Drift, Not Decision: Auditing the Small Product Changes That Pull UK Firms into Regulated Activity

Regulated activity rarely announces itself. It arrives as a checkout option, a warranty bundle, a subscription tier or a referral arrangement that seemed commercially sensible at the time. By the moment a regulator, lender or insurer asks the question, the firm may already have been operating outside the scope of its permissions for several months.

The consequences are not merely administrative. Under the Financial Services and Markets Act 2000, carrying on a regulated activity by way of business in the UK without authorisation or an applicable exemption is a criminal offence, and related agreements can be unenforceable. Yet the gap is seldom the product of a deliberate decision. It is the product of drift.

Why scope creep escapes the usual controls

Most firms map their regulatory permissions to the business model that existed when the application was prepared, and then treat that mapping as settled. Product, marketing and commercial teams keep iterating, often at a pace that outruns the annual compliance review. A new payment provider, a revised terms schedule or a white-label partnership can change the legal character of what the firm does without changing its internal description of itself.

The FCA's Perimeter Guidance is explicit that the analysis turns on the actual arrangements, not the label used in a marketing deck. That is precisely where drift hides: the firm believes it is selling software, while the customer journey looks like arranging, advising or broking.

The drift points worth testing

Payment and credit options

Buy-now-pay-later at checkout, instalment plans and lender introductions are common sources of unplanned credit broking. If the firm introduces a customer to a lender and receives commission, an exemption may apply, but the exemptions are narrow and fact-specific. A commercial team describing the arrangement as a marketing partnership does not change the regulatory analysis.

Protection products and warranties

Extended warranties, gadget cover and guaranteed asset protection products can amount to insurance distribution. The ancillary intermediary route is not a blanket permission, and the conditions attached to it are often overlooked when a product is bundled into a subscription.

Arranging and introductions

The arranging activity in Article 25 of the Regulated Activities Order is broad. A helpful introduction to an investment platform, a pension provider or an insurer, particularly where a fee changes hands, deserves a documented perimeter view rather than an assumption.

Subscription and membership adjustments

Recurring payments are not, by themselves, regulated. But a subscription that embeds a credit facility, deferred payment terms or a membership benefit resembling a credit token may cross a line that the pricing team never saw.

Claims, debt and redress services

Claims management in relation to financial services is regulated by the FCA, and debt advice and debt adjusting are regulated activities. Firms that add a help-with-complaints service or a debt support hub should test the position before launch, not after.

Cross-border and outsourced delivery

The territorial scope of UK permissions is easy to misread when delivery teams sit overseas or when a group entity sells into the UK. Appointed representative arrangements add a further layer that requires active oversight rather than a signed agreement in a drawer.

Running the audit: four steps

Step one is inventory. List every customer-facing product and service at the level of the customer journey, not the organisational chart. Include free services, because an introductory service that generates commission is unlikely to be genuinely free in regulatory terms.

Step two is mapping. For each journey, identify the activities performed, who performs them, who pays whom, and where the contractual obligation sits. Map each against the Regulated Activities Order and the relevant perimeter guidance.

Step three is exclusion testing. Where an exemption is claimed, record the specific provision relied on and the facts that satisfy it. An exemption asserted without evidence is not an exemption; it is a hope.

Step four is triage. Each gap should be assigned one of four outcomes: obtain a variation of permission, appoint an authorised representative, restructure the arrangement to fall outside the perimeter, or stop the activity pending advice. Every outcome needs a named owner and a date.

Turning the review into a permissions health check

A single audit dates quickly. The more durable control is a permissions health check that runs on a fixed cadence and is triggered by change. A quarterly product and pricing gate, an annual full perimeter review, and a standing agenda item at the board or risk committee will catch most drift before it becomes a breach.

Ownership should sit with Compliance but the inputs must come from Product, Finance, Legal and Commercial. The output should be a short, version-controlled document that states, in plain terms, the boundary conditions under which the current permissions remain valid. Where those conditions change, the health check restarts.

Evidence that survives external scrutiny

The evidence pack should include the permissions matrix, the decision log for each judgement, any external legal advice obtained, product approval minutes, and training records showing that commercial teams understand the perimeter. Lenders, insurers and acquiring banks increasingly ask for this material during due diligence, and a firm that cannot produce it will be treated as a risk regardless of whether a breach has occurred.

None of this is an argument for caution at the expense of growth. It is an argument for making drift visible while it is still cheap to correct. The audit is not pessimistic; it is the difference between discovering a permissions gap in a board pack and discovering it in a regulator's letter.