FCA High-Growth Firms: Good and Poor Practice in Governance, Risk and Controls
On 10 August 2026 the Financial Conduct Authority (FCA) published High-growth firms: good and poor practice, setting out what it found when it engaged with 15 rapidly growing firms between July 2025 and March 2026. The publication introduces no new rules and carries no deadline. It is a statement of supervisory expectation: where governance, risk management and control frameworks have not kept pace with commercial growth, the FCA treats that gap as a source of harm and expects the firm to close it without being told to.
The review is aimed at authorised firms that are newly established, experiencing rapid growth or undergoing significant change, and the FCA says it is particularly relevant to the asset management, wealth management and payments sectors. Firms outside those sectors should not set it aside: the FCA is explicit that the themes may be relevant to firms of different sizes and business models considering whether their arrangements are adequate for growth or operational change.
What the FCA Reviewed and How It Chose the Firms
The review sits within Early and High Growth Oversight, the FCA's programme of enhanced supervision for firms in the early years after authorisation. It engaged directly with each of the 15 firms, seeking to understand three things:
how firms grow
the characteristics of sustainable growth
the point at which risks begin to emerge
The selection method deserves more attention than it will probably get. The FCA used a data-led approach to identify firms exhibiting signs of growth, such as revenue, expenditure, staff growth and changes in permissions or control, so that supervisory engagement could happen earlier. In practice, a firm's own regulatory returns and change in control notifications may bring it to supervisory attention before it has had any conversation with the FCA about growth.
Two qualifications matter. The sample is small and qualitative, so it tells us nothing about how common these weaknesses are, and the FCA has published examples rather than conclusions.
The FCA's Key Findings
The FCA grouped its findings under six headings, pairing examples of good practice with areas for improvement in each:
governance and senior management oversight
risk management frameworks
resourcing, capability and scalability
systems, controls and management information
financial resilience
consumer and market outcomes
Governance and Senior Management Oversight
Stronger firms had clear Board and committee structures with defined roles, regular oversight of risk and compliance, and high-quality management information. They strengthened their governing bodies as the business evolved, bringing in independent or non-executive members to provide challenge, which the FCA noted particularly in payments firms.
The weaknesses are specific and mostly inexpensive to fix: Board and committee structures, including the scope, frequency and format of meetings, that were not always effective; responsibilities concentrated among a few individuals, with insufficient independent challenge; and weak governance record-keeping, covering missing minutes and poor documentation of attendance, quorum, conflicts, decisions and follow-up actions. That last point matters disproportionately, because governance records are the first thing a supervisor asks for, and a firm may have made a defensible decision and still be unable to demonstrate it.
Risk Management Frameworks
Stronger firms used risk-focused committees to review enterprise-wide risks and escalate to the Board, supported by clear risk appetites and key risk indicators, and reduced their dependency on single individuals through cross-training.
Elsewhere the FCA found heavy reliance on key individuals with limited contingency or succession planning, and firms that had not considered whether their risk management resources remained appropriate for the scale and complexity of the business. It flagged this as particularly relevant where third-party relationships were deepening, or where firms were making greater use of technologies such as artificial intelligence (AI). It also found business models and customer populations that had evolved while policies and controls had not: some firms' target market had changed without any corresponding review of their suitability frameworks.
Resourcing, Capability and Scalability
Stronger firms invested in capability by recruiting and training staff, and in scalability through improved technology, strengthening their compliance functions with additional resourcing, updated financial crime frameworks and enhanced transaction monitoring. The FCA points firms towards tools such as the Regulatory Initiatives Grid to anticipate future developments.
Forward-looking regulatory judgement was singled out as good practice. Some firms prepared early for upcoming safeguarding requirements, most readily understood as the changes confirmed in PS25/12, in force from 7 May 2026, shortly after the pilot closed. Others delayed expansion into new regulated activities until controls for existing business were more robust. It is rare for the FCA to describe commercial restraint as good practice, and it is a useful reference for compliance functions arguing for sequencing rather than simultaneous growth.
Systems, Controls and Management Information
Stronger firms had proactive cyber and operational resilience arrangements, including recognised security standards, penetration testing, third-party oversight and structured governance over emerging technologies such as AI. On conflicts, they identified those arising from group relationships, co-manufacturing arrangements, shared resources and combined senior management responsibilities, and could explain how each was escalated, challenged and monitored.
The areas for improvement were insufficient conflict of interest arrangements and management information that had not been updated. Outdated MI, including references to superseded documents or meetings, reduced the quality of oversight and delayed identification of conflict issues. On cyber, the FCA wants stronger evidence of change control, data governance, testing, third-party oversight and resilience planning, particularly where firms are introducing new technology, automation or AI. A conflicts register that is not refreshed as the group structure or senior management arrangements change becomes a record of a firm that no longer exists.
Financial Resilience
Stronger firms proactively monitored key financial risks, including liquidity and counterparty exposures, and used stress testing to check that their cost base was resilient and that they could remain viable during stress while continuing to meet regulatory capital requirements.
The improvement point is narrow: wind-down plans were not always current, practical or proportionate, and firms should supplement them with an understanding of relevant notification obligations such as SUP 15. For a firm that has doubled in size since its plan was written, the question is not whether a plan exists but whether its assumptions still describe the business, and whether the people named in it are still there.
Consumer and Market Outcomes
Stronger firms had active oversight of products and services through regular product or portfolio reviews, benchmarking and transparent client reporting, and some used client feedback to inform decisions about growth. The FCA links these practices to the outcomes expected under the Consumer Duty, such as assessing fair value and monitoring whether customers receive suitable outcomes.
Where firms fell short, they needed greater emphasis on assessing customer outcomes, including fair value. Without active monitoring, firms may be less able to check whether their products continue to meet customer needs or remain appropriate for the target market, which increases the risk of foreseeable harm.
The Themes Running Through the Findings
Read across the six sections, three themes are more useful than any individual finding.
The first is that these are lag problems rather than absence problems. Minutes, MI, conflicts registers, suitability frameworks and wind-down plans appear in the same form: fit for the firm that commissioned them, and out of step with the firm that now exists. That points towards a periodic review discipline rather than a rebuild.
The second is concentration. Responsibilities held by too few people, limited succession planning, thin independent challenge and risk functions that did not grow with the business are one issue: growth increases the load on the same individuals rather than redistributing it.
The third is evidence. Several findings are not about whether the firm did the right thing but about whether it can show that it did.
What Should Firms Do Now
The FCA's framing is proportionate. It encourages growing firms to reflect on the findings, assess whether their arrangements remain appropriate for their size, scale and complexity, and address gaps in a timely way. That is an invitation to review, not to rebuild. A proportionate response would cover the following:
Assess applicability honestly. Growth in headcount, revenue, permissions or ownership since the last framework review is the relevant test, not sector.
Run a focused gap analysis against the six finding areas rather than a full framework review. The FCA has supplied the agenda.
Review governance records first. Sample the last six to twelve months of Board and committee minutes and test whether attendance, quorum, conflicts, decisions and follow-up actions are captured.
Refresh the conflicts register and the Board MI pack together, removing references to superseded documents and committees that no longer meet.
Revisit the wind-down plan against the current business, including headcount, cost base and third-party dependencies, and confirm that those executing it understand their obligations under SUP 15.
Test key person dependency by identifying roles where a single departure would degrade a control, and document the contingency.
Review suitability, target market and fair value documentation where the client base has shifted.
Minute the decisions, including any Board conclusion that an arrangement remains appropriate despite growth.
Firms should allocate ownership and set a realistic completion date. Where the work will take months, a sequenced plan with Board oversight meets the FCA's expectation better than an unrealistic commitment.
Frequently Asked Questions
Does the FCA's high-growth firms publication create new rules?
No. It is a good and poor practice publication setting out examples the FCA identified during a supervisory pilot. It creates no new obligations, is not Handbook guidance and does not consult on anything. Existing obligations under the FCA Handbook, the Consumer Duty and, for payments firms, the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 are unchanged.
Which firms does the FCA's high-growth firms review apply to?
The FCA says it is relevant to authorised firms that are newly established, experiencing rapid growth or undergoing significant change, and particularly relevant to asset management, wealth management and payments. It adds that the themes may be relevant to firms of different sizes and business models assessing whether their arrangements are adequate for growth. Within the firm, it is directed at Boards, senior management function holders and those responsible for risk, compliance and operational oversight.
How does the FCA identify high-growth firms?
The FCA used a data-led approach to identify firms exhibiting signs of growth, including revenue, expenditure, staff growth and changes in permissions or control, and says it will consider how such approaches can support earlier identification of emerging risks and more targeted supervisory interventions. Firms should assume that indicators of growth in their regulatory submissions may prompt engagement.
What did the FCA say about wind-down plans for growing firms?
The FCA found that wind-down plans were not always current, practical or proportionate to the business. Effective planning can help prevent a firm's failure and, if the firm does fail, helps it wind down in an orderly way and reduces consumer harm. Firms should supplement their plans with an understanding of relevant notification obligations such as SUP 15.
Is there a deadline for firms to respond to the FCA's findings?
There is no deadline, implementation date or transitional arrangement, because the publication contains no rules. The FCA has given individual feedback to the pilot firms and encourages other growing firms to reflect on the findings and address gaps in a timely and proportionate way. It will use the insights to inform its supervisory approach to high-growth firms.
How Compliance Angle Can Help
This publication suits targeted work rather than an open-ended programme. We support FCA-regulated firms and firms seeking authorisation with:
compliance and regulatory health checks, which can be scoped directly against the six areas the FCA has set out
risk management and corporate governance support, covering Board and committee structures, escalation routes, risk appetite statements, key risk indicators and the risk reporting that reaches the Board
SM&CR support, where responsibilities have become concentrated or senior management accountability has not been revisited since the firm grew
compliance frameworks and policies, including compliance monitoring programmes and the policies and risk assessments that have fallen behind the business
Consumer Duty support, focused on fair value assessments and target market review
wind-down planning, reviewing assumptions, triggers, timelines and financial and operational resources against the business as it is now
FCA authorisation and application support, where the scalability of governance and controls is tested at application stage, as in our note on improving FCA applications for authorisation in asset management
ongoing compliance support, for firms whose compliance resource has not scaled with the business
Support is tailored to the firm's business model, permissions, size and regulatory risk. For a growing firm the useful question is narrow: which of these arrangements were built for a smaller version of this business, and which still work. To discuss how this applies to your firm, contact us at info@complianceangle.co.uk.
Source: Financial Conduct Authority, High-growth firms: good and poor practice, published 10 August 2026.
