Nine risks that can emerge when regulated firms grow

What happened?

What did the FCA’s high-growth firms review find? 

The FCA has published examples of good practice and areas for improvement identified through its work with high-growth firms in the payments, asset management and wealth management sectors. This forms part of the Early and High Growth Oversight Pilot, an FCA supervisory initiative designed to identify rapidly growing regulated firms, so governance, risk management and controls keep pace with their expansion.  

Following this review of 15 firms, which took place between July 2025 and March 2026, the FCA has set out examples of what is being done well, and what areas require improvement. 

Why does it matter?

The review’s findings matter because firms in these markets can scale quickly, while governance, compliance and controls develop more slowly, which can increase the risk of consumer harm.  

For instance, changes in customer profiles or target markets may prompt firms to revisit suitability arrangements, fair-value monitoring and product reviews. If the firm has scaled rapidly, its arrangements should remain proportionate to its current size, complexity and risk profile, rather than relying on controls designed for an earlier stage of growth. 

Who is affected?

Regulated firms affected by the FCA’s review 

The review’s findings are relevant to firms in the payments sector, asset management and wealth management. The regulator notes this is particularly relevant to newly established firms, those experiencing rapid growth, and any organisation in this sector that has undergone significant change.  

Within such firms, the board, senior management and those responsible for compliance and risk oversight are encouraged to consider whether their arrangements are suitable, based on the review’s practice examples.  

The FCA also factored in how data can help it identify high-growth firms and enable earlier and more targeted supervisory engagement. The data signals signs of growth by considering factors such as revenue, expenditure, staff expansion and changes in permissions or control. 

Key risks

How the FCA’s findings translate into nine practical risk areas  

Drawing on the FCA’s findings, we have identified nine practical risk areas for growing firms to consider: 

Governance failing to scale 

Board and committee structures can quickly become unsuitable as firms expand, acquire businesses or introduce products. The FCA found cases where meeting structures, responsibilities and governance arrangements had not evolved alongside the firm.

Insufficient challenge and unmanaged conflicts 

When responsibility is concentrated among a small leadership group, independent scrutiny can suffer. The FCA identified weaknesses in some firms’ conflict-management arrangements. Conversely, stronger firms demonstrated how conflicts arising from group relationships, shared resources and combined senior-management roles were escalated and monitored. 

Poor records and outdated management information (MI) 

Boards need accurate and timely information to oversee a growing business. However, the FCA identified missing or incomplete minutes and MI that still referred to superseded documents or meetings, thereby making it difficult to evidence effective challenge and decision-making. 

Immature risk management frameworks 

Growth often introduces risks that informal processes are no longer equipped to manage. Stronger firms addressed this through defined risk appetites, key risk indicators and risk committees that escalated significant issues to the board. 

Resource and capability gaps 

Compliance and operational capacity may need to develop alongside commercial activity. The FCA found that some firms relied heavily on key individuals, with limited contingency arrangements, succession planning or wider knowledge transfer. 

Third-party, technology and AI risks 

Outsourcing, automation, platform change and AI may support growth, but they also create additional governance, data, cyber and operational risks. The regulator observed that controls and resources were not always reassessed as supplier relationships expanded or new technologies were introduced.  

Consumer Duty and consumer-outcomes risks 

A firm’s products, customers, and target markets may change significantly during growth. In some cases, suitability frameworks were not reviewed frequently enough to reflect these changes, and customer outcomes and fair value were not actively monitored.  

Financial resilience and weak wind-down planning 

Rapid expansion can place additional pressure on liquidity, capital and counterparty exposures. Firms that demonstrated good practice used stress-testing to understand how they would perform under adverse conditions – others had wind-down plans that were outdated, impractical or disproportionate. 

Regulatory change risk 

Firms that do not monitor regulatory developments may react too late or expand before their controls are ready. The FCA highlighted better practice where firms prepared early for safeguarding requirements or delayed new regulated activities until their existing control environment was sufficiently robust.

Actions to take

A useful starting point is to assess whether governance, resources and controls remain appropriate for the firm’s current size, scale, complexity and risk profile – not the business it was before expansion. This can combine immediate improvements with longer-term planning. 

• Review governance arrangements: Check that board and committee structures, responsibilities and reporting lines remain clear and effective 

• Assess leadership capability and capacity: Consider whether senior managers collectively have the skills, experience and capacity needed to oversee growth 

• Identify resource gaps: Examine succession arrangements, dependencies, training needs and potential points of failure 

• Strengthen independent challenge: Explore whether conflicts are being identified and managed effectively and whether boards receive sufficient objective scrutiny. Seeking independent compliance expertise can be beneficial 

• Improve records and MI: Clear minutes can capture attendance, challenge decisions, and agreed actions. Board reporting may also cover growth, Consumer Duty, advice quality and risk, compliance and operational resilience 
• Test financial resilience: Stress testing can help firms understand the potential effect of adverse scenarios on liquidity, capital and their cost base. It is also worth checking that wind-down plans remain current and practical.  

Wider implications

As a firm develops, scalable governance and enterprise-wide risk-management frameworks can help it respond to future growth and change. Other areas of focus may include stronger customer-outcomes monitoring and more mature oversight of technology, AI, cyber risks and third parties.  

A structured approach to horizon scanning can help firms anticipate regulatory developments rather than responding after risks have materialised. Periodically testing whether the firm could provide meaningful evidence of effective oversight and good customer outcomes may support regulatory readiness. 

Ultimately, growth plans and control readiness are best considered together. Firms may benefit from assessing whether governance, risk management, resources and oversight arrangements are sufficiently mature before introducing significant business change, such as acquisition, product launch or new regulated activity. Where gaps are identified, addressing them early may support more sustainable growth and reduce the risk of future operational, consumer and regulatory issues.