UK FCA reminds firms not to let growth get ahead of good governance

The Financial Conduct Authority has reviewed how governance, risk management and control frameworks are developing at a group of rapidly growing firms. Its feedback flags how sometimes business models evolve but policies, procedures and control frameworks do not. The FCA tells start-ups and other firms to assess whether their arrangements remain appropriate for their size, scale and complexity.

The FCA reviewed 15 asset management, wealth management and payments firms as part of a high-growth pilot. It assessed whether their governance, risk management and control frameworks were keeping pace with business growth.

The FCA’s examples of good practice include:

• Boards of payments firms bringing together a mix of payments, fintech and senior governance experience

• Risk committees being supported by clear risk appetites and key risk indicators

• Firms delaying expansion into new regulated activities until controls for existing business were more robust

• Testing resilience of cost base for periods of stress

Areas flagged for improvement include:

• Governance: Insufficient independent challenge, incomplete minutes and poorly documented actions

• Risk management: Over-reliance on key individuals, and risk frameworks not keeping pace with deeper third-party relationships or greater use of new technologies such as AI

• Capability and scalability: Failure to review suitability frameworks following changes to their target market

• Systems and controls: Weak conflict management arrangements, outdated management information and limited evidence of operational resilience planning, including cyber

• Financial resilience: Out-of-date wind-down plans

• Consumer outcomes: More active monitoring of customer outcomes under the Consumer Duty, including fair value

The FCA promises to use insights from this work to inform its supervisory approach, especially with start-ups and those experiencing rapid growth or change. The FCA is also considering how it can use data to identify emerging risks sooner, enabling more targeted supervisory interventions.

Although the examples are drawn from a sample of firms, the themes are relevant to firms of different sizes, business models and sectors. Firms should assess the FCA’s findings against their own business and controls and address any gaps.