FCA Appointed Representatives: Principal Duties
If your firm has appointed representatives, you are on the hook for what they do. The Financial Services and Markets Act 2000 puts it plainly at section 39(3): "The principal of an appointed representative is responsible, to the same extent as if he had expressly permitted it, for anything done or omitted by the representative in carrying on the business for which he has accepted responsibility."
That is the whole regime in one sentence. An AR is exempt from needing its own authorisation because you have accepted responsibility for it in writing — and the price of that exemption is that the regulator looks to you when something goes wrong. This guide covers what the FCA expects a principal firm to do, the notification clock that catches small firms out, and the one place where the AR regime and SMCR do not meet.
What an appointed representative actually is
Section 39(1) of FSMA sets the mechanism. A person who is party to a contract with an authorised firm — "his principal" — which permits or requires them to carry on prescribed business, and "is someone for whose activities in carrying on the whole or part of that business his principal has accepted responsibility in writing", is "exempt from the general prohibition in relation to any regulated activity comprised in the carrying on of that business for which his principal has accepted responsibility."
The FCA's own summary is shorter: "An appointed representative (AR) carries on regulated activity under the responsibility of an authorised firm, known as 'the principal'. The principal is responsible for making sure the AR is fit and proper and complies with our rules."
Two consequences follow, and they are worth stating explicitly because firms routinely get the second one wrong:
- The AR's permission is your permission. It has no scope of its own. If the AR does something outside the business you accepted responsibility for, that activity is unauthorised.
- Your liability is not capped by what you knew. Section 39(3) makes the principal responsible "to the same extent as if he had expressly permitted it". Not knowing is not a defence.
Where SMCR stops — the thing most principals get wrong
The Senior Managers and Certification Regime does not extend down into your ARs. The FCA's guide for solo-regulated firms states it directly: "The SM&CR won't apply to Appointed Representatives. They will continue to be subject to the Approved Persons Regime."
The guide is equally specific about the customer-facing population: "CF30s at Appointed Representatives will be unaffected by these proposed changes as they remain subject to the APR."
So an adviser at your AR is an approved person under the older regime, approved on a Form A, and is not one of your certification staff or conduct rules staff. The difference from your own people shows up in what the form applies for: the guide describes Form A as "An application for an individual to perform a specified SMF (or, for Appointed Representatives only, controlled function) at the firm(s)" — so for an AR the application is to perform a controlled function, not a specified SMF. Your SMCR population is your own firm's people.
That produces a genuinely two-track firm, and it is the source of most of the confusion:
| Your own staff | Your AR's staff | |
|---|---|---|
| Regime | SM&CR | Approved Persons Regime |
| Approval route | Form A, applying for a specified SMF | Form A, applying for a controlled function (e.g. CF30) |
| Conduct rules | COCON applies | COCON does not apply |
| Annual certification | Yes, for certification functions | No — but you assess AR senior management F&P annually under the AR rules |
This matters for the non-financial misconduct changes. The new rule that took effect on 1 September 2026, COCON 1.1.7FR, extends the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues where it relates to the individual's role. Because COCON does not reach into ARs, that rule bites on your staff, not on your AR's. What does carry across is your obligation to assess the fitness and propriety of AR senior management — an assessment the FCA says "includes competence and capability", and one you would struggle to defend if you knew about serious misconduct and ignored it. Our conduct risk framework guide covers how the firm-level view should take AR activity into account.
What the FCA expects of a principal firm
The regulator publishes the list. As a principal firm, you must:
- Have a written AR agreement setting out what business the AR can do.
- Assess the AR before appointing them to ensure they are "fit and proper, financially stable and suitable to carry out business for your firm".
- Notify the FCA at least 30 days before the appointment takes effect.
- Regularly review the AR's activities, business and senior management.
- Keep the data the FCA holds on your AR up to date and notify changes.
- Take reasonable steps to ensure the AR acts within the scope of its appointment.
- Maintain adequate skills and resources to oversee the AR — including when the AR's business changes or expands.
- Provide complaints and revenue data annually via REP025.
- Be clear on when and how to terminate an AR relationship.
- Ensure the AR continues to meet the necessary standards, such as the Consumer Duty.
- Ensure adequate financial resources, taking AR activity into account.
- Hold compliant professional indemnity insurance covering current and former ARs where the rules require it.
On oversight specifically, the FCA's framing is the most useful sentence on the page: "Oversee ARs to the same standard as your employees." If your monitoring of an AR is lighter than your supervision of an employee doing the same job, that gap is the finding.
The AR calendar: every clock in one place
This is where small principals slip — not on the principle, on the dates.
| Event | Deadline | Route |
|---|---|---|
| Appointing a new AR | Notify at least 30 days before the appointment takes effect | Connect |
| Change to the types of regulated activity an AR conducts | At least 10 calendar days before the change | 'appointed representative or tied agent change details' form, Connect |
| Any other change to AR details | Within 10 business days of the change | Same form |
| Intending to provide regulatory hosting services | Notify at least 60 days in advance | SUP 15 Annex 4 form, Connect |
| Complaints and revenue data for ARs | Annually, within 60 business days of your annual reporting date | REP025, regular reporting mechanism |
| Review of each AR | At least every 12 months | Internal, written record required |
| Annual self-assessment | At least every 12 months, signed off by the governing body | Internal, retained at least 6 years |
Note the split between calendar days and business days in rows two and three — a change of activity gives you 10 calendar days' notice in advance, while other detail changes give you 10 business days afterwards. They are different clocks running in different directions, and a firm that treats them as one rule will miss one of them.
The annual review and the annual self-assessment
These are two documents, not one, and firms often produce only the first.
The AR review covers each AR at least every 12 months and must include the fitness and propriety of the AR's senior management and their competence, the AR's financial position, and the adequacy of your own controls and resources to oversee them. Keep a written record of each review. If significant issues arise, you must escalate them and ensure they are considered by your governing body.
The FCA also names the triggers for an additional review outside the annual cycle. Conduct one when an AR changes its business model, changes the regulated activities it conducts, is appointed by another principal, or receives a significant increase in complaints.
The annual self-assessment is about you, not them. The FCA describes it as "a single document designed to identify risks and gaps in compliance", focused on how you are meeting your responsibilities as principal and identifying "any material deficiencies or concerns". It must be reviewed and signed off by your governing body at least every 12 months, and kept for at least 6 years and made available to the FCA if requested.
The honest version of that document names things that are not working. A self-assessment with no deficiencies in it, year after year, is not evidence of a clean firm — it is evidence that nobody looked.
Introducer appointed representatives
An IAR is a narrower category. The FCA limits them to "undertaking introductions" and "distributing financial promotions", and nothing else. As principal you must ensure your IARs only carry out the activities they are permitted to do.
Some requirements are relaxed — you can provide less information when notifying an IAR appointment — but the oversight duty is not switched off. Two practical points follow. First, an IAR distributing your financial promotions is distributing material you are responsible for, which pulls the financial promotion rules into your oversight scope. Second, "introduction" is a narrower activity than most IARs assume; an IAR that starts giving views on suitability has stepped outside its permitted scope, and the exposure is yours.
Practical checklist for a small principal
- Confirm every AR agreement is current and matches what the AR actually does. Agreements drift; businesses change and the paperwork does not follow.
- Put the seven clocks above into a calendar rather than relying on someone remembering. The 30-day pre-appointment notice is the one that most often gets discovered late.
- Diarise each AR review and the self-assessment with the governing-body sign-off built in, not bolted on afterwards.
- Keep the AR review record in a form you could hand over. "We discussed it" is not a written record.
- Check your PII actually covers former ARs, not just current ones.
- Keep your two populations separate in your own records — SMCR staff on one side, AR approved persons on the other. A single undifferentiated staff list is how firms end up applying the wrong regime to the wrong person. Our COCON Conduct Rules Self-Assessment helps confirm the classification of your own staff, and our SMCR plain-English guide covers the three tiers that apply inside your firm.
- Read your Consumer Duty obligations as covering AR-delivered outcomes where you have material influence over them — see our Consumer Duty guide.
Summary
- FSMA section 39(3) makes the principal responsible for anything the AR does or omits in the business you accepted responsibility for, "to the same extent as if he had expressly permitted it".
- SM&CR does not apply to ARs — their people remain under the Approved Persons Regime, approved on a Form A to perform a controlled function rather than a specified SMF, and are not your conduct rules or certification staff.
- The new non-financial misconduct conduct rule that took effect on 1 September 2026 therefore applies to your own SMCR population, not to AR staff — but your F&P assessment of AR senior management still has to be a real assessment.
- Notification clocks: 30 days before an appointment, 10 calendar days before an activity change, 10 business days after other detail changes, 60 days before offering regulatory hosting, 60 business days for REP025 data.
- Review each AR at least every 12 months in writing; prepare an annual self-assessment, sign it off at governing-body level, and keep it at least 6 years.
- The standard to hold yourself to is the FCA's own: oversee ARs to the same standard as your employees.
Last reviewed: 15 September 2026. This guide explains the FCA's appointed representative regime for small principal firms. It is general information, not regulatory or legal advice, and it does not describe a ConductLog product feature — ConductLog is validating demand for a tool that helps small FCA-regulated firms handle conduct and misconduct processes. For your firm's specific obligations, check the FCA Handbook and the FCA's principals pages, and consider professional advice.