Since 8 December 2022 every principal firm has owed the FCA one document it did not owe before: a written self-assessment of how it complies with SUP 12, reviewed and approved by its governing body at least once every 12 months (SUP 12.6A.6R). The FCA looked at a sample in 2024 and judged 52% of the ones it reviewed good quality. A further 17% of principals had not completed one at all.

Most of the weak ones were not short. They were long and said the wrong things. This guide sets out what the rule requires, what the board is signing when it approves the document, what belongs in each section, and the weaknesses that let a self-assessment down. Rule references are given so you can go to the source. It is a practitioner’s read, not legal advice.

What the rule requires

Four things, and they are worth separating.

A written assessment of how the firm complies with SUP 12. Not a report on the ARs. A statement about the principal’s own compliance with the chapter: appointment, contracts, oversight, review, notification, termination and record keeping.
Identification of material deficiencies, with the remedial steps taken or planned. A self-assessment with nothing in this section is telling the FCA that a firm has audited itself and found nothing, which the regulator will test.
Review and approval by the governing body at least every 12 months. Not noting. Not receiving. Approving.
Retention of each approved version for at least six years (SUP 12.6A.8R).

The guidance at SUP 12.6A.7G says what the document should cover: the effectiveness of the firm’s oversight arrangements; the adequacy of its controls and resources; its assessment of the risk of harm to consumers and market integrity; the outcomes of its reviews of ARs; and the methodology used. SUP 12.6A.9G allows a single document across all ARs and does not require a new one each year, so the practical model is a living document that is updated and re-approved. SUP 12.6A.10G reminds senior management that approving it once a year does not replace continuous oversight.

What the board is signing

Directors sometimes treat the self-assessment as a compliance paper to be noted. It is closer to a set of accounts. By approving it the board is asserting, on the firm’s behalf, that the five conditions in SUP 12.4.2R are established for every AR and remain so; that the firm has the controls and resources to oversee them; that each AR was reviewed under SUP 12.6A.2R; and that the deficiencies listed are the material ones. The FCA can ask for the document at any time and expects it to be available.

For the senior manager who holds responsibility for AR oversight, the document is also the evidence of reasonable steps. That is why it has to be owned by the firm. A self-assessment produced by an external consultant and approved without challenge is a common pattern and a weak one: not because consultants should not help, but because the board has to be able to defend the content in its own words.

Section by section

The structure below follows SUP 12 in the order the FCA supervises it. Every section ends with the same three things: what the evidence was, what it showed, and what changed as a result.

1. Scope and the AR population

List every AR and introducer AR, with the regulated activities each carries on, the date of appointment, any multiple principal arrangement (SUP 12.4.5BR), and what changed during the year: appointments, terminations, changes of activity, changes of control or senior management. Name the senior manager responsible for oversight, the period the document covers and the date of the last approval.

2. Appointment and due diligence

For each appointment in the year, record how the firm established the five SUP 12.4.2R conditions: threshold conditions unaffected; the AR solvent, suitable and free of close links that would prevent supervision; adequate controls and resources; the firm ready to comply with SUP 12; and no undue risk of harm to consumers or market integrity. Cite the evidence held (accounts, register and Companies House checks, references, fit and proper assessments against FIT 1.3.1BG, the business plan, PI cover where SUP 12.4.10AR applies), the appointment decision, and who signed it.

3. Contracts

Confirm that every contract contains the SUP 12.5.5R terms: compliance with the relevant requirements, notification of other appointments, provision of information, cooperation with the FCA and access to premises, and the firm’s right to terminate where it can no longer adequately oversee the AR. Record the amendments made in the year and the notifications they triggered.

4. Oversight arrangements and their effectiveness

This is the section SUP 12.6A.7G puts first and the one the FCA reads most carefully. Describe the monitoring model: how ARs are risk rated, what each rating requires (visit frequency, file review percentages, financial promotion approval, call sampling, mystery shopping), and what management information is collected (revenue, complaints, staff turnover, financial position). Then, and this is what separates a good document from a weak one, say what the monitoring found. Files reviewed and the outcome. Promotions rejected. Complaint trends by AR and their root causes. Issues raised, closed and still open. Whether the Consumer Duty outcomes are being tested in the AR’s business, since PRIN 2A applies to it. Effectiveness is a judgement about whether the arrangements catch problems. If they caught none in a year, explain why that is credible.

5. Adequacy of controls and resources

SUP 12.4.2R(3) requires adequate controls over the AR’s activities and adequate resources to monitor and enforce compliance, and the guidance at SUP 12.4.4B expects both to be commensurate with the size and nature of the AR business. Set out who does the oversight, their competence, the time available against the number and risk of ARs, and the systems used. Address the growth triggers in SUP 12.4.4F: if an AR grew significantly, took on more activity or attracted more complaints, say whether resources were reassessed.

6. Annual reviews of each AR

Confirm that each AR was reviewed in the period under SUP 12.6A.2R against all three limbs: solvency and suitability; the fitness and propriety of its controllers, directors, partners, proprietors and managers; and the adequacy of the firm’s own controls and resources. Record any reviews triggered under SUP 12.6A.3R by a change of business model, an expansion of activities, repeated changes in senior management, a new principal or a significant rise in complaints. Summarise the outcome for each AR and point to the written record kept under SUP 12.6A.4R.

7. Risk of harm to consumers and market integrity

State the firm’s assessment under SUP 12.4.2R(5), using the factors in SUP 12.4.4C: the AR’s business model and customers, the impact on customers and on the firm if the AR fails, continuity of service, and reputation. A rating for each AR with the reasoning behind it is more persuasive than a single sentence for the network.

8. Notifications, reporting and records

List the notifications made in the year: appointments 30 days before commencement (SUP 12.7.1R), changes within ten business days or ten days ahead for a change of activity (SUP 12.7.7R), conditions no longer met (SUP 12.7.8R), and the annual complaints and revenue return within 60 business days of the accounting reference date (SUP 12.7.9DR). Confirm the SUP 12.9.1R records are held and say where.

9. Terminations

For each termination: the reason, the date the form went to the FCA against the ten business day limit in SUP 12.8.1R, and the SUP 12.8.3R steps taken to protect customers, with dates. Note any check made afterwards, such as confirming the former AR no longer holds itself out as authorised.

10. Material deficiencies and remedial actions

The mandatory section. For each deficiency: what it is, which rule it touches, its severity, the owner, the action, the date and the status. Carry last year’s items forward until they close. The FCA’s review named a clear list of deficiencies with an action plan, RAG rated, as good practice. It also expects the board to escalate anything that could harm consumers or market integrity before the next annual cycle (SUP 12.6A.10G).

11. Methodology and approval

Who prepared the document, what evidence they used, which internal reviews or audits it draws on, the date the board approved it, the minute reference, and the date the next approval is due.

Common weaknesses

The FCA’s 2024 review described good practice. The weaknesses below are its mirror image, and the ones we see most.

It describes policy rather than assessing effectiveness. Pages on what the oversight framework says, nothing on what it found, and none of the management information the firm collects.
It identifies no deficiencies. The regulator reads that as a document that did not look.
It has no action plan, or an action plan with no owners and no dates.
It was written for the board, not by it. No evidence of challenge, no minute, sometimes no approval at all.
It does not connect to the annual reviews. The reviews of each AR under SUP 12.6A.2R are the inputs. The self-assessment should be built from them, not written separately.
It is not maintained. A fresh document each year that starts from a blank page loses last year’s open items.
It cannot be produced. The approved version sits in an email thread, and the six-year retention under SUP 12.6A.8R rests on someone’s inbox.

How RegTechPRO helps

RegTechPRO’s SUP 12 module holds the self-assessment as a live record built from each AR’s file rather than a document written alongside it.

The 25-item SUP 12 checklist runs from appointment within permission and the due diligence pack, through the monitoring schedule, promotion approvals, customer outcome testing and complaints review, to notifications, the complaints and revenue return, termination records and the escalation route to the board. Each item carries a status, and the board sign-off sits directly beneath the checklist, so the approval is recorded against the version it approved.
The 80-question gap analysis across 14 chapters gives Section 10 its raw material: every question answered with a gap becomes a deficiency with an owner.
The annual review of each AR draws on the AR’s own record, so Sections 4 to 7 are populated from monitoring findings, financial monitoring, fit and proper currency and the risk tier rather than reconstructed.
Otto drafts four report formats from the live data: a full SUP 12 report in 14 sections, an executive summary, a network summary, and a 12-question FCA dry-run that puts the questions the regulator would ask and gives the firm’s evidenced response, a RAG and an examiner’s observation on each. Facts are traced to the record and gaps are stated as gaps. Otto drafts, the compliance officer edits, the board decides, and nothing is submitted anywhere automatically.

The RegTechPRO Blog