Compliance Outsourcing: What FCA-Regulated Firms Can and Can’t Outsource
Many FCA-regulated firms, especially smaller ones, outsource part of their compliance work to specialist providers: monitoring, file checking, financial promotions reviews, training or customer due diligence. Done well, outsourcing gives a firm expertise it couldn’t afford in-house. Done badly, it leaves a firm believing it’s covered when no one inside the business really understands its risks. This guide explains what you can outsource, what must stay with the firm, the FCA’s rules, and how fractional Senior Managers fit in.
The Basic Principle: You Can Outsource the Work, Not the Responsibility
The FCA’s rules on outsourcing are in SYSC 8. The central principle is that a firm remains fully responsible for meeting its regulatory obligations when it outsources a function. The provider does the work. The firm, and its Senior Managers, remain accountable for the outcome.
That has a practical consequence. A firm that outsources compliance still needs someone inside the business, usually an approved Senior Manager, who understands the work, oversees the provider and can answer the regulator’s questions.
What You Can and Can’t Outsource
| Activity | Can it be outsourced? | Notes |
|---|---|---|
| Compliance monitoring and testing | Yes | One of the most commonly outsourced activities |
| File reviews and quality checking | Yes | Common at advice and mortgage firms |
| Financial promotions reviews | Yes | Approval decisions should still be owned by the firm |
| Training and competence support | Yes | The firm remains responsible for staff competence |
| Customer due diligence checks | Yes, with care | The firm remains responsible for decisions and risk assessments |
| Policy drafting and regulatory change support | Yes | Policies must be adopted and owned by the firm |
| Regulatory reporting preparation | Yes | Senior Managers remain responsible for accuracy |
| The SMF16 Compliance Oversight function | No, as a responsibility | It must be held by an approved individual, who can be external and fractional |
| The SMF17 MLRO function | No, as a responsibility | It must be held by an approved individual, who can be external and fractional |
| Board and Senior Manager accountability | No | Cannot be delegated outside the firm |
Outsourcing the Compliance Officer or MLRO
A common question is whether a firm can simply “outsource its compliance officer”. The answer is nuanced. At firms in the Senior Managers regime, the compliance officer (SMF16) and MLRO (SMF17) functions must be held by named individuals approved by the FCA. Those individuals don’t have to be employees: many smaller firms appoint an external, fractional Senior Manager who works a set number of days a month and is approved at the firm.
What a firm can’t do is hand the responsibility to a consultancy and have no approved individual accountable. Our guide to who can be your MLRO or compliance officer answers the related questions.
Outsourced Compliance vs Fractional Senior Managers
| Outsourced compliance provider | Fractional Senior Manager | |
|---|---|---|
| What you get | A team carrying out defined compliance tasks | An approved individual holding SMF16 and/or SMF17 at your firm |
| Accountability | Stays with your firm’s Senior Managers | The fractional holder is personally accountable for their function |
| Best for | Firms with an internal compliance lead who needs support | Smaller firms without a suitable internal compliance officer or MLRO |
| Used together? | Often: the provider carries out monitoring and file checks | Often: the fractional holder oversees the provider and reports to the board |
Our comparison of fractional and full-time compliance officers sets out the costs and risks of each, and our page on fractional and interim SMF cover explains how fractional arrangements work.
The FCA’s Outsourcing Rules
When a firm outsources critical or important operational functions, SYSC 8 requires it to:
SYSC 8 outsourcing essentials
- Assess the provider’s ability, capacity and any authorisation required before appointing
- Have a written agreement setting out each party’s rights and obligations
- Keep the expertise to supervise the outsourced function and manage the risks
- Monitor the provider’s performance on an ongoing basis
- Make sure the FCA and the firm’s auditors can access data and premises
- Have contingency and exit plans if the provider fails or the arrangement ends
- Notify the FCA of material outsourcing arrangements where required
Firms using cloud and third-party IT providers should also follow the FCA’s guidance on outsourcing to the cloud. Dual-regulated firms must meet the PRA’s expectations in its supervisory statement on outsourcing and third-party risk. Outsourcing is also central to operational resilience. See our operational resilience guide.
Choosing an Outsourced Compliance Provider
- Sector experience: a provider that understands your activities, whether advice, consumer credit, payments or investment management.
- Clear scope: exactly what they’ll do, how often and what they’ll report.
- Quality of people: who will actually do the work, and their experience.
- Independence: no conflicts with your business or other clients.
- Reporting: findings your Senior Managers and board can act on.
- Exit terms: how records and knowledge transfer if you change provider.
Common Mistakes
- assuming the provider is responsible, with no one internally overseeing their work
- no approved SMF16 or SMF17, or a director nominally holding the role without the time or expertise
- a scope too narrow for the firm’s risks, leaving gaps no one owns
- findings reported but not acted on
- no exit plan, leaving the firm exposed if the provider leaves
A mortgage and protection broker leaves its network to become directly authorised. It appoints a fractional compliance officer and MLRO two days a month, approved as SMF16 and SMF17, and an outsourced provider for file checking and financial promotions reviews. The fractional compliance officer sets the monitoring plan, reviews the provider’s findings each month and reports to the board quarterly. The FCA asks about the arrangement during authorisation, and the clear split between oversight and outsourced work satisfies its questions.
When to Bring Compliance In-House
As firms grow, outsourcing often gives way to an in-house team. Signs it’s time include rising volumes of advice or transactions, more complex products, supervisory attention, a skilled person review, or moving from Core to Enhanced status. See our guides to becoming an Enhanced firm and section 166 reviews.
Outsourcing and Firms Outside the SMCR
Payment institutions, e-money institutions and crypto-asset businesses aren’t in the Senior Managers regime, but the same principle applies: they can outsource compliance tasks, not responsibility, and the FCA expects an MLRO and management who understand and oversee the work. See payment and e-money institution authorisation.
Compliance Without the Gaps
Fractional, interim and permanent compliance leadership. Every SMF search is led personally by Adrian Lawrence FCA
Fractional Compliance
An approved Senior Manager, part-time.
→ Fractional and interim cover
→ Fractional or full-time?
Compliance Leadership
Permanent appointments.
→ Compliance officer (SMF16)
→ MLRO (SMF17)
Firm Change
When outsourcing needs to change.
→ Going directly authorised
→ Appointed representatives
Resilience
Third-party and outsourcing risk.
→ Operational resilience
→ COO recruitment (SMF24)
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
Can compliance be outsourced?
Compliance tasks can be outsourced, but the firm remains responsible, and at SMCR firms, an approved individual must hold the compliance oversight function.
Can the MLRO role be outsourced?
The work can be supported externally, and the MLRO can be an external fractional individual, but they must be approved as SMF17 at SMCR firms. The responsibility can’t be handed to a provider.
What is SYSC 8?
The part of the FCA Handbook setting out the rules for outsourcing, particularly of critical or important functions.
Do we need to tell the FCA about outsourcing?
Firms must notify the FCA of material outsourcing arrangements where required. Check SYSC 8 and the notification rules for your firm.
Is a fractional compliance officer the same as outsourced compliance?
No. A fractional compliance officer is an approved Senior Manager at your firm. An outsourced provider carries out tasks under your oversight. Many firms use both, with the fractional Senior Manager overseeing the provider’s work.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally, including fractional compliance officers and MLROs who oversee outsourced compliance providers. View Adrian’s ICAEW profile.
Need an Approved Compliance Officer Without a Full-Time Hire?
A fractional SMF16 or SMF17 can give you accountable oversight at a fraction of the cost. Tell us about your hire.