The Financial Conduct Authority (FCA) has published findings from its Early and High Growth Oversight pilot, looking at how firms manage governance, risk, and controls during periods of rapid growth.
Between July 2025 and March 2026, the FCA worked with 15 firms across asset management, wealth management, and payments. Its findings highlight an important point: growth does not necessarily create governance problems, but it can expose existing weaknesses or mean that arrangements which worked for a smaller business are no longer enough.
In this article, we take a look at some of the key takeaways from the FCA’s pilot, and what it means for firms.
Governance Needs to Evolve With the Business
The FCA found that firms with stronger arrangements had clear Board and Committee structures, defined responsibilities, and effective oversight of risk and compliance. Some firms had also strengthened their Boards as they grew by bringing in additional skills and experience.
Management information (MI) was another important area. As a business grows, the information needed by the Board and senior management is likely to change. The FCA found examples where outdated MI reduced the quality of oversight and made it more difficult to identify issues promptly.
This does not mean governance needs to become more complicated as a firm grows. Instead, firms should consider whether their existing arrangements continue to provide the oversight, information, and challenge needed to manage a larger or more complex business.
Risk, Controls and Resources
Growth can change a firm’s risk profile, even where its core products and services remain broadly the same. More customers and transactions, new markets, additional employees, greater use of technology or increased reliance on third parties can all place additional pressure on existing arrangements.
The FCA found examples where firms had strengthened Compliance resources, financial crime frameworks, and transaction monitoring as they developed. It also found cases where policies and controls had not been updated following changes to the business, or where firms remained overly reliant on key individuals.
Resources are therefore an important part of the picture. Compliance, Risk and other control functions need sufficient people, expertise, and systems to provide effective oversight as the business grows.
What Should Firms Be Looking At?
The FCA’s findings provide a useful opportunity for growing firms to consider whether their existing arrangements still reflect the business as it operates today – and where it is heading.
Boards and senior management may wish to consider:
- whether MI continues to provide a clear picture of the firm’s key risks;
- whether Compliance, Risk and financial crime functions have sufficient resources;
- whether senior management can maintain effective oversight as the business becomes more complex;
- whether risk assessments and controls reflect changes in customers, products, markets and third parties; and
- whether operational resilience, financial crime controls and customer monitoring would remain effective at greater scale.
The aim is not simply to add more policies, committees, or people. It is to make sure the firm’s arrangements remain appropriate as its size, complexity, and risk profile change.
Next Steps for Firms
The FCA’s review shows that growth and good governance are not competing objectives. However, arrangements that were appropriate at one stage of a firm’s development may not remain so as the business expands.
Firms experiencing or planning significant growth should therefore consider the regulatory and risk implications alongside the commercial opportunity. Reviewing governance, MI, resources, and controls as part of growth planning can help identify weaknesses before they result in control failures, customer harm, or regulatory concerns.
The FCA has said that the findings from the pilot will inform its approach to supervising high-growth firms. For firms in the payments sector in particular, the review provides a useful indication of the areas the FCA may focus on as businesses develop.
If you have questions about how the FCA’s findings may affect your business, or would like support reviewing your governance, risk and control framework, please contact an API Compliance consultant using the form below.
