Section 5: What checks your business needs to have in place

This section covers the basic day-to-day arrangements you need in place to run your business safely, manage risks and treat your customers fairly.

This doesn’t mean you have to have a large compliance department – you can meet these requirements by having one named person responsible for oversight, clear written policies that outline how your business operates, and routine checks to make sure risks are identified and managed.

You must be clear who is responsible for running your business – making decisions, managing risks and dealing with issues as they arise. This can be as simple as having one named person with their responsibilities written down clearly in a short document or role description.
Anyone working in or for your business must have the skills and knowledge needed for their role. For example, this could include making sure that people understand their responsibilities and provide training and guidance for them that reflects the tasks they carry out.
You must have simple compliance and financial crime controls to help your firm meet its regulatory obligations. In practice, this could include developing short plain-language policies and implementing routine checks to confirm controls are working and issues are addressed.
You should understand the main risks in your business and take steps to keep them under control. For example, some of the risks that you identify could be the mis-selling of products or inadequate oversight of ARs.
If you rely on another firm to carry out critical or important parts of your business, you should make sure that this doesn’t weaken your controls or increase any risks you’re taking on. You remain fully responsible for meeting regulatory requirements and should understand what the third party does and how it’s overseen.
To demonstrate how you’ve complied with all our rules, you must keep records to show how your business is run and how decisions are made. You should make sure your records are easy to find and keep important information secure.
You must take steps to identify and address situations where your interests, or the interests of one customer, could conflict with those of another. Where these situations are identified, you must seek to prevent or manage them and keep a record of services where conflicts arise. You must also have a conflict of interest policy and review it regularly.

Where these requirements come from

Provisions	Purpose
SYSC 1[1]	Application and purpose: The application and purpose of the SYSC sourcebook. For the purposes of this Guide, we have assumed that credit brokers fall under ‘any other SM&CR firm’. This means that you should pay particular attention to chapters 4 to 12 and 18. Annex 1 has a detailed overview of the application of SYSC.
SYSC 4:[2]	General organisational requirements: The core standards for how a firm must be organised. It requires firms to have robust governance arrangements, including a clear organisational structure, clear lines of responsibility, good administrative and accounting procedures, and effective systems for identifying, managing and reporting risks.
SYSC 5[3]	Employees, agents and other relevant persons: The basic requirement that anyone working for, or on behalf of, a firm must have the skills, knowledge and expertise to carry out their role properly. It also covers the need for appropriate training, ensuring staff understand the firm’s procedures, and making sure individuals remain competent over time.
SYSC 6[4]	Compliance, internal audit and financial crime: This section requires firms to establish, implement and maintain policies and procedures to make sure they meet their regulatory duties, especially when it comes to preventing financial crime.
SYSC 7[5]	Risk control: How firms should organise their risk control framework. It includes provisions on having processes to identify, manage, monitor and report risks, expectations around setting and reviewing the level of risk the firm is willing to tolerate, and requirements for senior management to approve and periodically review the firm’s risk strategies.
SYSC 8[6]	Outsourcing: Rules and guidance applicable when a firm engages a third party to perform critical or important functions or provide services on its behalf. It specifies the governance and controls firms are expected to maintain when outsourcing, including ensuring that outsourcing arrangements do not introduce undue operational risk, compromise the firm’s internal control framework or impede the FCA’s ability to supervise the firm effectively.
SYSC 9:[7]	Record-keeping: How firms must keep records of their business that are orderly, accurate and accessible, so we can monitor how the firm complies with its obligations. This section also includes requirements for firms to have controls around the adequacy, security and accessibility of their records – covering how records are stored, how they can be retrieved, how long they must be kept, and how they are protected from loss, damage, or unauthorised access.
SYSC 10:[8]	Conflicts of interest: How firms should identify and manage conflicts of interest. It sets out the requirement for firms to take steps to identify situations where the firm’s interests could conflict with the interests of a client, or a conflict could arise between the interests of one client with another. Firms must take appropriate steps to prevent potential conflicts from causing harm to a client.

Further resources

Financial Crime Guide[9]

Section 4: Making sure the right people are in the right roles[10]

Section 6: Handling complaints when things go wrong[11]

First published: 20/05/2026 Last updated: 20/05/2026

Section 5: What checks your business needs to have in place

Where these requirements come from

Further resources

Previous page

Next page

On this page

Regulatory guide for credit brokers[12]