Managing SUP 12: A Principal's Obligations, and How Merrin Helps

If you are a principal firm, SUP 12 is the chapter of the FCA Handbook you live inside. It governs every appointed representative you take on, every check you run, every review you sign off, and the day you part ways. Since the enhanced regime took effect on 8 December 2022, the bar has moved. Principals are now expected to oversee their ARs as closely as their own business, because in the eyes of the regulator, the conduct of an AR is the principal's responsibility.

For most principals, the problem is not intent. It is evidence. SUP 12 does not simply ask you to oversee your ARs. It asks you to prove that you did, on demand, for any AR, across any period. That is hard to do when your oversight lives in a folder of spreadsheets and a shared inbox.

Merrin was built for exactly this. It turns the obligations in SUP 12 into a single system of record, so the evidence is a by-product of doing the work rather than something reconstructed in a hurry the week before a supervisory visit. Every SUP 12 obligation is covered today, and the wider compliance estate follows over the coming months.

What follows is what SUP 12 asks of you, obligation by obligation, and where firms most often come unstuck.

What SUP 12 actually requires

SUP 12 runs the full length of the relationship, from the decision to appoint through to the day it ends and beyond. It is useful to read it as a lifecycle rather than a checklist.

Before you appoint: due diligence

Before an AR goes live, you have to satisfy yourself that it is solvent, suitable, and has the resources and controls to do the regulated business you are permitting. Under the enhanced regime, that due diligence has to be proportionate to the risk the AR presents, and it has to look at the individuals behind the firm, not just the entity. You also need to consider whether taking on the AR will stretch your own oversight resources too thin. The FCA has been explicit that automated checks alone do not clear this bar. A credit search and a Companies House lookup are inputs to a decision, not the decision itself.

The agreement: required contract terms

You cannot appoint an AR on a handshake. SUP 12.5 sets out terms the written agreement must contain: the scope of business the AR may carry on, your right to give it directions and to take over or terminate the arrangement, the AR's obligation to comply with the rules, and your access to its records. Missing or out-of-date agreements are one of the most common findings when the FCA looks closely, and they are entirely avoidable.

While the relationship runs: oversight and monitoring

This is the heart of SUP 12. You must maintain adequate controls and resources to monitor each AR on an ongoing basis, and you must actually use data to do it. The FCA wants to see that you know what your ARs are doing, using real management information, rather than relying on what they tell you about themselves. That means watching for changes to permissions and directors, tracking complaints and revenue, reviewing public facing material, and acting on what you find.

Every year: self-assessment and the AR review

The enhanced regime added two annual obligations. The first is a self-assessment of your own oversight arrangements, documented and signed off by your governing body, that honestly identifies where your controls are weak and what you are doing about it. The second is an annual review of each AR covering fitness and propriety of its senior management, its financial position, and the adequacy of its controls. Neither is a tick-box exercise. A self-assessment that presents a wall of green, or a review built from the AR's own self-declarations, is precisely what the regulator has warned against.

Telling the regulator: notifications and reporting

You have to keep the FCA informed. New appointments now have to be notified in advance, before they take effect, rather than reported after the fact, which gives the regulator a window to intervene. Material changes have to be notified as they happen. On top of that, principals submit annual data on their ARs, covering the regulated and non-regulated activities they carry on and the revenue they generate. The data return is only as good as the records behind it.

When it ends: termination and what follows

Ending an AR relationship is an obligation in its own right, not an afterthought. You have to notify the FCA, and you have to make sure the former AR stops holding itself out as your representative. The FCA found firms that never checked a former AR's website, leaving it claiming permissions it no longer held. Post termination checks on websites, promotions, and the FS Register are part of doing this properly.

Throughout: records

Underneath all of it sits a record-keeping obligation. You have to keep the evidence of your due diligence, your monitoring, your reviews, and your decisions, and you have to be able to produce it. This is the obligation that quietly determines whether you pass a supervisory visit, because it is the one that proves you met all the others.

Why spreadsheets fall short

None of this is impossible to do by hand. Plenty of principals have managed it for years on spreadsheets, shared drives, and calendar reminders. The trouble is that the enhanced regime did only add tasks. It raised the standard of evidence.

When the FCA reviewed how principals were coping in 2024, it found that many were falling short, and not because they had done nothing. Firms had completed reviews and self-assessments that, on inspection, did not meet the quality bar. Fewer than half of the annual reviews the regulator examined were considered good quality. We wrote about that review in detail in our breakdown of the FCA's 2024 findings.

The pattern is consistent. Spreadsheets capture a snapshot, not a history. They do not tell you when an AR's permissions changed, they do not chase an overdue attestation, and they do not connect a year's monitoring to the review you sign off at year end. So the work gets done in a rush, from a blank sheet, with the evidence assembled afterwards. That is the exact failure mode the FCA keeps describing.

How Merrin maps to SUP 12

Merrin is organised around the obligations above, so that each one has a home and produces its own evidence.

• Due diligence and appointment. A structured onboarding workflow gathers the checks, accounts, and linked-individual data you need, and requires a human to make and record the decision. Automated data gathering, human judgement.
• Agreements. Every AR agreement is held against the AR it covers, with version history and expiry tracking, so an out-of-date contract surfaces before the regulator finds it.
• Ongoing oversight. Continuous FCA Register and Companies House monitoring flags changes to permissions, directors, and filings as they happen, alongside the management information you need to see what each AR is actually doing.
• Annual review and self-assessment. Each review is pre-populated from a year of captured monitoring, so you sign off on evidence already in hand rather than starting from nothing. The self-assessment is generated as a board-ready document with a real gap analysis.
• Notifications and records. Every check, decision, and document is logged, dated, and exportable as an evidence pack for any AR and any period, ready for a notification or a supervisory request.
• Termination. A structured offboarding workflow with mandatory post termination checks on websites, promotions, and the FS Register, and an audit trail of the decision.

The principle underneath the product is the one the FCA keeps signalling: evidence, not intent. If you can show the data behind a decision, you can show you made it carefully.

What is launching, and when

The SUP 12 oversight modules are the heart of Merrin and are live for principal firms today: screening, appointment and due diligence, approved persons and fitness and propriety, ongoing oversight and monitoring, the annual review and self-assessment cycle, termination and offboarding, and the records and evidence layer that ties the lot together.

From there Merrin extends into the wider compliance estate. Complaints handling, DISP timescales and helpdesk integrations arrive in October 2026. Financial promotions, promotion data and network financials follow in December. Personal account dealing and the rest of the individual conduct record land in early 2027. The full picture, with dates, is on our roadmap.

We build in the open, and Large Network customers have a say in what ships next. If there is an obligation that keeps you awake, we would genuinely like to hear which one.