SUP 12: what a principal needs to keep track of

SUP 12 sets out a principal’s responsibilities for its appointed representatives. It covers appointment, ongoing oversight, reviews, notifications and records. The principal needs to understand what its ARs are doing and whether its oversight arrangements remain adequate.

Keeping the evidence is part of that work. It is harder to explain a decision when the checks, correspondence and approval are spread across a shared inbox and several spreadsheets.

Merrin keeps firm records, checks, issues and review decisions together. Your team can follow what happened during the year without rebuilding the history from emails before each review.

What follows is what SUP 12 asks of you, obligation by obligation, and where firms most often come unstuck.

What SUP 12 actually requires

SUP 12 runs the full length of the relationship, from the decision to appoint through to the day it ends and beyond. It is useful to read it as a lifecycle rather than a checklist.

Before you appoint: due diligence

Before an AR goes live, you have to satisfy yourself that it is solvent, suitable, and has the resources and controls to do the regulated business you are permitting. Under the enhanced regime, that due diligence has to be proportionate to the risk the AR presents, and it has to look at the individuals behind the firm, not just the entity. You also need to consider whether taking on the AR will stretch your own oversight resources too thin. The FCA has been explicit that automated checks alone do not clear this bar. A credit search and a Companies House lookup are inputs to a decision, not the decision itself.

The agreement: required contract terms

You cannot appoint an AR on a handshake. SUP 12.5 sets out terms the written agreement must contain: the scope of business the AR may carry on, your right to give it directions and to take over or terminate the arrangement, the AR's obligation to comply with the rules, and your access to its records. Missing or out-of-date agreements are one of the most common findings when the FCA looks closely, and they are entirely avoidable.

While the relationship runs: oversight and monitoring

This is the heart of SUP 12. You must maintain adequate controls and resources to monitor each AR on an ongoing basis, and you must actually use data to do it. The FCA wants to see that you know what your ARs are doing, using real management information, rather than relying on what they tell you about themselves. That means watching for changes to permissions and directors, tracking complaints and revenue, reviewing public facing material, and acting on what you find.

Every year: self-assessment and the AR review

The enhanced regime added two annual obligations. The first is a self-assessment of your own oversight arrangements, documented and signed off by your governing body, that honestly identifies where your controls are weak and what you are doing about it. The second is an annual review of each AR covering fitness and propriety of its senior management, its financial position, and the adequacy of its controls. Neither is a tick-box exercise. A self-assessment that presents a wall of green, or a review built from the AR's own self-declarations, is precisely what the regulator has warned against.

Telling the regulator: notifications and reporting

You have to keep the FCA informed. New appointments now have to be notified in advance, before they take effect, rather than reported after the fact, which gives the regulator a window to intervene. Material changes have to be notified as they happen. On top of that, principals submit annual data on their ARs, covering the regulated and non-regulated activities they carry on and the revenue they generate. The data return is only as good as the records behind it.

When it ends: termination and what follows

Ending an AR relationship is an obligation in its own right, not an afterthought. You have to notify the FCA, and you have to make sure the former AR stops holding itself out as your representative. The FCA found firms that never checked a former AR's website, leaving it claiming permissions it no longer held. Post termination checks on websites, promotions, and the FS Register are part of doing this properly.

Throughout: records

Underneath all of it sits a record-keeping obligation. You have to keep the evidence of your due diligence, your monitoring, your reviews, and your decisions, and you have to be able to produce it. A clear record helps explain the checks you carried out and the decisions you made.

Where spreadsheets become difficult

Spreadsheets and shared drives can work, but the team still needs to connect the information. A change in firm details, an overdue return and a review decision may sit in three different places.

The difficulty is keeping a clear history: what changed, who looked at it and what happened next. Agree where that record belongs and keep it up to date as work is completed.

How Merrin helps

• Onboarding. Collect firm and Individual information, identify what is missing and prepare it for review.
• Monitoring. Check Companies House, the FCA Register and submitted returns. Record findings as issues for investigation.
• Returns. Schedule collection through the AR Portal and see what is overdue.
• Reviews. Retain the information considered, the approvers’ decisions and the supporting evidence.
• Filings. Prepare the information for Connect and track the submission and outcome.

Your team still assesses the evidence and makes the decisions. You can look through the features or check the roadmap for planned work.