This section covers the basic day-to-day arrangements you need in place to run your business safely, manage risks and treat your customers fairly.
This doesn’t mean you have to have a large compliance department – you can meet these requirements by having one named person responsible for oversight, clear written policies that outline how your business operates, and routine checks to make sure risks are identified and managed.
- You must be clear who is responsible for running your business – making decisions, managing risks and dealing with issues as they arise. This can be as simple as having one named person with their responsibilities written down clearly in a short document or role description.
- Anyone working in or for your business must have the skills and knowledge needed for their role. For example, this could include making sure that people understand their responsibilities and provide training and guidance for them that reflects the tasks they carry out.
- You must have simple compliance and financial crime controls to help your firm meet its regulatory obligations. In practice, this could include developing short plain-language policies and implementing routine checks to confirm controls are working and issues are addressed.
- You should understand the main risks in your business and take steps to keep them under control. For example, some of the risks that you identify could be the mis-selling of products or inadequate oversight of ARs.
- If you rely on another firm to carry out critical or important parts of your business, you should make sure that this doesn’t weaken your controls or increase any risks you’re taking on. You remain fully responsible for meeting regulatory requirements and should understand what the third party does and how it’s overseen.
- To demonstrate how you’ve complied with all our rules, you must keep records to show how your business is run and how decisions are made. You should make sure your records are easy to find and keep important information secure.
- You must take steps to identify and address situations where your interests, or the interests of one customer, could conflict with those of another. Where these situations are identified, you must seek to prevent or manage them and keep a record of services where conflicts arise. You must also have a conflict of interest policy and review it regularly.
