The registers every FCA-regulated firm keeps, and the two most firms forget

A register is a firm’s memory. It is where a decision, an event or a check is written down with a date, an owner and the evidence, so that six months later, or six years later, the firm can show what happened and what it did about it. When the FCA asks a firm to demonstrate compliance, the registers are usually the first thing it asks for, and it asks for them by name.

Twelve turn up in almost every firm. Two more are required in one form or another by almost every firm and kept by surprisingly few. This article lists all fourteen, says what each must contain and which rule sits behind it, and finishes with what it takes to keep them so that they are worth having. Rule references are given so you can go to the source. It is a practitioner’s read, not legal advice.

What every register entry needs

Whatever the subject, an entry that will stand up has the same bones: the date it was raised; who owns it; what happened, in plain terms; the assessment made and by whom; the action taken; the evidence, attached or referenced; the date it was closed; and, where a review is due, when. A register that holds only the event and not the decision is a diary, not a control.

The twelve every firm keeps

1. Complaints

DISP 1.9.1R requires a record of each complaint received and the measures taken to resolve it, kept for at least three years from the date it was received. The entry should hold the complainant, the date received, the subject, the eight-week clock, whether it was resolved within three business days, the final response, whether the complainant was told of the right to go to the Financial Ombudsman Service, any redress, and the root cause. The register is also the source for your complaints return and for the trend analysis the Consumer Duty expects.

2. Conflicts of interest

SYSC 10.1.3R requires a firm to identify conflicts between itself and its clients and between one client and another; SYSC 10.1.7R requires arrangements to manage them; SYSC 10.1.10R requires a written policy. The register is SYSC 10.1.6R: a record, kept and regularly updated, of the kinds of service or activity in which a conflict entailing a material risk of damage to a client has arisen or may arise. Each entry needs the conflict, who is affected, the controls applied, whether disclosure was made, and the review date.

3. Breaches

Principle 11 and SUP 15.3.11R require a firm to notify the FCA immediately of a significant breach of a rule. You cannot judge significance without a record of every breach, significant or not. The entry needs the rule breached, how it was found, the customer impact, the root cause, the remediation, whether it was notifiable and, if it was, when the FCA was told. Breach trends are also what the compliance monitoring the FCA expects under SYSC 6.1.1R is meant to act on.

4. Gifts and entertainment

The inducement rules in COBS 2.3 and 2.3A for investment business, and the guidance in ICOBS 2.3 for insurance distribution, treat hospitality and gifts as inducements that can compromise the duty to act in the client’s best interests. The Bribery Act 2010 sits behind them. The register records what was offered or received, by whom, from whom, its value, whether it was approved and by whom, and whether it was declined. A threshold in the policy without a register to test it against is a threshold nobody can evidence.

5. Financial promotions

COBS 4.11.1R requires an adequate record of every financial promotion a firm communicates or approves, kept for three years in most cases and longer for pensions, life and MiFID business. The entry holds the promotion itself or a reference to it, the channel, who approved it and when, the version, the date it was withdrawn and, where a firm approves promotions for others under section 21 of FSMA, the approval and its conditions. Consumer credit and insurance firms keep the same kind of record for promotions governed by CONC 3 and ICOBS 2.2.

6. Fraud

SYSC 6.1.1R requires policies and procedures for countering the risk that the firm is used to further financial crime, and fraud is financial crime. For large organisations the failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 has applied since September 2025. The register records suspected and confirmed fraud, internal and external, the loss, the customer impact, the investigation, any referral to the police or Action Fraud, and the control change that followed.

7. Whistleblowing

SYSC 18.3.1R requires UK banks and building societies (other than small deposit takers) and Solvency II insurers to keep arrangements for reportable concerns, including a record of each one. Every other firm may adopt the same arrangements as best practice, tailored to its size (SYSC 18.1.1CG), and the Public Interest Disclosure Act 1998 protects the worker either way. The register holds each concern, whether it was anonymous, its assessment, the outcome, any report to the FCA or PRA, and confirmation that nobody was victimised. Where the rules apply, it is reported to the board annually.

8. Data subject access requests

Article 15 of the UK GDPR gives an individual the right to their data, and Article 12(3) requires a response without undue delay and within one month, extendable by two months for a complex request. The register holds the date received, the identity check, the scope, any extension and its reason, the exemptions applied, the date sent and what was withheld. The Information Commissioner’s Office asks for exactly this when a complaint reaches it.

9. Personal data breaches

Article 33(5) of the UK GDPR requires a controller to document every personal data breach, its effects and the remedial action taken, whether or not it was reportable. Article 33(1) requires notification to the ICO within 72 hours where there is a risk to individuals, and Article 34 requires the individuals to be told where the risk is high. The register carries the facts, the risk assessment, the decision on notification and its reasoning, the notifications made with dates, and the fix. A breach assessed as not reportable must still be in it.

10. Politically exposed persons

Regulation 35 of the Money Laundering Regulations 2017 requires senior management approval before a business relationship with a PEP, a family member or a known close associate is established or continued, adequate measures to establish source of wealth and source of funds, and enhanced ongoing monitoring, continuing for at least 12 months after the person leaves office. Since 2024, regulation 35(3A) makes a domestic PEP a lower-risk starting point unless enhanced risk factors are present. The register records the match, the risk assessment, the approval and who gave it, the source of wealth and funds evidence, the monitoring schedule and the date the treatment ended.

11. Call monitoring

Firms in scope of SYSC 10A must record telephone conversations and electronic communications relating to in-scope investment activity (SYSC 10A.1.6R), keep them for five years, or seven if the FCA asks (SYSC 10A.1.14R), and periodically monitor the records (SYSC 10A.1.15R). For everyone else, call monitoring is how a firm evidences the consumer understanding outcome of the Consumer Duty (PRIN 2A.5) and the competence of its people (SYSC 5.1.1R). The register records the calls sampled, the scoring, the failings found, the feedback given and the retraining that followed.

12. Suitability and demands and needs

COBS 9.5.2R requires suitability records to be kept for three years, five for life policies and pensions, and indefinitely for pension transfers, with COBS 9A carrying the equivalent for MiFID business; ICOBS 5.2 requires a statement of demands and needs for insurance. The register is the index to those files: the client, the date, the adviser, the recommendation, the file review outcome and any remediation. It is what lets a firm answer the question the FCA asks most in advice reviews: how do you know the advice was suitable?

The two most firms forget

13. Conduct rule breaches

The Conduct Rules in COCON apply to almost everyone in a firm under the Senior Managers and Certification Regime. Section 64C of FSMA and SUP 15.11.6R require a firm to notify the FCA when a breach of the rules is the reason for disciplinary action. For senior managers that notice goes within seven business days under SUP 10C; for everyone else it goes once a year on REP008, covering the 12 months to 31 August, within two months of that date (SUP 15.11.13R). Regulatory references under SYSC 22 must disclose conduct rule breaches over the previous six years, and SYSC 22.9.1R requires the records to support that.

Most firms have no register because, they say, they have had no breaches. That is the wrong test. The register is where a firm records its assessment of every incident against the rules, including the ones found not to be breaches, so that the annual return, the reference and the answer to the regulator’s question are all built on the same record. Section 64B(2) of FSMA also requires the firm to have told its people the rules and taken reasonable steps to ensure they understood them, which leads to the next register.

14. Training and CPD

SYSC 5.1.1R requires a firm to employ people with the skills, knowledge and expertise for their responsibilities. TC 2.1 sets the competence and continuing professional development requirements for people in scope, including 35 hours a year for retail investment advisers, and TC 3.1.1R requires records to demonstrate compliance, kept for three years after the person stops the activity, five for MiFID business and indefinitely for pension transfer specialists. For insurance distribution, SYSC 28.2 requires the knowledge and ability for the role, with at least 15 hours a year for long-term insurance staff and a record of their training kept for three years (SYSC 28.4). Regulation 24(1)(b) of the Money Laundering Regulations 2017 requires a written record of the financial crime training given to relevant employees. The conduct rules training under section 64B(2) of FSMA has to be evidenced somewhere too.

Training happens in most firms. The record rarely does. The register holds, per person, what was delivered, by whom, when, for how long, whether it was assessed, and when it is next due. When the regulator asks who has been trained on the Consumer Duty and when, the answer is a filter on this register or a week of reconstruction.

Keeping them so they are worth having

Three things separate registers that protect a firm from registers that embarrass it.

• One place. A register in a spreadsheet on one person’s laptop is not a firm record. It needs to be where the firm can find it, with access controlled and changes logged.
• Dates and owners on every line. An entry without an owner is nobody’s problem, and an entry without a date cannot be shown to have been timely.
• A review rhythm. Every register needs a date on which someone looks across it for trends: complaints by product, breaches by root cause, gifts by counterparty. That review is what turns a record into a control, and it is what the monitoring the FCA expects under SYSC 6.1 is asking for.

Fenchurch One holds all fourteen. Eight core registers come with every plan (breaches, complaints, conflicts of interest, gifts and entertainment, financial promotions, fraud, the risk register and an ad hoc register), the full library of 29 registers and 13 attestations comes in from Growth (including whistleblowing, data subject requests, personal data breaches, PEPs, call monitoring, suitability reports and conduct rule breaches), and the form builder on every plan lets a firm build the training and CPD register, or any other, in minutes. Every entry is dated, owned and evidenced, review dates land in the Control Centre, and the proof pack and Live Link produce the lot on demand.