What the FCA actually expects a five-person firm to evidence

There's a common belief among small firms that the FCA grades effort. It doesn't. It reads evidence. A supervisor never asks whether you take compliance seriously — everyone says they do. The question, in one form or another, is always the same: show me.

That distinction matters most for the smallest firms. A five-person firm doesn't have a compliance department, and the FCA knows it. What the regulator expects is proportionate to your size and what you do — but proportionate doesn't mean optional. It means a smaller set of records, kept properly. Here is what that set actually looks like.

1. The registers you're expected to keep current

Four registers come up in almost every review of a small firm: complaints, gifts and hospitality, conflicts of interest and breaches. Most firms have them, in the sense that a spreadsheet exists somewhere. Far fewer keep them current — and "current" has a specific meaning.

A current register entry has three things:

• A date. When it happened and when it was recorded — ideally close together.
• An owner. A named person responsible for dealing with it, not "the firm".
• An outcome. What was decided, what was done, and when it was closed.

An entry that says "complaint received — resolved" with no dates and no name isn't evidence. It's a claim. And a register that's empty isn't automatically clean: a gifts register with nothing in it, at a firm that regularly entertains introducers, reads as a gap rather than good behaviour. If the honest answer for a period is "nothing to record", record that — a dated nil return shows the register is alive.

2. SM&CR, at five-person scale

The Senior Managers and Certification Regime sounds like it was written for banks, and much of it was. But the core of it applies to almost every authorised firm, and for a small firm it comes down to four questions a supervisor can ask on any given day:

• Who are your Senior Managers? You should be able to name them and say which functions each holds — without checking.
• Where are their Statements of Responsibilities? Each Senior Manager needs one, and it needs to describe what they actually do today — not the version drafted at authorisation and never touched since.
• When did you last assess fitness and propriety? This is an annual exercise, and it needs a record: what was checked, by whom, on what date, with what conclusion.
• Can you show conduct-rules training? "We talked it through over lunch" is not a training record. A dated note of who was trained, on what, and when is.

None of this is onerous at five people. The trap is that it's so small it never gets written down — and undocumented is, for supervisory purposes, undone.

3. Consumer Duty — outcomes, not shelfware

Every firm now has a Consumer Duty policy. The FCA has been clear that the policy is the least interesting part. What it wants to see is evidence of outcomes monitoring: what information you actually look at to judge whether your customers are getting good outcomes, how often you look at it, what you concluded, and what you changed when you didn't like the answer.

For a small firm that might be complaints trends, cancellation reasons, vulnerable-customer cases, or how long things take at each stage. The bar isn't sophistication — it's regularity and honesty. A short quarterly note saying "we reviewed X, we found Y, we're doing Z" is worth more than a beautiful policy nobody has opened since it was written.

Then there's the annual board report. The Duty requires your governing body to review, at least once a year, whether the firm is delivering good outcomes — and to record that it did so. In a five-person firm "the board" may be two directors at a kitchen table. That's fine. The dated record of what they reviewed and concluded is what counts.

4. Returns — the deadline that finds you

Everything above only surfaces if someone asks. RegData is different: your regulatory returns are due on fixed dates, and the system knows the moment one is late. A missed return triggers an administrative charge and, more importantly, a mark against the firm — it is the single fastest way for a small firm to move from unnoticed to noticed.

The frustrating part is that it's rarely a competence problem. Small firms miss returns because the deadline lived in one person's head and that person was on holiday, or left, or was simply busy. The fix isn't expertise. It's a tracked list of what's due, when, and who owns it — somewhere that reminds you before the date rather than after it.

5. What a request actually looks like

Information requests are usually unremarkable. An email arrives from the FCA asking the firm to provide, within ten working days: the complaints register for the last twelve months, current Statements of Responsibilities for each Senior Manager, the most recent Consumer Duty board report, and conduct-rules training records for all staff.

Now picture two firms receiving it.

The first keeps its records in one place. The director opens the system, exports each item, checks the dates, and sends the response the same afternoon. Total time: about an hour. What the supervisor receives is dated, consistent and complete — and it quietly answers a question that was never asked, which is whether this firm is in control of itself.

The second firm has everything, sort of. The complaints log is a spreadsheet with three versions in a shared drive. The Statements of Responsibilities are attachments in an inbox somewhere. Training happened, but the record is a calendar invite. The director spends most of a week reconstructing twelve months of activity, and what goes back — dates that don't quite line up, entries written in one sitting — looks reconstructed. Supervisors read the state of a firm's records as evidence about the firm itself. Both firms may be equally diligent. Only one of them can prove it.

The recording layer, handled

Everything in this article is a recording problem, not a knowledge problem. You already know what your complaints are, who your Senior Managers are, and what your board discussed. The gap is a place where those facts get written down — dated, owned, and retrievable a year later.

That layer is exactly what Fenchurch One systematises: the registers, People records for SM&CR, reminders for what's due, and board-ready reports built from what you've actually recorded. It won't exercise judgement for you — nothing should — but it makes "show me" a one-hour job instead of a lost week.