Policies

When describing your policies, it can be helpful to group them into themes rather than providing a long list of individual documents.

These policies help ensure the business operates in line with FCA requirements and delivers good customer outcomes.

This may include areas such as Consumer Duty, complaints handling, regulatory compliance procedures and governance responsibilities.

The FCA will be looking for evidence that regulatory requirements have been built into your operating model from the outset.

Insurance brokers are expected to have appropriate controls in place to prevent financial crime and protect the integrity of the market.

Common policies include:

Anti-money laundering.
Anti-money laundering.
Sanctions compliance.
Conflicts of interest.
Whistleblowing arrangements.

You do not need to provide extensive detail, but you should be able to demonstrate that these risks have been considered and documented.

Customer information is a critical asset for any brokerage and the FCA will expect firms to demonstrate appropriate safeguards.

Your policy framework may include provisions covering:

GDPR compliance.
Data handling and retention.
Information security.
Subject access requests.
Data breach management.

Where third-party systems or service providers are used, it may also be helpful to explain how information security risks are managed.

A number of operational policies help ensure the business can continue to function effectively and respond to unexpected events.

Depending on your business model, this may include areas such as:

Business continuity and disaster recovery.
Cyber security.
Staff training and competence.
Health and safety.
Payment processing controls.

The FCA is not necessarily assessing the detail of these policies, but it does want confidence that the firm has considered how it will manage operational risks.

Some applications include a lengthy list of policies but provide little explanation of why they are needed or how they support the business. Other common issues include:

Policies that do not align with the firm’s proposed activities.
Missing policies in key risk areas such as financial crime or complaints handling.
Templates that have not been tailored to the business.
No clear ownership or review process for policies.