The FCA conducted an Early and High Growth Oversight pilot between July 2025 and March 2026, engaging with 15 firms within the asset management, wealth management, and payments sectors. This initiative aimed to identify rapidly growing firms at an earlier stage to support them as they evolve their business models. While rapid growth can benefit consumers by increasing choice and improving services, it also presents significant risks if expansion is prioritised over the development of robust governance, risk management, and control frameworks.

Who this applies to

The findings in this report are relevant to authorised firms that are newly established, experiencing rapid growth, or undergoing significant change. It is particularly pertinent to those operating in the asset management, wealth management, and payments sectors. The review is intended for Boards, individuals in senior management functions, and those responsible for risk, compliance, and operational oversight. These individuals are essential in ensuring that firms maintain appropriate governance arrangements and focus on delivering good outcomes for consumers and markets, regardless of the firm’s size or business model.

What we looked at

Through the pilot, the FCA sought to better understand how firms grow, the characteristics of sustainable growth, and the specific points at which risks begin to emerge. The regulator used a data-led approach to identify firms exhibiting signs of growth, such as changes in revenue, expenditure, staff numbers, and permissions or control. Direct engagement was then undertaken with each firm to assess whether their governance, risk management, and control arrangements were effectively keeping pace with their expansion.

Governance and senior management oversight

Firms identified as having stronger arrangements ensured that their frameworks kept pace with business growth. Good practices included having clear Board and Committee structures with defined roles, regular oversight of risk and compliance matters, and high-quality management information (MI) to support decision-making. These firms also documented decisions and challenges properly to ensure transparency. Furthermore, they strengthened their governing bodies by ensuring a right mix of skills and experience, often including independent or non-executive members. This was notably evident in payments firms that utilised a mix of payments, fintech, and senior governance expertise.

Areas for improvement included governance arrangements that lagged behind business growth. In some instances, Board and Committee structures were ineffective in terms of scope, frequency, and meeting format. Some firms lacked sufficient independent challenge, with responsibilities concentrated among a small number of individuals. Weaknesses were also observed in record-keeping, such as incomplete or missing meeting minutes and poor documentation of attendance, quorum, conflicts, and follow-up actions.

Risk management frameworks

Stronger firms possessed mature risk management approaches, often using risk-focused committees to review enterprise-wide risks and escalate issues to the Board. These were supported by clear risk appetites and key risk indicators. Some firms also reduced dependency on single individuals through cross-training and knowledge sharing. Conversely, areas for improvement included heavy reliance on key individuals without adequate contingency or succession planning. Some firms failed to adjust their risk management resources to match the increasing scale and complexity of the business, particularly as third-party relationships deepened or new technologies like AI were introduced. Outdated policies that failed to reflect evolved business models or changes in target markets were also identified as weaknesses.

Resourcing, capability and scalability

Stronger firms invested in staff recruitment, training, and technology to ensure scalability. They strengthened compliance functions through additional resourcing, updated financial crime frameworks, and enhanced transaction monitoring. These firms demonstrated forward-looking regulatory judgement, such as preparing early for upcoming safeguarding requirements or delaying expansion until controls were robust. Tools like the Regulatory Initiatives Grid were highlighted as helpful for anticipating developments. However, weaknesses were found where internal policies and procedures had not evolved alongside changes in customer populations or business models, particularly regarding the regular review of suitability frameworks.

Systems, controls and management information (MI)

Good practice included proactive cyber and operational resilience arrangements, such as penetration testing and third-party oversight. Strong conflict management involved identifying conflicts arising from group relationships, co-manufacturing, and shared resources. Some firms showed they had learnt from previous cyber incidents to strengthen their resilience. Areas for improvement included outdated MI and insufficient conflict of interest arrangements. Outdated MI, including references to superseded documents, undermined the quality of oversight. Weaknesses in cyber controls, change control, and data governance were also noted, especially when introducing automation or AI.

Financial resilience

Firms with strong financial resilience proactively monitored liquidity and counterparty exposures. Some used stress testing to ensure their cost base remained resilient and that they could meet regulatory capital requirements during periods of stress. In contrast, some firms needed to strengthen their planning, as wind-down plans were often found to be not current, practical, or proportionate. Effective planning is crucial to prevent failure or to facilitate an orderly wind-down, reducing consumer harm. Firms are encouraged to supplement these plans with an understanding of notification obligations such as SUP 15.

Consumer and market outcomes

Stronger firms maintained active oversight of products and services through regular reviews, benchmarking, and transparent reporting. They also conducted due diligence on providers with customer outcomes in mind, aligning with expectations under the Consumer Duty. Some firms used client feedback to inform growth decisions. However, some firms needed to put more emphasis on assessing customer outcomes and fair value. Without active monitoring, firms risk failing to identify if products remain appropriate for their target market, thereby increasing the risk of foreseeable harm.

Next steps

The FCA has provided individual feedback to the firms involved in the pilot. All firms experiencing growth are encouraged to reflect on these findings and assess whether their arrangements remain appropriate for their size and complexity. The FCA will use these insights to inform its future supervisory approach and considers how data-led methods can support the earlier identification of emerging risks and targeted interventions.