon for change.
What FCA Compliance Means and Who It Applies To
The Financial Conduct Authority regulates firms under the Financial Services and Markets Act 2000. Its strategic objective is to make relevant markets function well, supported by operational objectives on consumer protection, market integrity and competition.
The Handbook sets the rules, while authorisation or registration defines your permissions. Supervision monitors firms, and enforcement follows failures.
Not every financial business needs the same approval. Depending on what you actually do, you may need:
- FCA authorisation for specified regulated activities
- Registration only, such as MLR registration for cryptoasset AML supervision (not a general permission for regulated activities)
- Appointed representative status under a principal firm, which remains responsible for the AR's appointed business
- Authorisation from another regulator, such as the PRA for relevant banks
The FCA's authorisation guidance and PERG help you work out where you sit. Don't start regulated activities while an application is pending unless an exemption applies.
Being "FCA compliant" means operating within the right permissions and running effective, proportionate, documented and monitored systems and controls. Appearing on the Financial Services Register, or having policies on file, isn't enough. The Register shows status and permissions, not a blanket licence for every activity.
Build a Risk-Based FCA Compliance Framework
Map your regulatory scope and obligations
Start with an obligations register. Cover:
- Regulated activities and permissions
- Products, customer segments and jurisdictions
- Distribution channels and outsourcing arrangements
- Applicable Handbook provisions, such as PRIN, SYSC, COBS, DISP and the Financial Crime Guide (FCG)
- Duties owed to other bodies: the PRA, HM Treasury's OFSI, the National Crime Agency and the ICO
Run a dynamic risk assessment
Assess inherent and residual risk across these dimensions:
- Customers, products and geographies
- Channels and technology
- Fraud, money laundering and sanctions
- Consumer harm, operational disruption and third parties
For money laundering, MLR 2017 regulation 18 requires a written business-wide assessment. Refresh it after any material change to your business, products or regulation.
Turn risks into proportionate controls
Every material risk needs:
- A control and an owner
- An operating frequency and an evidence requirement
- An escalation route and a testing method
Without that chain you have a pile of disconnected policies, not a framework.
Strengthen AML and financial crime controls
Core elements under the Money Laundering Regulations include:
- Customer due diligence and beneficial ownership checks (regulation 28)
- Enhanced due diligence for higher-risk cases (regulation 33)
- PEP management with senior approval and source-of-wealth checks (regulation 35)
- Sanctions screening, transaction monitoring and SARs to the NCA's UK Financial Intelligence Unit
The enforcement record shows the stakes. The FCA fined Monzo £21,091,300 in 2025 over financial crime control failings, including inadequate customer due diligence. Its May 2026 sanctions review of 150+ firms found outdated lists, screening gaps and mishandled alerts.
Protect customer outcomes and communications
Build Consumer Duty (PRIN 2A) into design, onboarding, servicing and promotions. The four outcomes are products and services, price and value, consumer understanding and consumer support.
Add complaints handling under DISP, vulnerable customer guidance (FG21/1) and product governance under PROD where it applies to you.
Financial promotions need care too. Under FSMA s.21, unauthorised persons generally can't communicate promotions unless an authorised firm approves them or an exemption applies. Cryptoasset promotions have their own lawful routes.
Implementation still lags. The FCA's review of 23 payment firms found just under half had only partly implemented the Duty.
Embed Governance, Accountability and Compliance Culture
Make senior accountability explicit
The board and senior managers should approve the framework, set risk appetite, assign responsibilities and receive meaningful management information. Commercial and product decisions should visibly reflect compliance input. Under SM&CR, FSMA s.66A creates a statutory duty of responsibility for senior managers.
Resource an independent compliance function
SYSC 6.1 expects compliance arrangements proportionate to the firm and, where independence requirements apply, independent of the activities monitored. Compliance leaders need authority to challenge, a clear escalation line to the board, adequate budget and full access to information. Don't bury compliance inside revenue-generating teams.
Smaller firms can use part-time SMF16 or SMF17 holders if the time commitment is adequate. The FCA says it will probably refuse an application where an external consultant is the firm's only compliance resource.
For a scaling fintech where a full-time hire isn't yet proportionate, a director-led fractional model can help. Fraxtional provides fractional and interim CCO and MLRO support under UK, EU and Canadian frameworks, with directors who can be named in filings and who liaise with the FCA. Your senior management still holds regulatory accountability.
Build a speak-up and training culture
- Role-specific induction and recurring training
- Competence assessments under TC and policy attestations
- Manager involvement in reinforcing standards
- Confidential reporting channels under SYSC 18, with non-retaliation expectations
- Evidence that staff know how to escalate
Govern outsourcing and third parties
SYSC 8 is clear: outsourcing never lets senior personnel abdicate responsibility. Build oversight that covers:
- Due diligence on providers
- Contractual responsibilities and service levels
- Access to records and performance monitoring
- Controls on subcontracting
- Tested exit plans
The Critical Third Parties regime, with first designations from 13 July 2026, complements your own third-party oversight and doesn't replace it.
Link compliance to resilience and technology
Assign owners for critical systems, data security, access management, incident response, continuity and disaster recovery. SYSC 15A requires important business services, impact tolerances and scenario testing.
Any automated decisioning or monitoring tool in your compliance programme needs a named owner too.
Operationalise, Test and Evidence Ongoing Compliance
Keep reliable reporting and audit trails
Build a regulatory reporting calendar around RegData, with data owners, reconciliations, sign-off and version control. Depending on your firm type, this may include:
- REP-CRIM annual financial crime report, due within 60 business days of your accounting reference date
- REP017 payments fraud reporting
- The safeguarding return under SUP 16.14A, effective 7 May 2026
Verify retention periods by record type. SYSC 9 sets no universal period. For MLR records, regulation 40 requires CDD and supporting records to be kept for five years, and transaction records for no more than ten years.
Monitor and independently test controls
Day-to-day monitoring confirms controls are operating. Independent assurance tests whether they work as designed. Use risk-based quality assurance, thematic reviews, sample testing and control effectiveness reviews. SYSC 6.2 requires internal audit for some firms, but a three lines of defence model is not a universal requirement.
Manage incidents, complaints and remediation
- Log the concern as soon as it arises
- Triage severity against your risk criteria
- Investigate root cause and preserve evidence
- Escalate material issues, including to the FCA where Principle 11 or SUP 15 applies
- Communicate with affected parties where required
- Assign corrective actions with owners, deadlines, validation and documented closure
The FCA's standardised incident reporting framework is due 18 March 2027, and payment firms face enhanced reporting.
Keep policies aligned with regulatory change
Scan the Regulatory Initiatives Grid, annual work programme, Handbook notices, consultations, Dear CEO letters and Final Notices. Each relevant change should trigger an impact assessment, policy and system updates, training and a report to senior management. Crypto firms should note that existing MLR registrations don't convert automatically to FSMA authorisation.
Use technology without replacing oversight
Tools help with screening, workflow, alerts, evidence collection and management information. The FCA is technology-neutral and applies existing rules; technical metrics alone may not show consumer outcomes. Keep humans in the loop, document assumptions, check data quality and validate periodically.
Assess FCA Readiness: Common Gaps and a Practical Checklist
Signs your programme exists only on paper
- Risk assessments that are out of date
- Generic policies and unclear permissions
- Thin evidence and unsupported compliance officers
- Board reporting that lacks substance
- Training nobody checks
- Monitoring alerts left unresolved
- Weak third-party oversight
- Controls that are untested or unconnected to real risks
Paper programmes leave firms exposed when the FCA looks closer. The FCA's February 2025 payments portfolio letter flags Consumer Duty, safeguarding, financial crime, resilience, fraud and governance weaknesses.
Readiness checklist
- Regulatory scope and permissions confirmed
- Governance and accountable owners documented
- Financial crime controls tested
- Consumer Duty and complaints evidenced
- Financial promotions approved and reviewed
- Reporting calendar, records and data protection in place
- Operational resilience and outsourcing oversight reviewed
- Staff competence verified
- Incident response, testing and remediation tracked
Validate readiness before a major event
Commission an independent gap assessment before a major milestone:
- Applying for authorisation
- Launching a product or entering a market
- Approaching a sponsor bank
- Completing an investment or acquisition
- Responding to major regulatory change
Fraxtional's independent audits and Policy and Controls Review test whether controls work as designed, then produce prioritised remediation roadmaps. Fractional compliance leadership can then carry the work forward at a proportionate cost. External support doesn't remove your own FCA responsibilities.
Frequently Asked Questions
Who needs FCA approval?
It depends on the regulated activities you perform, your business model, permissions and any exemptions or other regimes. Check the FCA's authorisation guidance and PERG.
Is FCA equivalent to CA?
No. FCA means the UK Financial Conduct Authority. "CA" could mean a different regulator, country or designation, such as the Chartered Accountant title used by ICAS in Scotland.
What does FCA compliant mean?
It means operating within the correct permissions while maintaining governance, controls, conduct standards, reporting, monitoring, records and remediation that work in practice.
What does FCA stand for?
In UK financial services, FCA stands for the Financial Conduct Authority. In US federal law, it can also mean the False Claims Act.
