Principal Firm Obligations for Appointed Representatives: A Practical Guide

The legal basis: FSMA section 39 responsibility

The appointed representative regime is set in primary legislation. Under section 39 of FSMA, a person can be exempt from the general prohibition on carrying on regulated activities where an authorised person, the principal, has contracted with them and has accepted responsibility in writing for the conduct of those activities. In other words, the AR relies on your permissions rather than holding its own.

The consequence is set out in section 39(3): the principal of an appointed representative is responsible, to the same extent as if it had expressly permitted it, for anything done or omitted by the representative in carrying on the business for which the principal has accepted responsibility. This is not a shared or diluted duty. You cannot outsource the regulatory outcome to the AR, and the FCA can take action against you for what your AR does or fails to do.

Because responsibility flows to you, you must also hold permission for every regulated activity your AR carries on under the arrangement. The written contract, sometimes called the AR agreement, defines the scope of business you have accepted responsibility for. Getting that scope right at the outset is the first of your principal firm obligations, and it frames everything that follows.

Why the FCA tightened the regime

The FCA did not raise expectations in a vacuum. In PS22/11 it explained that, while the AR regime has real benefits, it had identified a wide range of harm across all the sectors where principals and ARs operate. Where harm occurs, the FCA said, it is often because principals do not undertake adequate due diligence before appointing an AR, or because of poor ongoing control and oversight.

The supporting data is stark. The FCA's analysis of Financial Services Compensation Scheme claims found that, from 2018 to the first half of 2019, principals and ARs accounted for 61% of the value of claims, for which the total was 1.1 billion pounds during that period. On average, the FCA found, principals cause 50 to 400% more supervisory cases and complaints than non-principals, and supervisory cases were higher for principals across every sector it examined.

As at PS22/11 the FCA estimated there were around 3,400 principals with around 37,000 ARs, including introducer ARs. The reforms in PS22/11 were built around two themes: collecting additional information on ARs and strengthening reporting requirements for principals, and clarifying and strengthening the responsibilities and expectations of principals. Understanding that context helps explain why each obligation exists.

Before appointment: due diligence and notification

Your obligations begin before an AR does any business. The FCA expects you to assess the AR before appointing it to satisfy yourself that it is fit and proper, financially stable and suitable to carry on business for your firm. That assessment should reflect real judgement about the AR's people, business model and controls, not a purely automated check.

You must also have a written AR agreement that sets out what business the AR can and cannot do. This is the document that defines the scope of activities you are accepting responsibility for under section 39, so it needs to be precise and kept current as the relationship develops.

Notification is the third pre-appointment step. Under the FCA's rules you must notify the FCA at least 30 days before the appointment takes effect. That advance window gives the regulator the chance to raise concerns before the AR starts trading, and it is one of the enhanced notification points the FCA emphasised when strengthening the regime. Missing or rushing this step is a straightforward compliance failure that is easy to avoid.

Ongoing oversight and the annual review

Appointing an AR is the start, not the end, of your responsibility. The FCA expects principals to apply an appropriate level of ongoing oversight and monitoring proportionate to the nature, scale and complexity of the AR's business. In practice that means understanding the AR's business model, including any unregulated activity, monitoring what it says to customers, and checking that it stays within the scope you have agreed.

A central plank of the PS22/11 reforms is a formal review of each AR. You must review each AR at least every 12 months. The review must cover the fitness and propriety of the AR's senior management and their competence, the AR's financial position, and the adequacy of your own controls and resources to oversee the AR. The FCA expects these reviews to be documented in writing so you can evidence them.

The FCA's later good and poor practice work showed why this matters. It found firms taking a tick-box approach, weak record-keeping that meant principals could not demonstrate adequate annual reviews, and that fewer than one-third of firms checked consumer-facing materials such as websites or social media to confirm ARs stayed in scope. Effective oversight is active and evidenced, not assumed.

The annual self-assessment document

Alongside reviewing each individual AR, PS22/11 introduced a requirement for the principal to look at itself. You must prepare a self-assessment document that sets out how you are meeting your responsibilities in relation to all of your ARs, and that identifies any material deficiencies or concerns together with the action you plan to take.

The self-assessment is not a filing you send in by default. It must be reviewed and signed off by your governing body at least every 12 months, kept for at least six years, and made available to the FCA on request. The sign-off requirement is deliberate: it forces senior accountability for the quality of your AR oversight rather than leaving it to a compliance function alone.

The FCA's practice review found this is where many firms fall short. It reported that around one in five firms had not completed the required self-assessments or annual reviews, and that only around half of completed self-assessments reached a good quality standard. A self-assessment that honestly surfaces weaknesses, with a credible plan to fix them, is far more useful to you and the regulator than one that simply asserts everything is fine.

Data returns: complaints and revenue reporting

The reforms also gave the FCA a data pipeline into the AR population. Principals must report complaints and revenue information for each AR, including introducer ARs, to the FCA every year. This is submitted through the REP025 return in RegData and covers the ARs you had during the reporting period, including any relationships that ended during the year.

The deadline is fixed to your reporting cycle. You must submit REP025 within 60 business days of your firm's accounting reference date. The return captures complaints opened or closed in the period relating to the AR's regulated activities carried on for you, regulated business revenue, relevant non-regulated revenue, and any redress payments made in the period whether or not the complaint was upheld.

Treat these returns as part of your oversight, not a separate administrative chore. The complaints and revenue picture for an AR is exactly the kind of signal that should feed your annual review and your self-assessment. The FCA uses the same data to identify trends and emerging risks and to target its supervision, so material discrepancies between what you report and what you can evidence will attract attention.

Consequences of poor oversight

Because your responsibility is legal, weak oversight is not just a supervisory concern; it exposes your firm directly. Under section 39 the FCA can take regulatory action against you for what your AR does or fails to do, as if you had authorised it yourself. Complaints, redress and compensation claims arising from an AR's conduct land at your door.

The FCA has made clear it will act where standards are not met. In its good and poor practice publication it said it would take swift action where principals are not meeting standards and would continue to monitor compliance with a particular focus on annual reviews, self-assessments and the quality of oversight. It also noted that many principals were over-confident about their compliance, with 96% claiming confidence in implementing the new rules against much weaker evidence of good-quality reviews and assessments.

The practical lesson is to build oversight that would stand up to scrutiny before the FCA asks. That means real due diligence at onboarding, active monitoring that includes checking public-facing materials, documented annual reviews, an honest self-assessment signed off at board level, and accurate, timely data returns. Firms that treat these as a genuine control framework rather than a paperwork exercise are the ones least likely to face enforcement.

Putting it into practice

The obligations are demanding but they follow a logical cycle: assess and appoint carefully, oversee continuously, review formally each year, self-assess and report. Building that cycle into your firm's governance, with clear ownership and evidence at each stage, turns a list of rules into a repeatable process you can defend.

If you are considering the AR model or tightening up an existing programme, the ground covered here maps directly onto the systems and controls the FCA expects. Structuring your permissions, oversight framework and reporting from the start is far easier than retrofitting them after a supervisory query. Our FCA authorisation service helps firms design an AR oversight framework that meets these obligations, and our ongoing compliance controls support the annual review, self-assessment and data-return cycle over time.

Conclusion

Principal firm obligations for appointed representatives all stem from a single principle: when you accept responsibility for an AR under section 39 of FSMA, you own the regulatory outcome. The SUP 12 framework and the PS22/11 enhancements translate that principle into concrete duties, from a 30-day notification before appointment, through continuous oversight and a documented annual review of each AR, to a board-signed self-assessment and a REP025 data return within 60 business days of your accounting reference date.

The FCA strengthened the regime because principals and ARs generated a disproportionate share of harm, and it has signalled that it will act where oversight is weak. Firms that treat these obligations as a genuine, evidenced control cycle rather than a compliance formality protect their customers, their permissions and their reputation. If you are building or reviewing an AR programme, start with the framework and let the reporting fall out of it, not the other way around.

Frequently asked questions