Annual self-assessment

Once a year the principal's governing body must review and approve a written self-assessment setting out how the firm complies with SUP 12, naming any material deficiencies and agreeing what will be done about them. It is a single document covering all the firm's AR relationships, IARs included (SUP 12.6A.6R).

The rule

Reviewed and approved by the governing body at least every 12 months, recording how the firm complies and identifying material deficiencies and the steps to address them (SUP 12.6A.6R(1)).
It must include concerns arising from the latest annual and triggered reviews of each AR (SUP 12.6A.6R(2)).
It should cover the effectiveness of oversight, the adequacy of controls and resources, the risk of harm and the methods used to verify compliance (SUP 12.6A.7G).
Each approved version is kept for at least six years (SUP 12.6A.8R). Escalation does not wait for the annual sign-off (SUP 12.6A.10G).

What the FCA found

In its September 2024 review the FCA found that 83% of the principals it assessed in depth had completed a self-assessment, but only 52% were of good quality.
Weak examples were tick-box templates missing required points, with no list of deficiencies, no action plan and no evidence of governing body sign-off.

Common misconceptions

“It is a document per AR.”: It is one firm-level document. The per-AR work is the annual review.
“Compliance can sign it off.”: It must be approved by the governing body.

In Merrin

In Merrin the self-assessment is a review with the organisation as its subject, built from the year's AR reviews and issues and signed off by the board.

Reviews & approvals

Sources

Checked against these sources on 23 October 2026. This is general information, not legal advice.

See what your team could stop doing by hand

Walk through onboarding, monitoring and reviews with your own oversight process in mind.

Schedule a demo