FCA Register: How to Check a Regulated Firm

Under section 19 of the Financial Services and Markets Act 2000 (FSMA), carrying out a regulated activity in the United Kingdom without authorisation or exemption is a criminal offence. For solicitors, corporate finance advisers, lenders, and private equity investors, verifying a counterparty's regulatory status is not a mere administrative hurdle. It is a critical risk management function.

Dealing with an unauthorised entity carries severe consequences. It can render commercial contracts entirely unenforceable under section 26 of FSMA. It can void professional indemnity insurance policies. It can also expose your own firm to regulatory censure or secondary liability for facilitating unauthorised business.

The primary tool for this verification is the Financial Services Register, maintained jointly by the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA).

However, simply confirming that a firm's name appears on the register is insufficient. A comprehensive check requires interrogating the firm's specific permissions, cross-referencing its corporate identity, and ensuring the individuals acting on its behalf hold the appropriate approved functions.

Expert Analysis: The Limits of a Basic Register Check

The most common error in regulatory due diligence is treating FCA authorisation as a blanket approval. Authorisation is granted for specific regulated activities, not for the firm as a whole.

A firm might be fully authorised to conduct insurance distribution but hold no permissions whatsoever for debt administration, consumer credit, or providing investment advice. If a corporate finance team engages a broker to arrange a complex debt facility, and that broker only holds permissions for non-investment insurance contracts, the transaction is immediately compromised.

Furthermore, the register is a public-facing database that relies on timely updates from the firms themselves and the regulator. While it is the definitive legal record of regulatory status, it does not provide real-time alerts on a firm's underlying financial health. A firm can maintain an "Authorised" status on the FCA Register while simultaneously facing severe creditor pressure, defaulting on commercial leases, or defending insolvency proceedings.

Professionals must therefore view the FCA Register as only one pillar of a wider corporate intelligence strategy. Regulatory data must be combined with statutory corporate filings, litigation records, and active insolvency indicators to form a complete risk profile.

The Principal and Appointed Representative Dynamic

Not all regulated firms hold direct authorisation. Many operate as Appointed Representatives (ARs). Under section 39 of FSMA, an AR conducts regulated activities under the regulatory umbrella of a "Principal" firm.

The Principal firm holds the direct FCA authorisation and accepts full legal and regulatory responsibility for the AR's activities. This regulatory hosting model is highly common in corporate finance, private equity, and consumer credit.

When dealing with an AR, your due diligence burden doubles. You must verify the AR's status, but you must also heavily scrutinise the Principal firm. If the Principal loses its FCA permissions, or if the FCA imposes a restriction on the Principal's ability to host ARs, the AR immediately loses its ability to trade legally. You must check the specific agreement listed on the register to ensure the Principal has explicitly accepted responsibility for the exact regulated activity the AR is performing for you.

Checking Individuals: The SM&CR Blind Spot

Historically, the FCA Register listed almost all customer-facing staff under the Approved Persons Regime. This changed with the introduction of the Senior Managers and Certification Regime (SM&CR).

Today, the public FCA Register only lists individuals who hold specific Senior Management Functions (SMFs), such as the Chief Executive (SMF1), Chief Finance Function (SMF2), or Compliance Oversight (SMF16).

Individuals who fall under the "Certification Regime" (such as mortgage advisers, financial planners, or algorithmic traders) are no longer individually approved by the FCA. Instead, the firm itself certifies them as fit and proper. While the FCA maintains a separate "Directory of certified and assessed persons", this relies entirely on the firm uploading accurate data. Professionals must understand this distinction. The absence of a junior broker's name on the main FCA Register does not mean they are unauthorised, but the absence of a registered SMF16 (Compliance Oversight) at the firm level is a massive red flag.

Decision Framework: Standard Verification Protocol

When conducting due diligence on a financial services firm, follow this systematic framework to ensure no regulatory blind spots remain.

1. Obtain the Firm Reference Number (FRN): Never search solely by name. Many firms share similar names. Fraudulent entities frequently adopt names identical to dormant or legitimate firms. Demand the six- or seven-digit FRN from the counterparty.

2. Verify the Legal Entity: Cross-reference the registered company name and number on the FCA Register with the official record at Companies House. Any discrepancy between the trading name, the registered name, and the FCA record requires immediate clarification.

3. Check the Primary Status: Confirm the firm's current status. Is it "Authorised", an "Appointed Representative", or "No longer authorised"?

4. Audit the Permissions Profile: Expand the "Permissions" tab on the register. Verify that the firm holds the exact permission required for the specific transaction you are contemplating. Check for any "Requirements or Restrictions" placed on the firm by the regulator.

5. Validate Contact Information: Fraudsters operate "clone firms" by copying a legitimate firm's FRN and name but using different contact details. Always verify that the email domains, telephone numbers, and physical addresses provided by your contact match those listed on the FCA Register.

6. Review the SM&CR Record: Check the "Individuals" section to ensure the directors or partners you are dealing with are officially recognised as holding Senior Management Functions.

7. Cross-Check Data Protection: Regulated firms process sensitive financial data. Cross-reference the corporate entity against the Information Commissioner's Office register of fee payers to ensure they hold a valid data protection registration.

Understanding FCA Register Statuses

The register uses specific terminology to denote a firm's regulatory standing. Misinterpreting these statuses can lead to significant compliance failures.

| FCA Status | Professional Meaning | Risk Implication |

| :--- | :--- | :--- |

| Authorised | The firm has direct permission from the FCA or PRA to carry out specified regulated activities. | Low regulatory risk, provided the specific activities match their permissions profile. |

| Appointed Representative (AR) | The firm is not directly authorised. It acts under the responsibility of a Principal firm which holds the authorisation. | Moderate risk. You must check the Principal firm's status and ensure the Principal has accepted responsibility for the AR's specific activities. |

| Registered | Typically applies to firms subject to specific regimes, such as cryptoasset businesses under Money Laundering Regulations. | High nuance. "Registered" does not mean "Authorised". They are often not covered by the Financial Services Compensation Scheme (FSCS). |

| Suspended / Restricted | The firm is still on the register but the FCA has intervened to stop them carrying out certain or all activities. | High risk. Immediate halt to transactions required. Review the statutory notices to understand the breach. |

| No longer authorised | The firm previously held permissions but these have been cancelled. | Critical risk. Do not engage in new regulated activities with this firm. |

Worked Example: Intercepting a Clone Firm Fraud

Consider a scenario where a bridging lender is approached by a commercial finance broker looking to place a £2.5 million development loan. The broker identifies himself as representing "Apex Commercial Finance Ltd". He provides an FRN and directs the lender to a highly professional website.

The lender's underwriter begins the due diligence process.

First, they input the FRN into the FCA Register. The register confirms that Apex Commercial Finance Ltd is an Authorised firm with permissions for credit broking. The company registration number on the FCA Register matches the official record at Companies House.

However, the underwriter applies the contact validation step from the decision framework. The email address provided by the broker is `john.smith@apexcommercial-finance.co.uk`. The underwriter checks the FCA Register's "Contact Details" tab. The official email domain registered with the FCA is `@apexcommercialfinance.com`. Furthermore, the registered telephone number differs entirely from the one in the broker's email signature.

The underwriter calls the telephone number listed on the official FCA Register. The genuine compliance officer at Apex Commercial Finance Ltd answers the phone. They confirm they have no employee named John Smith and are entirely unaware of the £2.5 million transaction.

The lender has successfully identified a "clone firm" fraud. The fraudster had simply lifted the FRN and name of a legitimate firm, registered a slightly different web domain, and attempted to intercept the loan funds. By validating the contact data rather than just the firm name, the underwriter saved £2.5 million and avoided severe reputational damage. This highlights exactly why checking the FRN alone is never sufficient.

Bridging the Gap: Regulatory Status vs. Financial Reality

A clean record on the FCA Register does not guarantee a firm is commercially viable or operationally sound. Regulatory distress and financial distress are deeply intertwined, but they appear on different public registers at different times.

For example, a wealth management firm might maintain its "Authorised" status while quietly struggling with severe cash flow issues. The FCA Register will not show you if the firm has defaulted on a commercial lease, if a supplier has taken legal action, or if HMRC is pursuing unpaid taxes.

To build a complete risk profile, professionals must pair FCA checks with deep corporate intelligence.

First, you must look for active insolvency indicators before engaging a regulated firm. You should check any UK company for a winding up petition to reveal if creditors are attempting to force the company into compulsory liquidation. A regulated firm facing a winding up petition will almost certainly face imminent regulatory intervention, as financial resources are a threshold condition for authorisation.

Second, understanding how a regulated firm is funded is critical. You must review company charges on Companies House to see if the firm has granted fixed or floating charges over its assets to institutional lenders. High levels of secured debt can indicate limited operational flexibility. If a debenture holder appoints an administrator, the firm's ability to conduct regulated activities will be severely disrupted.

Finally, due diligence is not a one-off event. The risk profile of a regulated counterparty changes daily. Implementing a system to monitor a UK company free ensures you are alerted the moment a firm files new accounts, changes its board of directors, or is subject to a statutory notice in The Gazette.

By combining the regulatory certainty of the FCA Register with the financial reality of Companies House and the insolvency courts, professionals can make defensible, risk-adjusted decisions.

How Professionals Do This Manually Today, and How Corp Intel Changes It

Traditionally, compliance teams and corporate lawyers manage regulatory due diligence through manual, highly repetitive processes. An analyst will search the FCA Register, download the permissions profile as a PDF, run a separate search on Companies House to check the corporate structure, and manually review The Gazette for insolvency notices. This data is then logged in a static spreadsheet.

If the firm's FCA status changes, or if a restriction is applied weeks later, the professional only discovers this if they remember to manually repeat the search. This creates massive blind spots between review cycles.

Corp Intel fundamentally changes this workflow by unifying statutory and regulatory data. Instead of isolated searches across multiple government portals, professionals use Corp Intel to link a firm's FRN directly to its corporate entity, financial history, and litigation risk profile.

More importantly, Corp Intel automates the ongoing risk assessment. Compliance teams receive immediate alerts if a counterparty's corporate status changes, if new directors are appointed, or if adverse filings appear. This shifts regulatory due diligence from a static, point-in-time check to a continuous, highly defensible monitoring process.

Next Steps for Corporate Due Diligence

Relying on static, manual checks exposes your firm to regulatory blind spots and counterparty risk. A firm that is fully authorised today could face a winding up petition tomorrow. Ensure your due diligence processes are robust, continuous, and fully integrated across both regulatory and corporate data sets.

Start by verifying your counterparties comprehensively. Use Corp Intel's company search to cross-reference corporate identities, review historical filings, and establish automated monitoring for all your regulated partners.