Firms regulated by the Financial Conduct Authority have a clear obligation: know who you are doing business with, and keep knowing. Whether it is an appointed representative, a key outsourcing partner or a firm in your distribution chain, the FCA expects you to carry out meaningful and ongoing due diligence on the third parties your business depends on.
Yet for many compliance teams, third-party monitoring remains one of the most resource-intensive and error-prone areas of their work. This guide sets out a practical framework for monitoring FCA permissions across your third-party relationships, and explains how tooling can turn what has traditionally been a manual, periodic exercise into a routine, dependable one.
Why third-party monitoring matters
The FCA's expectations of third-party oversight have sharpened in recent years, not least through its rules on operational resilience. Principle 3 (management and control) requires a firm to take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems – and that includes the risks introduced by the firms it relies on. SYSC 8 sets specific requirements for outsourcing, and a firm with appointed representatives carries the responsibilities of a principal set out in SUP 12. The Senior Managers and Certification Regime adds personal accountability: a senior manager's statement of responsibilities can include oversight of outsourced or delegated activities.
The consequences of getting this wrong are significant. If a firm in your distribution chain loses its authorisation, or has its permission varied, you could find yourself facilitating regulated activity through an entity that is no longer permitted to carry it out. The reputational and regulatory consequences can be severe, regardless of whether the failure originated with your firm or a third party.
Who needs monitoring?
Not every supplier relationship requires FCA-specific due diligence, but the following categories almost certainly do:
- Appointed representatives and introducer appointed representatives – as principal, you have accepted regulatory responsibility for them
- Firms in your distribution chain – including those who distribute your products or refer clients to you
- Outsourced service providers carrying out regulated activities on your behalf
- Key suppliers whose failure could affect your ability to meet regulatory obligations
- Joint venture partners and firms with whom you share clients or data
Current approaches and their limitations
Most compliance teams currently monitor third-party FCA permissions through a combination of manual processes:
Manual register checks
The FCA Register is publicly available, and checking a firm's status is straightforward enough for a one-off exercise. However, when you are responsible for monitoring dozens or hundreds of third-party relationships, manual register lookups become impractical. Each check requires navigating to the register, searching for the firm, reviewing its current permissions, requirements and disciplinary history, and comparing them against what you last recorded. Multiply this by 50 firms on a quarterly basis and you have a significant administrative burden.
Spreadsheet tracking
Many teams maintain spreadsheets listing their monitored firms alongside key details such as FRN, authorisation status and last-checked date. Spreadsheets are better than nothing, but they introduce several risks: data quickly becomes stale, version control is difficult to maintain, and there is no mechanism to alert you when something changes between review dates.
Periodic reviews
Quarterly or annual reviews are the most common approach. However, the FCA Register can change at any time. A firm's permission might be varied, a requirement imposed, or an enforcement action published between your scheduled review dates. Periodic reviews create blind spots that increase your exposure to regulatory risk.
What to monitor
Effective third-party due diligence requires monitoring several dimensions of a firm's regulatory standing. Understanding what to look for is just as important as how often you look.
Authorisation status
The most fundamental check: is the firm still authorised by the FCA? Authorisation can be cancelled or suspended, or the firm can apply to give it up. Any change in authorisation status should trigger an immediate review of your relationship with that firm.
Permissions
A firm authorised under Part 4A of FSMA holds a permission setting out the regulated activities it may carry on; payment and e-money firms are authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 instead. The FCA can vary a permission, or the firm can apply to change it. You need to know whether a firm has permission for the activities relevant to your relationship, not only whether it is authorised. For example, a firm that loses its permission to arrange deals in investments can no longer lawfully carry on that activity, even if it remains authorised for other purposes.
Firmwatcher's permissions monitoring alerts you to new requirements on a firm and to variations or cancellations of its permission that the FCA records as disciplinary action. It does not compare a firm's full list of permitted activities, so review that on the register when you onboard a firm and at each periodic review.
Requirements and enforcement action
The FCA records requirements and disciplinary action against regulated firms on the register, and announces fines, bans and censures on its website. Watching for these helps you identify emerging risks before they become direct problems for your business. The FCA also publishes warnings about unauthorised firms on its Warning List, which is worth checking before you onboard anyone.
With regulatory alerts, your team is told the morning after a new requirement or disciplinary entry appears on the register for a firm on your watchlist, and within the hour when the FCA announces a fine, ban or censure against it.
Appointed representative status
An appointed representative is not authorised. It is an exempt person for the regulated activities its principal has accepted responsibility for, under section 39 of FSMA. If you work with a firm that is an appointed representative, its regulatory standing depends on that appointment: if the principal ends it, the firm loses its exemption and can no longer carry on those activities. Check the register for the firm's principal and for when the appointment started or ended.
Disciplinary history
Past enforcement actions, fines and requirements imposed by the FCA can provide early warning signals about a firm's compliance culture and future risk profile.
Building a monitoring process
Having established what to monitor, the next step is building a process that is proportionate, auditable and sustainable.
Set a monitoring frequency
The appropriate frequency depends on the nature and risk profile of each relationship:
- Appointed representatives: frequent monitoring – daily where you can – given your direct regulatory responsibility
- Key distribution partners: at least monthly, with alerts for material developments in between
- Other regulated third parties: quarterly reviews may be enough for lower-risk relationships, provided you have alerting in place for critical changes
The FCA does not prescribe specific frequencies, but your approach should be proportionate to the risk each third party presents.
Assign clear responsibility
Every monitored relationship should have a named owner. Under SM&CR there is no single function that automatically owns third-party oversight: firms allocate it through senior managers' statements of responsibilities and, for enhanced firms, the management responsibilities map. The compliance oversight function (SMF16) and the money laundering reporting officer (SMF17) have their own defined remits and are not responsible for third-party oversight by default. Document who is responsible, and make sure cover arrangements are in place for absences.
Define escalation procedures
Not every change requires the same response. Establish a tiered escalation framework:
- Critical: loss of authorisation, suspension, or removal of a relevant permission – requires immediate escalation to senior management and potential suspension of the commercial relationship
- Significant: new enforcement action, a new requirement, or a material change in permission – requires review within 24 to 48 hours
- Routine: minor permission variations, change of name or address – review at the next scheduled assessment
Document everything
The FCA expects firms to be able to demonstrate their oversight activities. Keep a clear record of the checks you perform, the changes you identify, the decisions you take and the reasons for them. Firmwatcher's audit trail records each acknowledgement with who made it, when and why. Good record-keeping is a regulatory expectation, and it also protects your firm and your senior managers if questions are raised later.
Tools and automation
The limitations of manual monitoring have driven a shift towards automated tools. For compliance teams managing more than a handful of third-party relationships, automation removes much of the routine work.
Daily or periodic monitoring
The biggest advantage of automated monitoring is frequency. Rather than checking the register on a quarterly schedule, an FRN monitoring tool checks your firms every day – Firmwatcher every morning, plus FCA announcements within the hour – and alerts you when something new appears.
Moving from quarterly to daily checks shrinks the blind spots that periodic reviews create. It also reduces the overall administrative burden, because your team spends less time performing routine checks and more time responding to developments that need attention.
What automation provides
Monitoring tools offer several capabilities that are difficult to replicate manually:
- Prompt detection – notification the morning after a new requirement or disciplinary entry appears on the register
- Centralised monitoring – all your monitored firms and their current status in a single dashboard, replacing fragmented spreadsheets
- Automatic record-keeping – alerts and acknowledgements recorded automatically, giving you an audit trail without manual upkeep
- Structured alerting – each person chooses which kinds of alert they receive and how often
- History – a firm's requirements and disciplinary history in one place, including entries that were on record before you started monitoring it
Reducing operational risk
Manual processes are inherently vulnerable to human error: a firm might be missed in a review cycle, a change might be overlooked, or a spreadsheet might not be updated. Automated monitoring removes those failure points by checking every firm on your list, every day, in the same way.
Getting started
If your current third-party monitoring relies on manual register checks and spreadsheet tracking, moving to an automated approach does not need to be complex. Start by identifying your highest-risk third-party relationships and the permissions that matter for each.
Firmwatcher is built for compliance teams that need to monitor FCA-regulated firms reliably. Search the register and add firms by name or FRN – or send us your list and we'll load it for you. Each firm's existing requirements and disciplinary history appear as soon as you add it, and daily checks start from there.
Start a 14-day trial and see how daily FCA monitoring can strengthen your third-party due diligence.