SUP 12, Covered End to End
When we started building Merrin we set ourselves a deliberately narrow first goal: cover a principal's obligations under SUP 12 in full before doing anything else. Not most of them, and not the interesting ones. All of them, from the first conversation with a prospective appointed representative through to the day the appointment ends.
As of August 2026, that is done. This post sets out what is now live, why we sequenced it this way, and what we are building next.
Why SUP 12 first
The obligations in SUP 12 are the ones that decide whether you keep your principal permission. They are also the ones that are hardest to evidence after the fact, because most of the work is spread across a year of small decisions: a director change you noticed, a financial return you chased, a fit and proper check that came back clean.
The FCA's 2024 review of principal firms made the point plainly. Fewer than half of the annual reviews it looked at were of good quality, and the common failure was not laziness. It was that firms had nowhere to put the evidence as it arrived, so the annual review became a scramble to reconstruct a year from email. We wrote about that review here.
Fixing that means covering the whole lifecycle rather than a slice of it. A review is only as good as the twelve months of monitoring behind it, and monitoring is only useful if the onboarding record it compares against is trustworthy. Half a lifecycle is not half as useful. It is a different and considerably worse product.
What is live now
Nine areas. Each one used to be a spreadsheet, a shared inbox, or a line on a consultant's invoice.
Initial screening
Screen a firm before you commit to it. Companies House, the FS Register and the firm's own numbers, pulled together in minutes so you can decline early rather than three weeks into a document chase.
Onboarding and appointment
A structured onboarding process with your own internal approval gates, SMF sign-off recorded at the moment of decision, and AR agreements issued and executed inside the platform. The record of who approved what, and on what basis, is a by-product of doing the work rather than something you write up afterwards.
Fit and proper
Fit and proper assessments run themselves. Individuals complete them in their own private portal, and the sensitive identity data they submit is held separately from the rest of the AR record, visible only to the people who need it.
Annual reviews and attestations
This is the one that changes how the year feels. Reviews and attestations run end to end without your team chasing anyone. ARs are prompted, reminded and escalated automatically, and the evidence has been accruing since the last review. By the time a review lands on a compliance officer's desk, it is a decision to make rather than a file to build.
Live risk analysis
Signals from Companies House, the FS Register and other public sources raise an alert the day something moves. A director resigns, accounts go overdue, a charge is registered, permissions change. You hear about it that week, not at the next annual review.
FCA filing tracking
Every Connect submission and regulatory notification tracked from draft through to acceptance, with the deadline visible well before it becomes a late notification.
Compliance scoring
Two questions every head of compliance is asked and few can answer quickly: how compliant are we, and which firms need work. Merrin gives each AR a live score and rolls those up into a network view, so the answer is a page rather than a project.
Termination and offboarding
A structured wind-down that runs the same way every time, with the post-termination checks on websites, promotions and the FS Register recorded as they are completed. This is the stage firms most often skip, and the one the FCA most often asks about.
Records and evidence
Every document, decision and check in one place with expiry tracking, exportable as an evidence pack for any period you choose. If a supervisor asks what you knew in March, the answer takes a minute.
What we are building next
SUP 12 is the floor, not the ceiling. Principals carry plenty of obligations that sit outside it, and those are what the next three releases cover.
October 2026, complaints. Complaints logged, triaged and tracked against DISP timescales, with live SLA timers and FOS referrals followed through. Alongside it, a link to Freshdesk and the other helpdesks your ARs already run on, so complaints reach Merrin without anyone rekeying them. Volumes and outcomes then feed each AR's compliance score, which is where complaints data earns its keep.
December 2026, promotions and financials. Promotions collected from across the network, reviewed against COBS 4, and archived with every approval and withdrawal. Structured promotion data captured on a schedule so the figures behind your regulatory returns are already assembled. And financials, meaning management accounts, capital adequacy and solvency captured on a cycle you set, with trends visible across the network rather than filed and forgotten.
Early 2027, personal account dealing. Dealing registers, pre-approvals and breach records for the individuals inside your ARs, aligned to COBS 11.7 and 11.7A, with conflicts of interest, inducements and gifts and hospitality kept in the same place. Conduct at the level of the individual becomes one view rather than four.
The full detail, and the rest of what is queued, is on the roadmap.
A note on dates
We publish dates because a roadmap without them is marketing. We also expect to be wrong about one or two. The commitment is the scope of each release, not the week it lands. If a date moves it moves on the roadmap page, in public, where you can see it.
If you are still on spreadsheets
The gap between a well-run spreadsheet and a system of record is not effort. Plenty of compliance teams work far harder than they should to keep a spreadsheet honest. The gap is that a spreadsheet cannot watch Companies House overnight, cannot chase an AR that has gone quiet, and cannot tell you next year what it knew last March.
If you want to see the whole lifecycle in one place, we run a twenty-minute walkthrough with no slides in it. Bring the AR you would least like a supervisor to open first, and we will work through that one.