Cookies on this site

We use a few cookies to keep this site working and secure. We would also like to use analytics cookies, which count visits and show us which pages are read; they are only set if you accept them. The Calendly booking calendar on the Contact page sets its own cookies: it shows there if you accept it here, or opens when you choose “See available times”. You can change your choice at any time using the cookie settings link at the bottom of every page.

Read our cookie notice
Manage cookies
Skip to content
Contact

What should a buyer check in an FCA-authorised firm’s governance?

James Walker

Last reviewed 1 October 2026

James is a board chair, non-executive director and Chartered Internal Auditor who has held senior internal audit roles at Credit Suisse and UBS.

The short answer

A buyer should check the governance of a firm authorised by the Financial Conduct Authority (FCA) for how long its audit and compliance findings stay open, whether decisions follow the responsibilities on paper and what reaches the board. Before approving the change in control, the FCA assesses whether the firm will be able to meet its governance and control requirements then and afterwards. What the buyer finds can go into the price, a specific indemnity, a condition before completion or the 100-day plan.

How long do findings the firm raised itself stay open?

A buyer should test how long the findings from internal audit and compliance at the firm stayed open, as well as how many were raised. Internal audit reports and compliance monitoring findings are the record the firm kept of what it already knew about itself, so a finding left open past its agreed date shows a known weakness left unfixed.

Where a deadline has moved several times, or a finding was closed by the person who owned it without anyone confirming the fix, the buyer should treat it as open until internal audit or compliance has re-tested it.

Correspondence with the regulator adds what the supervisor has already asked about. Where the regulator has raised a matter the firm never mentions in its own findings, its assurance missed something the supervisor saw, and the buyer should ask why.

Does the governance on paper match the governance in use?

Tracing a handful of significant decisions from the last year against the statements of responsibilities and delegated authorities of the firm shows whether the governance on paper is the governance in use. Where the two differ, the buyer should ask who actually took the decision and on what authority.

Under the Senior Managers and Certification Regime, each approved senior manager has a statement of responsibilities setting out which of the affairs of the firm they are responsible for managing. Among firms authorised by the FCA alone, the larger ones that the regime classes as enhanced must also keep a management responsibilities map describing their management and governance arrangements, while smaller core firms need the statements but not the map. Since 24 April 2026 firms have had up to six months to tell the regulators about changes, so the version to read is the current one the firm holds.

The same tracing shows where controls depend on individuals, such as the one person who can explain the reconciliation, or the director who approves everything because nothing has been delegated. Where those people are leaving at completion, the buyer should find out who will hold their responsibilities, since FCA rules expect well defined lines of responsibility.

What does the board actually see?

The board sees what management chooses to report, so a year of board and committee packs, read with the minutes that follow them, shows a buyer whether that was enough to govern the firm.

Management information should arrive early enough for directors to act on it, and should report against the risks the firm names as principal. Where papers arrive the day before the meeting, or describe activity without saying what it means for those risks, the buyer should ask how directors were expected to decide from them.

The minutes should record the questions directors asked, the answers they received and what was followed up at the next meeting. Where minutes record presentations but no decisions, the buyer should find out where the decisions were actually taken.

The risk register should change as the risks facing the firm change. Where it reads the same as it did a year ago, with the same ratings and the same owners, the buyer should ask what the board used instead to follow the risks of the firm.

Which FCA rule sets the baseline for governance?

For most firms the FCA authorises, the baseline is rule 4.1.1R in the Senior Management Arrangements, Systems and Controls sourcebook of the FCA Handbook. The rule requires “robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms”. A buyer should test each clause against how the firm actually runs, starting with the lines of responsibility, which the statements of responsibilities should already describe.

Payment and e-money firms are a different case: they come under their own regulations, which set similar governance conditions but not the Senior Managers and Certification Regime, and a buyer should also test how they safeguard the money they hold for customers, under rules the FCA strengthened from 7 May 2026.

Why does the regulator care how the target is governed?

Approval of the change in control by the FCA depends partly on whether the firm will be able to meet its governance and control requirements after the deal. Its guidance on assessing acquisitions, FG24/5, says it assesses whether the firm can comply at the time of the acquisition and continue to comply afterwards, including with requirements on governance arrangements, regulatory reporting, internal control, risk management and compliance. The rest of the assessment concerns the buyer, its group, the people who will direct the firm and any money laundering risk, and going ahead without approval is a criminal offence, the FCA says.

What the buyer sets out in its business plan matters as well. FG24/5 says the FCA may take account of the intentions the buyer has declared, as reflected in that plan and backed by commitments that can cover corporate governance, and that the plan should set out the future activities and organisation of the firm, including the proposed group structure.

Where the buyer will take control of 50 per cent or more, or the firm will become its subsidiary, part of the assessment may continue for the foreseeable future, which the guidance puts at three to five years, and the plan should cover at least that period. The buyer writes the plan before completion, so its governance commitments should be drafted with the post-completion board in mind.

Apart from the approval of the regulator, every test here works on an unregulated target too, where the delegated authorities and board packs take the place of the statements of responsibilities.

Sources

Each source opens in a new tab.

Organisers can also invite James to speak on this subject.

Insights

Worth reading next

The reading below stays close to this subject, often seen from the side of someone else round the table, such as the chair, an investor or the head of internal audit. It shows the wider subject from their perspective, and the questions each of them is likely to ask.

Briefing

James Walker

Which governance and controls come first in a 100-day plan?

Once a business changes hands, the first thing to put in writing is who may decide what, before old habits set the pattern.

Read the briefing
More insights

Explore your own question further

For a buyer of an FCA-authorised firm, James can run these checks on the target before the investment decision. In a particular organisation, the detail can change the answer to a question like this one. James is happy to hear from anyone weighing it up for their own board, audit function or deal. This briefing is general information on the rules as they stood when it was last reviewed, and is not advice on any particular situation.

ContactEmail JamesHow James works