The Compliance Doctor

The appointed representative regime was designed to widen access to regulated markets. But for principal firms, it comes with a burden of responsibility that many have consistently underestimated — and that the FCA has spent the last several years making significantly harder to ignore. Following its thematic review and the sweeping changes introduced under PS21/3, the regulator has made clear that...

Consumer Duty has been in force since July 2023, and the FCA is no longer giving firms the benefit of the doubt. Supervisory visits, thematic reviews, and enforcement activity are all signalling the same message — having a Consumer Duty policy isn't enough. You need to evidence that your firm is consistently delivering good outcomes for retail customers, and that your board is sighted on the d...

Is your firm's Fair Value Assessment actually fit for purpose — or is it a compliance exercise dressed up as consumer protection? Since Consumer Duty came into full force, the FCA has been unequivocal: firms must be able to demonstrate that the price customers pay is reasonable relative to the benefit they receive. That is not a box-ticking exercise. It is a structured, evidenced, and regularl...

When it comes to Politically Exposed Persons and high-risk customers, the gap between having an EDD process and having one that actually works is wider than most firms realise — and the FCA knows it. Enhanced Due Diligence is one of the most scrutinised areas of AML compliance in UK financial services. The Money Laundering Regulations 2017 are explicit: certain customers require a materially highe...

The FCA and PRA's operational resilience framework is no longer a future obligation. The March 2025 implementation deadline has passed — and firms are now expected to be operating within their impact tolerances, not still mapping them. Operational resilience has moved from policy commitment to supervisory reality. Regulators expect firms to have identified their important business services, se...

An FCA supervisory visit is not a conversation. It is a structured regulatory assessment of your firm's systems, controls, and culture — and firms that treat it as an informal check-up are the ones that end up with the most uncomfortable outcomes. Whether it arrives as a routine engagement, a Dear CEO letter follow-up, or a targeted thematic review, an FCA visit demands that your firm can demo...

Every regulated firm has a compliance risk register. Far fewer have one that genuinely reflects their risk profile, drives management decision-making, or would survive scrutiny from the FCA, an internal auditor, or a skilled person examiner. A compliance risk register is not a spreadsheet exercise. It is the foundation of your firm's entire risk management framework — the document that should...

Payment service providers operate in one of the most rapidly evolving regulatory environments in UK financial services. Yet the compliance risk registers many PSR-authorised firms rely on were built for a different business model, a different regulatory framework, or — in some cases — barely built at all. A compliance risk register is not optional for payment institutions, e-money institutions, or...

Filing a Suspicious Activity Report is one of the most consequential decisions a compliance professional makes. Get it wrong in either direction — failing to file when you should, or filing without adequate reasoning — and the personal consequences under SMCR can be severe. The SAR regime sits at the heart of the UK's anti-money laundering framework. The Proceeds of Crime Act 2002 and the Terroris...

A Compliance Monitoring Programme is one of the most powerful tools a regulated firm has. It is also one of the most consistently underused — and the FCA's supervisory findings show that the regulator is increasingly focused on whether monitoring is genuinely risk-based or simply cyclical and superficial. The obligation to monitor compliance is not discretionary. Whether your firm is FCA-autho...

A Section 166 skilled person review is one of the most significant regulatory interventions an FCA-regulated firm can face. It is not a routine supervisory visit. It is a deep, independent examination of your firm's systems and controls — commissioned by the regulator, paid for by you, and with findings that go directly back to the FCA. The power to require a skilled person review sits within...

Sanctions compliance is no longer a back-office checkbox. With OFSI issuing significant monetary penalties, the FCA embedding sanctions risk into its supervisory framework, and the geopolitical landscape producing new designations at pace, the consequences of inadequate screening have never been more immediate — or more personal. The UK sanctions regime, administered through OFSI and underpinned b...

Every FCA-regulated firm and payment service provider subject to the Money Laundering Regulations 2017 must have a Business-Wide Risk Assessment. Not a summary. Not a policy statement. A documented, evidenced, and regularly reviewed assessment of the specific money laundering and terrorist financing risks your firm faces — and what it is doing about them. The Business-Wide Risk Assessment is the c...

When a Senior Manager leaves a regulated firm, retires, or moves role, the accountability they carried does not simply transfer with their laptop and access credentials. Under SMCR, handover is a regulated event — and the documentation surrounding it is one of the most consistently underprepared areas of Senior Manager regime compliance. The FCA is explicit. Senior Managers must take reasonable st...

The FCA's expectations around vulnerable customers have never been more explicit. Under Consumer Duty, identifying, recording, and appropriately supporting customers in vulnerable circumstances is not a discretionary act of goodwill — it is a regulatory obligation with board-level accountability attached. The FCA's Financial Lives survey consistently demonstrates that the majority of UK ad...

Under SMCR, the FCA's Conduct Rules apply to virtually every individual working in a regulated firm. When a potential breach is identified, what happens next is not a matter of internal discretion — it is a regulated process with statutory reporting obligations, personal accountability consequences, and an audit trail the FCA will scrutinise. The Individual Conduct Rules set baseline standards...

If you're a Senior Manager, MLRO, or Compliance Officer working inside an FCA-authorised firm, you already know that SMCR isn't just a box-ticking exercise — it's a personal accountability regime with real criminal and civil consequences attached to your name. But here's the uncomfortable truth: most firms are still operating with responsibilities maps that are vague, out of date,...

Submitting a Senior Manager Function application to the FCA sounds straightforward. In practice, it's one of the most consequential regulatory processes a firm will go through — and one where mistakes, omissions, or poor preparation can result in delays, requests for further information, or in serious cases, outright rejection. Under SMCR, every individual performing a Senior Manager Function...

Replacement business is one of the oldest conduct risks in financial services — and one that continues to generate regulatory findings, redress requirements, and in serious cases, enforcement action. The FCA has been clear: recommending that a customer switches, transfers, or cancels an existing product in favour of a new one carries significant responsibility. That responsibility sits with the fi...

Outsourcing a function doesn't mean outsourcing the responsibility for it. That's one of the most important — and most frequently misunderstood — principles in FCA regulation. Yet every year, firms face supervisory scrutiny, remediation requirements, and in some cases enforcement action, precisely because their third-party oversight arrangements weren't fit for purpose. Whether you&#39...

Receiving a query from the FCA is one of the most stressful moments in a compliance professional's calendar. Whether it's a supervisory information request, a data query, a Dear CEO letter follow-up, or the opening move in a more formal supervisory engagement, how you respond matters enormously — and most firms simply aren't prepared. In this episode, we're talking about the FCA Qu...

Most firms have a complaints process. Far fewer have one that actually drives improvement — and the FCA's thematic findings make clear that the regulator can tell the difference. Complaints handling sits at the heart of the Consumer Duty framework. The FCA expects firms not only to resolve complaints fairly and promptly, but to analyse them systematically, identify root causes, and use that in...

Every year, FCA-regulated firms go through the motions of annual certification — and every year, the FCA finds firms that can't evidence what they've actually done. Certification under SMCR isn't just a box-ticking exercise. It's a legal obligation, and when things go wrong, the consequences land directly on senior managers. In this episode, we're cutting through the complexity...

Most compliance failures don't come out of nowhere. They come from regulatory changes that were signalled months — sometimes years — in advance, and firms that simply weren't watching. Regulatory horizon scanning isn't a luxury reserved for large firms with dedicated regulatory intelligence teams. It's a fundamental risk management discipline, and the FCA expects every authorised f...

In this episode of the Atomic Impact Podcast, host Jason Osborn speaks with Lee Werrell, owner of UK Compliance Consultant Limited, also known as Compliance Doctor, about building a successful regulatory compliance consultancy in the financial services sector. Lee shares insights on the importance of relationships, dialogue over hard selling, and creating practical frameworks that help businesses...