Authorisation and Regulation of Financial Firms
A business cannot simply decide to offer regulated financial services.
First, it needs the correct regulatory status.
For many financial firms, this means being authorised by the Financial Conduct Authority, or FCA.
However, authorisation does not give a firm permission to do everything.
Instead, the firm can only carry out the regulated activities covered by its permissions.
Therefore, two ideas are important:
Authorisation → The firm is allowed to operate within the regulated system.
Permissions → Define which regulated activities the firm can carry out.
Understanding this difference is essential for CeMAP.
Why Is Authorisation Needed?
Financial firms can have a major effect on people’s lives.
For example, they may:
- lend money
- arrange mortgages
- give financial advice
- arrange insurance
- manage investments
Therefore, customers need protection.
Authorisation helps make sure firms meet certain standards before they carry out regulated activities.
However, those standards do not stop once authorisation is granted.
Instead, firms must continue meeting regulatory requirements while they operate.
The General Prohibition
The Financial Services and Markets Act 2000, or FSMA, contains an important rule known as the general prohibition.
Broadly, a person must not carry on a regulated activity in the UK unless they are:
- authorised
or
- exempt.
Therefore:
Regulated activity
No authorisation or exemption
=
Potential breach of the general prohibition
This is one of the foundations of UK financial regulation.
What Is an Authorised Firm?
An authorised firm has permission to operate within the regulated financial-services system.
For example, an authorised mortgage firm may be able to:
- advise on mortgages
- arrange mortgages
- carry out other permitted activities
However, the exact position depends on its regulatory permissions.
Therefore:
Authorised does not mean authorised for everything.
This distinction is very important.
What Are Regulatory Permissions?
A firm’s permissions define which regulated activities it can carry out.
For example, one firm may have permission to:
Advise on regulated mortgage contracts
and:
Arrange regulated mortgage contracts
Meanwhile, another firm may have permissions covering:
- investments
- insurance
- consumer credit
Therefore, two FCA-authorised firms can have very different permissions.
Why Do Permissions Matter?
Imagine a mortgage firm has permission to advise on regulated mortgages.
However, a customer then asks the adviser:
Which investment fund should I use for my savings?
That could involve a different regulated activity.
Therefore, the firm’s mortgage permissions do not automatically allow it to provide regulated investment advice.
As a result:
A firm must stay within its permissions.
This also helps explain why financial firms often refer customers to specialists for services they do not provide.
Who Authorises Firms?
For many financial-services businesses, the FCA is responsible for authorisation.
However, the position is slightly different for certain major financial institutions.
For example, banks, building societies, credit unions and insurers can be dual-regulated.
In those cases:
Prudential Regulation Authority
focuses particularly on financial safety and soundness.
Meanwhile:
Financial Conduct Authority
focuses particularly on conduct and markets.
Therefore, some firms are regulated by both the FCA and PRA.
FCA Regulation and PRA Regulation
A simple memory aid is:
FCA → Conduct
PRA → Prudential safety
This is simplified, but useful.
For example, the FCA is concerned with matters such as:
- customer treatment
- financial promotions
- conduct
- market integrity
Meanwhile, the PRA focuses on areas such as:
- financial resilience
- capital
- liquidity
- safety and soundness
Therefore, the two regulators have different but connected roles.
What Does the FCA Consider?
Before authorising a firm, the FCA needs to understand the business.
For example, it may consider:
- what the firm plans to do
- who will run it
- its financial resources
- its systems and controls
- how it will manage risks
- whether it can meet regulatory requirements
Therefore, authorisation is more than filling in an application form.
The firm needs to show that it is ready to operate within the regulated financial system.
The Threshold Conditions
Firms need to meet certain minimum requirements known as the Threshold Conditions.
These are basic standards that relevant firms must meet to become and remain authorised.
Depending on the firm, important areas can include:
- legal status
- location of offices
- appropriate resources
- suitability
- business model
Therefore:
Threshold Conditions are minimum standards for regulatory authorisation.
Importantly, firms need to continue meeting them after authorisation.
Appropriate Resources
A financial firm needs suitable resources for the business it carries out.
However, resources do not only mean money.
They can also include:
- staff
- knowledge
- systems
- technology
- management
- financial resources
Therefore, a firm should have enough capacity to operate properly.
For example, a mortgage business should not take on more customers than it can reasonably support.
Suitability
The FCA also considers whether the firm is suitable.
This can involve areas such as:
- competence
- honesty
- integrity
- reputation
- financial soundness
Therefore, financial regulation looks at more than the firm’s business plan.
The people and culture behind the business also matter.
The Business Model
The FCA may also consider the firm’s business model.
In simple terms, this means:
How does the business plan to operate and make money?
For example, a mortgage brokerage might receive income through:
- broker fees
- lender procuration fees
- related permitted services
The regulator may consider whether the business model is sustainable and whether it could create unreasonable risks.
Therefore, how a firm earns money can be relevant to regulation.
Direct Authorisation
A mortgage business may choose to become directly authorised.
This means it holds its own FCA authorisation and relevant permissions.
Therefore, the firm is directly responsible for meeting its regulatory obligations.
For example, it may need to manage:
- compliance
- regulatory reporting
- complaints
- supervision
- staff competence
- financial resources
- record keeping
As a result, direct authorisation can provide greater independence.
However, it also brings significant responsibility.
Appointed Representatives
A different route is to become an appointed representative, usually shortened to:
AR
An appointed representative carries out certain regulated activities under the responsibility of an authorised firm.
That authorised firm is called the:
Principal
Therefore:
Authorised Principal
↓
Accepts responsibility for relevant regulated activities
↓
Appointed Representative
This structure is common in financial services, including mortgage advice.
A Mortgage Network
Mortgage advisers often hear the word network.
A mortgage network can act as the authorised principal for appointed representatives.
For example:
Mortgage Network
↓
Principal firm
↓
Mortgage brokerage
↓
Appointed representative
↓
Mortgage advisers
The network may provide systems, compliance support and supervision.
Therefore, a smaller mortgage business can operate within the principal’s regulatory structure rather than becoming directly authorised itself.
Directly Authorised or Appointed Representative?
Both routes can allow a mortgage business to operate within the regulated system.
However, the structure is different.
Directly Authorised
The firm holds its own FCA authorisation.
Therefore, it has direct responsibility for meeting FCA requirements.
Meanwhile:
Appointed Representative
The business operates under an authorised principal for the activities covered by the appointment.
Therefore, the principal has important responsibility for overseeing the AR.
A Simple Comparison
Think of the difference like this:
Directly Authorised Firm
More direct regulatory responsibility
↓
More control
↓
More compliance responsibility
Meanwhile:
Appointed Representative
Operates under a principal
↓
Principal provides oversight
↓
AR follows the principal’s regulatory framework
Neither model is automatically better.
Instead, they suit different businesses.
The Principal Firm
A principal firm has important responsibilities for its appointed representatives.
Therefore, it cannot simply appoint another business and forget about it.
Instead, the principal needs to oversee the AR.
For example, this can involve:
- checking suitability before appointment
- understanding the AR’s activities
- monitoring compliance
- supervising regulated activities
- reviewing risks
- overseeing customer outcomes
Therefore:
Principal status brings responsibility.
Why Does the Principal Need Control?
Imagine a mortgage network has 50 appointed representative firms.
If those firms could operate however they wanted, the principal would have little control over the risks created under its regulatory umbrella.
Therefore, principals need appropriate oversight.
For example, the network may require advisers to use:
- approved systems
- standard processes
- compliance checks
- approved financial promotions
As a result, appointed representatives may have less freedom than directly authorised firms.
However, they can also receive substantial regulatory support.
Introducer Appointed Representatives
You may also come across the term:
Introducer Appointed Representative
or:
IAR
An IAR has a more limited role than a full appointed representative.
Broadly, its activities are restricted to certain introductions and distributing certain financial promotions.
Therefore:
IAR → Limited activities
Meanwhile:
AR → Can carry out a wider range of permitted activities under the principal
The exact activities always depend on the regulatory arrangement.
What Is an Exempt Person?
The general prohibition allows regulated activities to be carried out by people who are authorised or exempt.
An exempt person can carry out certain regulated activities without obtaining ordinary authorisation where a legal exemption applies.
However, exemptions are specific.
Therefore, a person cannot simply declare:
I don’t need authorisation.
There must be a proper legal basis.
The Financial Services Register
The FCA maintains the Financial Services Register.
This is an important public record.
It can provide information about:
- authorised firms
- regulatory permissions
- appointed representatives
- principal firms
- certain individuals
- regulatory restrictions
Therefore, the Register can help customers and professionals check a firm’s regulatory position.
Why Should Customers Use the Register?
Suppose a customer finds a mortgage broker online.
The website says:
FCA regulated
However, the customer should not automatically rely on that statement.
Instead, they can check the Financial Services Register.
This can help confirm whether the business really has the regulatory status it claims.
Therefore:
Check regulatory claims rather than simply trusting them.
Clone Firms
Checking the Register is especially important because criminals sometimes create clone firms.
A clone firm copies information from a genuine regulated business.
For example, fraudsters may copy:
- the firm’s name
- FCA reference number
- address
- branding
However, they may use their own:
- telephone number
- email address
- website
Therefore, seeing a genuine FCA number does not automatically prove that the person contacting you is genuine.
A Simple Clone Firm Example
Imagine a genuine firm is called:
Example Mortgage Services Ltd
A criminal creates:
Example Mortgage Service UK
They then copy the genuine firm’s FCA reference number.
At first glance, everything may look convincing.
However, the telephone number and website are different.
Therefore, customers should use trusted contact details and check the Register carefully.
Authorisation Does Not Mean FCA Recommendation
Another important distinction is that FCA authorisation does not mean the FCA recommends the firm.
Therefore:
FCA authorised
does not mean:
FCA says this is the best firm
Likewise, the FCA does not normally approve every mortgage product offered by an authorised firm.
Instead, authorisation means the firm operates within the relevant regulatory framework.
Authorisation Is Not Permanent Permission to Ignore the Rules
A firm does not simply receive authorisation and then continue forever without oversight.
Instead, regulation is ongoing.
Therefore, authorised firms may need to:
- submit regulatory information
- maintain adequate resources
- follow FCA rules
- supervise staff
- maintain suitable systems
- manage risks
- cooperate with regulators
As a result:
Authorisation is an ongoing responsibility.
FCA Supervision
After authorisation, the FCA supervises firms.
The exact level and type of supervision can depend on the firm and the risks it creates.
For example, the FCA may consider:
- customer harm
- complaints
- business practices
- financial promotions
- governance
- financial crime risks
- regulatory data
Therefore, supervision helps the FCA identify and respond to problems.
Regulatory Reporting
Firms may need to provide information to the FCA.
This is known as regulatory reporting.
Depending on the firm, reports can cover areas such as:
- business activity
- financial information
- complaints
- regulatory capital
- other required data
Therefore, firms need accurate records.
After all, poor information can lead to poor regulatory reporting.
Firms Must Keep Information Up to Date
A firm’s circumstances can change.
For example, it may:
- change its address
- appoint new senior people
- change its business activities
- add or remove appointed representatives
- apply for different permissions
Therefore, regulatory information may need to be updated.
This helps keep the regulatory system accurate.
Varying Permissions
An authorised firm may want to change the activities it carries out.
For example, it might want to add a new regulated service.
In that case, it may need to apply to vary its permission.
Likewise, a firm may decide to stop carrying out an activity.
Therefore:
Permissions can change as the business changes.
However, the firm should not begin carrying out a new regulated activity simply because it plans to apply for permission later.
Cancelling Authorisation
A firm may eventually decide to stop carrying out regulated activities.
Therefore, it may apply to cancel its permissions or authorisation.
However, stopping new business does not necessarily remove every existing responsibility immediately.
For example, customers or outstanding liabilities may still need to be dealt with properly.
Therefore, leaving the regulated system also needs to be managed carefully.
What Happens If a Firm Breaks the Rules?
The FCA has enforcement powers.
Depending on the circumstances, regulatory action can include:
- investigations
- restrictions
- financial penalties
- public censures
- changes to permissions
- cancellation of authorisation
Therefore, FCA rules have real consequences.
Serious misconduct can threaten a firm’s ability to continue operating.
Restrictions on a Firm
Sometimes, the FCA may restrict what a firm can do.
For example, a firm could be prevented from:
- taking on certain new business
- carrying out a particular regulated activity
- using a particular permission
Therefore, the FCA Register may show important restrictions as well as permissions.
This is another reason why checking only whether a firm is “authorised” may not tell the whole story.
Authorisation and Mortgage Advisers
There is an important distinction between the firm and the individual adviser.
A mortgage adviser may hold CeMAP.
However:
CeMAP does not itself give the individual FCA authorisation to trade independently.
Instead, the adviser needs to operate within the correct regulatory structure.
For example, they might work for:
A directly authorised firm
or:
An appointed representative of an authorised principal
Therefore, qualification and regulatory status are separate.
Qualification Versus Authorisation
This distinction is worth remembering.
CeMAP
Shows that the person has achieved a recognised mortgage-advice qualification.
Meanwhile:
FCA Authorisation and Permissions
Determine the regulatory basis on which the business carries out regulated activities.
Therefore:
Qualification
≠
Authorisation
Both are important.
However, they serve different purposes.
A Practical Example
Imagine David passes CeMAP.
He creates a website the following day saying:
Independent Mortgage Adviser — Now Taking Clients
However, David has not joined an authorised firm, become part of an appointed representative structure or obtained the regulatory status required for the activities he wants to perform.
His CeMAP qualification alone does not solve this problem.
Therefore:
Qualified
does not automatically mean:
Authorised to trade independently
This is one of the most important practical lessons for new mortgage advisers.
Authorisation and Customer Protection
Authorisation helps place firms inside a regulated system.
Therefore, depending on the activity and circumstances, customers may benefit from protections such as:
- FCA conduct requirements
- formal complaint procedures
- access to the Financial Ombudsman Service
- possible FSCS protection where applicable
However, these protections depend on the exact activity and circumstances.
Therefore, firms should not make blanket promises about protection.
Authorisation Does Not Guarantee Perfect Advice
An authorised firm can still make mistakes.
For example:
- an adviser may misunderstand information
- a system may fail
- a complaint may arise
- unsuitable advice may sometimes be given
Therefore, authorisation is not a guarantee that nothing can go wrong.
Instead, it provides:
- standards
- supervision
- accountability
- routes for redress
As a result, customers have stronger protections than they would in an uncontrolled system.
A Simple Regulatory Structure
Let’s put the main ideas together.
Directly Authorised Route
FCA
↓
Authorised Mortgage Firm
↓
Mortgage Adviser
↓
Customer
Meanwhile:
Appointed Representative Route
FCA
↓
Authorised Principal / Network
↓
Appointed Representative
↓
Mortgage Adviser
↓
Customer
Therefore, the regulatory route may differ.
However, regulated mortgage advice still needs to sit within an appropriate regulatory structure.
What Should You Remember for CeMAP?
When you see a question about authorisation, think in this order:
Step 1
Is the activity regulated?
↓
Step 2
What regulatory status does the firm have?
↓
Step 3
Does it have the correct permission?
↓
Step 4
Is it directly authorised or operating under a principal?
↓
Step 5
Is it staying within its regulatory boundaries?
This simple sequence can make many regulatory questions easier.
Key Terms to Remember
Authorisation
Regulatory status allowing a firm to operate within the financial-services regulatory system.
Permission
The regulated activities an authorised firm is allowed to carry out.
General Prohibition
The broad restriction preventing unauthorised or non-exempt persons from carrying on regulated activities.
Directly Authorised Firm
A firm holding its own regulatory authorisation.
Appointed Representative
A person or business carrying out certain regulated activities under the responsibility of an authorised principal.
Principal
The authorised firm responsible for its appointed representative.
Introducer Appointed Representative
An appointed representative with a more limited range of permitted activities.
Threshold Conditions
Minimum conditions relevant firms must satisfy to become and remain authorised.
Financial Services Register
The FCA’s public record of regulated firms, appointed representatives and other regulatory information.
Clone Firm
A fraudulent business pretending to be a genuine regulated firm.
Quick Knowledge Check
1. Can any business carry out regulated financial activities?
No. The correct authorisation, exemption or other permitted regulatory arrangement is required.
2. What is the general prohibition?
Broadly, it prevents a person from carrying on a regulated activity in the UK unless authorised or exempt.
3. Does FCA authorisation allow a firm to carry out every regulated activity?
No. The firm must have the relevant permissions.
4. What is a directly authorised firm?
A firm that holds its own regulatory authorisation.
5. What is an appointed representative?
A person or business carrying out certain regulated activities under the responsibility of an authorised principal.
6. What is a principal?
The authorised firm responsible for overseeing its appointed representatives.
7. What are Threshold Conditions?
Minimum standards relevant firms must meet to become and remain authorised.
8. What is the Financial Services Register used for?
Checking regulatory information about firms, appointed representatives and certain individuals.
9. Does passing CeMAP make someone independently FCA authorised?
No. CeMAP is a qualification, not regulatory authorisation.
10. Does FCA authorisation mean the FCA recommends the firm?
No. Authorisation means the firm operates within the relevant regulatory framework.
Quick Summary
To sum up, firms need the correct regulatory status before carrying out regulated financial activities.
The basic structure is:
Regulated activity
↓
Authorisation or permitted alternative
↓
Correct permissions
↓
Ongoing FCA requirements
Therefore, remember the difference:
Authorisation → Allows the firm into the regulated system.
Permissions → Define what regulated activities it may carry out.
A mortgage business may be:
Directly authorised
or:
An appointed representative of an authorised principal
Meanwhile, the Financial Services Register helps customers and professionals check regulatory information.
Most importantly:
CeMAP qualification and FCA authorisation are not the same thing.
CeMAP relates to the adviser’s qualification.
Meanwhile, authorisation and permissions relate to the regulatory structure through which regulated business is carried out.
Finally, authorisation is not a one-off event.
Firms must continue meeting regulatory standards throughout their operation.
Next Page
Individual Conduct and Accountability