FCA Findings on Early-Stage and High-Growth Firms: Notes for Founders and Investors
Key Points
The Financial Conduct Authority’s (FCA) recent publication of findings from its Early and High Growth Oversight pilot is useful reading for founders of and investors in early-stage FCA-regulated firms, such as asset and wealth managers, payment service providers, lenders, and crypto service providers.
The FCA examined whether the firms’ governance, risk management, and controls kept pace with their growth.
- Supervisory expectations: The publication sets out examples of good and poor practice rather than introducing new rules. It provides insight into the FCA’s approach to supervising growing firms.
- Practical implications: Firms should review governance, staffing, policies, and controls as their activities, customer base, and use of technology evolve.
- Resilience and outcomes: Financial resilience, operational resilience, and consumer outcomes should remain central to growth planning.
- Proportionality: Arrangements should reflect each firm’s size, scale, complexity, and risk profile, with identified gaps addressed promptly.
The FCA’s “High-growth firms: good and poor practice” drew on its engagement with 15 asset management, wealth management, and payments firms between July 2025 and March 2026. The pilot assessed whether the firms’ governance, risk management, and control frameworks were developing sufficiently in line with the growth of the businesses.
The publication is especially relevant for newly established firms, firms experiencing rapid growth, and firms undergoing significant change.
Although the FCA focused on three sectors — asset management, wealth management, and payment services — the FCA notes that the themes may apply more widely. The findings will therefore be relevant for lenders, crypto service providers, and other technology-enabled financial-services businesses.
The founders, boards, senior managers, and those responsible for risk, compliance, and operational oversight, as well as the investors in those businesses, should take note of the findings and take steps to address them.
Governance Keeping Pace?
A central question is whether arrangements established for an earlier stage of a firm’s development remain effective as the business grows.
The FCA’s message is that firms should periodically review their board and committee structures, meeting frequency, and capacity for independent challenge. Meeting records should document attendance, quorums, conflicts, decisions, and follow-up actions.
Reliance on a small number of individuals also warrants attention. Succession planning, cross-training, and knowledge sharing can help reduce dependencies as a business expands.
Translating the Findings Into Practical Action
Beyond governance, firms should consider whether their arrangements continue to reflect the business they operate.
- Policies and risk resources: Changes to target markets or customer populations should prompt a review of suitability frameworks and related controls. Risk resources should reflect growing third-party dependencies and the use of technologies such as AI.
- Capability and compliance: Recruitment, training, financial-crime controls, and transaction monitoring should develop alongside the business. The FCA identified cases in which firms deferred new activities until existing controls were stronger.
- Management information and conflicts: Management information should remain current. Conflicts assessments should cover group relationships, co-manufacturing, shared resources, and combined senior roles with clear escalation and oversight.
- Cyber and operational resilience: Review incident recovery, supplier oversight, cyber testing, data governance, and change controls, particularly when introducing new technology.
- Financial resilience: Monitor liquidity and counterparty risk and consider stress-testing. Wind-down plans should remain current, practical, and proportionate, supported by an understanding of relevant notification obligations, including chapter 15 of the FCA Supervision Manual.
- Consumer outcomes: Monitor suitability and fair value, taking prompt corrective action. Product reviews, benchmarking, and customer feedback can support the FCA Consumer Duty outcomes.
Earlier Supervisory Engagement
The FCA used indicators including revenue, expenditures, staff growth, and firms’ applications for variation in their regulatory permissions, or control to identify firms for the pilot, followed by direct engagement.
It has provided feedback to participants and will use the findings to inform supervision while considering further use of data to identify risks earlier.
For growing firms, the practical implication is that governance and controls should form part of expansion planning. Firms should consider how their arrangements will support the business at its next stage of development.
Proportionality in Approach?
The FCA encourages firms to assess their arrangements against their size, scale, complexity, and risk profile and to address gaps in a timely and proportionate way.
As a practical matter, investment in governance and controls requires funding and management capacity. Smaller firms should therefore incorporate those demands into their growth strategy, including whether the resources needed to support expansion will be available when required.
The findings are reproduced below.
1. Governance and Senior-Management Oversight
| Good Practice | Areas for Improvement |
|---|---|
|
Firms with stronger arrangements ensured governance, risk management, and control frameworks kept pace with business growth. They had clear board and committee structures, with defined roles and responsibilities, regular oversight of risk and compliance matters, and high-quality management information for better decision-making. Decisions, actions, and challenges were properly documented for transparency and accountability. Firms also strengthened their governing bodies as they evolved. Boards had the right mix of skills, knowledge, and experience, with independent or nonexecutive members to challenge them. This was particularly evident in payments firms where boards drew on a mix of payments, fintech, and senior governance experience. |
In some firms, governance arrangements had not kept pace with business growth. Board and committee structures including the scope, frequency, and format of meetings were not always effective. Some firms lacked sufficient independent challenge, with responsibilities concentrated among a small number of individuals. The FCA also saw weaknesses in governance record-keeping, including:
Growing firms may benefit from revisiting governance and oversight arrangements to ensure they remain effective. Firms with strong governance, risk management, and oversight arrangements are often better equipped to manage the challenges associated with rapid growth. This can improve the sustainability of growth and reduce the risk of consumer harm as the firm scales. |
2. Risk Management Frameworks
| Good Practice | Areas for Improvement |
|---|---|
|
Stronger firms had more mature risk management approaches. Some used risk-focused committees to review enterprise-wide risks and escalate issues to the board, supported by clear risk appetites and key risk indicators. Some firms reduced their dependency on single individuals through cross-training and wider knowledge sharing. |
Some firms relied heavily on key individuals, with limited contingency, succession planning, or broader knowledge transfer arrangements. Some failed to sufficiently consider whether their risk management resources remained appropriate for the scale and complexity of the business. This was particularly relevant where third-party relationships were becoming deeper or more numerous or where firms were making greater use of new technologies such as AI. The FCA also observed weaknesses where business models or customer populations had evolved but policies, procedures, and control frameworks had not. For example, some firms’ target market had changed, and they would have benefited from reviewing their suitability frameworks more regularly to keep pace. |
3. Resourcing, Capability, and Scalability
| Good Practice | Areas for Improvement |
|---|---|
|
As their business evolved, stronger firms invested in capability by recruiting and training staff and in scalability through improved technology. They strengthened their compliance functions through the following:
Stronger firms also demonstrated forward-looking regulatory judgement, preparing early for upcoming policy changes and legal requirements. For example, some prepared early for upcoming safeguarding requirements. In some cases, firms showed sound regulatory judgement by delaying expansion into newly regulated activities until their controls for existing business were more robust. Using tools such as the FCA’s Regulatory Initiatives Grid to anticipate future developments could be helpful. |
The FCA identified some weaknesses in firms’ capability and control frameworks where business models or customer populations had evolved but internal policies and procedures had not. For example, some firms would benefit from reviewing suitability frameworks more regularly in light of changes to their target market. Firms should ensure that their resourcing, policies, and oversight arrangements continue to evolve alongside the business so that they remain appropriate and effective. |
4. Systems, Controls, and Management Information
| Good Practice | Areas for Improvement |
|---|---|
|
Stronger firms had proactive cyber- and operational-resilience arrangements. This included using recognised security standards, penetration testing, third-party oversight, and structured governance over the use of emerging technologies such as AI. Stronger examples of conflict management included firms identifying conflicts arising from the following:
Such firms were able to explain how conflicts were escalated, challenged, and monitored through governance forums. Some firms had also improved their controls following cyber incidents, demonstrating they had learned from events and strengthened resilience. Regularly testing and reviewing cyber controls helps firms identify vulnerabilities early and respond to emerging threats. Firms of all sizes should consider how they would respond to and recover from cyber incidents and other operational disruptions, including those affecting their third-party suppliers as well as their own systems. Ensuring staff understand their role in identifying and responding to cyber risks can also help. |
Weaknesses included insufficient conflict of interest arrangements and management information that had not been updated. Outdated management information, including references to superseded documents or meetings, reduced the quality of oversight and undermined firms’ ability to identify conflict issues promptly. Similarly, weak conflict management arrangements can impair firms’ ability to identify, manage, and mitigate potential detriment to customers. Areas for improvement on cyber included strengthening evidence of change control, data governance, cyber testing, third-party oversight, and operational-resilience planning, particularly where firms were introducing new technology, automation, platform changes, or AI. |
5. Financial Resilience
| Good Practice | Areas for Improvement |
|---|---|
|
Stronger firms proactively monitored key financial risks, including liquidity and counterparty exposures. Some firms used stress-testing to check that their cost base was resilient and that they could remain viable during periods of stress while continuing to meet regulatory capital requirements. These arrangements helped firms understand their financial resilience and prepare for adverse scenarios. |
Some firms needed to strengthen their financial-resilience planning. In particular, wind-down plans were not always current, practical, or proportionate to the business. Effective planning can help prevent a firm’s failure. But if the firm does fail, it also helps it wind down in an orderly way and reduces the potential for consumer harm. Firms should supplement their wind-down plans with an understanding of relevant notification obligations, such as chapter 15 of the FCA Supervision Manual. |
6. Consumer and Market Outcomes
| Good Practice | Areas for Improvement |
|---|---|
|
Stronger firms had active oversight of their products and services, including:
Some firms also carried out due diligence on providers and platforms with customer outcomes in mind, including identifying more cost-effective or flexible solutions where appropriate. Others used client feedback and satisfaction reviews to inform their business decisions, including those about growth. These practices helped firms deliver the outcomes expected under the Consumer Duty, such as assessing fair value, maintaining appropriate propositions, and monitoring whether customers were receiving suitable outcomes. |
Some firms needed to put greater emphasis on assessing customer outcomes, including fair value. Without active monitoring, firms may be less able to check if their products and services continue to meet customer needs, represent fair value, or remain appropriate for the intended target market. This increases the risk of causing foreseeable harm to consumers. Firms should have effective processes in place to monitor outcomes and act where they identify problems. |
This informational piece, which may be considered advertising under the ethical rules of certain jurisdictions, is provided on the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin or its lawyers. Prior results do not guarantee similar outcomes.
Contacts
- Andrew Henderson
Andrew Henderson
Partner - James Taylor
James Taylor
Counsel