UK FCA findings from review of early and high growth oversight pilot

The UK Financial Conduct Authority (FCA) has published the findings from its review of its early and high growth oversight pilot. Between July 2025 and March 2026, the FCA engaged with 15 firms across asset management, wealth management and payments as part of a high-growth pilot. This was to identify rapidly growing firms earlier and support them as they establish and evolve their business. The FCA assessed whether their governance, risk management and control frameworks were developing in line with their growth. The FCA has set out its findings, including examples of good and poor practice:

• Governance and senior management oversight—Firms with stronger arrangements ensured governance, risk management and control frameworks kept pace with business growth. They had clear board and committee structures, with defined roles and responsibilities, regular oversight of risk and compliance matters, and high-quality management information for better decision-making. However, in some firms, governance arrangements had not kept pace with business growth. Board and committee structures including the scope, frequency and format of meetings, were not always effective and some firms lacked sufficient independent challenge, with responsibilities concentrated among a small number of individuals.
• Risk management frameworks—Stronger firms had more mature risk management approaches. Some used risk-focused committees to review enterprise-wide risks and escalate issues to the board, supported by clear risk appetites and key risk indicators. However, some firms relied heavily on key individuals, with limited contingency, succession planning, or broader knowledge transfer arrangements. Some firms also failed to sufficiently consider whether their risk management resources remained appropriate for the scale and complexity of the business.
• Resourcing, capability and scalability—As their business evolved, stronger firms invested in capability by recruiting and training staff, and in scalability through improved technology. They also demonstrated forward-looking regulatory judgement, preparing early for upcoming policy changes and legal requirements. However, the FCA identified some weaknesses in firms' capability and control frameworks where business models or customer populations had evolved but internal policies and procedures had not.
• Systems, controls and management information—Stronger firms had proactive cyber and operational resilience arrangements. This included using recognised security standards, penetration testing, third-party oversight and structured governance over the use of emerging technologies such as AI. Weaknesses included insufficient conflict of interest arrangements and management information that had not been updated.
• Financial resilience—Stronger firms proactively monitored key financial risks, including liquidity and counterparty exposures. Some firms used stress testing to check that their cost base was resilient, and that they could remain viable during periods of stress while continuing to meet regulatory capital requirements. In order to improve, the FCA highlights that some firms need to strengthen their financial resilience planning. In particular, wind-down plans are not always current, practical or proportionate to the business.

The FCA has provided individual feedback to all firms involved in the pilot. The FCA encourages firms experiencing growth to consider these findings and assess whether their arrangements remain appropriate for their size, scale, complexity and risk profile. If they find gaps, firms should take timely and appropriate action.

Return to main website.