The eight-file maintenance model
- Licence and activity file. Maintain the current licence, categories, conditions, approved key individuals, business and product map, change requests and regulator correspondence. Compare it with services promoted on the website and in proposals.
- Representative and supervision file. Keep the representative register, appointment evidence, mandates, supervision plans, competency milestones, removals and debarment-related records where relevant.
- Fit and proper file. Separate evidence for honesty and integrity, experience, qualifications, regulatory examinations, class of business training, product-specific training, CPD, operational ability and financial soundness as applicable to the role.
- Customer-outcomes and complaints file. Record disclosures, advice or intermediary-service controls, complaints themes, turnaround, root causes, remediation and the management information used to improve outcomes.
- Regulatory calendar and submission file. Track recurring returns, financial statements, compliance reports, levies, notifications and event-driven submissions. Retain receipts, approvals and correspondence—not only the final document.
- FICA file, where applicable. Keep registration details, the institutional risk assessment, RMCP, due-diligence controls, sanctions screening, monitoring, reporting, records and training aligned with the institution's actual risk.
- Public claims and data file. Review website, social-media, lead forms, email campaigns, FSP references, product language, privacy notices, cookie behavior and data-subject routes whenever products, channels or suppliers change.
- Governance and assurance file. Give the governing body a short dashboard of overdue actions, exceptions, complaints trends, competence gaps, regulatory change and proof that material issues were closed.
What makes the evidence defensible?
OwnerWho is accountable for the control?
FrequencyWhen is it performed and reviewed?
EvidenceWhat proves that it actually happened?
ExceptionHow are failures escalated and closed?
A policy without operating evidence is weak. A calendar entry without a submission receipt is incomplete. A certificate without a role-based competence assessment may not explain why the learning was suitable. Good licence maintenance connects the rule, the control, the owner, the evidence and the exception path.
Suggested review rhythm
| Frequency | Minimum review |
|---|---|
| Monthly | Changes in people, products, complaints, submissions, public claims and open regulatory actions. |
| Quarterly | Representative and competence exceptions, complaints themes, monitoring findings and board reporting. |
| Annually | Full licence-to-activity map, fit and proper evidence, control framework, RMCP where applicable and website review. |
| Event-driven | Ownership, directors, key people, categories, suppliers, systems, channels, products or regulatory publications that change the control environment. |
The exact due dates and evidence depend on the FSP's licence, category, structure and applicable legislation.
Official source shelf
- FSCA Fit and Proper — requirement areas and current examination material.
- FSCA FSP Search — public licence verification.
- FSCA compliance reports — official reporting source.
- FIC compliance obligations — accountable-institution controls.
Need a clean evidence file?