When a firm regulated by the Financial Conduct Authority loses its permissions, the effects are rarely contained to that firm alone. Every business that relies on it – whether as a counterparty, distributor or service provider – is potentially exposed to regulatory, legal and reputational risk.
For compliance teams, awareness of permission changes is not optional. It is a fundamental part of ongoing due diligence and third-party risk management. Yet many organisations still rely on periodic manual checks of the FCA Register, leaving gaps between when a change occurs and when it is noticed.
This article explains the ways the FCA can change or restrict a firm's permission, how that affects your organisation, and what practical steps compliance teams should take to manage the risk.
Understanding FCA permissions and how they change
A firm authorised under Part 4A of the Financial Services and Markets Act 2000 (FSMA) holds a permission that sets out the regulated activities it may carry on. Acting outside that permission is a breach the FCA can take action on; carrying on a regulated activity with no authorisation or exemption at all is a criminal offence. Payment institutions and e-money institutions are authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 rather than Part 4A, but their authorisation can be varied and cancelled too.
Permissions are not static. They can be altered through several mechanisms, each with different implications.
Voluntary variation of permission (VVOP)
A firm may choose to give up or narrow its permission. This often happens during business restructuring, when a firm exits a particular market, or when it no longer wishes to carry on certain regulated activities. While voluntary, a VVOP still changes the scope of what the firm is legally permitted to do – and any business relying on that permission needs to know promptly.
Own-initiative variation of permission (OIVOP)
The FCA has the power to vary a firm's permission on its own initiative. This is typically a supervisory or enforcement action, taken when the FCA believes the firm is failing, or likely to fail, its threshold conditions, poses a risk to consumers, or is otherwise failing to comply with regulatory requirements. An OIVOP is a serious regulatory signal and can precede further enforcement action.
Requirements
Rather than changing the permission itself, the FCA may impose requirements on a firm (own-initiative requirements, or OIREQs), or agree voluntary requirements (VREQs) with it. These restrict how the firm carries on its business – for example preventing it from taking on new clients, handling client money or operating in certain markets. Requirements can be imposed with immediate effect in urgent cases, which makes timely detection critical.
Cancellation of permission
In the most severe cases, the FCA can cancel a firm's Part 4A permission entirely, and a firm left with no permission ceases to be authorised to carry on any regulated activity. Cancellation may be initiated by the FCA as an enforcement measure, or it may follow a firm's own request – for example, when a firm ceases trading. Whatever the trigger, cancellation has immediate and far-reaching consequences.
How a firm losing permission affects your organisation
If a firm you work with loses permission, or has it varied, the consequences for your own organisation can be significant. Understanding these risks is essential for any compliance function managing third-party relationships.
Contractual and legal exposure
Many agreements with FCA-regulated firms include clauses that require the counterparty to maintain its regulatory authorisations. When a firm loses permissions relevant to the services it provides to you, those provisions may be triggered, and you may need to decide quickly whether to suspend or end the arrangement.
Beyond contract law, there are direct regulatory implications. If your organisation continues to rely on a firm that no longer holds the necessary permission, you may be facilitating unauthorised activity, which carries its own legal and regulatory risks.
Regulatory risk to your firm
Under the FCA's rules, regulated firms are expected to carry out appropriate due diligence on their counterparties and maintain adequate oversight of outsourcing and third-party arrangements. If a firm you depend on loses its permission and you fail to identify this promptly, your own firm may be seen as falling short of its regulatory obligations.
The Senior Managers and Certification Regime (SM&CR) places personal accountability on senior individuals for the areas they oversee. A failure to detect a material change in a counterparty's regulatory status could raise questions about the adequacy of your firm's systems and controls – and, by extension, the discharge of individual senior management responsibilities.
Reputational damage
Association with a firm that has had its permission restricted or cancelled can carry reputational consequences, particularly if the FCA's action is linked to consumer harm, financial crime or serious compliance failings. Even where your own firm has done nothing wrong, the association may attract unwanted scrutiny from regulators, clients and the press.
Disruption to business operations
On a purely operational level, a counterparty losing its permission can disrupt your business. If the firm can no longer provide the regulated services you depend on, you may need to find alternative arrangements quickly – often under time pressure and with limited options.
What compliance teams should do
Managing the risk of counterparty permission changes requires a structured, proactive approach. The following steps represent good practice for compliance teams in regulated firms.
Keep an up-to-date list of regulated counterparties
Every firm you deal with that holds FCA permissions should be recorded, along with the specific permissions relevant to your relationship. This list forms the basis for effective monitoring and should be reviewed regularly.
Monitor the FCA register regularly
Quarterly or monthly checks leave long gaps. The FCA can impose variations or requirements with immediate effect, and delays in detection increase your exposure.
Daily monitoring of the FCA Register for the firms on your counterparty list is a sensible standard to aim for. FRN monitoring does this by replacing manual spot checks with a daily automated check.
Establish a response process
When a permission change is detected, your team needs to know exactly what to do. A documented response process should cover:
- Initial assessment – determining what has changed and whether it affects your business relationship
- Escalation procedures – who needs to be informed, including senior management, legal counsel and affected business lines
- Risk evaluation – assessing the impact on contracts, regulatory compliance and ongoing operations
- Action steps – whether the relationship can continue, needs to be modified, or must be terminated
- Communication – notifying affected stakeholders, both internally and externally where appropriate
Document everything
Regulators expect to see evidence of your firm's oversight activities. Every check, alert, decision and action taken in response to a counterparty permission change should be documented. A clear audit trail helps you show the FCA how you oversee your counterparties.
Review appointed representative relationships
If your firm is a principal with appointed representatives (ARs), watch their regulatory standing closely. An AR holds no permission of its own: it is exempt only for the regulated activities you have accepted responsibility for, and you remain responsible for what it does in carrying them on (SUP 12 sets out what the FCA expects of principals). Keep your AR records on the register up to date, and act quickly on anything that suggests an AR is operating outside the scope of its appointment.
How automation helps
The challenge with manual monitoring is straightforward: it does not scale, and it leaves gaps. Compliance teams managing dozens or hundreds of regulated counterparties cannot realistically check the FCA Register for each one often enough to catch changes promptly.
Firmwatcher's permissions monitoring checks every firm on your watchlist each morning for new requirements and for variations or cancellations of permission recorded as disciplinary action, and reads FCA announcements hourly. When it finds one, your team is told through regulatory alerts.
Firmwatcher monitors FCA-regulated firms by their Firm Reference Number (FRN), alerts your compliance team to new requirements and disciplinary action, and records who acknowledged each alert, when and why – evidence of oversight you can show an auditor. It does not track a firm's full list of permitted activities or changes a firm makes to its own permission, so keep those in your periodic reviews.
Key benefits include:
- Daily detection of new requirements, and of variations and cancellations of permission recorded as disciplinary action
- Alerts by email and in the app – as they are found, or in a daily or weekly summary
- An audit trail of acknowledgements and watchlist changes, exportable as CSV
- Centralised counterparty oversight across your portfolio of regulated relationships
- Reduced operational risk by narrowing the gaps inherent in periodic manual checks
Take control of counterparty monitoring
When an FCA-regulated firm loses its permissions, the firms that suffer most are those that find out too late. Automated monitoring means your compliance team hears about it sooner and can act.
Firmwatcher checks your FCA-regulated counterparties every morning, reads FCA announcements within the hour, and keeps a record of how your team responded.
Start a 14-day trial and see what daily monitoring looks like for your counterparties.