CP26/20: Adapting our rules for a changing market: self-invested personal pensions

Consultation Paper CP26/20** Adapting our rules for a changing market: self-invested personal pensions June 2026

How to respond We are asking for comments on this Consultation Paper (CP) by 24 August 2026. You can send them to us using the form on our website. Or in writing to: Pensions Policy Financial Conduct Authority 12 Endeavour Square London E20 1JN Email: cp26-20@fca.org.uk All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. Disclaimer When we make rules, we are required to publish: • a list of the names of respondents who made representations where those respondents consented to the publication of their names, • an account of the representations we receive, and • an account of how we have responded to the representations. In your response, please indicate: • if you consent to the publication of your name. If you are replying from an organisation, we will assume that the respondent is the organisation and will publish that name, unless you indicate that you are responding in an individual capacity (in which case, we will publish your name), • if you wish your response to be treated as confidential. We will have regard to this indication, but may not be able to maintain confidentiality where we are subject to a legal duty to publish or disclose the information in question. By responding to this publication, you are providing personal data to the FCA, including your name, contact details (including, if provided, details of the organisation you work for), and any opinions expressed in your response. This data will be used by the FCA to inform regulatory policy and rulemaking, in the public interest and in the exercise of official authority under FSMA and other applicable legislation. The FCA may share personal data where necessary to perform their public tasks and to support regulatory cooperation and joint policy development. Please note that we will not regard a standard confidentiality statement in an email message as a request for non-disclosure. Irrespective of whether you indicate that your response should be treated as confidential, we are obliged to publish an account of all the representations we receive when we make the rules. Further information on about the FCA’s use of personal data can be found on the FCA website at: https://www.fca.org.uk/privacy.

3

Contents Chapter 1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 4 Chapter 2 The wider context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 9 Chapter 3 Due diligence rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 10 Chapter 4 Pension scheme money and assets rules . . . . . . . . . . . . . . . . Page 23 Chapter 5 Self-invested personal pensions (SIPPs): segmenting the market, target market and wider harms . . . . . . . . . . . . . . . . . . . . . . . Page 39 Annex 1 Questions in this paper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 42 Annex 2 Cost benefit analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 44 Annex 3 Compatibility statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 88 Annex 4 List of respondents to DP 24/3 . . . . . . . . . . . . . . . . . . . . . . . . . Page 93 Annex 5 Abbreviations in this document . . . . . . . . . . . . . . . . . . . . . . . . . Page 95 Appendix 1 Draft Handbook text

4 Chapter 1 Summary Why we are consulting 1.1 We are proposing new rules for firms operating self-invested personal pensions (SIPP), to strengthen consumer protections in areas of the market where risks may be more likely to arise. The rules cover: • due diligence requirements • handling pension scheme money and assets 1.2 SIPPs play a vital role in the pensions market and give consumers more choice and flexibility with their pension investments, and the market has grown substantially. Firms are offering a wider range of assets for consumers to invest in, and the number and value of assets under administration have risen. We support this broad range of choices, growth and innovation but, given average pot sizes are often higher than other types of personal pension, we need to make changes to allow firms to grow sustainably and to make sure all consumers get adequate protection. This supports our priorities of strengthening trust and securing good consumer outcomes in the sector as set out in our Consumer Investments Regulatory Priorities Report. 1.3 When run well, and offered to the right customers, SIPPs can greatly improve consumer choice and many SIPPs are operated to a high standard. However, we have seen a subset of firms with inadequate due diligence processes, weak controls over trustee bank accounts and poorly maintained (or in some cases absent) books and records. These weaknesses have led to consumer losses and, in the most serious cases, significant delays and difficulties in ensuring an orderly winddown or transfer of schemes. 1.4 Due diligence obligations already exist under our high-level rules (including under Principle 2 and COBS 2.1.1R), and we have set out our supervisory expectations in 2013 non￾Handbook guidance and CEO letters. The Consumer Duty also reinforces the importance of firms acting to avoid causing foreseeable harm. Whilst we have seen improvements in firms’ due diligence, the high-level nature of the existing rules has led to differing interpretations by some firms about the extent and scope of due diligence required. We have seen inconsistent application and approaches adopted that don’t meet our expectations. As a result, we consider more explicit Handbook rules would support more consistent and effective due diligence standards across firms in this sector. 1.5 There are no detailed Handbook requirements governing the handling of pension scheme money and assets where firms are not subject to the Client Assets Sourcebook (CASS). Instead, firms rely on high-level obligations to maintain orderly records and adequate systems and controls (including under SYSC 9.1.1 and Principle 3) and protecting client assets (Principle 10), with the Consumer Duty reinforcing the need to avoid causing foreseeable harm. Supervisory experience indicates that firms often assert compliance with these obligations without a sufficiently robust evidence

5

base, with weaknesses in underlying controls or inconsistent record-keeping quality in practice. More specific requirements on record-keeping, reconciliations and audit trails (aligned with CASS where appropriate) will establish clearer baseline standards, strengthen firms’ underlying controls, and improve record-keeping. 1.6 In our Discussion Paper 24/3, ‘Pensions: Adapting our requirements for a changing market’ (December 2024), we asked for feedback on our regulatory framework, including our approach to SIPPs. We have analysed the responses and done further stakeholder engagement, and have now developed proposals to ensure firms protect their SIPPs customers appropriately. These include: • due diligence rules to mitigate the risk from scams and fraud • more effective requirements for firms handling pension scheme money and assets 1.7 Our proposals focus on SIPP schemes that give consumers flexibility and choice over their investments, which is the focus of due diligence rules, and on structures that include an unauthorised trustee, which are covered by the pension scheme money and assets rules. These features are where we most often see the risks we are concerned about. Who this applies to 1.8 This paper will primarily interest: • all firms that operate and provide personal pension products (both accumulation and decumulation) • investment platform providers • firms offering discretionary investment services • stockbrokers • platforms • third-party custodians • trustees of defined contribution occupational pension schemes • auditors • insolvency practitioners • trade bodies for regulated firms • consumers and groups representing consumers’ interest What we want to change Due Diligence 1.9 SIPP operators have an important role to play in ensuring the investments they offer to consumers do not expose them to scam or fraud risks. To deliver good outcomes for consumers, SIPP operators must act with due skill, care and diligence. They have due

6 diligence obligations under our high-level rules (including under Principle 2 and COBS 2.1.1R), and we have set out our expectations in non-handbook guidance (FG 13/8). This includes, for example, duties to check and monitor introducers, and make sure the investments they accept are appropriate for personal pension schemes. Many firms operate to a high standard, and we have seen improvements across the SIPP market. However, we are concerned that some firms’ due diligence is not adequate. 1.10 We are consulting on explicit due diligence requirements for SIPP operators in our FCA Handbook rules. We have considered obligations under existing high-level rules when developing these so our proposed requirements aim to be clear, proportionate and fit for the future. We want consumers to be appropriately protected, in particular from fraud enabled by investment vehicles such as investment arrangements held within a SIPP. 1.11 We think that setting out explicit due diligence rules in our Handbook will secure better outcomes for consumers and create greater confidence in the SIPP market. This is because it will: • improve the consistency and adequacy of due diligence across all SIPP operators • strengthen our supervision and enforcement capability by having more detailed criteria for firms to meet • make it easier to show where firms have not complied with obligations which will help with consumer redress (including through the Financial Services Compensation Scheme) • make our expectations clear and predictable for firms, giving them more confidence to offer a wider range of investment options 1.12 We aim to balance proportionality and regulatory certainty, so firms can operate efficiently and offer a full suite of products for consumers. Pension scheme money and assets 1.13 SIPP operators need to be able to identify what money and assets are held for each individual SIPP or member’s arrangement. They need to ensure that money and assets are properly protected. 1.14 Some SIPP operators are already subject to detailed client asset rules. However, where firms are not subject to those detailed requirements, we have concerns about how a subset of firms handle and keep records for pension scheme money and assets. Over time, a significant number of SIPP operators have legitimately structured their business so that an unauthorised trustee company holds money and assets for the pension scheme. This means our CASS rules, which are designed to protect client money and assets, do not apply to them. SIPP operators tend to be subject to CASS rules if they also carry on activities subject to the UK MiFID framework – which many bespoke SIPP operators, often offering more complex arrangements, do not. 1.15 Our experience is that some firms, on their own initiative, have applied or sought to mirror elements of CASS where it does not apply. However, this has been done inconsistently and to varying standards. In general, the absence of prescriptive

7 requirements means that market practice amongst SIPP operators for record-keeping varies considerably. The result is risks to consumers from weak maintenance of books and records, delays in firms identifying discrepancies, and difficulties when assets are transferred or firms wind down. 1.16 We therefore propose to introduce a Pension Scheme Money and Assets (PSM&A) regime to protect SIPPs not currently covered by our CASS rules. It will set clear minimum standards so that there is consistent consumer protection across all SIPP firms. To do this, we propose new Handbook requirements to: • ensure that pension scheme money and assets are securely held, accurately recorded and subject to effective oversight, enabling firms to identify those money and assets promptly • improve the quality and accuracy of firms’ books and records • require firms to carry out regular checks to ensure these records are complete and accurate • protect against delays or issues where a client transfers assets or where a firm winds down, particularly for disorderly wind-downs • enhance monitoring and information flows from different firms involved in SIPP arrangements, to support our aims and allow us to have earlier and more effective supervisory engagement 1.17 We propose to achieve this minimum standard in a proportionate way, reflecting some of the key principles of CASS, but diverging from some of the detailed requirements where they do not adequately account for the characteristics of SIPP structures or would be ineffective in this context. The regime is supported by an appropriately long implementation period, giving firms sufficient time to develop or upgrade systems and controls to comply with the new requirements. Clearer and more consistent requirements should also support safer and more confident consumer investment. 1.18 In light of our proposals for due diligence and PSM&A rules, we propose to retire the 2013 non-Handbook guidance provided in FG 13/08. Measuring success 1.19 We will measure the success of our proposals by: • considering insights from various sources, including our supervision activities and intelligence • reviewing firm data on Financial Ombudsman complaints, to understand how our rules affect consumers • observing how the rules help firms comply with the Consumer Duty (the Duty) in practice, through our ongoing supervision 1.20 In time, we may ask firms for data from the new records they will have to keep.

8    Next steps 1.21 We invite your feedback on our proposals, including the draft Handbook text in Appendix

1. Please send your comments by 24th August 2026. 1.22 We will engage with a range of stakeholders through the consultation period, as we develop our draft rules and guidance. 1.23 Subject to the responses we receive, we aim to publish a policy statement and final Handbook text in H1 2027.

9 Chapter 2 The wider context 2.1 SIPPs were introduced in 1989 as an alternative to standard personal pensions, giving people more control and a wider range of investment options. In 2006, all personal pensions became subject to the same rules on the types of investments people can hold. Since then, the market has expanded substantially, both in scale and in the range of business models and structures. The distinction between the SIPP market and the wider personal pensions market has become increasingly blurred. As these markets grow and evolve, we must continually adapt our regulatory framework – supporting growth and innovation while providing appropriate protection for all pension savers. 2.2 By 2024, nearly a third of the assets under administration in FCA-authorised defined contribution pensions were in SIPPs (based on our 2024 SIPPs data request). This shows their growing role in the pensions market. 2.3 We want to strengthen the framework for SIPPs as part of our wider work to tackle harm in pensions and support growth. We have developed our proposals using feedback from DP24/3, engagement with industry and consumer bodies, and input from our statutory panels. The FCA Practitioner Panel, the FCA Smaller Business Practitioner Panel and the Financial Services Consumer Panel all provided valuable input and challenge. How it links to our objectives 2.4 We want a SIPP market where firms do not cause foreseeable harm to their customers. Consumers should be able to find strong and innovative pension products, make informed decisions, and receive fair value throughout their pension journey. While SIPPs allow investors to take on a wider range of risks, they should still have appropriate protection. The regulatory framework must remain resilient as the market evolves. 2.5 SIPPs also play an increasingly important role in directing long-term investment into the economy. Their flexible investment structures allow consumers to access a broader spectrum of assets that can support long-term value, diversification and economic growth. We want the SIPP market to facilitate this investment, in line with our secondary objective. 2.6 Annex 3 sets out why our proposals: • are compatible with our general duty under section 1B(1) FSMA to act in a way that supports our strategic and operational objectives • advance, as far as reasonably possible, our secondary international competitiveness and growth objective under section 1B(4A) FSMA, particularly by enabling well￾governed access to a wider range of productive investment opportunities within SIPPs • comply with our duty under section 1B(5)(a) FSMA to have regard to the regulatory principles in section 3B FSMA, including ensuring proportionate regulation and enabling innovation where it benefits consumers.

10 Chapter 3 Due diligence rules 3.1 This section outlines our proposals for explicit due diligence obligations for SIPP operators. Background and context 3.2 While standards have improved since 2013, our 2022 review and other supervisory work showed that some firms still do not conduct adequate due diligence. This has led to recurring consumer harm where firms did not carry out sufficient due diligence on investments or introducers of new business. 3.3 Over the years, there have been a number of cases in the Courts involving the nature and extent of an operator’s responsibilities for due diligence of investments accepted into a SIPP. For some providers and parts of the market, these cases have contributed to a continuing debate about what obligations apply to SIPP operators. 3.4 As set out in Chapter 1, while due diligence obligations already exist under our high-level rules and the Consumer Duty, their broad nature has led to inconsistent interpretation and application. We consider that introducing more explicit requirements will promote greater consistency and strengthen standards across the sector. 3.5 We have considered obligations under existing high-level rules when developing our proposed due diligence rules, with a view to making sure they are effective and fit for the future. We want to strike an appropriate balance between proportionality and regulatory certainty, supporting firms to efficiently offer a full range of products for consumers. Overall summary of feedback to DP24/3 on due diligence rules 3.6 The majority of respondents supported setting out explicit due diligence requirements in our Handbook rules. They believed this would: • promote more consistent standards across the market • strengthen compliance • reduce consumer harm and provide greater regulatory certainty 3.7 A few respondents felt poor due diligence is largely a historic issue and our existing guidance, supplemented with good practice examples, would be sufficient. Several respondents said more explicit requirements would lead to more efficient complaints handling by both the Financial Ombudsman Service and The Pensions Ombudsman. 3.8 A key theme was the need for proportionate requirements that reflect the varying risks of different asset classes and arrangements. Many respondents said we should focus on

11

higher-risk areas, such as ‘non-standard’ assets, third-party investment arrangements and unregulated or overseas introducers. They cautioned that undue or overly prescriptive requirements could increase costs for providers and consumers. Proposals for due diligence requirements in Handbook rules Purpose 3.9 Our principal aim is to ensure that the investments made in a consumer’s SIPP are genuine and involve a credible investment proposition. Our proposed due diligence requirements are designed to reduce the risk of consumers’ retirement savings being exposed to scams or fraud, or assets with investment propositions that lack credibility and are inherently unlikely to deliver the returns claimed. 3.10 The proposed requirements do not require firms to assess the suitability of an investment for an individual consumer, nor should they limit the range of legitimate assets they can accept into SIPP schemes. We want consumers to have confidence in, and to benefit from, the flexibility and investment choice SIPPs offer. Our rules aim to reinforce this by reducing the chance of harmful assets entering the broad investment choice available to consumers. 3.11 Our proposed rules aim to: • codify requirements and expectations for SIPP operators, so they can confidently and effectively apply them in consumers’ interests • improve the consistency and adequacy of due diligence across the market, preventing consumer harms from assets that expose consumers to undue risk • strengthen our supervision and enforcement capability by having more explicit Handbook rules 3.12 To be proportionate, there is a greater focus in our proposed rules on areas with higher risks of consumer harm from fraud or scams. This includes asset categories with fewer existing protections and arrangements involving unvetted third parties such as unauthorised introducers and overseas third parties. 3.13 Our proposed rules complement the regulatory framework that already applies to SIPP operators across the Handbook. This includes applicable product governance requirements where firms must design products and services to meet the needs, characteristics and objectives of their target market. 3.14 Where applicable, we are proposing that our rules will also apply to Gibraltar-based firms in relation to business carried on from an establishment in the UK. We also intend for our rules to apply to firms in supervised run-off.

12

Scope and application 3.15 Across the different types of firms offering SIPPs, there are now a wide range of products. We propose that the due diligence rules will apply to personal pension schemes where the primary purpose and design of the scheme, or the relevant element of the scheme, is to give consumers flexibility and choice over the underlying investments on an ongoing basis. This includes, in particular, schemes where consumers can direct the investment of their pension pot into specific assets of their choosing. 3.16 The proposed rules will not apply to schemes that offer a limited range of pre-selected investments (such as a target-date fund) or risk-rated model portfolios, where the firm is responsible for the make-up of the investment offering. This is because the potential risks of fraud and scams are lower in schemes where firms retain responsibility for investment selection. 3.17 Consumers in all personal pension schemes, including pre-selected schemes, will continue to benefit from firms’ existing Handbook obligations. These include the Principles for Businesses, conduct of business rules, the Consumer Duty, and applicable product governance rules, which generally require firms to design products to meet an identified need of customers in the target market. Due diligence on relevant third parties 3.18 While many third parties operate to a high standard and deliver good consumer outcomes, there have been several cases of consumer harm involving the use of third parties. These include introducers acting outside their regulatory remit, continuing to introduce business while being subject to FCA warning or prohibition notices and unduly influencing clients’ investment decisions. These cases show that firms need to carry out proportionate, risk based due diligence on the parties they propose to deal with to avoid the risk of exposing consumers to harm. The feedback we received 3.19 Respondents to DP24/3 generally supported proportionate and risk-based due diligence and monitoring requirements on introducers and other third parties. They also suggested additional or enhanced checks for higher-risk contexts, such as where a firm accepts business from a third party who is not an authorised person. Our response and proposal We propose that SIPP operators must carry out initial and ongoing due diligence on third parties that introduce members or facilitate investments to be held within a SIPP, and those that acquire and manage investments for the scheme on behalf of the consumer (without the SIPP operator being involved in the transaction). This typically includes introducers of business to their firm, advisers, and discretionary investment managers (DIMs). This will enable SIPP operators to understand the nature of the third parties’ business, be satisfied they have the required regulatory

13 permissions and are appropriate to deal with. It will also allow them to make sure the business they conduct does not pose risks to consumers. We agree that checks should be proportionate. Our proposed rules require SIPP firms to carry out core checks on all relevant third parties, with additional checks to mitigate the associated higher risks where they are unauthorised or overseas. The checks must be carried out before commencement of the business relationship. Core requirements for all relevant third parties We propose that SIPP operators must carry out the following core checks on all relevant third parties, including introducers, advisers and DIMs: • Verify the third party’s identity (the firm or individuals as appropriate) • Check that neither the third party, nor any key individuals (directors, senior managers, approved persons or appointed representatives) are undergoing, or have been the subject of, any, criminal or disciplinary proceedings, investigations or convictions relevant to any introductions or services they provide, or propose to provide, including: – appearing on the FCA Register, or overseas comparable, lists of prohibited individuals or cancelled firms or the FCA’s Warning List – having any concerning disciplinary record • Ensure that the third party holds the necessary legal and regulatory requirements or permissions, for the service being provided, in the relevant jurisdiction and is not acting in breach of the general prohibition (i.e. undertaking regulated business without the necessary authorisation). • Undertaking checks of relationships across parties connected to the third party to identify and manage any conflicts and dependencies not aligned with the consumers’ best interests We also propose to require firms to put in place clear terms of business setting out the relationship with, and responsibilities of, the relevant third party. We have set out requirements covering contracts with third parties that have control over and manage a consumer’s investments within a scheme in paragraphs 3.22 to 3.24 below. SIPP operators must be mindful that the purpose of due diligence requirements is to prevent consumers being exposed to scams and fraud. Firms operating in the retail market must, in particular, have regard to their obligations under the Consumer Duty and consider foreseeable harm to retail customers when deciding whether to enter into arrangements with relevant third parties. If, for example, a firm identifies other indicators of fraud or scams in the process of undertaking core checks (or otherwise obtains relevant information), we propose the firm either declines to enter into the arrangement or take additional due diligence steps as reasonably required in the circumstances and only proceed with the arrangement if it can be satisfied that it is safe for consumers. This approach is consistent with SIPP operators’ existing Consumer Duty obligations, in particular acting in good faith and avoiding foreseeable harm to retail customers.

14 Additional due diligence Unregulated introducers, and overseas third parties, can pose heightened risks to consumers. They may be subject to alternative regulatory frameworks, or unregulated, which increases the potential for fraudulent business being directed to SIPP operators. Our proposals require firms to carry out additional checks to identify and manage the risks of accepting business from these third parties. Firms must decide what additional checks are appropriate in each case, depending on the circumstances. We propose guidance setting out illustrative, non-exhaustive examples they should consider, including: • reviewing publicly available information about the company and key individuals (directors, senior managers, approved persons or appointed representatives), such as Companies House records • understanding the nature of a third party’s business, including identifying any unusual, irregular, or high-risk activity that may indicate it is not appropriate to deal with. We propose that SIPP operators should carry out regular checks on third parties, at least annually, and more frequently where circumstances warrant it. They must also take reasonable steps to independently verify all information or documentation provided by the third party that they rely on for due diligence. Adverse findings If a firm cannot be satisfied, following the due diligence checks set out above, that engaging with the third party involves no undue risks to the consumer they must not enter into, or continue with, the arrangement. This includes ceasing new business or further services, taking reasonable steps to terminate any existing arrangements, and assessing and mitigating risks to clients from prior business. Firms should also take appropriate steps to meet the information needs of affected scheme members. Question 1: Do you agree with our proposed due diligence requirements for relevant third parties? If not, please outline why. What challenges or unintended consequences, if any, should we consider? Should we consider, if warranted, further protections for SIPP consumers? Due diligence on SIPP investments 3.20 There have been recurring cases of consumer harm where SIPP operators have accepted assets into their schemes without performing adequate due diligence, which have turned out to be a scam, or linked to fraud. This has resulted in consumers losing significant amounts of their retirement savings.

15

The feedback we received 3.21 Respondents to DP24/3 emphasised that due diligence on investments should be proportionate. Additional or enhanced due diligence should focus on higher risk, non￾standard or speculative assets. Standard, authorised, or lower risk investments should require minimal, lighter-touch checks. Some firms said they would prefer us to clearly state when we expect them to do additional checks, rather than them having to form judgments on large numbers of assets. Our response and proposal We propose that SIPP operators must carry out appropriate due diligence on investments they are instructed, by or on behalf of a consumer, to arrange to be acquired for a scheme they operate (for investments made by third parties the proposals are set out in paragraphs 3.22 to 3.24). This must enable them to form a reasonable understanding of the nature and risks of the investments, so they do not accept investments that unduly expose consumers to the risk of harm from scams and fraud or investment propositions that lack credibility. We agree that due diligence should be proportionate. While there are benefits to a judgment-based approach, we accept this creates challenges for firms. We therefore propose that core due diligence requirements would apply to all assets, with additional due diligence steps for higher-risk investments with fewer existing protections under applicable regulatory regimes. We have previously used the standard asset definition and list in IPRU￾INV 5.9 to distinguish between asset types, including for the purpose of collecting data on assets held by firms. Some firms also use this to guide their decisions on when to apply investment due diligence. However, the IPRU-INV definition of a standard asset was created for prudential regulation and focuses on liquidity for the purpose of determining capital adequacy requirements. Our proposed requirements would instead focus on the risks relevant to consumer harm and scam prevention. Core requirements for all assets Regardless of the type of asset, we propose SIPP operators must carry out the following core due diligence: • Ensure all investments accepted are not taxable property for the purposes of HMRC pension tax rules. • Be satisfied there is proper custody and good title to the investment (or that it can be obtained) and firms can administrate it effectively. • Ensure the investment can be reliably valued at the outset and on an ongoing basis. We recognise that the risks of being associated with scams and fraud vary widely among asset types. The risks of some assets are already mitigated under applicable regulatory regimes and other protections, which reduce the chance of consumer harm from a due diligence perspective.

16 To maintain a proportionate and risk-based approach, we are proposing that firms do not need to conduct additional due diligence on the following categories of assets where they are not, except for LTAFs, also non-mass market investments or restricted mass market investments: • Cash Deposits (including National Savings & Investments products (NS&I)): Deposit taking is a regulated activity, so providers must be FCA or PRA authorised. • Units in Regulated Investment Funds: Investments in funds like unit trusts or Open-Ended Investment Companies are subject to FCA rules, or equivalent overseas rules, for collective investment schemes supporting transparency, fair pricing and investor protection. • Unit-linked investments (including insurance-based investment products (IBIPs): These are subject to FCA rules including COBS 21 (permitted links and asset restrictions). • A share in a Long-Term Asset Fund (LTAF): These long-term, less liquid regulated investment funds are governed by enhanced FCA rules to ensure strong governance, independent oversight, transparent disclosures, and controlled access, and are classified as restricted mass market investments. • Readily Realisable Securities (RRSs): where the security is: – admitted to the UK Official List – admitted to trading on a regulated market, or – regularly traded on an overseas exchange or market where the SIPP operator has assessed, based on reasonably available information, there are no factors that indicate reliance on core due diligence is insufficient to mitigate risks. For assets that fall within these categories, we are proposing SIPP operators only carry out the core due diligence. For other investments, we propose that SIPP operators must undertake further due diligence. As set out at paragraph 3.19 above, SIPP operators must be mindful that the purpose of due diligence requirements is to protect consumers being exposed to scams and fraud, and prevent foreseeable harm in line with their Consumer Duty obligations. If, for example, in the process of undertaking core checks the firm identifies other indicators of fraud or scams, or that the investment proposition is implausible, we propose that the firm would either reject the investment or take additional due diligence steps as reasonably required in the circumstances. It should only accept the asset into the scheme if it can be satisfied that it is safe for consumers. Additional due diligence We are proposing that SIPP operators must carry out additional due diligence for all assets other than those set out in the subheading ‘core requirements for all assets’ above and particularly: • Non-mass market investments (non-mainstream pooled investments; speculative illiquid securities) • Restricted mass market investments (except LTAFs), including non￾readily realisable securities

17

• Direct investments in UK or overseas commercial property This is because they generally have fewer regulatory safeguards and are less transparent, so potentially carry an increased risk of fraud and scams. Under our proposals, firms must determine what additional checks to undertake; we are not proposing to prescribe them. We expect firms to take a reasonable and proportionate approach to this, based on the asset type, risk profile and specific circumstances. These checks must allow the firm to be satisfied that the investment is genuine and not linked to fraud, scams, or implausible to the extent that it cannot deliver the returns it purports to offer. Non-exhaustive guidance examples of additional due diligence firms should consider include: • Verifying the legitimacy and credibility of companies and associated parties, including screening against the FCA, or overseas comparable, Warning Lists. • Assessing what protections are available under the FSCS, or comparable overseas scheme • Assessing whether the investment seems realistically capable of performing as described, considering, for example, its structure and underlying assets. • Identifying and assessing any unnecessary, unusual or unexplained complexity or opacity in the investment’s structure or terms. • Taking reasonable steps to verify whether investors’ contractual rights are reliable and enforceable, especially under overseas jurisdictions. • Reviewing the level, structure and complexity of fees, commissions and charges to identify any that are high, unclear or unusual. • Reviewing any history of investor problems, such as missed income payments, redemption delays or prior defaults. As with due diligence on third parties, we are proposing that firms must take reasonable steps to independently verify the information or documentation they rely on when undertaking due diligence on investments. These proposals aim to balance safeguarding consumers’ pension savings with maintaining proportionate, risk-based requirements, and allowing firms to tailor additional checks to the specific risks of asset types and relevant circumstances. In developing these proposals, we considered an approach that would give firms greater scope to exercise judgement in determining whether only core or additional due diligence should apply across different assets. However, we recognise the importance of giving firms clearer regulatory parameters to support consistent and straightforward implementation. This is why we have proposed a more specific approach where the level of due diligence requirements is based on the asset category. We welcome stakeholders’ views on this approach.

18 Adverse findings If a firm identifies an asset where it cannot be satisfied it does not pose an undue risk of harm from fraud, scams or because the investment proposition is unlikely to be credible, they must not accept the asset into the scheme.  They must also take all reasonable steps to prevent new or further investments being accepted into schemes and take reasonable steps to mitigate harm to members from any existing holdings. Firms should take appropriate steps to meet the information needs of affected scheme members. Question 2: Do you agree with our proposed approach for proportionate due diligence on investments using asset categories? If not, why not? Do you agree with the asset categories for core and additional due diligence or are further protections needed for some assets to sufficiently protect consumers? SIPP investments made by third parties 3.22 This section concerns arrangements where a third party can acquire and manage investments for the scheme (operated by the SIPP operator) on behalf of the consumer without the SIPP operator being involved in the transaction. These arrangements most commonly involve a discretionary investment manager (DIM) acting on the consumers behalf under a discretionary mandate or an adviser with the authority from a SIPP operator to give instructions to a third party. The SIPP operator administers and is responsible for the pension but may not control or oversee the third party’s investment decisions and transactions. Many of these relationships are legitimate and deliver good consumer outcomes. However, in some cases, a third party managing investments has been included in the distribution chain to enable or facilitate investments that a SIPP operator carrying out its own due diligence should not, or would not, have accepted. 3.23 Weaknesses in arrangements and oversight can leave the SIPP operator with limited visibility of investments selected or managed by a third party. Our supervisory experience and previous cases of consumer harm show that inadequate due diligence over these third party arrangements and investments can increase the likelihood of consumers losing money. This underlines the need for SIPP operators to put in place clear arrangements and procedures to monitor third parties that manage assets and control consumer exposure to investment risks within the SIPPs they operate. This includes ensuring they are supported by appropriate information and data from the third party to do so. The feedback we received 3.24 Respondents to DP24/3, overall, said that due diligence rules should set out SIPP operators’ responsibilities where third parties have discretion to control and manage scheme assets. Some respondents said these third parties, for example a DIM, should be subject to their own regulatory requirements to protect SIPP consumers and that SIPP operators should not be expected to shadow regulate these. Others stressed

19

that SIPP operators must still fulfil their due diligence responsibilities and should not be allowed to avoid these because a third party is managing scheme assets. Respondents also noted that any monitoring should be proportionate and should not require SIPP operators to review large volumes of detailed investment data. Our response and proposal We propose proportionate and focused due diligence requirements that address the specific risks associated with third parties that acquire and manage assets within a scheme. We propose SIPPs must: i. assess the third party at onboarding (as set out in the section above for due diligence on relevant third parties) ii. set clear contractual parameters, including types of permitted assets and reporting, and iii. carry out periodic oversight to identify and escalate issues. This approach aims to set consistent minimum protections for consumers using a third party to manage assets, while maintaining clear accountability between parties. Contractual arrangements We propose that SIPP operators have contractual agreements with these third parties that must, as a minimum: • Define the expectations and responsibilities of all parties. • Set clear parameters on the types of assets the third party may select within the SIPP and require them to carry out sufficient checks to avoid exposing consumers to harm. This includes those under the core requirements for due diligence on investments above. • Require any corrective action needed where investments are made outside the agreed asset parameters. We also propose firms should carefully consider setting out sufficiently detailed contractual expectations between the parties, including liability. Periodic monitoring While contracts set the framework of responsibilities and risk parameters between SIPP operators and third parties that acquire and manage assets within a scheme, we consider it necessary that SIPP operators also carry out periodic checks on assets managed by a third party. These periodic checks should allow SIPP operators to be satisfied that: • investments remain within agreed contractual parameters • any changes in asset type or classification are identified promptly such that they can take any necessary corrective action • SIPP operators capital adequacy requirements are up to date and met This oversight protects SIPP consumers by identifying issues promptly, so the firm can tell consumers about any changes and associated risks. It also supports SIPP operators to comply with their capital requirements.

20 If the SIPP operator finds that an asset falls outside scheme parameters, firms are reminded of their high level Handbook obligations including under the Consumer Duty to act in good faith and avoid foreseeable harm. It should take particular care where the asset presents higher risks or charges, or affects the firm’s capital adequacy. Firms should take timely and proportionate action, which may include: • restricting further dealings with the third party • escalating the issue internally • reassessing whether the asset should continue to be held • consider exit options. Firms should also take appropriate steps to meet the information needs of affected scheme members. Firms should decide how frequently to carry out these checks based on the volume of funds and the frequency of the third party’s investments. We consider this should be at least quarterly. To support periodic monitoring, SIPP operators must have arrangements with the third party to obtain the information they need to maintain adequate oversight and support appropriate consumer protection. These arrangements should set out the information required, including the frequency and quality of the information the third party must provide. Firms should be prepared to end the relationship if the third party does not provide the data needed. Question 3: Do you agree with our proposed contract and monitoring requirements for SIPP operators to protect consumers where assets are acquired and managed by a third party on behalf of the consumer? Are there any challenges for SIPP operators in meeting these requirements, or further requirements needed to protect consumers? Governance, management information and record-keeping Governance 3.25 We propose that firms establish processes and controls that ensure they carry out effective due diligence that complies with the proposed rules. The firm’s governance arrangements must enable appropriate oversight of these processes, including consideration of appropriate staff training, to support consistent compliance with due diligence obligations. 3.26 We propose that firms review the effectiveness of their due diligence processes at least annually and after any significant event, such as a breach of requirements. They must take appropriate steps to promptly address any issues identified. Firms may consider setting internal standards, which reflect their business model and risk tolerance, for assessing how effectively their processes and controls comply with due diligence obligations.

21

Monitoring 3.27 Our proposals will require SIPP operators to have processes to gather and analyse management information to help them assess the effectiveness of due diligence processes, including identifying potential risks or trends, to protect consumers from possible scams and frauds. 3.28 Firms must update this management information at least once every 6 months and review this to identify any weaknesses in their due diligence processes, policies or controls. This includes tracking declined investments and monitoring trends in business from introducers and addressing any issues they identify promptly. 3.29 Where a firm identifies a significant breach of a rule, it must notify us under existing obligations in our SUP sourcebook. Documentation and record-keeping 3.30 In line with their obligations under the Senior Management Arrangements, Systems and Controls sourcebook (SYSC), SIPP operators must maintain documentation that clearly demonstrates their compliance with all due diligence requirements. They must retain all required records and management information, and ensure they are complete and up to date. They must make any records available to us on request. Question 4: Do you agree with our proposals on governance, monitoring and record-keeping? If not, why not? Implementation period 3.31 We are proposing to allow 12 months for firms to make the necessary changes to their due diligence processes and procedures, recognising that firms may need time to review existing arrangements. We aim to achieve this through a 12 month implementation period during which the proposed due diligence regime would be replaced by transitional provisions. 3.32 After the expiry of a 12 month implementation period, running from the date the instrument is made, our proposed due diligence rules will apply to: • any new assets added to the range of investable assets made available • further investment in an asset (that has previously been accepted into the scheme) • new arrangements firms make with relevant third parties. 3.33 Firms will need to ensure that after the implementation period all investment, onboarding of assets, and any new third party relationships comply with the proposed rules. 3.34 We are proposing that firms bring existing arrangements with third parties up to compliance with the proposed rules during the implementation period. We recognise that firms may need time to update existing arrangements. We therefore propose that during the 12 month implementation period firms must review these relationships

22 to consider whether they are consistent with proposed new rules and implement any necessary changes. Firms may transition to the proposed regime earlier, where they are able to do so, ahead of the implementation deadline. 3.35 The proposed rules will not apply retrospectively to investments made before the end of the implementation period. Assets already accepted into the scheme will remain subject to existing high-level obligations, including under Principle 2, COBS 2.1.1R and the Consumer Duty (where applicable), and firms should continue to manage associated risks in line with those requirements. Question 5: Do you agree an implementation period is needed? If so, is 12 months an appropriate timeframe?

23 Chapter 4 Pension scheme money and assets rules 4.1 This section sets out our proposal to introduce a Pension Scheme Money and Assets (PSM&A) regime within COBS 19B. At a high-level, our objectives are to: • ensure that pension scheme money and assets are protected, including in the event of a firm failure • minimise the risk of loss, misuse or delays in transferring a SIPP to a new provider following firm failure or allowing another firm to operate the SIPP 4.2 The PSM&A regime addresses gaps in requirements due to differences in how personal pension schemes are structured and operated. In particular, there are currently no detailed requirements on a SIPP operator for handling money and assets held by unauthorised trustees and third parties (who make or hold investments for the scheme in the name of those trustees). Unauthorised trustees themselves are not subject to FCA rules. 4.3 Although the proposals will apply to any personal pension scheme that uses an unauthorised trustee company, such structures are most commonly used by SIPP operators. For ease of reference, we therefore refer to SIPPs throughout this chapter. Background and context SIPP structures and arrangements 4.4 In DP24/3, we noted how SIPP business models and operating structures vary. All SIPP operators hold permission to operate a personal pension scheme, but they can deliver these pension schemes in different ways – so other permissions they hold may also differ. For example, some SIPP operators also operate an investment platform service. As a result, different FCA rules apply to different SIPP operators. 4.5 Some SIPP operators are subject to CASS, so are already subject to detailed client money and client asset rules. For other operators, there are no detailed Handbook requirements for handling pension scheme money and assets. Instead, they are subject to high-level obligations, including requirements to maintain orderly records and adequate systems and controls (for example under SYSC 9.1.1 and Principle 3). This has resulted in significant variation in market practice. 4.6 Our supervisory experience shows that many of these firms have not, over time, invested in systems and controls to keep pace with advances in data handling. For pension scheme money, such firms tend to rely significantly on banking providers for daily cash-movement data to create or maintain internal records, which increases the risk that the firm’s books and records cease to be an independent record of cash movements. This can weaken reconciliation controls, limit the ability to identify errors, and impair a firm’s ability to reconstruct historical cash positions if external data becomes unavailable, incomplete, or inaccurate. Some firms also continue to operate

24

highly manual controls over trustee bank accounts, increasing the risk of human error. For pension scheme assets, some firms may not keep timely or complete internal records of investments held or transactions made for a pension scheme. Some firms’ pension administration systems simply cannot record such data. 4.7 Whilst these practices can create issues with ongoing pension scheme administration, they cause significant issues when a SIPP operator fails. The lack of investment data often means that other firms are reluctant to even consider taking over the operation of the pension scheme. In other cases, there can be delays to scheme wind-up or increased costs for the new operator while remedial work is carried out to establish or recreate accurate books and records to determine if sufficient pension scheme money is being held. Our supervisory engagement suggests such weaknesses exist across the market. While this has not yet resulted in widespread consumer harm, we want to improve standards and reduce the risk of harm if more firms fail. Third-party relationships 4.8 For ‘bespoke’ SIPPs that offer access to a wide range of investments, custody arrangements and asset registration practices can be complex. They may involve multiple third parties across the distribution and custody chain, including, but not limited to, banks, platforms, custodians and DIMs. Many of these third parties are themselves subject to FCA requirements, including CASS, in respect of the services they provide. 4.9 When a third party is engaged to make and hold investments for a pension scheme, the SIPP operator typically opens an account with it to access market infrastructure. The unauthorised trustee is recorded as the third party’s client. These arrangements are not generally treated as outsourcing, as the third party provides services to the trustee rather than performing functions on behalf of the SIPP operator. Accounts are often designated to individual SIPPs. 4.10 Pension scheme assets may also be held by third parties that provide trading and custody services on behalf of the trustee. SIPP operators subject to IPRU-INV 5, and their trustee companies, rely on third parties as they do not have the permissions or infrastructure to access markets directly. 4.11 Pension scheme money is typically held in a combination of pooled and individual bank accounts in the name of an unauthorised trustee. Pooled accounts may be used to receive contributions, move money in and out of the scheme, and receive tax relief, whilst cash for an individual member’s pension fund or arrangement may be moved to and held longer-term in an individual account. Where investments are made through third parties, pension scheme money is generally transferred from the trustee bank accounts into the third party’s own client money arrangements to complete the investment. It is not common practice for funds to be routinely moved back and forth once transferred.

25 Figure 1: Bespoke SIPP scheme model Scheme member contributes into SIPP Property/ unregulated investments owned directly by the trustee (e.g. commercial property) The bespoke SIPP scheme Pension scheme trust deed and rules Scheme operator • Not authorised • Vehicle through which investments are made for the pension scheme under bare trust Scheme trustee SIPP Trustee Limited • Holds pension scheme cash and direct property investments • Custody of other pension scheme assets delegated to third parties Third parties • Authorised firm • Typically HMRC scheme administrator SIPP Operator Limited • Investment management firm under IPRU-INV Chapter 5 Regulated investments accessed via Pension scheme money third parties, for example: • Pooled bank account • Platform service provider • Individual bank account • Discretionary investment manager • Stockbroker accounts • Trustee investment plans These third parties may also hold cash. Onward third-party custody arrangements e.g. central securities depositories, custody banks, funds custodian

26 DP24/3 – Summary of feedback on pension scheme money and asset rules 4.12 Most respondents supported clearer, more prescriptive standards so that the way firms (outside of CASS) handle pension scheme money and assets is more transparent. Stakeholders agreed that greater consistency and stronger baseline controls would help raise standards across the market. Some acknowledged that any new rules would require a degree of change. 4.13 Proportionality was a key concern. Around a quarter of respondents thought a full CASS-style framework would be disproportionate, and could increase costs for consumers. Respondents noted that bespoke SIPP operating models differ from those CASS is designed for because: • Pension scheme money and assets are typically controlled by the unauthorised trustee and third parties rather than the sipp operator. • Firms often have to rely on information from third parties to understand asset holding and transaction activity, particularly where consumers or their intermediaries are permitted to give dealing instructions directly to those third parties. They also highlighted that CASS-style compliance could duplicate obligations for regulated third parties such as banks and custodians, or require firms to collect data from them excessively frequently. 4.14 A few respondents suggested that regulation should distinguish between providers operating closer to mainstream personal pensions and those offering genuinely bespoke SIPPs. A quarter of respondents suggested targeted supervisory or enforcement action against a small subset of firms, rather than new rules imposing unnecessary burdens on compliant firms. 4.15 Respondents acknowledged that enhanced requirements may increase costs for firms, particularly where new systems or reconciliation processes are needed. Some viewed these costs as part of good practice, citing benefits such as improved consumer outcomes and smoother firm exits. However, respondents cautioned against duplicating requirements already placed on regulated custodians. Proposals for pension scheme money and asset regime 4.16 To protect pension scheme money and assets, our proposed PSM&A regime will require that pension scheme money and assets are securely held and that SIPP operators maintain comprehensive and accurate records, while taking account of current market practices. 4.17 The regime applies where a firm, as the operator of a personal pension scheme, uses an unauthorised trustee to hold or receive pension scheme money or assets. These may be held directly by the trustee or indirectly through third parties holding them on behalf

27 of the scheme in the trustee’s name. The regime would not apply to money or assets that are held by a SIPP operator and already subject to CASS. This means firms will not have overlapping requirements in respect of the same money or assets. 4.18 At a high level, our proposals require firms to: • maintain accurate books and records • check these records regularly to ensure that they are complete and accurate • identify and investigate any discrepancies promptly • maintain appropriate standards through audit and, pending the development of an appropriate regime with firms, reporting. 4.19 We considered whether we could apply CASS to firms that are currently not subject to it, as it provides a well-established framework for firms that hold client money and/or assets. This includes investment businesses, insurance intermediaries and debt management companies. However, we concluded that the complexity of SIPP structures and operating arrangements would mean firms could not implement the CASS regime in full. We might also need to make significant changes to the CASS application framework or require firms to stop firms using unauthorised trustees in pension scheme structures. Each of these would be a substantial intervention. We therefore propose a proportionate approach that reflects some key principles of CASS, but diverges from some of the detailed requirements in CASS 6 (custody assets) and CASS 7 (client money) where they do not adequately account for the characteristics of SIPP structures or would be ineffective this context. 4.20 Some firms, particularly larger platform providers or life insurers, may already operate processes that are broadly consistent with our proposals to pension scheme money and assets because other areas of their business are in scope for CASS. We do not expect the proposed rules to create significant additional burden on these firms. They are likely to be operating largely in line with the less prescriptive requirements under the PSM&A regime or have ready access to the data needed to create the relevant records. However, there are areas where the PSM&A regime differs, including in relation to the treatment of shortfalls, and these differences will need to be reflected in firms’ processes. 4.21 We recognise that compliance costs may prompt some firms to leave the market. However, the rules set a minimum standard of requiring firms to maintain up-to-date records, which all firms operating a personal pension scheme should be able to meet. It is therefore appropriate for firms to exit if they cannot meet this requirement. Our proposed 2-year implementation period is intended to support orderly exit where necessary, and to give other firms time to adapt processes or introduce new systems (including through third party providers). An additional 1-year period is available for SIPPs with existing third party relationships, where firms have identified dependencies on third party data and developed a plan to address these, providing more time to integrate legacy providers or complete orderly offboarding. 4.22 Where applicable, we are proposing that our rules will also apply to Gibraltar-based firms in relation to business carried on from an establishment in the UK. We also intend for our rules to apply to firms in supervised run-off.

28 Question 6: Do you agree with our proposed high-level scope and approach to introducing a more prescriptive PSM&A regime for SIPPs? What challenges, unintended consequences, or additional protections for consumers or firms should we consider? Question 7: Are there areas where our proposed PSM&A requirements create complexity for firms operating across both regimes (including CASS)? If so, what mitigations would be possible to address these complexities? Overarching principle applying to pension scheme money and assets 4.23 Our proposed PSM&A regime is based on our Principle 10 (Clients’ assets). This requires firms to arrange adequate protection for client assets where they are responsible for them. Firms must maintain strong systems and controls to ensure pension scheme money and assets are securely held, appropriately handled, and accurately recorded at all times, in order to reduce the risk of harm to individuals’ retirement savings. 4.24 In line with this purpose, where a SIPP uses an unauthorised trustee (which is typically a dormant company, with no staff), the authorised firm (as the SIPP operator) remains responsible for ensuring that robust systems and controls are in place to protect pension scheme money and assets and members’ interests. Where the proposed rules require actions to be taken by an unauthorised trustee controlled by the SIPP operator, these should be understood as obligations on the operator to ensure the trustee takes the required action. 4.25 Scheme members are, and remain, the firm’s clients, regardless of any distribution arrangements. The use of intermediaries, trustees or other third parties does not reduce the firm’s own regulatory responsibilities to the end consumer. 4.26 To support this, we propose in rules that firms should ensure there is a sufficiently detailed arrangement with third parties which it approves, or with which an account is open to hold pension scheme money or assets. This arrangement must include provisions covering matters such as the terms on which the third party holds assets and the services it provides. Firms should carefully review the terms of such arrangements, including whether they provide for liability in the event of loss of pension scheme money or assets arising from fraud or negligence, and set out expectations for the timely and effective resolution of any shortfalls for which the third party is responsible. 4.27 Our proposed PSM&A regime will also require the firm to allocate a senior manager with operational oversight of the regime. This includes overall accountability for the firm’s compliance with the PSM&A rules and for ensuring that appropriate systems and controls are in place to support the accurate identification, recording and monitoring of pension scheme money and assets. The senior manager is also responsible for reporting to the SIPP operator’s governing body on that oversight (typically the board).

29

4.28 Firms must establish and maintain adequate organisational arrangements to minimise the risk of loss or diminution of pension scheme money or assets, or of associated rights, arising from misuse, fraud, poor administration, inadequate record-keeping or negligence. Pension scheme money Classification and allocation of pension scheme money 4.29 For the purposes of the regime, the classification of pension scheme money focuses on how it is held. We propose two categories: • Directly held scheme money: Held within pension scheme bank accounts in the name of the unauthorised trustee. • Indirectly held scheme money: Held other than in a pension scheme bank account, by a third-party, for or on behalf of the unauthorised trustee (for example a DIM, third-party custodian, or stockbroker account). 4.30 Where third parties hold indirect scheme money in their own client money arrangements, the SIPP operator may not have full or timely visibility of cash transactions, as they may not get detailed information from live data feeds. 4.31 These third parties are typically subject to their own regulatory requirements and, in many cases, to CASS. We therefore consider that a different, and in some cases less frequent, approach to updating records and carrying out reconciliations is appropriate for indirectly held scheme money. 4.32 Firms must allocate directly held scheme money, received into pension scheme bank accounts, to an individual pension, fund or arrangement promptly (and no later than ten business days after receiving it). They must record the money as ‘unallocated scheme money’ until it has been allocated, so that it is appropriately recorded in the firm’s records. 4.33 Firms will earn interest on cash balances they hold for scheme members in pension scheme bank accounts. In some cases, this interest is retained to cover the operational costs of managing cash. Any interest earned on directly held scheme money must be allocated to the individual fund of the scheme member, unless the firm has notified the scheme member in writing that it will retain all or part of that interest, and does so in a way that is compatible with its regulatory obligations. Interest earned on indirectly held scheme money will be captured by the rules applicable to the third party’s own client money arrangements. Maintenance of records and accounts 4.34 Under our proposals, firms must establish and maintain comprehensive and accurate records that enable them to determine the total amount of directly and indirectly held pension scheme money. Firms must be able to calculate the total amount of pension scheme money required to be held for the scheme by aggregating the amounts attributable to each individual SIPP or member’s arrangement, and identify where that money is being held. Taken together, this will enable firms to maintain a clear audit trail for the handling of pension scheme money.

30 4.35 Our proposal is that firms must maintain internal records of pension scheme money independently of external records, so far as is reasonably possible. This means that, for trustee bank accounts, firms should not rely primarily on transaction data imported from banking providers for their internal records. 4.36 We recognise that many firms do not currently maintain independent internal records of individual transactions and balances that could, for example, function as an independent cashbook for directly held pension scheme money. We acknowledge that this will mean some firms (or third-party software providers) will need to develop new systems and processes to meet our proposed requirements. However, we are satisfied that this is necessary to ensure firms maintain timely, accurate and reliable records and can reconcile and protect pension scheme money effectively. 4.37 We do, however, recognise that there may be scenarios where a third party is the only reliable source of relevant data (for indirectly held pension scheme money). In such cases, we are proposing that firms may use that external data for the purposes of maintaining their records, provided it is reasonable to do so (for example, where transactions occur without the involvement of the operator). Question 8: Do you agree with our proposal that firms should establish and maintain an internal record of pension scheme money, including money held indirectly by third parties? What challenges do SIPP operators face in meeting this requirement? Reconciliations 4.38 Reconciliations are checks that firms conduct to ensure the accuracy of their records and enable them to identify and resolve discrepancies, thereby reducing the risk of harm to consumers. 4.39 We propose that firms must reconcile their internal records of pension scheme money held in trustee banks, or by third-parties, on a daily basis. This requires a comparison of two internal records to establish that sufficient pension scheme money is being held: • Scheme money resource: The aggregate balance of trustee bank accounts (i.e. the cashbook) and amounts being held by third parties. • Scheme money obligation: The total amount of scheme money necessary to fulfil obligations to members, based on the aggregation of individual arrangement balances. 4.40 We propose that firms should calculate the scheme money obligation using a standardised approach, based on pension scheme money attributable to individual SIPPs or members’ arrangements. We do not propose to permit firms to use a method similar to the net negative add-back that is available under CASS 7.16.17R. That method relies on aggregate bank-account-level calculations and may not align well with typical SIPP operating models, in which bank accounts can be designated to individual SIPPs (as a pooled arrangement can be used).

31 4.41 However, we recognise that our approach may be restrictive. We want stakeholders’ views on whether firms currently use bank account level calculations, and whether the net negative addback method would be appropriate. Methods for calculating pension scheme requirement Standardised approach: Aggregating the positive pension scheme money balances attributable to each individual SIPP or member’s arrangement, based on the firm’s internal books and records. Net negative add-back: Aggregating the pension scheme money held in trustee bank accounts, and adding any negative balances back so that the total amount held is not understated. 4.42 We are proposing that firms must also include indirectly held scheme money as part of their daily internal reconciliation to obtain a complete view of pension scheme money. However, we recognise that the indirectly held scheme money position may not change on a day-to-day basis, until updated information is received from a third party that holds pension scheme money in its own client money arrangements. Firms must therefore ensure that updated amounts are provided at least monthly, to align with our asset information requirements (see paragraphs 4.52 to 4.59). 4.43 Finally, firms must reconcile their internal records with the records and accounts of any third parties, including banks, that hold pension scheme money. This external reconciliation must cover both directly and indirectly held scheme money and be performed as often as necessary, and at least monthly. This reconciliation is to ensure that the firm’s internal records accurately reflect the amounts held by third parties for the pension scheme. Question 9: Do you agree with our proposals for pension scheme money reconciliations, including the frequency of reconciliations and the treatment of indirectly held scheme money as money rather than an asset? What challenges do firms face in meeting these requirements? Question 10: Would firms prefer to be able to calculate the scheme money obligation using the net negative add-back method? Discrepancies and treatment of shortfalls 4.44 Under our proposals, where a firm identifies a discrepancy because of an internal or external pension scheme money reconciliation, it must promptly investigate and take appropriate steps to resolve the discrepancy without delay. Until the discrepancy is resolved, the firm must take appropriate steps to address any resulting shortfall (deficit between the amount that should be held and the amount actually held).

32

4.45 This approach is intended to reduce the risk of pension scheme money being unfunded for extended periods, and to limit potential consumer harm if a firm fails while a discrepancy exists. We do not prescribe how firms must address a shortfall, either during the investigation period or where they are responsible for the shortfall. 4.46 Where a firm reasonably concludes that a third party it has appointed to hold pension scheme money is responsible for a shortfall, the firm must take reasonable steps to engage and cooperate with that third party to resolve the shortfall. Until the shortfall is resolved, the firm must consider whether it is appropriate to notify the FCA. 4.47 Where a firm expects that a material shortfall will not be resolved within a reasonable timeframe, it must notify the FCA in writing without delay. This includes in circumstances where a third party is failing to comply with, or cooperate in, resolving a discrepancy. The firm must also consider whether it is appropriate to notify each affected scheme member. Where it decides not to do so, it must keep that decision continuously under review. 4.48 In addition, a firm must notify the FCA without delay if it: • has internal records of pension scheme money that are materially out of date • is unable to, or fails to, conduct an internal or external pension scheme money reconciliation Pension scheme assets 4.49 As set out in paragraph 4.9 and 4.10, SIPP operators may hold assets through different structures. Some assets, such as commercial property registered at HM Land Registry, are often held directly by the trustee. Other investments, such as securities, are commonly traded and held through third parties that provide trading and custody services. These are typically held by those third parties on behalf of the unauthorised trustee. 4.50 Where assets are held by third parties, firms often rely on information from the third party to understand changes in asset holdings and transaction activity. In some cases, intermediaries or clients may place dealing instructions directly with those third parties without involving the firm, particularly where DIMs act on the members’ behalf. As a result, firms may have incomplete or delayed records and may not always have a clear, uptodate view of the assets held for members. 4.51 Regardless of the structure or intermediaries, the firm is the pension scheme operator, responsible to members for managing and administering the assets of the scheme (see Q4, PERG 12.2). Therefore, we expect firms to have sufficient information and oversight to: • ensure that assets held within the pension scheme are appropriately attributed, and held for the benefit of the scheme • identify, on an ongoing basis, which assets within the scheme are attributable to each individual SIPP or member’s arrangement.

33

Maintenance of records and accounts 4.52 We understand that some firms do not currently record transaction-level data or maintain records on the individual assets held by third parties. Instead, they may only record an aggregated portfolio valuation in their system, which in some cases can be updated as infrequently as once a year. 4.53 We propose that firms’ records must enable them to clearly distinguish the pension scheme assets held for one member from those held for any other member. Firms must also record and maintain data on both investment holdings and transactions, including those made by third parties, to create and maintain up-to-date holdings record. This information must be updated at least monthly. Taken together, these requirements will enable firms to maintain a clear audit trail for the handling of pension scheme assets. 4.54 A firm’s holdings record for an individual SIPP or member’s arrangement must be capable of providing: • the total amount of pension scheme assets held for that scheme member’s individual fund or arrangement • the specific investments being held within the individual SIPP • the third party with whom the trustee has made arrangements to hold the asset Firms may also choose to maintain a separate aggregate record of pension scheme assets. 4.55 It is best practice for firms to create and maintain internal records without relying on external data. However, as with indirectly held scheme money, third parties are often the only reliable source of transaction and holdings data relating to pension scheme assets. We therefore propose that, where third parties are the only source of the data, firms may use that data, provided it is reasonable to do so. Question 11: Do you agree with our proposal that firms must record and maintain data on investment holdings and transactions, including those made through third parties? Record checks and reconciliations for assets 4.56 To support compliance with the record and account requirements set out above, we propose that firms must maintain systems and controls that are capable of: • testing the integrity of each individual arrangement holdings record (defined below) • identifying discrepancies in the firm’s recordkeeping, including over- or understatement of pension scheme assets, negative balances, and processing, journal entry or IT errors • promptly determining the total pension scheme assets held by the unauthorised trustee and relevant third parties for scheme members • ensuring that data received from third parties to satisfy the firm’s obligations has been correctly received and accurately processed over the relevant period, and that weaknesses or errors in data consumption are identified and addressed.

34 4.57 Certain firms may choose to maintain a separate aggregate asset holding record to support checks that internal records and accounts are accurate and consistent. Where a firm maintains such a record using its own data (that is, not relying on third-party data), it must have an appropriate monthly internal reconciliation process to: • ensure consistency between the two records • identify discrepancies that may not be detected through the baseline systems and controls alone While we recognise that many firms do not currently maintain a separate aggregate record, we consider it important to set expectations where firms systems develop in this way in future. This reconciliation would compare: • an individual arrangement holdings record, showing the pension scheme assets held for each individual scheme member, and • an aggregate asset holding record, showing all assets held for the pension scheme. 4.58 Our proposals are that firms must carry out external pension scheme asset checks to provide reasonable assurance over the completeness and accuracy of their internal records. They should do this by comparing their internal records with statements or confirmations from relevant third parties. Firms must do these checks as often as necessary, but no less frequently than monthly. 4.59 Firms must also verify pension scheme assets held in physical form where they are held in arrangements within the control of the SIPP operator. This involves confirming that such assets (typically items such as paper share certificates, title deeds, or other documents evidencing ownership) are accurately and completely reflected in, and match, the firm’s internal records or accounts. Firms must perform this reconciliation as often as necessary, and at least annually. Question 12: Do you agree with our proposals for pension scheme asset checks and reconciliations? What challenges do firms face in meeting these requirements? Discrepancies and treatment of shortfalls 4.60 Pension scheme assets are commonly held by third parties on behalf of the scheme in the name of the unauthorised trustee. As a result, a firm may sit at the end of an extended custodial chain, so it may only partly control the investigation and resolution of discrepancies. 4.61 As with pension scheme money, where a firm identifies a discrepancy through pension scheme asset reconciliations or checks, it must investigate promptly and take appropriate steps to resolve the discrepancy without undue delay. Until the discrepancy is resolved, the firm must take appropriate steps to address any resulting shortfall. 4.62 The same requirements set out in 4.44 to 4.47 apply in relation to pension scheme assets. In particular, where a firm reasonably concludes that a third party it has appointed

35 to hold pension scheme assets is responsible for a shortfall, the firm must take reasonable steps to engage and cooperate with that third party to resolve the shortfall. 4.63 In addition, a firm must notify the FCA without delay if it: • has internal records or accounts of pension scheme assets that are materially out of date, inaccurate, or invalid • is unable to, or materially fails to, conduct an external pension scheme asset check. Arrangements with third-parties 4.64 Where a third party holds pension scheme money or assets for the scheme in the name of an unauthorised trustee, we propose that firms must exercise due skill, care and diligence in selecting, appointing and reviewing the third party on an ongoing basis, which would include understanding the third party’s arrangements for holding assets. 4.65 To meet the above requirements, particularly those relating to indirectly held scheme money and pension scheme assets, we expect firms need to receive regular and timely information from third parties. Many firms already receive live data feeds that cover a significant proportion of third party relationships. We therefore propose that firms must have arrangements in place with third parties that specify the information flows required, including expectations around frequency and format, to enable the firm to maintain adequate books and records and carry out reconciliations. 4.66 Firms should be prepared to take appropriate action if a third party’s data provision does not give them adequate oversight and ensure they can protect consumers. This may, in some cases, include the termination of contracts. We do not propose placing direct obligations on third parties holding pension scheme money and assets to provide information as we consider agreements between the parties should be sufficient to achieve the necessary information flows in practice. 4.67 We expect that, once these proposed rules are in place, many SIPP operators will encourage third parties to provide live data feeds at the required frequency, or will undertake the orderly off boarding of third parties that cannot meet these requirements, with accounts transferred to alternative providers. As the market shifts towards third parties capable of providing live feeds, it should become less onerous to perform reconciliations, reducing (and potentially eliminating) the need for ongoing manual reconciliations. Valuations 4.68 Valuations help consumers understand the value of their pension benefits, make informed decisions and plan appropriately for retirement. In DP24/3, we highlighted issues with inaccurate or outdated asset valuations, including delays to withdrawals and cases where impaired assets continue to be recorded at book cost. 4.69 For the purposes of reconciliations under the PSM&A regime, firms are not required to regularly obtain an up-to-date valuations, as reconciliations are based primarily on holdings records and quantities rather than precise values.

36 4.70 Some asset classes held by SIPPs, such as commercial property and intellectual property rights, are costly and complex to value and may therefore be valued less frequently. Requiring more frequent valuations could therefore be disproportionate and result in consumers bearing additional costs. 4.71 To strike an appropriate balance and mitigate the risk of firms relying on impaired or outdated valuations, we propose that firms must include a recent valuation within their asset holdings record. While firms are not required to obtain fresh valuations at the same frequency as reconciliations for harder to value assets, they must ensure that recorded valuations are reasonable, credible, and sufficiently up to date. Where a firm reasonably expects that the value of an asset has changed materially, it should reflect this in its holdings record. Question 13: Do you agree with our proposals for pension scheme asset valuations? Audit requirements 4.72 External assurance can play an important role in protecting pension scheme money and assets. We propose that firms commission an annual audit for internal assurance purposes. The resulting Scheme report must be addressed to the firms governing body (typically the board) and must state whether, in the auditor’s opinion: • The SIPP operator has maintained adequate systems and controls to comply with the Scheme report rules throughout the period covered by the report, and • The SIPP operator was in compliance with the Scheme report rules at the end of that period. 4.73 The auditor must provide the Scheme report to the firm’s governing body within four months of the end of each reporting period, and to the FCA on request. The auditor must also notify the FCA, together with the expected reasons for failure, where it expects that it will be unable to meet the requirement to produce the report within this timeframe. 4.74 The auditor’s report must identify any instances where the SIPP operator has failed to meet the requirements set out above, including where systems and controls are not adequate or where the firm was not compliant with the PSM&A rules at the end of the reporting period. 4.75 Firms must notify us electronically of any materially adverse audit findings for the relevant period. A materially adverse finding is one that indicates systemic or pervasive weaknesses in a firm’s arrangements for the handling of pension scheme money or assets. We would normally expect firms to tell us about such findings under existing requirements. These include Principle 11, which requires firms to deal with their regulators in an open and cooperative way and to disclose anything relating to the firm of which we would reasonably expect notice.

37

4.76 We are engaging with the Financial Reporting Council on whether an existing assurance standard would support the performance of these engagements or if a new standard may be required. If a new standard is required, this will be considered in any proposed implementation timeline. Question 14: Do you agree with our proposed auditing requirements for the PSM&A regime? What challenges do firms and auditors face in meeting these requirements? Reporting obligations 4.77 Under the CASS regime, firms above a specified threshold are required to submit a monthly Client Money and Assets Return (CMAR) to the FCA, which provides a snapshot of a firm’s client asset holdings, bank accounts, custody assets, reconciliation activity and outsourcing arrangements. The FCA uses this information to monitor risk and may follow up where there are, for example, significant month on month changes, late submissions or indications of insufficient diversification. 4.78 We therefore propose to work with firms to assess and define the appropriate reporting regime for the PSM&A regime, including whether such reporting would be necessary and proportionate, as firms establish systems and controls to meet the new requirements. In doing so, we will also consider the information the FCA already collects through ad hoc SIPP data requests. 4.79 We already require firms to give us a range of firm level regulatory information, including annual accounts, financial resources returns and complaints data. These obligations arise from several separate reporting regimes. For example, reporting under SUP 16.12 (Regulated Activity Group 4, where applicable) provides firm level prudential and financial information. Firms also report on retirement income and decumulation, including assets under administration and retirement income flows. However, outside of firms required to submit a CMAR, there is no consistent or systemic data on how pension scheme money and assets are held, recorded and reconciled. 4.80 We expect any future PSM&A reporting to draw primarily on information that firms would maintain under the maintenance of records and accounts, reconciliation and valuation requirements in this chapter. This could include, for example: • the total amount of pension scheme money and assets held for each individual SIPP or member’s arrangement • details of reconciliations performed, including the timing and scope, any discrepancies identified, and the actions taken to investigate and resolve them. Question 15: Do you think the new PSM&A regime warrants the introduction of a new regulatory return, and if not, what existing or alternative information should the FCA use to assess whether firms are meeting the requirements of the new regime?

38

Question 16: Do you think that a monthly reporting obligation is proportionate, or would less frequent reporting be more appropriate for a Pension Scheme Money and Asset Return? If so, how frequent (for example, quarterly)? Implementation period 4.81 Our proposals will require SIPP operators to develop or enhance internal systems and processes, particularly to improve internal maintenance of records and accounts. They may also need to update agreements with third parties to obtain data more frequently, including through live data feeds. While these requirements represent minimum standards for operating SIPPs, we are mindful of the potential burden on firms and consider it appropriate to provide time to adapt. 4.82 We therefore propose a two year implementation period before the requirements come into force. During this period, SIPP operators must: • put in place the organisational arrangements, systems, policies and procedures needed to comply with the requirements • stop onboarding new third party relationships that cannot meet the requirements, and ensure all new relationships are compliant • review existing contractual arrangements with third parties and, where necessary, terminate and possibly re-establish them to meet the requirements This is intended to signal that existing practices cannot continue and that firms should be able to comply within two years. 4.83 For operators with existing third-party relationships, we propose a further one year period may be available, where needed, following the initial two year period. During the first two years, firms must identify any significant dependencies on third parties that prevent full compliance and develop plans to address them. The additional year can then be used to give effect to that plan, likely through integrating legacy providers or carrying out the orderly off-boarding of third parties that cannot meet the data frequency requirements, to resolve those dependencies. By the end of the third year, all operators should be fully compliant and, where necessary, have ended such relationships. Question 17: Do you agree that an implementation period is needed? If so, is a two-year period appropriate, with an additional year available for dependencies on third parties?

39 Chapter 5 Self-invested personal pensions (SIPPs): segmenting the market, target market and wider harms Range of SIPP products and segmenting the market 5.1 The issues outlined in this paper relating to due diligence and holding of pension scheme money and assets arise in part because of the wide variability of SIPPs products and structures across the market. 5.2 DP24/3 outlined the main product types in the SIPP market, which we broadly divided into three categories: • Bespoke SIPPs: These provide access to a wide range of asset classes, including non-mainstream and more esoteric investments such as derivatives. They are typically designed for experienced or highly engaged investors. • Streamlined or simple SIPPs: These usually offer access to a broad range of mainstream funds and are more commonly targeted at the mass market. • Ready-made SIPPs: These usually offer access to a limited range of preselected investments (such as target-date funds) or risk-rated model portfolios. 5.3 We noted that different SIPP products create different consumer experiences, so operators may need to provide varying levels of support. For instance, consumers using bespoke SIPPs tend to take a more active role in managing their investments, whereas simple SIPP users are typically less engaged. We asked for feedback on these product categories, and how the market could be segmented to better target differing consumer support needs. The feedback we received 5.4 Responses to DP24/3 were mixed. Some respondents agreed with our product categorisations, while a few proposed alternatives such as segmenting the market only into bespoke and simple SIPPs. Others argued that formal segmentation would add complexity with limited benefit, noting that consumer engagement varies widely and is not necessarily determined by whether a SIPP is ‘simple’, ‘bespoke’, or ‘ready-made’. They also highlighted that consumer behaviour, and needs, can change over time, even within the same product. Several respondents suggested we review the definitions of SIPPs and personal pensions, saying they are too similar, but emphasised that any changes must be carefully designed to avoid unintended consequences.

40 Our response After considering the feedback, along with the complexity and diversity of the SIPP market, we are not proposing to introduce formal categorisation of SIPPs. Although SIPPs can be described along a spectrum of product types, we do not consider that formal segmentation would materially improve consumer outcomes or the targeting of support. We also see a risk that prescriptive categorisation could introduce unnecessary complexity or reduce flexibility. However, we have reflected the differing risk profile of different offerings in our rules on due diligence. Target market 5.5 In DP24/3, we noted that some SIPP operators were not defining their target market with sufficient detail. This creates a risk that consumers are being sold SIPP products that are not designed to meet their needs. We invited feedback on how operators ensure they offer consumers the right SIPP product, and any challenges they have in detailing their target market. The feedback we received 5.6 Respondents said that defining target markets needs a considered approach due to the diverse nature of SIPP products and assessing client suitability should be an ongoing process as client needs can change over time. They noted that different SIPPs serve different client needs. For example, a bespoke SIPP might be the right option for a client who wants to place a commercial property into a pension wrapper, whereas the target market for a ready-made SIPP can be very wide. Despite these complexities, respondents generally felt that the Duty’s obligations already provide an adequate framework for firms to identify and appropriately define their target markets, and address potential consumer harms in this area. Our response Under the Duty, SIPP operators act as both manufacturers and distributors, so they must clearly define the target market for each product. As set out in DP24/3, we do not propose new requirements at this stage and will continue to rely on the general obligations under the Duty framework. We have already clarified our supervisory expectations about how SIPP operators should specify a target market in our 2023 and 2024 Dear CEO letters.

41 Further harms in the SIPP market 5.7 In addition to the specific issues set out in DP24/3, we asked for feedback on any other drivers of harm that could have a significant impact on the SIPPs market. The feedback we received 5.8 Of those that responded to this question, around a third thought there were no other significant harms. A small number of respondents called for a review of the ‘standard’ asset categorisation under IPRU-INV 5.9. They said the 30-day liquidity test deters operators from offering certain products, such as fixed-term deposits, because they would result in higher capital requirements. They said this undermines consumer choice and market diversity and, in some cases, creates barriers for consumers who want to transfer out of unsuitable SIPPs. 5.9 There were additional concerns that were raised individually by separate respondents. These included: • SIPPs that don’t offer a full range of features, including further contributions and a range of decumulation options, which could have a negative impact on income in retirement. The increasing use of SIPPs as consolidation vehicles highlights the importance of this. • Operational and legacy challenges for distressed firms managing historical books containing illiquid or inappropriate assets. The respondent suggested grace periods or lighter touch regulation in rescue or transfer scenarios. • Ongoing risks from fees being charged on scam-linked investments and introducers re-emerging as claims managers. Our response Having considered responses to this question, which were limited in number, we do not consider these issues a priority to justify changes to our rules at this time. We will continue to monitor these issues, taking account of our supervisory experience and any further evidence of consumer harm. The capital requirements in IPRU-INV 5.9 form part of our prudential framework and are intended to protect consumers by reducing the risk and impact of a SIPP operator failure. They help ensure that: • assets can be transferred or realised promptly • sufficient funds are available to cover wind-down costs • consumers do not suffer loss (for example, paying for the administrator of a failed firm out of their pension assets) It is worth noting that a fixed term deposit with more than 30 days residual maturity is not automatically a ‘non-standard’ asset. It may still qualify to be ‘standard’ if, for example, there is a break clause, and the deposit could be withdrawn early (albeit with an interest penalty).

42 Annex 1 Questions in this paper Question 1: Do you agree with our proposed due diligence requirements for relevant third parties? If not, please outline why. What challenges or unintended consequences, if any, should we consider? Should we consider, if warranted, further protections for SIPP consumers? Question 2: Do you agree with our proposed approach for proportionate due diligence on investments using asset categories? If not, why not? Do you agree with the asset categories for core and additional due diligence or are further protections needed for some assets to sufficiently protect consumers? Question 3: Do you agree with our proposed contract and monitoring requirements for SIPP operators to protect consumers where assets are acquired and managed by a third party on behalf of the consumer? Are there any challenges for SIPP operators in meeting these requirements, or further requirements needed to protect consumers? Question 4: Do you agree with our proposals on governance, monitoring and record-keeping? If not, why not? Question 5: Do you agree an implementation period is needed? If so, is 12 months an appropriate timeframe? Question 6: Do you agree with our proposed high-level scope and approach to introducing a more prescriptive PSM&A regime for SIPPs? What challenges, unintended consequences, or additional protections for consumers or firms should we consider? Question 7: Are there areas where our proposed PSM&A requirements create complexity for firms operating across both regimes (including CASS)? If so, what mitigations would be possible to address these complexities? Question 8: Do you agree with our proposal that firms should establish and maintain an internal record of pension scheme money, including money held indirectly by third parties? What challenges do SIPP operators face in meeting this requirement?

43 Question 9: Do you agree with our proposals for pension scheme money reconciliations, including the frequency of reconciliations and the treatment of indirect pension scheme money as money rather than an asset? What challenges do firms face in meeting these requirements? Question 10: Would firms prefer to be able to calculate the scheme money obligation using the net negative add-back method? Question 11: Do you agree with our proposal that firms must record and maintain data on investment holdings and transactions, including those made through third parties? Question 12: Do you agree with our proposals for pension scheme asset checks and reconciliations? What challenges do firms face in meeting these requirements? Question 13: Do you agree with our proposals for pension scheme asset valuations? Question 14: Do you agree with our proposed audit requirements for the PSM&A regime? What challenges might firms and auditors face in meeting these requirements? Question 15: Do you think the new PSM&A regime warrants the introduction of a new regulatory return, and if not, what existing or alternative information should the FCA use to assess whether firms are meeting the requirements of the new regime? Question 16: Do you think that a monthly reporting obligation is proportionate, or would less frequent reporting be more appropriate for a Pension Scheme Money and Asset Return? If so, how frequent (for example, quarterly)? Question 17: Do you agree that an implementation period is needed? If so, is a two-year period appropriate, with an additional year available for dependencies on third parties?

44 Annex 2 Cost benefit analysis Executive summary

1. Self-invested personal pensions (SIPPs) are a type of personal pension scheme designed to give individual investors greater control over where their pension money is invested.
2. There are currently 98 firms with relevant permissions who offer SIPP products in the market. In 2024 assets under administration (AUA) within SIPPs stood at approximately £567bn across 5.3 million consumers, having grown from £330bn in 2022. The harm
3. We are concerned that some firms’ current due diligence processes for accepting investments into a SIPP may not be sufficiently robust. This can expose consumers to higher risk of harm from firms accepting inappropriate assets into schemes, including investments that turn out to be scams or fraud, and investment propositions that lack credibility and are inherently unlikely to deliver returns claimed.
4. We are also concerned that the requirements for handling of pension scheme money and assets in some firms are insufficient. SIPP products can be operated under different business models, meaning they may fall under differing regulatory requirements. For example, the Client Assets Sourcebook (CASS) client money rules for firms acting as trustees versus the Prudential Sourcebook for Investment Firms (IPRU-INV) rules for investment firms. Indeed, where an unauthorised trustee is used, or where third parties hold pension scheme money or assets in the name of the unauthorised trustee, there may be no prescriptive requirements on the scheme operator with respect to issues like record-keeping, reconciliation and client reporting. These inconsistencies weaken the protection of pension scheme money and assets across the industry.
5. Redress liabilities associated with due diligence complaints against SIPP operators upheld by the Financial Ombudsman have contributed to high rates of SIPP operator failures in recent years. Between 2010 and 2025, 26 SIPP operators failed leaving redress liabilities created by poor due diligence in relation to investments accepted during and prior to this period. Consumers have suffered financial losses, as well as experiencing significant distress, because of these failures. While FSCS protection of up to £85,000 per eligible consumer, per firm is available in the event of SIPP operator failure (having been raised from £50,000 in April 2019 for firms failing after then), consumers’ exposures can exceed this such that they are not fully compensated. We estimate that across 22 SIPP operator failures that occurred between 2011 and 2023 (but that may have been associated with investments that predated this period), consumers’ have suffered uncompensated financial losses of approximately £526 million following SIPP operator failures, mostly where consumers’ losses exceeded the applicable FSCS compensation limits.

45 6. Weaknesses in the handling of pension scheme money and assets can also lead to delays or issues where a firm winds down, particularly for disorderly wind-downs. Our proposals 7. Due diligence obligations already exist under our high-level rules (including under Principle 2 and COBS 2.1.1R) and our (supervisory) expectations have previously been set out in non-Handbook guidance. However, to improve consumer outcomes, and support more consistent standards across firms going forward, we consider it important to set out explicit core due diligence obligations in Handbook rules. 8. We are also addressing gaps in existing requirements that arise from differences in how pension schemes are structured and operated, to ensure that money held by unauthorised trustees is subject to detailed requirements governing its handling. These measures are intended to ensure that investments, and third parties providing services in relation to these investments, are subject to appropriate scrutiny and that firms maintain adequate books and records, perform frequent reconciliations to ensure these records are accurate, identify and investigate discrepancies promptly, and maintain appropriate standard through audit. Costs and benefits 9. We expect that our proposals will reduce uncompensated losses to consumers in excess of the cap on FSCS protection for SIPPs following SIPP operator failures. Our due diligence proposals will reduce the risk of firms accepting scams and fraudulent or implausible investments into portfolios, reducing the redress liabilities associated with inadequate due diligence. Our proposed PSM&A rules will improve firms’ oversight and allow them to identify and address issues earlier. Together, we expect the proposals to reduce the risk of SIPP operator failures. Where a firm failure does occur, we expect our proposals to mitigate the extent of consumer losses above the FSCS compensation cap by reducing consumers’ losses from scams and fraudulent or implausible investments and preventing discrepancies between the scheme’s records and a client’s actual holdings of assets and money in the scheme from accumulating. Where our proposals prevent operator failures, this will also avoid the negative wellbeing impacts on consumers associated with the stress and uncertainty of their SIPP operator failing. 10. Our central estimate of these quantified benefits over our 10-year appraisal period is £136.4m in present value (PV) terms. We also expect further (unquantified) benefits to consumers in the form of reductions in delays and issues in transfers of SIPPs between operators when a firm is winding down, and to firms in the form of greater consumer trust in the SIPP market. 11. We expect SIPP operators to incur both one-off and ongoing costs to comply with our proposals. Third parties who hold or manage investments in SIPPs, including but not limited to discretionary investment managers, will also face one-off and ongoing costs as SIPP operators will need these third parties to provide information in order for them (the SIPP operators) to comply with our proposals. We estimate these costs, together, to be £63.4m in PV terms over our 10-year appraisal period.

46 12. We therefore estimate a net benefit, in our central case, of £72.9m in PV terms over the appraisal period. The estimated annual net direct cost to business (EANDCB) is £7.4m. We consider these costs to be proportionate to the expected benefits, given the scale of consumer harm addressed. Table 1: Total benefits and costs of proposals over 10 years, PV-adjusted  PV Benefits PV Costs NPV Total impact £136.4m £63.4m £72.9m 13. We conduct several sensitivity analyses to examine how our estimates change as we vary key assumptions. Our estimated benefits exceed our estimated costs in all the scenarios we model, except the one in which we assume that our proposals have no effect on the losses of consumers who complain against financial advisers who provided unsuitable advice following a SIPP operator failure, often to invest in high-risk or inappropriate assets via a SIPP. We expect, though, that our proposals will reduce such losses. We expect that our proposals will reduce the likelihood of inappropriate investments being accepted into SIPPs even where unsuitable advice has been provided, by improving operators’ due diligence, and help to reduce the likelihood of operator failures. Monitoring and evaluation 14. We propose that we would draw on a range of information and data to assess the success of our proposals. We would assess the impact of our proposals on firms and the market, including any increases in firm exits and market consolidation, through our supervisory work and intelligence. We would also review data on complaints to SIPP operators and to the Financial Ombudsman to gain insights on how consumers’ experiences of the SIPP market are changing. We may, in the future, request data from firms drawn from the records they would be required to keep under our proposals. Introduction 15. The Financial Services and Markets Act (2000) requires us to publish a cost benefit analysis (CBA) of our proposed rules. Specifically, section 138I requires us to publish a CBA of proposed rules, defined as ‘an analysis of the costs, together with an analysis of the benefits that will arise if the proposed rules are made’. 16. This analysis presents estimates of the significant impacts of our proposals. We provide monetary values for the impacts where we believe it is reasonably practicable to do so. For others, we provide a qualitative explanation of their impacts. Our proposals are based on weighing up all the impacts we expect and reaching a judgement about the appropriate level of regulatory intervention.

47 17. The CBA has the following structure: • The SIPPs market • Problem and rationale for intervention • Our proposed intervention • Alternative options considered • Baseline and key assumptions • Summary of costs and benefits • Benefits • Costs • Modelling risks and uncertainty • Wider economic impacts, including on our secondary objective • Monitoring and evaluation The SIPPs market 18. SIPPs were introduced through the Finance Act 1989. They are a type of personal pension scheme designed to give individual investors greater control over where their pension money is invested. Originally designed for wealthier investors, they have since become a more mainstream product. 19. The SIPP market has seen significant growth in recent years, particularly following pension freedoms and the wider appeal of streamlined and platform SIPPs. Our 2024 survey of SIPP operators indicates that assets under administration (AUA) within SIPPs has increased significantly from £330bn in 2022 to approximately £567bn in 2024, for approximately 5.3m consumers. This represents roughly a third of the £1.4tn held in FCA-regulated defined contribution (DC) pensions. SIPP operators 20. There are currently 98 firms with the relevant permissions offering SIPP products. These firms include specialist SIPP providers, platform-based operators (often linked to life insurers), and wealth management firms. Below we provide an overview of the SIPPs, split by the FCA ‘portfolios’ the different firms sit in. As part of its approach to supervision, the FCA splits the firms it regulates into ‘portfolios’ of firms with similar core business models. Table 2: General overview of SIPPs market in 2024 Portfolio Number of firms Total number of SIPPs Total AUA (£) SIPP Operators 51 1.5m £184bn Platforms 19 1.6m £203bn

48 Portfolio Number of firms Total number of SIPPs Total AUA (£) Life Insurance 14 2.0m £163bn Wealth Management 8 0.03m £7.4bn 1 Other portfolios 6 0.16m £9.2bn Total 98 5.3m £567bn 21. Competitive levers for SIPP operators include the range of investment choices offered and pricing models. Ease of use and digital functionality are increasingly important factors, as consumers increasingly expect intuitive platforms, mobile apps, and integrated retirement planning tools. Pricing strategies vary between flat-fee structures and tiered percentage charges, often supplemented by promotional offers such as cashback or fee caps for larger portfolios. Consumers in the SIPP market 22. For consumers, SIPPs can offer a tax-efficient way of saving for retirement and can provide flexibility and control over investment choices. 23. Different types of SIPP can suit different consumer needs. For instance, SIPPs that we termed ‘bespoke SIPPs’ in DP24/3 typically attract more engaged consumers who take an active role in managing their investments and who may have a higher risk appetite regarding potential financial losses. Bespoke SIPPs often allow consumers to invest in a range of non-standard assets such as commercial property. At the other end of the spectrum, ‘ready-made’ SIPPs allow consumers access to a limited set of pre-selected investments or risk-rated model portfolios. In general, consumers using ready-made SIPPs tend to be less engaged and less likely to be advised than those using bespoke SIPPs. Those using bespoke SIPPs may tend to exhibit a larger appetite for risk. For the avoidance of doubt, note that we are not proposing to introduce a formal categorisation of SIPPs. See Chapter 5 of the Consultation Paper above. 24. As we discuss further below, some SIPP operators have in the past accrued significant redress liabilities following consumer complaints around their due diligence of new business or investments. In 2019-20, the number of open cases at the Financial Ombudsman relating to SIPP due diligence reached a peak of around 3,500; this number had fallen to around 800 by late 2024. Third parties in the SIPPs market 25. SIPP operators often have relationships with various third parties across the distribution and custody chain. Investments may be made via a third party such as a platform service provider, stockbroker account, or discretionary investment manager (DIM). These third parties may also hold cash. Further information on SIPP scheme structures is provided in paragraphs [4.8] to [4.11] in the Consultation Paper above. 1 Advisers & Intermediaries, Asset Management, Custody & Fund Services, and Retail Banking.

49 26. For the purposes of this CBA, where we consider SIPP operators’ third-party relationships, we focus on relationships with DIMs since they represent the vast majority of relevant relationships with regulated thirdparties, and reliable, detailed data on other third parties is not available. DIMs include a range of firms, including wealth managers and asset managers. SIPPs often account for only a small proportion of DIMs’ revenues. Problem and rationale for intervention 27. The diagram below outlines the theory of harm relating to SIPP operators’ practices with respect to due diligence and the handling of pension scheme money and assets. Figure 1: Theory of harm Moral hazard Drivers of harm Transmission of harm Insufficiently specific due diligence requirements Principal￾agent problem Inconsistency in asset protection requirements Inaccurate or out of date books & records Weak reconciliation processes Consumers complain; redress liabilities rise and operators are unable to meet costs Financial and welfare loss to consumers Consumer losses upon firm failure Delays and issues in SIPP transfers in the case of firm failure Inadequate due diligence checks conducted by firms Firms accept scams and fraudulent or implausible investments into SIPPs High-level obligations on non-MiFID SIPP operators around handling pension scheme money and assets; Handbook obligations do not apply to unregulated entities holding assets HARM

50 Driver of harm – insufficient due diligence requirements 28. Due diligence obligations already exist under our high-level rules (including under Principle 2 and COBS 2.1.1R) and our expectations have been previously conveyed in non-Handbook guidance (FG 13/8). In 2013, we published finalised guidance for SIPP operators, setting out our expectations on due diligence and observations on good industry practice following thematic reviews. This includes, for example, duties to check and monitor introducers as well as assessing that the investments SIPP operators accept are appropriate to include within a personal pension scheme. 29. Since 2013, we have undertaken extensive supervisory work to assess whether firms are meeting these obligations and have reinforced our expectations through CEO letters and engagement with firms. We have also intervened in litigation, including the Berkeley Burke and Options judicial reviews and the Adams v Options case, to support greater clarity regarding the nature and scope of firms’ responsibilities, including the level of due diligence required before permitting investments into a SIPP. 30. However, our supervisory evidence indicates that application remains inconsistent, and that some firms still do not conduct adequate due diligence. The 2022 due diligence review and ongoing supervisory work identified weaknesses in firms’ assessment of introducers and of investments accepted into SIPPs, as well as gaps in ongoing monitoring, including limited scrutiny of assets managed by discretionary investment managers and shortcomings in firms’ systems and controls. 31. While firms are now expected to be more familiar with the Consumer Duty and outcomes-based requirements, the due diligence review demonstrates weaknesses and inconsistencies in firms’ underlying processes and controls can still give rise to poor outcomes, even where firms have sometimes asserted compliance without sufficiently adequate measures in place. In these cases, reliance on principles alone may therefore be insufficient where core controls are not operating effectively. 32. These weaknesses increase the risk of unsuitable or high-risk investments being accepted into SIPPs, particularly where investment propositions are weak, unverified, or vulnerable to misrepresentation, leading to potential consumer detriment when such investments fail to perform or prove to be fundamentally flawed. 33. This situation gives rise to moral hazard. Where weaknesses in firms’ underlying due diligence and monitoring arrangements are not addressed sufficiently through the existing regulatory framework, there is a risk that poor practices persist and that firms continue to accept unsuitable or high-risk investments into SIPPs. 34. More explicit rules will establish clearer, consistent standards and application in practice across firms. They also support a more consistent and evidential foundation for timely and proportionate supervisory and, where appropriate, enforcement action, while continuing to operate alongside the Consumer Duty. Driver of harm – inconsistency in asset protection requirements 35. For SIPP operators authorised under the Markets in Financial Instruments Directive (MiFID), compliance with the Client Assets Sourcebook (CASS) is central to safeguarding

51 assets. CASS applies to all client money and custody assets held by the firm, including those within SIPPs. Operators must implement controls such as segregation of client money and assets, daily reconciliations, and identification and investigation of discrepancies (where pension scheme money or assets are more or less than they should be). Regular audits under CASS provide assurance that SIPP assets are accurately recorded and protected from misuse or shortfall. Other personal pension schemes operated by insurance firms or life insurers are already subject to governance, data quality and documentation requirements under Solvency II. 36. In SIPPs that use an unauthorised trustee, pension scheme money and assets are held in the name of, or for, the trustees. Often (in the case of over 90% of SIPP schemes, according to our 2024 data request), the trustee is a separate, unauthorised entity. Over time a significant number of firms have legitimately structured their businesses in this way such that our CASS requirements, which are designed to protect money and assets, do not apply to them. Instead, the SIPP operator is subject only to high￾level requirements to maintain orderly records and adequate systems and controls (for example under SYSC 9.1.1 and Principles 3 and 10). Where operators use unauthorised trustee structures, pension scheme money and assets are held by unregulated entities that are not themselves subject to FCA rules. 37. The absence of more prescriptive requirements has led to significant variation in market practice. Unlike firms subject to CASS, SIPP operators with unauthorised trustees are not required to meet detailed standards on client-level records, reconciliation frequency or audit trails. For firms outside CASS, this can also limit the FCA’s ability to evidence breaches to the standard required for enforcement. In practice, enforcement action is therefore largely confined to more serious cases where record-keeping and reconciliation failures form part of wider systems and controls breaches and may not capture concerns relating solely to the quality, completeness or auditability of records. Where these more minor deficiencies arise, supervisory intervention typically focuses on remediation and enhanced oversight, rather than formal enforcement outcomes. 38. Our supervisory work indicates that many of the firms (further detail provided in baseline and key assumptions chapter) to whom no detailed CASS rules apply at the moment have not established systems and controls for the handling of pension scheme money and assets that are in line with what we are proposing. Some of these firms may not maintain timely, complete records of transactions and investment holdings. Reconciliations are often delayed, with operators relying on external bank data rather than internal systems, limiting their ability to identify errors promptly. 39. This situation reflects a principal-agent problem. Consumers rely on SIPP operators to safeguard pension scheme money and assets and to maintain accurate records on their behalf, but typically have limited visibility of, or ability to assess, the adequacy of firms’ underlying systems. Failures in record-keeping and reconciliation processes may therefore not become apparent to consumers until losses crystallise. Inadequate books and records can impair firms’ ability to track pension scheme money and value pension scheme assets correctly, potentially resulting in consumers being provided with incomplete valuations and making decisions based on flawed information.

52 Harm – financial and welfare losses to consumers 40. Previous FCA thematic reviews concluded that a significant number of SIPP operators were failing to manage risks, and make sure consumers were appropriately protected, by not carrying out adequate checks, in particular on non-standard assets. Historically, assets held within SIPPs have also been targeted for scams and fraud. 41. SIPP operators have previously sometimes accepted new business or investments without adequate due diligence, leading to significant redress liabilities associated with complaints being upheld by the Financial Ombudsman. 42. These liabilities have contributed to the 26 SIPP operator insolvencies that occurred between 2010 and 2025, with others coming close to failure. This number of failures is high relative to the number of operators (currently 98) in the market. These issues have contributed to or significantly increased the risk of harm to consumers through loss of value in their pension wealth. 43. In the event of firm insolvency, consumer losses may go uncompensated if they exceed the Financial Services Compensation Scheme (FSCS) compensation limit. The FSCS compensation limit in the event of SIPP operator failure is £85,000 per eligible customer, per firm if the firm failed after 1st April 2019; it was £50,000 for firms that failed between 1st January 2010 and 31st March 2019. Such consumer losses may be more likely where inappropriate assets (i.e. scams and fraudulent or implausible investments) have been accepted into the scheme, or where there are inadequate records of the money and assets each consumer has within the scheme. 44. Our 2024 data request indicates SIPP operators’ AuA are more than £100,000 per consumer, greater than the £85,000 FSCS cap. As we set out in further detail below, we estimate that across 22 SIPP operator failures (that all occurred between 2011 and 2023, though they may have been associated with investments predating that period) consumers experienced uncompensated losses totalling around £526m, largely where their losses exceeded the FSCS compensation limit. These figures highlight the potential for appreciable consumer losses in the event that a SIPP operator fails. Such financial losses are likely to also be accompanied by wellbeing impacts associated with stress and uncertainty. Harm – delays in SIPP transfers in case of firm failure 45. Weaknesses in how some SIPP operators handle pension scheme money and assets mean that money and assets cannot be accurately identified for relevant consumers, due to the absence of an effective audit trail. External information may need to be relied on where internal records are not up to date. These factors can contribute to delays in the transfer of a SIPP to a new operator where the existing operator is winding down. Transfer delays when problems arise at firms may mean that consumers are unable to sell assets and avoid losses or are unable to buy assets and realise investment gains. Transfer delays may also delay consumers accessing money in the SIPP (for instance, if the consumer wishes to draw down from their SIPP). As well as these financial implications, delays may cause stress for affected consumers.

53 Our proposed intervention 46. For a full description of our proposals please refer to the Consultation Paper above. Here we briefly summarise the proposals. 47. Due diligence obligations already exist under our high-level rules (including under Principle 2 and COBS 2.1.1R), and we have set out our supervisory expectations in non￾Handbook guidance. Firms should already be meeting these obligations. In this context, and given the scale of potential consumer harm, we consider more explicit Handbook requirements to be a necessary and proportionate step to strengthen consumer protection outcomes. More explicit rules help address the practical limitations of a high-level framework by establishing clearer, consistent standards and application in practice across firms. They also strengthen more timely and effective supervisory and enforcement action, while continuing to operate alongside the Consumer Duty. 48. The proposed rules would apply to new assets added, further investment to an asset, and new arrangements entered into with introducers, investment managers, and other relevant third-parties, from the end of the implementation period. We propose a 12-month implementation period for existing arrangements with third parties, reflecting the fact that some firms may need time to update those existing arrangements to align with more explicit rules, where necessary. The proposed rules would not apply to existing investments made into assets accepted into the scheme before the end of the implementation period. Table 3: Proposed SIPP operator due diligence rules Check Explanation Due diligence on investments Checks to assess the nature and risks of an investment before accepting into a scheme, so as to identify and mitigate foreseeable harm to customers from assets which are not appropriate pension scheme holdings Due diligence on relevant third parties Adequate understanding of the third party business to be satisfied they are appropriate to deal with, and make sure the business they conduct does not pose risks to consumers. Third parties that acquire and manage investments for the scheme Even where a third party makes investment decisions, the SIPP operator is ultimately responsible for the SIPP it operates. SIPP operators must have sufficient arrangements in place to mitigate risks to consumers from investments held in a SIPP they operate even if those investments are acquired and managed by others. 49. Furthermore, we propose to introduce a new regime for the handling of pension scheme money and assets in SIPP schemes where the firm uses an unauthorised trustee to hold pension scheme money and assets, either directly by the trustee or indirectly through third parties holding money assets on the trustee’s behalf. 50. Introducing clearer and more prescriptive requirements on client-level records, reconciliations and audit trails would address these risks by establishing consistent baseline standards and strengthening firms’ underlying controls, reducing the likelihood

54 of weaknesses crystallising during periods of stress or failure. Clearer expectations would also provide greater regulatory certainty and a firmer basis for supervisory escalation and enforcement. Taken together, the evidence supports the introduction of explicit record-keeping and reconciliation requirements as a proportionate measure to strengthen safeguarding outcomes and enhance the FCA’s supervisory and enforcement toolkit. 51. The Pension Schemes Money and Assets (PSM&A) regime will ensure that firms maintain accurate records and accounts, perform frequent reconciliations to ensure these records are accurate, identify and investigate discrepancies promptly, and maintain appropriate standards through audit. The regime would not apply to money or assets for which the firm is already subject to CASS, ensuring firms are not subject to overlapping requirements in respect of the same money or assets. Finally, the regime would place requirements on SIPP operators and not on the third parties with whom they have relationships, though SIPP operators would require information from those third parties in order to comply with our proposals (for instance, to perform reconciliations where those third parties hold or manage scheme money and assets). 52. We propose a two-year implementation period, with a further year available, where needed, for SIPP operators with existing third-party relationships. This additional year is intended to allow firms to integrate legacy providers or carry out the orderly off￾boarding of third parties that cannot provide the requisite data at the frequency needed to comply with our proposals. Access to the additional year is conditional on firms having identified dependencies on third-party data and developed a plan to address them. 53. Our proposals aim to address the issues identified in this CBA by: • Improving the consistency and adequacy of due diligence across all SIPP operators, minimising the risk that consumers are exposed to inappropriate assets; • Strengthening our supervision and enforcement capability by having more explicit due diligence requirements for firms to meet; • Ensuring that firms hold pension scheme money and assets securely, record them accurately, and can identify discrepancies promptly; and, • Protecting against delays or issues where a client transfers assets or where a firm winds down, particularly for disorderly wind-downs. 54. Figure 2 summarises, at a high level, how we expect our proposals to reduce harm in the market. Key assumptions underpinning this causal chain include assumptions that firms comply with our proposals, and that firms’ due diligence will be effective in reducing the risk of consumer harm from scams and fraudulent and or implausible investments being invested into SIPPs.

55 Figure 2: Summary of the expected impact of our proposed rules for SIPPs HARM REDUCED Explicit due diligence obligations for SIPP operators are introduced SIPP operator Pension Scheme Money and Asset requirements are set out in more detailed Handbook rules The adequacy of due diligence by SIPP operators improves, reducing the risk of consumer harm from scams and fraudulent and/or implausible investments being accepted into SIPPs Reduction in redress liabilities stemming from poor due diligence Firms ensure that accurate books and records are maintained, check these records regularly to ensure that they are complete and accurate, identify and investigate any discrepancies promptly, and maintain appropriate standards through audit Reduction in shortfalls and fraudulent payments made from the pension scheme Clearer due diligence standards strengthen FCA supervision and enforcement Earlier and more effective FCA supervisory engagement Reduced risk of negative wellbeing impact Reduced uncompensated consumer losses Improved market trust and firm reputation Greater market stability Reduced delays in SIPP transfers during firm wind-down Reduced consumer losses where a firm does fail Firms improve distribution of funds to clients in the event of failure; reduced length of insolvency process Reduced risk of firms failing in a disorderly fashion Interventions Firm changes FCA outcomes Outcomes Drivers of international growth and competitiveness

56 Alternative options considered 55. In designing our proposed intervention, we considered several alternative options. In each case, we set out why we have chosen not to take them forward as our preferred approach. 56. Extend CASS safeguarding rules: We could extend the application of CASS (Client Assets Sourcebook) safeguarding requirements to SIPP operators, with the aim of strengthening protections around pension scheme money and assets, particularly where high-risk investments are held. However, SIPP operators often have a different structure and operating model from the businesses that CASS rules apply to, including reliance on information feeds from third parties, and money and assets are generally held by the trustee (or on behalf of the trustee) rather than the operator itself, with safeguarding functions often already performed by regulated third-party custodians. Applying the CASS rules in this context at this point of time could impose significant operational burdens and risk a significant number of firms exiting the market. Our proposed approach better balances effective safeguards, reflecting CASS principles, with the operational realities of the SIPP market. 57. Place obligations on DIMs and other third parties to provide SIPP operators with data: Our proposals rely on SIPP operators obtaining certain information from DIMs and other parties that they have a relationship with, for instance where such information is necessary to allow them to perform reconciliations. We considered placing obligations in rules for those third parties to provide SIPP operators with such information. However, we consider that our proposed approach (of placing requirements on SIPP operators and not on third parties in our rules) maintains accountability with the SIPP operator as the party responsible to scheme members and the FCA, ensuring clear responsibility. Our proposed approach allows industry to identify the best ways of establishing the arrangements that would underpin the necessary information flows. We recognise, though, that there are likely to be some costs to firms associated with making arrangements around the supply of the required data at the required frequency. We model these costs below. 58. Do nothing (rely on existing rules and guidance, and the Consumer Duty): Current obligations for SIPP operators in relation to due diligence are contained in high-level rules, with our expectations being set out in non-Handbook guidance. While we have seen improvements in due diligence practices in the SIPPs market, it remains the case that some firms do not appear to be conducting adequate due diligence. Similarly, SIPP operators’ handling of pension scheme money and assets is not subject to detailed Handbook requirements; only high-level obligations (for example under SYSC 9.1.1 and Principles 3 and 10) apply. Where an operator uses an unauthorised trustee, that entity is not subject to the FCA’s rules. Again, we have seen varying market practice in this area and have concerns about some firms’ systems and controls. The Consumer Duty is principles-based and evidence in this particular market suggests that more specific requirements are needed to set clearer expectations and secure consistency in firms’ approaches. We therefore think that in both areas (due diligence and the handling of pension scheme money and assets) new rules are necessary and proportionate to secure the outcomes we want to see in the market.

57 Baseline and key assumptions General assumptions 59. To estimate the cost to firms of complying with our proposals, we have used our standardised cost model (SCM). Appendix 1 of the FCA’s statement of policy on how it analyses the costs and benefits of its policies provides an overview of the SCM and when and why we use it. 60. We assess the impact of our proposals over a 10-year appraisal period. We considered whether a longer appraisal period would be appropriate given that pensions can affect consumers through to retirement. However, the proposals primarily relate to the operational and administrative functioning of SIPPs, such as provider processes, governance and oversight. Therefore, the direct impacts are expected to arise mainly within the implementation and operational period following introduction, making a 10-year appraisal period sufficient to capture the material costs and benefits to firms and consumers. 61. In estimating the net present value (NPV) of costs and benefits, we apply a 3.5% discount rate for most impacts, in line with HM Treasury’s Green Book. For wellbeing-related impacts, though, we apply a lower discount rate of 1.5%, reflecting Green Book guidance. 62. We assume that all firms comply with our proposals (where they are relevant to them). We assume that firms are compliant with the PSM&A proposals, and incur the associated ongoing costs, from year 4 onwards, since this reflects the 3-year implementation period for existing third-party relationships. With respect to the one-off costs associated with achieving compliance, we assume that these are all incurred in year 1. This is a simplifying assumption; it is not reasonably practicable to model the profile of firms’ spend on one-off changes over the implementation period. This assumption (that one-off costs are ‘front-loaded’) increases the PV of the estimated costs relative to a situation where the one-off costs are spread over the implementation period. 63. For the purposes of calculating annual and PV figures, we assume that benefits accrue at a constant rate over the appraisal period. In reality, the number of insolvencies that occur or would occur in a given year must be an integer, and so this is a simplifying assumption. Moreover, insolvencies may not occur at a constant rate throughout the appraisal period (for instance, there may be a particular year in which several occur and then a year in which fewer occur). 64. Estimates are provided in nominal terms for the most recent year that data is available. 65. We conduct our calculations based on averages across the market. This CBA is not conducted at the individual firm or consumer level. We distinguish between one-off impacts and those expected to be realised on an ongoing basis following implementation.

58 Baseline 66. The costs and benefits of our proposals must be assessed against a baseline – a reasonable assessment of the way the world would look without the proposed intervention (the counterfactual). This counterfactual is not necessarily the state of the world as it is now. This section covers our assumptions for the baseline. 67. In the period covering 2010-2025, 26 SIPP operators entered administration. This represents an average rate of approximately 1.6 operator insolvencies per year, or 16 insolvencies per ten-year period. While it is, of course, challenging to estimate how many insolvencies will occur in the market in the next ten years, we expect that the rate of insolvencies going forward will be lower than was the case historically. Historic firm failures in this market were attributable to redress liabilities stemming from due diligence complaints upheld by the Financial Ombudsman. But, as set out in our 2024 Dear CEO letter, the number of open SIPP due diligence cases at the Financial Ombudsman was 800 which is far below its 2019-20 peak of 3,500, and any live redress schemes do not pose risks to the solvency of the firms involved. The risk of firm insolvencies is therefore reduced relative to the past, although not entirely eliminated. 68. For the purposes of our modelling, we assume that the rate of insolvencies in the ten￾year appraisal period is 50% lower than the historical average – that is, we assume that in the absence of intervention we would see 8 insolvencies of SIPP operators during our ten-year appraisal period. We acknowledge that this approach may not fully reflect market conditions if, for example, past failures were driven by a subset of firms or legacy issues that have since been resolved. We explore how varying this assumption would affect our estimates in the Modelling risks and uncertainty section below. 69. We do not model the growth of the SIPPs market for the purposes of estimating the costs and benefits of our proposals. We do not consider that it is proportionate or appropriate to do so. Attempting to model how the growth of the SIPPs market would affect our estimates of costs and benefits would be subject to considerable uncertainty, since it would involve both uncertainty about the future path of growth in the SIPPs market and, crucially, uncertainty about how this growth would be reflected in the specific parameters used in our estimates (such as numbers of relationships between SIPP operators and third parties), including at the firm level. 70. We did not model future growth in the SIPPs market quantitatively as part of the baseline, as doing so would require a range of uncertain assumptions regarding consumer demand and provider behaviour over the appraisal period. We considered the additional analytical complexity uncertainty introduced by such modelling would not be proportionate to the likely impact on the overall assessment. Therefore, we comment below qualitatively on how modelling such growth would affect our estimates. 71. The SIPPs market has, as noted above, grown in recent years, and is expected to continue to do so. The growth of the SIPPs market would tend to increase the magnitude of the benefits of our proposals; it may also increase some of the costs of our proposals by, for instance, increasing the scale of the IT systems needing to be set up or maintained. We do not consider that this affects our assessment that our proposals are proportionate.

59 Defining the population of affected firms SIPP operators and our due diligence proposals 72. Our proposed due diligence rules would apply to personal pension schemes in which consumers have ongoing choice and flexibility around the underlying investments in the SIPP, such as those where consumers can instruct the firm to make investments. They would not apply to schemes in which where the SIPP operator is responsible for the make-up of the investment offering (for instance, where firms offer consumers a choice of pre-selected investments (such as a target-date fund) or risk-rated model portfolios). This is because the risk from fraud, scams or implausible investments is greater where individual consumers have discretion over the underlying investments in their SIPP than where firms select the underlying investments. For consumers investing in such ‘ready￾made’ SIPPs, existing Handbook requirements, including the Principle for Business, conduct of business rules in COBS, the Consumer Duty, and any relevant product governance requirements, will continue to be available. 73. For the purposes of our cost estimates below, we estimate costs associated with our due diligence proposals for all 98 SIPP operators because we do not have data on which of them operate the sorts of scheme that are within the scope of our due diligence proposals. In this sense, our cost estimates will tend to overestimate the costs of our due diligence proposals, since any SIPP operators who offer only schemes where they (the firm) decide the underlying investments will not be within the scope of the proposals (though their existing obligations will continue to apply). Table 4: Breakdown of SIPP operators included in our due diligence cost calculations, by SCM size Firm type Small Medium Large Total SIPP operators 62 25 11 98 SIPP operators and our Pension Scheme Money and Assets proposals 74. Regarding our proposed PSM&A regime, given that MiFIDPRU explicitly incorporates many of the key CASS rules for MiFID business, we assume that the 34 operators who are classified as MiFID-PRU (Prudential Sourcebook for investment firms under the FCA Handbook) already satisfy the pension scheme money and assets requirements, which are largely similar to the rules set out in the CASS 6 & 7 framework. The costs and benefits of our proposal therefore do not apply to these firms as they are assumed to be subject to CASS rules for these money and assets and are hence excluded from the regime. They will not have to action any changes to meet the extended Handbook requirements. 75. On that basis, we assume that the proposed PSM&A regime will be applied to all 64 non￾MiFID firms for whom existing Handbook obligations do not fully apply.

60 76. It should be noted, though, that current practice amongst these 64 firms varies and that, correspondingly, they will need to make varying levels of changes to reach compliance with our PSM&A proposals. We seek to reflect this variation with some of the assumptions in our cost estimates described below. Based on supervisory insights, we believe it is likely that many of those non-MiFID firms will have some measures in place that mirror some of what would be required under the PSM&A requirements. We understand from firm engagement that some firms, particularly life insurers, already apply processes broadly consistent with CASS 6 and CASS 7 to pension scheme money or assets held by an unauthorised trustee. These firms typically maintain independent internal records (for example, a cash book), carry out frequent reconciliations, and identify and address discrepancies. We reflect this in our cost estimates below by making different assumptions about the changes life insurance firms will need to make compared with other firms. Table 5: Breakdown of SIPP operators included in our PSM&A cost calculations, by SCM size Firm type Small Medium Large Total SIPP operator with non-MiFID status 48 10 6 64 Third parties, including DIMs 77. While our proposals do not impose requirements on third parties such as DIMs and third-party custodians directly, we acknowledge that compliance with our proposals by SIPP operators will, in many cases, require the provision of information by third parties. Some third parties will need to make changes in order to provide this information at the required frequency, which they will need to do if they wish to retain SIPP operators’ business. 78. For the purposes of our cost estimates below, we use data on DIMs’ involvement in the SIPPs market as a proxy for the involvement of third parties in the SIPPs market. This is because, as described above, DIMs account for the vast majority of relevant relationships in the SIPPs market and we do not have reliable, detailed data on other third parties and their relationships with SIPP operators. Our 2024 data request suggests that there are 743 DIMs active in the SIPPs market. Summary of costs and benefits 79. Table 6 presents a summary of the estimated annual ongoing and one-off costs and benefits to stakeholders from our proposals overall. 80. We estimate our proposals to have a net benefit over our 10-year appraisal. We calculate the net present value (NPV) of the costs and benefits of our proposals to be £72.9m. We estimate the annual benefits of our proposals, where quantification is possible, to be between £10.8m-£20.7m. For the purposes of estimating the net present value

61 (NPV), we apply the midpoint value (£15.7m) of this range. Similarly, for the costs where we present a range, we use the midpoint value when calculating the NPV and equivalent annual net direct cost to business (EANDCB). We estimate one off costs to firms of £19.4m and ongoing costs to firms of £3.8m-£11.6m per year from year 4 onwards. Table 6: Summary table of benefits and costs Group affected Item description Benefits (£) Costs (£) One off Ongoing (annual) One off Ongoing (annual) Firms (all proposals) Familiarisation & gap analysis £1.4m Firms (due diligence proposals) Change project £544k Firms (PSM&A proposals) Staff training £2.8m IT projects £5.1m Project governance £3.0m Reconciliations (automated) £408k from year 4 Reconciliations (manual) £0-£7.8m from year 4 Supply of information to SIPP operators by DIMs £1.7m from year 4 Arrangement negotiations between SIPP operators and DIMs £6.6m Annual auditing £1.7m from year 4 Firms (all proposals) Increased consumer trust Unquantified Consumers Reduction in uncompensated consumer losses £9.6-£19.1m Wellbeing improvements £1.2m-£1.5m

62 Group affected Item description Benefits (£) Costs (£) One off Ongoing (annual) One off Ongoing (annual) Reduction in SIPP transfer delays in case of firm failure Unquantified Loss of availability of the services of some DIMs and other third parties in SIPPs Unquantified Potential cost pass-through Unquantified FCA Enhanced ability to supervise and enforce against more explicit standards Unquantified Financial Ombudsman Reduced burden Unquantified FSCS Reduced volatility in levy requirements and more efficient redress process Unquantified Total £10.8m-£20.7m £19.4m £3.8m-£11.6m from year 4 Note: figures may not sum due to rounding. Table 7: Total benefits and costs of proposals over 10 years, PV-adjusted PV Benefits PV Costs NPV (10 years) Total impact £136.4m £63.4m £72.9m Note: figures may not sum due to rounding. Table 8: Net direct costs to firms Total (Present Value) Net Direct Cost to Business (10 yrs) EANDCB Total net direct cost to business (costs to businesses – benefits to businesses) £63.4m £7.4m

63 Benefits Benefits to consumers Reduction in uncompensated consumer losses 81. As set out in our Problem and rationale for intervention section, without appropriate measures in place for due diligence and handling pension scheme money and assets, in the event of SIPP operator failures investors are left exposed to the risk of significant financial loss and are dependent on mitigating losses through the FSCS compensation scheme, with compensation subject to a cap. 82. We expect that our rules will reduce consumer losses that are in excess of the FSCS compensation limit in the event of SIPP operator insolvencies – either by helping to prevent insolvencies occurring in the first place, or by reducing the extent of consumer losses where insolvencies do occur. 83. Improvements to firms’ due diligence practices should reduce the risk of consumers experiencing harm from scams and fraudulent or implausible investments, reducing firms’ exposure to resulting redress liabilities. This, in turn, should reduce the likelihood of disorderly firm failure. Similarly, the proposed PSM&A regime should give firms better oversight of potential issues, allowing them to identify and address issues earlier and thereby reducing the risk of failure. 84. Where a firm does fail, the proposed due diligence rules should reduce firms’ redress liabilities (through the mechanism described above) and reduce consumers’ losses from scams and fraudulent or implausible investments. Better handling of pension scheme money and assets should prevent discrepancies between the scheme’s records and a client’s actual holdings of assets and money in the scheme from accumulating. These things mean consumer losses are less likely to exceed the FSCS cap and therefore go uncompensated. 85. In the analysis set out in the rest of this section, our analytical approach is as follows. We first estimate the average value of uncompensated consumer losses in historic SIPP operator failures. We then estimate the value of uncompensated consumer losses that would be avoided as a result of our intervention by multiplying this average figure by the number of operator failures we assume would occur over the appraisal period if we did not intervene. Average value of uncompensated consumer losses in historic SIPP operator failures 86. Using data collected through our supervisory work, we estimate the number of FSCS claims and compensation paid for 22 insolvent SIPP operators (all of whose failures occurred in the period 2011-2023) by the following types of claim:

64 • Due diligence claims – these claims arise when a SIPP operator is found to have failed in its duty to carry out adequate due diligence on investments, particularly in relation to high-risk assets. • Financial adviser claims – compensation claims made by consumers against financial advisers who provided unsuitable advice, often to invest in high-risk or inappropriate assets via a SIPP. Although improvements to due diligence standards will not have a direct impact on the recommendations provided by financial advisers, we assume that there will be an indirect impact on the number of financial adviser claims. This is because whilst our due diligence proposals do not require an assessment of suitability, they do include requirements for initial and ongoing due diligence of advisers and other third parties that SIPP operators do business with to mitigate the risk of fraud, scams and implausible investments. So, even where the advice provided to investors is unsuitable, new due diligence rules are intended to mitigate the risk of scams and fraudulent or implausible investments being accepted into SIPP schemes. This should reduce the incidence of investment failures that have in the past given rise to consumer losses and, in turn, adviser-related compensation claims. Table 9: Breakdown of FSCS claims and compensation paid by claim type Type of claim Number of compensated FSCS claims Compensation calculated FSCS compensation paid Uncompensated losses Due diligence 11,900 £422m £352m £70m Financial adviser 21,506 £1.2bn £726m £456m Total 33,406 £1.6bn £1.1bn £526m 87. As set out in Table 9, we estimate total uncompensated consumer losses of £526m across 22 insolvent operators, largely where the consumers’ losses exceeded the FSCS compensation cap. On average, this represents an uncompensated financial loss to consumers of approximately £24m per insolvency. This highlights the scale of financial loss faced by consumers following firm insolvency. Estimating the reduction in uncompensated consumer losses 88. For the purposes of our modelling, our lower and upper bound estimates assume that where an insolvency occurs, our PSM&A proposals are 50% and 100% effective respectively in preventing uncompensated consumer losses. 89. For our upper bound estimate, we multiply the financial loss to consumers of approximately £24m per insolvency by the 8 insolvencies we assume would have occurred over the appraisal period in the absence of our intervention to derive the value of the financial loss that our proposals will avoid for consumers by either preventing those insolvencies or reducing losses exceeding the FSCS compensation cap in the event they do occur. This gives a benefit to consumers of £191.4m (in nominal terms) over the 10-year appraisal period, or £19.1m per year (on average).

65 90. For our lower bound estimate, where we assume the proposals are 50% effective in reducing consumer losses associated with insolvencies, we apply an estimated financial loss of approximately £12m per insolvency, rather than £24m. This results in an estimated consumer benefit of £95.7m (in nominal terms) over the 10-year appraisal period, or £9.6m per year on average. 91. For the purposes of our central estimate, we take the midpoint between the upper and lower bound estimates. This results in an estimated consumer benefit of £143.6m (in nominal terms) over the 10-year appraisal period, or £14.4m per year on average. 92. We note that our PSM&A proposals have an implementation period of 2 years for new third-party relationships and 3 years for existing ones (with the additional year being intended to facilitate the offboarding of third parties who cannot provide data at the required frequency). If an insolvency were to occur during this implementation period and if an uncompensated consumer loss were to occur because the firm in question was still in the process of reaching compliance, then the estimate above would overstate the benefits of our proposals. Our sensitivity analysis varying our assumption about the effectiveness of our proposals in reducing consumer losses, presented in the Modelling risks and uncertainty section below, reflects this risk. The magnitude of this modelling risk depends on the extent to which the rate of insolvencies is reduced by our proposals, but the NPV of our proposals remains positive in all the scenarios we model for effectiveness. Avoided wellbeing loss 93. Avoiding future operator insolvencies and the associated wave of consumer complaints delivers not only financial benefits but also significant wellbeing gains for affected investors. When operators fail and consumers are drawn into lengthy and uncertain compensation processes, the emotional and psychological toll can be substantial and extend beyond the direct monetary loss. 94. We expect that our proposed due diligence rule change will benefit consumers by reducing the likelihood of operator failure and associated complaints, avoiding the wellbeing losses typically experienced by individuals across the insolvency period. 95. Research by Which? found that individuals who lost money to scams experienced a reduction in wellbeing equivalent to approximately £2,000–£2,500 per person, in addition to the direct financial loss incurred. These estimates are derived from statistically significant associations between scam victimisation and lower wellbeing and were monetised in line with best practice wellbeing valuation guidance (supplementary to HMT’s Green Book). The estimates reflect the psychological distress associated with being deceived or unexpectedly losing money. 96. The use of this figure in the context of SIPP operator failure is likely to be very conservative, since the average financial loss (where a loss occurred) in the sample used in the Which? research was £600; the sums at stake in the event of SIPP operator failure could be far larger than this.

66 97. Table 9 shows there were approximately 33k compensated FSCS claims in relation to 22 failed SIPP operators between 2011 and 2023, or around 1,500 claims per firm. In the absence of granular data, it is assumed that each claim represents a unique investor as individuals are unlikely to hold multiple SIPPs across several firms, for simplicity and administrative ease purposes. 98. We conservatively assume that only individuals whose claims were either fully or partially compensated by the FSCS suffered wellbeing disbenefits during the complaints process. Although some rejected claimants may have experienced wellbeing detriment, we do not quantify these losses in the absence of data on the nature and validity of rejected claims – acknowledging that some complaints may have been unfounded or outside the scope of FSCS protection. Regarding the potential for double-counting of benefits, we assume that the financial compensation scheme does not account for distress-related wellbeing losses and is designed purely to capture the recoverable value of SIPP investments. 99. Multiplying the assumed number of investors per failed firm with the assumed wellbeing impact of around £2,000-£2,500 per person, each insolvency is estimated to involve a wellbeing loss to consumers of approximately £3.0m-£3.8m. We anticipate our proposals will lead to a reduction in firm insolvencies. We apply a range of assumptions to account for uncertainty: • Higher estimate – if 7 operators avoid insolvency (of the 8 we assume would fail absent intervention) over the next 10 years, this would result in an avoided wellbeing loss of £21.2-26.7m, or £2.1-2.7m per year. • Midpoint – if 4 operators avoid insolvency over the next 10 years, this would result in an avoided wellbeing loss of £12.1-15.2m, or £1.2-1.5m per year. • Lower estimate – in the event that 1 operator avoids insolvency over the next 10 years, this would result in an avoided wellbeing loss of £3.0-3.8m for consumers, or £0.3-0.4m per year. Reduction in SIPP transfer delays in case of firm failure 100. We expect that our proposed improvements to the handling of pension scheme money and assets will lead to fewer issues and delays and a more orderly wind-down process in the event of firm failure. In particular, the maintenance of up to date, accurate pension scheme money and asset records should aid in quickly identifying and transferring the money and assets a client has in a scheme. This would reduce the harm to consumers from not being able to buy assets to realise investment gains, sell assets and avoid investment losses, or access their money (if they were looking to decumulate) in the meantime. It is not reasonably practicable to quantify this benefit. Benefits to firms 101. By protecting pension scheme money and assets and enforcing strong governance, firms are expected to be less exposed to the operational risks and financial weaknesses that typically lead to insolvency. As a result, operators should be able to maintain financial stability, avoid failure and ensure continued service to their clients.

67 102. Strengthening pension scheme money and asset handling and due diligence requirements is also expected to enhance consumer confidence and trust in SIPPs and SIPP operators. This greater trust can encourage greater engagement with SIPP products. It is not reasonably practicable to quantify this benefit. 103. Firms may also benefit from reduced volatility in FCS levy requirements because of the expected reduction in the number of SIPP operator insolvencies. This is discussed further in paragraph 106 below. Benefits to the FCA, Financial Ombudsman & FSCS 104. We expect to observe fewer incidences of consumer harm & operator failure which should limit the need for reactive FCA supervisory or enforcement action. With fewer firm failures and misconduct cases to investigate, the FCA can allocate supervisory resources more efficiently. Moreover, having more actionable rules will strengthen the FCA’s supervision and enforcement in these areas. 105. More explicit due diligence rules are likely to reduce the volume of complaints escalated to the Financial Ombudsman, though it is not reasonably practicable to quantify the extent of this reduction. Many of the complaints received in relation to SIPPs concern a lack of proper checks on investments or failures to assess the suitability and risks of assets accepted into the wrapper. By addressing these issues at the firm level, fewer complaints are likely to arise in the first place, reducing the level of financial burden on the Financial Ombudsman. 106. In recent years, SIPP-related operator failures have resulted in FSCS compensation payments of £60m and £31m in 2024/25 and 2023/24 respectively to consumers. In conjunction with improved due diligence, stronger procedures around the handling of pension scheme money and assets should mean that fewer consumers reach the point of requesting redress via the FSCS, helping to preserve the sustainability of the FSCS levy by reducing volatility in levy requirements and contributing to a stable funding model for the levy scheme. More explicit rules will also increase the efficiency of redress processes by making it easier to demonstrate where firms have not complied with the relevant requirements. Costs Costs to firms Familiarisation and gap analysis (one-off) 107. Firms will need to read relevant changes put forward as part of the proposals in this Consultation Paper and familiarise themselves with the detailed requirements of the proposals. For the purposes of our modelling, we assume all 98 FCA-regulated firms identified as operating SIPPs in our 2024 data request and all DIMs active in the SIPPs market will do this familiarisation exercise. Some firms act as both SIPP operators and

68 DIMs, so the total number of firms who we assume will need to familiarise themselves with our proposals and perform gap analysis is smaller than the sum of the number of SIPP operators and the number of DIMs active in the SIPPs market. 108. We monetise the resource costs associated with firms familiarising themselves with the new rules and guidance, based on the number of people assumed to read the document at each firm and their hourly salary (including overheads). We apply our standard SCM assumptions for monetising familiarisation costs and assume each person familiarising themselves with the proposals will need to read 35 pages. 109. Our assumptions are summarised in the table below. Table 10: Assumptions used in familiarisation cost modelling, SCM model estimates Size of firm Large Medium Small Number of firms 47 144 617 Number of compliance staff assumed to read CP per firm 20 5 2 Average hourly cost of compliance staff time £75 £70 £58 Average reading speed, words per minute 100 Average number of words per page 300 Number of pages to be read 35 110. We also estimate the costs to firms of performing a gap analysis. We assume that the gap analysis will require a legal (or compliance) team reading 40 pages of legal text relating to the proposed legal instrument. The assumptions used in modelling the costs of gap analysis are summarised in the table below. Table 11: Assumptions used in gap analysis cost modelling, SCM model estimates Size of firm Large Medium Small Number of firms 47 144 617 Size of legal team (or equivalent) reading legal text 4 2 1 Days per team member to review 50 pages of legal text 4 3 1 Average hourly cost of legal team (or equivalent) time £87 £81 £77 Number of pages to be read 40 111. Together, these assumptions imply total one-off familiarisation and gap analysis costs of £1.36m. This is equal to a cost of approximately £2k per firm. 112. These estimates may overstate the costs to firms of familiarisation and gap analysis associated with our proposals. As noted above, only a subset of SIPP operators will be

69 affected by each of our sets of proposals. Third parties such as DIMs may not familiarise themselves with the proposals, since the proposals would not impose requirements on them directly, and instead may simply rely on SIPP operators to inform them of what is required of them (though in this case they may still need to assess their current practices against the requirements). Due diligence proposals – change project (one-off) 113. As noted above, due diligence obligations on SIPP operators already exist under our high-level rules (including under Principle 2 and COBS 2.1.1R) and we have previously set out our (supervisory) expectations in non-Handbook guidance. However, we recognise that firms may identify, through the gap analysis described above, changes they need to make to their processes in order to achieve compliance with our more explicit rule proposals. We do not expect that these changes will make their processes materially more onerous or costly on an ongoing basis, but we recognise that there is a cost to making such changes, including the need to go through internal governance processes. 114. We model these one-off change project costs using one of the change project scenarios in the SCM. The assumptions used are outlined in the table below. In the absence of data on how many firms are already fully compliant with our due diligence proposals or those with schemes that are within the scope of the proposed rules, we make the conservative assumption for the purposes of our modelling that all SIPP operators will need to make some changes. Table 12: Assumptions used in due diligence change project cost modelling, SCM model estimates Firm size Large firms Medium firms Small firms Total person days (project team and manager) 45 14 3 Board review, person days 0.4 0.3 0.1 Executive committee review, person days 0.6 0.4 0.1 115. These assumptions imply one-off change costs of £544k across the 98 SIPP operators, or roughly £6k per firm. Pension scheme money and assets regime – staff training (one-off) 116. We expect that all 64 non-MiFID operators will provide training on the proposed PSM&A regime to relevant staff members. This training represents a one-off cost incurred to familiarise employees with PSM&A policies, procedures, and their responsibilities in maintaining compliance with FCA rules. The cost typically includes the development or purchase of training materials, delivery time by trainers or external providers, and staff time spent completing the training. 117. We model training costs based on all staff receiving training, using employee numbers collected from firms. In practice, while all staff may need to be made aware of the

70 changes, the more extensive training that we model is likely to be necessary for only a subset of employees (those for whom our proposals add to or change their responsibilities). We do not have data on how big that subset is likely to be, so we take a conservative approach and model the costs of all staff undergoing ‘full’ training, noting that this is likely to overstate training costs. 118. As noted above, we understand from firm engagement that SIPP operators that are life insurance firms often already have in place processes that are broadly consistent with CASS 6 and CASS 7 in relation to pension scheme money or assets held by an unauthorised trustee. For these firms, any changes required by the new regime would be minor and limited to a very small part of their overall book. We therefore assume that staff at these firms will need less training on the proposed PSM&A training than staff at other SIPP operators. We assume that each relevant employee at these firms will require 3.5 hours (half of a working day) of basic training. 119. For operators that are not life insurers, we assume that 7 hours of bespoke training will be required to cover all necessary PSM&A topics. 120. The assumptions used in modelling the costs of staff training are outlined in the table below. Table 13: Assumptions used in PSM&A staff training cost modelling, SCM model estimates Size of firm Large Medium Small Non-life insurance firms Number of firms 0 6 44 Average number of staff that need to be informed/ trained 700 95 15 Average salary of staff member being trained £61k £52k £56k Training time required per staff member 1 day Type of training Bespoke training Life insurance firms Number of firms 6 4 4 Average number of staff that need to be informed/ trained 700 95 15 Average salary of staff member being trained £61k £52k £56k Training time required per staff member 0.5 days Type of training Basic training 121. These assumptions imply total one-off staff training costs of £2.8m, or £44k per firm on average. This total comprises costs of £1.1m for large firms, £787k for medium firms and £932k for small firms.

71 Pension scheme money and assets regime – IT projects (one-off) 122. We anticipate that the proposed PSM&A regime will require many non-MiFID SIPP operators to update their systems to ensure that they maintain accurate, up to date records of pension scheme money and assets, with appropriate reconciliation processes in place. This includes requirements to retain internal records of pension scheme money both in pension scheme bank accounts in the name of the trustee and those held by third parties, and investment holdings and transactions of pension scheme assets. 123. While some firms have existing procedures in place that reflect our proposals, we make the conservative assumption, based on supervisory insights, that most non-MiFID SIPP operators will nonetheless need to make systems upgrades to reach compliance with the proposed PSM&A requirements and for a minority these will be significant. In the absence of complete information about which and how many firms will need to make these material changes, we take a conservative approach and use the ‘large’ IT project scenario in the SCM to model the IT changes most non-MiFID SIPP operators will need to make. This may overstate IT costs since many of these firms are likely not to have to make such substantial changes. 124. The exception is SIPP operators who are life insurance firms, who we understand from firm engagement often already apply processes that are broadly consistent with CASS 6 and CASS 7 to pension scheme money or assets held by an unauthorised trustee. Any changes will also affect only a small part of their overall book. For these firms, we therefore assume that only a ‘Small’ IT project is needed to upgrade systems so as to achieve PSM&A compliance. 125. The table below summarises our assumptions. Table 14: Assumptions used in PSM&A IT project cost modelling, SCM model estimates Firm size Large firms Medium firms Small firms Non-life insurance firms Number of firms 0 6 44 Project length (Person days) 1,638 585 Fixed £32k cost Life insurance firms Number of firms 6 4 4 Project length (Person days) 546 156 Fixed £16k cost 126. Overall, these assumptions imply total one-off IT costs of £5.1m, comprising costs of £1.6m for large firms, £2.0m for medium firms and £1.5m for small firms.

72 Pension scheme money and assets regime – Project governance (one-off) 127. All 64 SIPP operators are expected to need to update their controls and oversight frameworks to meet the proposed enhanced requirements around the handling of pension scheme money and assets. 128. We expect these changes to be relatively moderate for most firms. Feedback from operators indicates that many are likely to already have some form of oversight and control arrangements in place, and the proposed requirements are expected to build on existing practices rather than require wholesale changes. As such, we anticipate that firms will need to make targeted enhancements. 129. We model the costs of governance changes using one of the change project scenarios in the SCM. The assumptions used are outlined in the table below. We do not distinguish between life insurance firms and other SIPP operators for the purposes of this modelling since we expect that life insurance firms may need to make this level of updates and changes to internal governance processes to ensure compliance with our proposals, even if their processes are in principles already closer to compliance with our proposals many than other firms. Table 15: Assumptions used in PSM&A change cost modelling, SCM model estimates Firm size Large firms Medium firms Small firms Total person days (project team and manager) 540 280 6 Board review, person days 0.7 0.6 0.1 Executive committee review, person days 1.1 0.9 0.3 130. Overall, these assumptions imply total one-off governance costs of £3.0m. This is equal to a cost of £1.6m (£265k per firm) for large firms, £1.3m (£129k per firm) for medium firms and £121k (£3k per firm) for small firms. Pension scheme money and assets regime – reconciliations undertaken using data feeds from third parties (ongoing) 131. The proposed PSM&A regime will involve ongoing receipt and processing by SIPP operators of data from third parties such as DIMs, platforms, stockbrokers and third￾party custodians who hold or manage pension scheme money and assets on the operator’s behalf. The operator retains ultimate responsibility for handling pension scheme money and assets, even where daily control lies with another party and assets may be traded without instructions passing through the operator. Where investments are made via third parties, pension scheme money is generally transferred into the third party’s own client money arrangements to complete the investment, so information on this amount of money is also required. 132. Therefore, under our proposed PSM&A rules, operators must – after an implementation period – undertake monthly reconciliations or record checks, to ensure that their data align accurately with those of relevant third parties. These external reconciliations

73 help to identify and resolve discrepancies in pension scheme asset holdings and cash balances, providing an essential control to protect pension scheme money and assets from misappropriation or error. 133. They must also perform daily reconciliations of their internal records of pension scheme money. Where money is held indirectly by third parties on behalf of the unauthorised trustee (as opposed to in bank accounts in the name of the trustee), balances may not change on a day-to-day basis until updated using information received from the relevant third party. We expect both the amounts recorded and the frequency with which information is provided to align with the asset information requirements. 134. The ongoing cost associated with this activity reflects the technological effort required to support regular data validation, and monitoring processes. We assume there will be minor ongoing IT costs associated with reconciliation processes for all 64 operators with non-MiFID status, such as updating reconciliation tools or software, and supporting reporting functionality. However, we expect these to be limited in scope, as firms will have reconciliation systems in place following the IT and governance changes described above. 135. On that basis, we assume the following level of IT projects are required: 80 person days for large firms, 14 for medium firms and a cost of £2,000 for small firms without IT departments. We find a total cost of approximately £408k per year (following the implementation period), broken down as follows: • Large firms – £246k for 6 firms or around £41k per firm • Medium firms – £66k for 10 firms or around £6,600 per firm • Small firms – £96k for 48 firms or £2k per firm Pension scheme money and assets regime – reconciliations undertaken manually for DIM accounts (ongoing) 136. In the previous section, the cost estimates are based on operators receiving live data feeds from third parties holding pension scheme money and assets. However, at present, there are cases where third parties do not provide such data through a feed in a way that would support automated reconciliations. The data may be provided in alternative formats, for example, through PDFs or paper-based records. 137. If it continues to be the case that operators receive data in formats that do not allow for automated reconciliations and current technology is in place, they are likely to need to manually review and input the data to perform reconciliations, increasing the time and effort required compared with automated processes. As shown below, such manual reconciliations are costly for SIPP operators. 138. However, two forms of market adaptation would reduce the need for manual reconciliations. The first is a reduction in the number of accounts where data is provided in a way that does not support automated reconciliations. This could be achieved either by DIMs and other third parties moving to providing data via feeds where they do not currently do so (with commercial pressure from SIPP operators to do so), or by SIPP operators offboarding third parties who do not provide data in a way that allows for automated reconciliations and moving to those who can provide live feeds. Our

74 proposals include an additional year of implementation period for existing third-party relationships to allow SIPP operators to offboard third parties who cannot or will not support compliance with our proposals in an orderly way. The second is SIPP operators adopting technology that allows for the automated reconciliation of accounts where data is provided in formats such as PDFs. 139. There is uncertainty as to the extent to which such adaptation will occur. For this reason, we present below a high adaptation scenario, a low adaptation scenario, and the midpoint between the former two scenarios. As set out below, this implies a range of costs between no additional costs (beyond the cost of automated reconciliations and the associated systems and processes changes set out above) and costs of £7.8m per year after the PSM&A rules are in effect, with a midpoint of £3.9m per year. 140. We expect that these costs are, in practice, likely to be towards the lower end of the range, since our supervisory experience suggests that the market is already moving towards the provision of data through feeds, and our proposed two-year implementation period and additional one year for existing relationships gives industry more time in which to prepare and adapt. High adaptation scenario 141. In the high adaptation scenario, we assume that SIPP operators receive data on all their third-party accounts in a format that allows them to do automated reconciliations. As set out above, this could be because of third parties moving to providing data through live feeds, SIPP operators moving business from third parties who cannot or will not provide data in a form that supports automated reconciliations, or SIPP operators adopting technology that allows the automation of reconciliations with a wider range of data input formats – or a combination of all three. In the polar case where this is achieved entirely by SIPP operators moving business away from third parties who cannot or will not provide data in a way that facilitates automated reconciliations, this could be achieved with negligible costs (with the revenue lost by the third parties SIPP operators move business away from being transferred to those the SIPP operators move to). Low adaptation scenario 142. In the low adaptation scenario, we assume that the rate at which third parties provide data feeds that allow for automated reconciliations remains the same as it is now even after the implementation period. We assume further that SIPP operators do not adopt any technology that allows for further automation of reconciliations even where data is provided in ways that require manual reconciliation now. 143. Our 2024 data request of operators provides us with the number of DIM accounts associated with the 64 non-MiFID SIPP operators. Based on information gathered through our supervisory work, we assume that firms in the life insurance portfolio and firms in other portfolios with at least 10,000 DIM accounts receive data feeds on 90% of their DIM accounts, while firms in portfolios other than life insurance with fewer than 10,000 DIM account receive data feeds on a lower proportion, 70%, of their DIM accounts.

75 144. Data from our 2022 survey of 63 SIPP operators (including MiFID firms) indicates an average of 24 lines per DIM account. Although we do not track time spent to complete a review of a single account, we assume that a reasonable time per line entry for manual input would be 1 minute. This would involve a quick check of the investment before entering the line data on to the relevant record. We assume that manual reconciliations will be conducted by business support employees, whose average salary is taken to be between roughly £32k and £38k, depending on firm size. 145. Under the assumptions listed above, the average cost for the review each month of a single DIM account (with 24 lines) is around £10-12 per account (with the cost varying by the size of the SIPP operator, since salaries are assumed to vary by firm size). Where there is no change in the assets held in the account from one month to the next, the cost of reconciliations is likely to be lower and so this figure would overstate the cost in such cases. 146. On that basis, we estimate that monthly manual reconciliations would be associated with a cost of £7.8m per year – after the PSM&A regime is in effect – across 64 non￾MiFID SIPP operators. 147. We note that these costs do not account for any additional investigation arising from flags raised around the investment, which would increase staff time spent on reconciliations. Furthermore, these costs relate just to DIM accounts. However, we also note that these estimates do not account for efficiency gains achieved over time. Midpoint 148. Taking the midpoint of the low and high adaptation scenarios gives an annual cost of £3.9m per year, after the PSM&A regime is in effect. As noted above, we use this midpoint when calculating the NPV and EANDCB of our proposals. However, we expect that in practice these costs will be below this midpoint value for the reasons set out in paragraph 140 above. Pension scheme money and assets regime – establishing arrangements for information provision by DIMs and other third parties at the required frequency (one-off) 149. In order to perform the reconciliations and record checks required of them under our proposals, SIPP operators would require information at least monthly from third parties who hold or manage pension scheme money and assets on their behalf, including DIMs, platforms, stockbrokers and third-party custodians. 150. SIPP operators often already receive this data on at least a monthly basis at present, and we are aware that some SIPP operators already require DIMs and other third parties they work with to provide data at the required frequency. 151. However, we are aware through our supervisory work that some DIMs provide this data to SIPP operators less frequently (in some cases, only annually), and some SIPP operators do not have provisions in their agreements and contracts with DIMs and other third parties in relation to the frequency of data provision.

76 152. We expect that SIPP operators are likely to seek to establish arrangements with DIMs and other third parties that the third party will provide data to allow them to perform monthly reconciliations, where they do not already do have such an arrangements. This will imply one-off costs for both the SIPP operator and the third party associated with coming to such an arrangement. We estimate these costs here. For the reasons set out above, we use DIMs as a proxy for all relevant third parties. 153. We assume, based on our supervisory experience and firm engagement, that SIPP operators that are life insurers and SIPP operators with at least 10,000 DIM accounts already have in place arrangements with DIMs that the DIMs will provide data to them at least each month. This mirrors our assumption above that these SIPP operators receive data via data feeds for a greater share of their DIM accounts than other SIPP operators do. 154. We assume that the remaining 39 non-MiFID SIPP operators (i.e., the non-MiFID SIPP operators who are not life insurers and have fewer than 10,000 DIM accounts) who have a relationship with at least one DIM will need to reach arrangements with their DIMs that they (the DIM) will provide them with the data required for reconciliations at least monthly. For brevity, we refer to these SIPP operators as ‘arrangement-needing SIPP operators’ for the remainder of this subsection. Using our 2024 data request, we calculate the number of unique DIMs each arrangement-needing SIPP operator has a relationship with. This is the number of arrangements it will need to establish. 155. We also calculate the number of unique arrangement-needing SIPP operators each DIM has a relationship with to derive the number of arrangements it will need to enter into. 156. We do not expect that each arrangement will require protracted negotiations between the arrangement-needing SIPP operator and the DIM in question. In some cases, the arrangement may be established just by updates to existing commitments made between SIPP operators and their DIMs. Arrangements may be especially straightforward to reach where the DIM already provides data at the required frequency but this is not currently underpinned by any formal commitment (in such cases, the SIPP operator may still wish to establish a formal arrangement given that they will need the DIM operator to supply the data in order to meet their own regulatory obligations). However, we expect that the more information provision arrangements a SIPP operator or DIM needs to establish, the more effort and cost will be involved (for instance, because it increases the chance that one relationship is with a party who demands more negotiations). 157. We model the cost of establishing these arrangements as change projects in the SCM. We assign sizes to these change projects according to the number of relationships the arrangement-needing SIPP operator or DIM has as set out in the table below. Table 16: Assumptions used in information provision arrangement cost modelling Number of relevant relationships Size of change project needed Number of SIPPs and DIMs in this bucket 1 – 9 Very small 711 10 – 49 Small 58

77 Number of relevant relationships Size of change project needed Number of SIPPs and DIMs in this bucket 50 or more Moderate 13 Total 782 158. The total estimated one-off cost of £6.6 million falls largely fall on DIMs (£6.0 million) with SIPPS making up the remaining £600k. 159. We note that some DIMs and other third parties may choose to exit the SIPP market rather than agree to provide SIPP operators with the required data at least monthly. Our proposals include an additional implementation year for existing third-party relationships to allow for the orderly offboarding of such third parties. To the extent third parties simply exit the SIPPs market (resulting in a transfer of their SIPP-related revenue to another third party), these costs may be lower than estimated here. Pension scheme money and assets regime – information provision by DIMs and other third parties (ongoing) 160. As discussed above, while our proposals do not place obligations on those third parties directly, we expect that SIPP operators would look to place obligations on third parties to provide certain information at least monthly, so that they (the SIPP operator) can comply with the requirements place on them. We therefore consider here the costs to third parties of providing this information at the required frequency. Again, we estimate costs based just on figures for DIMs for the reasons set out above. 161. At present, market practice with respect to the provision of information by DIMs to SIPP operators varies. Some DIMs already provide data to SIPP operators through a live feed or on a daily, weekly or monthly basis, but we are aware that some provide data only annually or ad hoc when needed. Those DIMs would need to increase the frequency at which they provide data to at least monthly in order to allow SIPP operators to meet their obligations under our proposals. 162. We model the costs of some DIMs needing to provide data to SIPP operators more frequently as follows. Of the 743 DIMs we estimate to be active in the SIPPs market, we assume that the 180 classified as large or medium-sized by the SCM already provide data to SIPP operators via a live feed or no less frequently than monthly (and so will not have to provide data more frequently), but that the 563 DIMs classified as small in the SCM currently provide data only annually. This may be a conservative assumption in that it assumes a large proportion of the market is currently providing only infrequently. 163. We assume that firms who currently provide data only annually will, following our proposals coming into force, need to manually download the data from their systems each month (i.e. 12 times per year, versus the 1 time per year they are assumed to do so currently) and send it over to the SIPP operator(s) they work with. We assume that each manual download and transfer takes 3.5 hours of business support professional time. We assume that compliance staff will review the process by which the manual download

78 and transfer occurs annually. The table below sets out the assumptions we use to monetise the costs of these manual downloads and transfers and compliance reviews. Table 17: Assumptions used in DIMs manual information provision cost modelling Firm size Small firms Hours of business support professional time required (per year) 38.5 (= 3.5 * (12-1)) Hourly cost of business support professional time £25 Hours of compliance staff time required (per year) 35 Hourly cost of compliance staff time £58 164. These assumptions imply a total cost to affected DIMs of £1.7m per year, or nearly £3k per year for each affected firm. These costs would apply only after the PSM&A regime’s implementation period. DIMs who cease operating in the SIPPs market would not incur these costs. 165. We recognise that this approach may introduce a directional bias into our cost estimates. DIMs are themselves FCA-authorised firms, and, as such, are likely to have better developed compliance infrastructure and greater familiarity with regulatory reporting obligations, relative to unregulated third parties that are out of the scope of this CBA. To the extent that non-DIM relationships involve higher marginal costs of compliance uplift, our estimates of third-party-related costs may represent a lower bound of the true aggregate burden on firms. Pension scheme money and assets regime – annual audits (ongoing) 166. We assume that if a regulated SIPP firm holds pension scheme money or assets, it falls under the proposed PSM&A regime and require mandatory external audit reports. It is assumed that SIPP firms do not qualify for the small company audit exemption under the Companies Act 2006. 167. We have based the costs of annual audits on our previous engagement with auditors as part of our work on changes to the safeguarding regime for payment and e-money institutions. These costs are informed by large auditors (such as one of the “Big Four” global accounting firms), who generally charge higher fees than other auditors, as well as smaller ones. Table 18: Audit costs and firm complexity Complexity Large auditors Other auditors Simple £30-60k £10-18k Average £60-150k £20-30k Complex £150-250k £75-125k Very complex £250-500k £125-250k

79 168. We have assumed that the 64 non-MiFID SIPP operators fall within the ‘simple’ category for audit-complexity purposes. This is not intended to suggest that these firms lack complexity in themselves but rather reflects the generally lower volume and frequency of client asset transactions associated with their business models. While non-MiFID SIPP firms may permit a range of non-standard investments, these are typically characterised by lower levels of day-to-day trading activity, resulting in fewer transactions to record, reconcile, and audit. In practice, many such firms also operate more standardised pension propositions and maintain smaller client books, which further limits transactional intensity. 169. By contrast, firms operating under MiFID permissions – particularly those more active in markets and other frequently-traded financial instruments – are subject to significantly higher transactional volumes and safeguarding demands, necessitating more advanced systems and controls. On balance, while SIPP operators may exhibit complexity in the nature of certain permitted investments, the overall audit burden is generally less intricate, which is expected to reduce the scope and cost of the annual audit relative to MiFID-PRU firms. 170. Based on CASS audits of firms, PS25/12 apportioned firms to different types of auditors. Firm sizes were defined according to Companies Act 2025 income brackets. Table 19: Breakdown of auditors used by firm size by Companies Act 2025 income brackets Firm size Large auditors Other auditors Small 20% 80% Medium 56% 44% Large 91% 9% 171. The Companies Act 2025 brackets are driven by 3 criteria: the firm’s total turnover, the size of its balance sheet and the number of its employees. We estimate the breakdown of firms using employee figures alone, as we do not have information on the other criteria. On this basis, we estimate a total of 35 small firms, 18 medium firms and 11 large firms. 172. We applied the breakdown in Table 19 to our SIPP firm population to estimate the proportion of firms that are covered by large and other auditors. Table 20: Breakdown of non-MiFID SIPP operators by type of auditor Firm size Large auditors Other auditors Small 7 28 Medium 10 8 Large 10 1 Total 27 37

80 173. We assume that all 64 non-MiFID SIPP operators will arrange annual audits of their PSM&A regime compliance. It is assumed that the remaining 34 MiFID operators currently arrange audits under existing CASS obligations and would not be expected to incur additional costs as part of this proposal. 174. We estimate these costs by multiplying the approximate costs of an audit per firm by the number of non-MiFID firms who will require an audit. We take the lower bound, midpoint and upper bound of the audit costs by firm complexity and auditor type in Table 18 above to produce lower, central and higher estimates of annual audit costs. Table 21: Annual cost range of audits Audit cost Large auditors Other auditors Total Lower estimate £0.8m £0.4m £1.2m Central estimate £1.2m £0.5m £1.7m Higher estimate £1.6m £0.7m £2.3m 175. We estimate annual costs to firms of £1.2-2.3m, with a central estimate of £1.7m. These costs would begin after the PSM&A regime’s implementation period. Pension scheme money and assets regime – risk of firm exit 176. There is a risk that, following the introduction of our PSM&A proposals, smaller SIPP operators may struggle to adapt to rising costs and ultimately find it unviable to continue operating in the market. While the intention of these rules is to formalise good practice and strengthen consumer protections, the increased compliance demands could particularly affect firms with limited resources or less robust systems at present. If firms are unable to manage these costs, this could result in market exits with wider implications for competition. 177. As referred to above, some DIMs and other third parties may be unable or unwilling to provide information to SIPP operators at the required frequency. In this case, they would be offboarded by SIPP operators and would not be able to operate in the SIPP market. This may be more likely for third parties who have only a small presence in the SIPP market and for whom SIPPs account for a very small proportion of their business. We expect this to result in a transfer of revenue from the third party exiting the market to third parties who remain in the market. Again, though, this could have implications for competition in the market. 178. We discuss these issues further in the Wider economic impacts, including on our secondary objective section below. Costs to consumers 179. As discussed above, SIPP operators may need to offboard DIMs and other third parties holding and managing investments in SIPPs if those third parties cannot provide them with the required information at the frequency needed for the SIPP operator to

81

comply with our proposals. We have included in our PSM&A proposals an additional implementation period of a year (further to the ‘core’ 2-year implementation period for those proposals) for existing third-party relationships to allow for the orderly offboarding of third parties who cannot support compliance with our proposals. While this should mitigate the disruption to consumers, consumers may nonetheless see some disruption and a reduction in choice if third parties they have chosen are unable to continue their relationship with their SIPP operator. 180. An unintended consequence of our proposal could arise if SIPP operators and third parties pass on the costs of implementing the proposed due diligence and PSM&A requirements to consumers, for example through higher fees. While some cost pass￾through is possible, the incremental costs are expected to be limited in many cases, particularly where firms already operate to high standards and already undertake similar due diligence and monitoring activities. 181. We consider that these costs to consumers are proportionate to the benefits that consumers would derive from our proposals. Our changes aim to reduce the risk of harm to consumers which, as evidenced in the insolvencies of numerous SIPP operators over the past decade, could be substantial. Costs to the FCA, Financial Ombudsman & FSCS 182. We do not anticipate significant direct costs to the FCA as a result of our proposals. These proposals largely build on existing expectations and supervisory focus areas, such as oversight of investments, control of client money, and governance of operators. As such, the FCA already has many of the supervisory frameworks in place to monitor compliance. While we may need to refine or extend our supervisory approaches in light of any new rules, these are expected to be modest and manageable within existing resource allocations. 183. Similarly, we do not expect the proposals to generate significant new cost pressures for the Financial Ombudsman. Clarification of due diligence expectations should support more consistent decision-making and reduce the scope for disputes where SIPP operators have acted in line with requirements set out in Handbook rules. In the short term, the Financial Ombudsman may observe a shift in the nature of complaints, but we expect this to be manageable and to give way over time to a decline in due-diligence￾related complaints as operator practices improve. 184. We do not expect our proposals to increase costs for the FSCS. Indeed, as set out above, the proposed intervention may lead to reduced costs to the FSCS over the longer term. Modelling risks and uncertainty 185. We recognise that establishing potential costs and benefits before the intervention takes effect is subject to uncertainty If our assumptions do not hold or if we have not accounted for all market dynamics, the costs and benefits discussed in this CBA may be over or understated.

82 186. Where possible, our main analysis (presented above) aimed to capture a spectrum of possible values to reflect uncertainty. We set out some sensitivity checks below to further assess the robustness of our findings. Number of SIPP operator failures absent intervention 187. As we noted above, there is uncertainty around how many SIPP operators would fail during the 10-year appraisal period if we did not intervene. While we anticipate a reduction in the frequency of SIPP operator failures relative to the recent past for the reasons set out in the Baseline and key assumptions section above, the extent of this reduction is difficult to be certain about. 188. In the table below we set out how our estimated costs, benefits and NPV vary if we change our assumptions about the number of SIPP operator failures that would occur in the appraisal period if we did not intervene and, relatedly, the number of such failures prevented by our due diligence proposals. We see the NPV of our proposals remains positive across the three scenarios we present, with the benefits of our proposals being greater the higher the number of operator failures in the ‘do nothing’ counterfactual. Table 22: Net present values at different levels of SIPP operator failures in the baseline Number of SIPP operator failures in 10 years in absence of intervention Of which, prevented by proposals PV benefits PV costs NPV 4 1 £85.6m £22.1m 8 4 £177.6m £63.4m £114.1m 12 7 £269.5m £206.1m Note: figures may not sum due to rounding. Impact of FSCS compensation claims and operator insolvencies on financial and wellbeing benefits 189. In the Benefits section, we assumed that that our proposals would indirectly lead to a reduction in SIPP-related financial adviser claims (and subsequent consumer losses). This assumption is critical to our findings, as the scale of consumer losses is directly influenced by the magnitude of FSCS claims in relation to firm insolvencies. Here, we soften our assumption and focus exclusively on SIPP-related due diligence claims to estimate the direct financial and wellbeing savings to consumers. 190. Per Table 9, we estimate total uncompensated financial losses to consumers of £70m regarding due diligence complaints only. On average, this represents a financial loss to consumers of approximately £3.2m per insolvent firm. Across the 8 insolvencies that we assume would occur during the appraisal period in the absence of our intervention, this yields a benefit of around £25.5m, or an average of £2.5m per year.

83 191. If we only account for consumer losses associated with due diligence complaints (while assuming that the same number of insolvencies are prevented, such that the wellbeing impacts of our proposals are unchanged), the policy is expected to provide a net cost of £28.7m in PV terms. Table 23: Net present values at different levels of complaints Scenario PV benefits PV costs NPV Due diligence complaints only £34.7m £63.4m -£28.7m Original scenario (all complaints) £177.6m £114.1m Note: figures may not sum due to rounding. Effectiveness of proposals in reducing uncompensated consumer losses 192. Our analysis further assumes that uncompensated consumer losses resulting from SIPP operator failures will be entirely eliminated through effective due diligence and pension scheme money and asset handling measures. To account for uncertainty around factors such as firm compliance and whether any operator failures that occur happen before our rules are in force, we also estimate the PV of benefits under scenarios where 75% and 50% of uncompensated losses are eliminated. Again, we assume a constant annual benefit for the purposes of calculating NPVs. 193. We observe that at both 75% and 50% effectiveness, our proposals retain a positive NPV. Table 24: Net present values at different levels of effectiveness in reducing consumer losses above the FSCS compensation cap Scenario PV benefits PV costs NPV 100% effectiveness £177.6m £114.1m 75% effectiveness £136.4m £63.4m £72.9m 50% effectiveness £95.2m £31.8m Note: figures may not sum due to rounding. Variation in annual audit costs by firm complexity 194. A further area of uncertainty relates to the expected level of annual audit costs for SIPP operators under the proposed PSM&A requirements. Our initial assumptions treat the SIPP firm itself as relatively simple in structure. However, the actual complexity of firms’ operations and the range of investments they manage can vary significantly, which could impact the overall costs of the proposals.

84 195. Table 25 illustrates how, if we instead assume that medium-sized firms are of average complexity and large firms are classified as complex (with small firms still classified as simple), the NPV of our proposals is lower but remains positive and large. Table 25: Net present values at different levels of firm complexity, based on midpoint audit estimates Firm complexity PV benefits PV costs NPV 100% of firms are classified simple £63.4m £114.1m Small firms are classified as simple, medium firms as average, and large firms as complex £177.6m £76.7m £100.9m Note: figures may not sum due to rounding. Wider economic impacts, including on our secondary objective 196. We expect the proposals outlined in this CBA to support the UK’s competitiveness and medium- to long-term growth through their impacts in the UK’s financial services markets. The proposals are expected to promote the productivity of the financial services sector through the following channels: • Well-functioning markets – we anticipate that a reduced number of SIPP operators will fail in a disorderly fashion due to high redress costs generated by complaints about unsuitable investments, ensuring greater market stability. • Effective competition – we expect that stronger standards will promote effective competition by removing the possibility of firms achieving a competitive advantage through poor conduct. However, as noted in the Costs section, the changes required by our proposals could create affordability pressures for some smaller SIPP operators and DIMs with a small presence in the SIPP market. To the extent that this induces some firm exits from the SIPP market, it could see market consolidation around larger providers, with potential negative implications for competition and fees. 197. We expect that our proposals will better protect consumers. Our proposals will help to reduce consumers’ exposure to potential losses in the event of SIPP operator insolvency. This will enhance trust and confidence in the SIPPs market, helping consumers to take advantage of the choice and flexibility offered by SIPPs where appropriate for them. Greater saving via SIPPs may also have positive wider economic effects by providing capital for investment, helping firms in the real economy to access finance. 198. We have considered the proposals assessed in this CBA from the perspective of ‘rebalancing risk’. We are not a zero-fail regulator, and we accept that risk plays an important role in innovation and consumer choice. Our proposed due diligence rules would not require firms to assess whether an investment is suitable for a particular consumer, and they are not intended to limit the range of legitimate assets accepted

85 into SIPP schemes. Rather, they seek to protect consumers from harm associated with scams and fraudulent or implausible investments being accepted into SIPPs. As such, the proposals are not intended to materially rebalance risk between market participants, but rather to ensure that particular risks are more effectively managed. Monitoring and evaluation 199. We propose that we would monitor a range of information and data to assess the success of our proposals. 200. We would draw on our supervisory activities and intelligence in order to assess the impact of our proposals on firms and the market, including the extent to which the proposals were leading to firm exit and consolidation within the market. Our supervisory work would also allow us to observe how these rules support firms’ compliance with the Consumer Duty. 201. We would also review complaints data from SIPP operators and the Financial Ombudsman to gain insights into how the frequency of consumer issues in the SIPP market evolves following the implementation of our proposals. 202. We may, in the future, request firms to data draw from the records they would be required to keep under our proposals. Response to consolidated CBA Panel feedback on this CBA 203. We have consulted the independent CBA Panel in the preparation of this CBA in line with the requirements of s138IA(2)(a) FSMA. A summary of the main group of recommendations provided by the CBA Panel and the measures we took in response to Panel advice is provided in the table below. 204. In addition, we have undertaken further changes based on wider feedback from the CBA Panel on specific points of the CBA. The CBA Panel publishes a summary of their feedback on their website, which can be accessed here.

86 Table 26: Summary of main recommendations from the CBA Panel and our response CBA Panel main recommendations Our response Strengthen the economic analysis underpinning the proposed intervention The CBA would benefit from analysing more clearly why existing regulation – including high-level rules, guidance and the Consumer Duty – does not deliver the intended outcomes in the market for self-invested personal pensions (SIPPs), and why more prescriptive requirements are expected to be more effective. The analysis should explain why principles-based regulation, with its benefits for efficiency and innovation, is not believed to be appropriate, and why a more prescriptive approach is warranted in this case. In particular, it would be valuable to set out more clearly what is assumed to change in firms’ incentives or behaviour under greater prescription, and how alternative approaches – including less prescriptive or non-regulatory options – were considered. In line with the Panel’s feedback, we have made significant amendments to the problem and rationale for intervention and our proposed intervention chapters. In broad terms, the revised narrative now focuses on the drivers of harm not being sufficiently addressed through due diligence requirements and inconsistencies in asset and safeguarding requirements, rather than framing the issue primarily as a market failure affecting operator incentives and, subsequently, consumer outcomes. We now set out that reliance on the existing high-level principles based framework alone risks the same drivers of harm remaining unaddressed, including where firms apply due diligence standards inconsistently or fail to implement effective underlying safeguarding controls. The revised chapters also explain why, in this context, we consider a more prescriptive approach to be warranted in certain areas in order to provide greater regulatory clarity, promote more consistent standards across firms, and reduce the risk of consumer harm. Clarify the basis for the assumptions driving the benefits. The estimated benefits are highly sensitive to assumptions on the level of compliance and the extent to which the proposals would reduce uncompensated consumer losses. Given the importance of these assumptions, the Panel recommends that the CBA sets out more clearly why they are considered credible. As set out in Paragraph 7.29 of the FCA’s Statement of Policy, we generally assume there will be full compliance from firms with any new policy we implement. However, we agree with the Panel’s view that there is uncertainty as to the extent to which the proposals would fully eliminate uncompensated consumer losses in practice. In the absence of strong evidence to the contrary, we do not consider it appropriate to assume that the proposals would prevent all instances of consumer loss. We have therefore revised our analysis to incorporate a range of outcomes reflecting uncertainty around the effectiveness of the proposals. Specifically, we have applied a more conservative lower bound assumption that the proposals eliminate 50% of relevant consumer losses and have based our central estimate on a midpoint assumption of 75% effectiveness. As a result, the estimated PV of benefits decreases from £177.6 million to £136.4 million.

87 CBA Panel main recommendations Improve the credibility of cost estimates and modelling inputs. The presentation of cost estimates is generally transparent but uneven in the level of detail provided across the analysis. In some areas, detailed breakdowns are included, while in others the underlying assumptions and derivation are less clearly explained. Key inputs, such as the firm population and scope decisions, are set out earlier in the document but are not always clearly linked to the subsequent cost estimates. Strengthening consistency in the level of detail and improving crossreferencing between inputs and outputs would enhance the credibility and usability of the analysis. Providing clear sources for all tables would also support this. Our response Overall, we have sought to improve the transparency of the analysis by providing additional explanation of key assumptions, particularly where these rely on external sources, alongside clearer sourcing for data tables throughout the CBA. Where detailed documentation already exists (for example in relation to SCM modelling inputs), we have included links within the text to enable readers to refer directly to the underlying material and maintain brevity where possible. To illustrate these changes, we have expanded the discussion of the monetised wellbeing estimates derived from research published by Which?, including their robustness in the context of HM Treasury Green Book guidance and their relevance to the harms addressed by these proposals. We have also clarified our rationale for applying a standard 10-year appraisal period, given that the proposals primarily relate to the operational and administrative functioning of SIPP operators. Question 18: Do you have any comments on our cost benefit analysis? Question 19: Do you agree with the assumptions made in our cost benefit analysis? Question 20: Are there any significant costs or benefits that we did not adequately consider in our cost benefit analysis?

88 Annex 3 Compatibility statement Compliance with legal requirements

1. This Annex records the FCA’s compliance with a number of legal requirements applicable to the proposals in this consultation, including an explanation of the FCA’s reasons for concluding that our proposals in this consultation are compatible with certain requirements under the Financial Services and Markets Act 2000 (FSMA).
2. When consulting on new rules, the FCA is required by section 138I(2)(d) FSMA to include an explanation of why it believes making the proposed rules (a) is compatible with its general duty, under section 1B(1) FSMA, so far as reasonably possible, to act in a way which is compatible with its strategic objective and advances one or more of its operational objectives, (b) so far as reasonably possible, advances the secondary international competitiveness and growth objective, under section 1B(4A) FSMA, and (c) complies with its general duty under section 1B(5)(a) FSMA to have regard to the regulatory principles in section 3B FSMA. The FCA is also required by s 138K(2) FSMA to state its opinion on whether the proposed rules will have a significantly different impact on mutual societies as opposed to other authorised persons.
3. This Annex also sets out the FCA’s view of how the proposed rules are compatible with the duty on the FCA to discharge its general functions (which include rule-making) in a way which promotes effective competition in the interests of consumers (section 1B(4)). This duty applies in so far as promoting competition is compatible with advancing the FCA’s consumer protection and/or integrity objectives.
4. In addition, this Annex explains how we have considered the recommendations made by the Treasury under section 1JA FSMA about aspects of the economic policy of His Majesty’s Government to which we should have regard in connection with our general duties.
5. This Annex includes our assessment of the equality and diversity implications of these proposals.
6. Under the Legislative and Regulatory Reform Act 2006 (LRRA) the FCA is subject to requirements to have regard to a number of high-level ‘Principles’ in the exercise of some of our regulatory functions and to have regard to a ‘Regulators’ Code’ when determining general policies and principles and giving general guidance (but not when exercising other legislative functions like making rules). This Annex sets out how we have complied with requirements under the LRRA.

89

The FCA’s objectives and regulatory principles: Compatibility statement 7. The proposals set out in this consultation are primarily intended to advance the FCA’s operational objective to protect consumers. Our proposals to set out explicit due diligence rules in our Handbook will help to ensure consumers are protected from a scam, fraud or implausible investment within a SIPP. The proposals for a PSM&A regime will help ensure consumers are protected from loss or misuse, and that, in the event of a SIPP operator failure, there is an accurate record of their rights under the scheme such that orderly wind down is not delayed. 8. We consider these proposals are compatible with the FCA’s strategic objective of ensuring that the relevant markets function well because they will drive higher standards, supporting stability and resilience in the SIPP market. For the purposes of the FCA’s strategic objective, “relevant markets” are defined by section 1F FSMA. 9. We consider these proposals comply with the FCA’s secondary objective in advancing competitiveness and growth. SIPPs play an increasingly important role in directing long-term investment into the economy. Their flexible investment structures allow consumers to access a broader spectrum of assets that can support long-term value, diversification, and economic growth. Our proposals seek to raise standards across SIPP operators and improve consistency through clarity of expectations thereby reducing losses to scams and improving consumer and market confidence. In particular, the PSM&A regime will require firms to maintain accurate records of pension scheme money and assets, enabling consumers to more confidently and accurately identify the value of their SIPP. This improved transparency and confidence can support the opportunity for sustainable growth and well governed access to a wider range of productive investment opportunities within SIPPs, consistent with appropriate consumer protections. 10. We also consider that the proposals advance the FCA’s integrity objective. By reducing the scope for poor practice, weak controls and inconsistent standards in higher risk areas of the SIPP market, the proposals are intended to support orderly market functioning and reduce the risk that firms or market structures are used in ways that undermine trust in the pensions system. The FCA’s regulatory principles 11. In preparing the proposals set out in this consultation, the FCA has had regard to the regulatory principles set out in section 3B FSMA. The need to use our resources in the most efficient and economic way 12. Our proposals are consistent with an efficient and economic use of our resources. Firms will have records and practices in place which will allow them to identify issues earlier and rectify these before they become serious supervisory issues. Where supervisory intervention is needed the clarity of expectations will facilitate timely action.

90

The principle that a burden or restriction should be proportionate to the benefits 13. We have carefully considered the proportionality of our proposals. We asked for views in DP24/3 on high level intentions for SIPP due diligence and the handling of pension scheme money and assets. We are aware from our supervisory engagement with firms that there is a range of current practices in the SIPP market. We have designed the proposals to be proportionate to the risks identified. Requirements are targeted at higher risk areas of the SIPP market. We recognise that our proposals will require some firms to make significant investment in systems and the implementation timelines in our proposals seeks to ensure adequate time for this. Supported by the cost benefit analysis (CBA) we have undertaken, we consider that the burden on firms is proportionate and the benefits outweigh the costs. Our CBA in Annex 2 sets out our assessment of the costs and benefits of our proposals. The need to contribute towards achieving compliance by the Secretary of State with section 1 of the Climate Change Act 2008 (UK net zero emissions target) and section 5 of the Environment Act 2021 (environmental targets) 14. This principle in not relevant to our proposals The general principle that consumers should take responsibility for their decisions 15. Our proposals will provide greater protection for consumers. They do not inhibit consumers’ ability to purchase the products they wish to purchase, nor do they seek to remove from consumers the need to take responsibility for their own decisions. The responsibilities of senior management 16. It will be the responsibility of relevant Senior Managers to ensure that their firms comply with the rule changes that we are proposing, if made. Senior Managers must have regard to their responsibilities under the Senior Managers and Certification Regime. 17. Under the PSM&A regime, a director or senior manager will be required to have operational oversight of the regime. This includes overall accountability for the firm’s compliance with the PSM&A rules and for ensuring that appropriate systems and controls are in place, and remain effective, to support accurate identification, recording and monitoring of pension scheme money and assets. The desirability of recognising differences in the nature of, and objectives of, businesses carried on by different persons including mutual societies and other kinds of business organisation 18. We have had regard to this principle and do not believe that our proposals undermine it.

91 The desirability of publishing information relating to persons subject to requirements imposed under FSMA, or requiring them to publish information 19. This principle is not relevant to our proposals. The principle that we should exercise our functions as transparently as possible 20. In developing these proposals, we have acted as transparently as possible. We published a Discussion Paper (DP 24/3) in December 2024. We have also engaged with stakeholders representing consumer and industry perspectives. We have attended the FCA statutory panels for early views on our policy proposals. Financial crime 21. In formulating these proposals, the FCA has had regard to the importance of taking action intended to minimise the extent to which it is possible for a business carried on (i) by an authorised person or a recognised investment exchange; or (ii) in contravention of the general prohibition, to be used for a purpose connected with financial crime (as required by section 1B(5)(b) FSMA). The proposals seek to reduce the scope for SIPPs to be as vehicles for scams or fraud. Expected effect on mutual societies 22. The FCA does not expect the proposals in this paper to have a significantly different impact on mutual societies. Compatibility with the duty to promote effective competition in the interests of consumers 23. In preparing the proposals as set out in this consultation, we have had regard to the FCA’s duty to promote effective competition in the interests of consumers. We consider that the proposals are compatible with that duty. By clarifying minimum standards and addressing inconsistencies that can distort competition, the proposals are intended to support a level playing field among firms, while allowing competition on the basis of service quality, governance and innovation that benefits consumers. Equality and diversity 24. We are required under the Equality Act 2010 in exercising our functions to ‘have due regard’ to the need to eliminate discrimination, harassment, victimisation and any other

92

conduct prohibited by or under the Act, advance equality of opportunity between persons who share a relevant protected characteristic and those who do not, to and foster good relations between people who share a protected characteristic and those who do not. 25. As part of this, we ensure the equality and diversity implications of any new policy proposals are considered. Overall, we do not consider that the proposals materially impact any of the groups with protected characteristics under the Equality Act 2010 (in Northern Ireland, the Equality Act is not enacted but other antidiscrimination legislation applies). 26. We welcome your comments if you have any concerns. We will keep these considerations under review throughout the consultation period and in developing our final rules. Legislative and Regulatory Reform Act 2006 (LRRA) 27. We have had regard to the principles in the LRRA for the parts of the proposals that consist of general policies, principles or guidance and consider that our proposals are transparent, accountable, proportionate, and targeted only where action is needed. 28. We have had regard to the Regulators’ Code for the parts of the proposals that consist of general policies, principles or guidance. We consider that our proposals are consistent with the principles of the code. This consultation is a way for firms to let us know their views of our proposals. This consultation paper and instrument will allow firms to understand the requirements applicable to them. We are also transparently setting out what our policy aims are so that firms can take those into account.

93 Annex 4 List of respondents to DP 24/3 We include a list of the names of respondents to Discussion Paper 24/3 who have consented to the publication of their name. It should be noted that not all of these respondents commented directly on the proposals relating to SIPPs. The list is set out below: Association of British Insurers Aegon UK AJ Bell Alltrust Services Limited Association of Member-Directed Pension Schemes Association of Pension Lawyers Atsipp Aviva City of London Corporation Enhance Support Solutions Fidelity Financial Services Consumer Panel Hargreaves Landsdowne IFGL Pensions Investment & Life Assurance Group Legal and General Money Alive Moneybox Moret SIPPs Mattioli Woods Nest

94 Nucleus PensionBee Peoples Partnership Phoenix Group Quilter Royal London Scottish Widows St James’s Place Smart Pension The British Private Equity & Venture Capital Association The Investing and Saving Alliance The Society of Pension Professionals TISA Exchange Limited (TeX) Zurich

95 Annex 5 Abbreviations in this document Abbreviation Description AUA Assets Under Administration CASS Client Assets Sourcebook CBA Cost Benefit Analysis CEO Chief Executive Officer CMAR Client Money and Assets Return COBS Conduct of Business Sourcebook CP Consultation Paper DC Defined Contribution DIM Discretionary Investment Manager DP Discussion Paper EANDCB Estimated Annual Net Direct Cost to Business FCA Financial Conduct Authority FG Non-Handbook Guidance FSCS Financial Services Compensation Scheme FSMA Financial Services and Markets Act 2000 HM His Majesty’s HMRC His Majesty’s Revenue and Customs IBIP Insurance-Based Investment Product IPRU-INV Interim Prudential Sourcebook for Investment Businesses IT Information Technology

Abbreviation Description LRRA Legislative and Regulatory Reform Act 2006 LTAF Long-Term Asset Fund MiFID Markets in Financial Instruments Directive MiFID-PRU Markets in Financial Instruments Directive Prudential Sourcebook NPV Net Present Value NS&I National Savings & Investments products PERG Perimeter Guidance Manual PRA Prudential Regulation Authority PSM&A Pension Scheme Money and Assets RRS Readily Realisable Securities SCM Standardised Cost Model SIPP Self-Invested Personal Pension SUP Supervision Manual SYSC Senior Management Arrangements, Systems and Controls UK United Kingdom

Appendix 1 Draft Handbook text

FCA 202X/YY SELF-INVESTMENT OPTIONS AND SCHEME MONEY AND ASSETS (OPERATOR RESPONSIBILITIES) INSTRUMENT 202X Powers exercised A. The Financial Conduct Authority makes this instrument in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 137A (The FCA’s general rules); (2) section 137T (General supplementary powers); (3) section 139A (Power of the FCA to give guidance); and (4) section 340 (Appointment). B. The rule-making provisions listed above are specified for the purposes of section 138G(2) (Rule-making instruments) of the Act. Commencement C. This instrument comes into force on [date]. Amendments to the Handbook D. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes in this instrument listed in column (2) below: (1) (2) Glossary of definitions Annex A Conduct of Business sourcebook (COBS) Annex B Supervision manual (SUP) Annex C Citation F. This instrument may be cited as the Self-investment Options and Scheme Money and Assets (Operator Responsibilities) Instrument 202X. By order of the Board [date]

FCA 202X/YY Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text and striking through indicates deleted text, unless indicated otherwise. Insert the following new definitions in the appropriate alphabetical position. The text is not underlined. directly held scheme money that is held in a scheme bank account. scheme money indirectly held scheme money that is held in a bank account opened and maintained in scheme money the name of a relevant third party. individual pot (in COBS 19A and COBS 19B) money or investments originating in or acquired via contributions paid into a personal pension scheme by a client or the client’s employer on behalf of that client or for that client’s benefit. This includes, for avoidance of doubt, any tax relief, interest earned, growth in the value of the investments or assets, proceeds of any disinvestment awaiting reinvestment in a different investment, and inward transfers of the client’s rights or interests within other pension schemes. relevant third party (a) in COBS 19A, and as set out in COBS 19A.2.1R, a person who provides, or proposes to provide, introductions or one or more services in relation to investments that are, or are proposed to be, held within a scheme; or (b) in COBS 19B, a person, other than the scheme trustee, with whom the scheme trustee has entered into an agreement to hold, administer, or manage scheme money or scheme assets for example a bank, a custodian, or a platform service provider. scheme asset any asset or investment, other than scheme money, that is part of a personal pension scheme and held by the scheme trustee, or by a relevant third party for or on behalf of the scheme trustee. scheme bank a bank account opened and maintained in the name of the scheme account trustee for the purposes of holding scheme money. scheme money money of any currency that is part of a personal pension scheme. scheme report a report prepared by an auditor in accordance with the requirements set out in SUP 3.12.1R Page 2 of 51

FCA 202X/YY scheme trustee a person or entity, other than an authorised person, who owns scheme assets and scheme money under the scheme’s trust deed and rules, and who holds, manages or administers such assets and money for the benefit of the scheme’s members or beneficiaries. self-investment as set out in COBS 19A.1.2R(1) and subject to COBS 19A.1.2R(2), options terms of a personal pension scheme allowing a client to direct the investment of some or all of their individual pot into investments selected by the client (whether or not without the benefit of advice) or by a relevant third party selected by the client or acting on the instructions of or under a mandate agreed with or on behalf of the client. Amend the following definition as shown. scheme … (2) (in COBS, CASS and, SUP and COBS, other than in COBS 19A and COBS 19B): … (3) (in COBS 19A and 19B) a personal pension scheme in respect of which an operator is subject to the requirements in COBS 19A and COBS 19B. Page 3 of 51

FCA 202X/YY Annex B Amendments to the Conduct of Business Sourcebook (COBS) In this Annex, underlining indicates new text and striking through indicates deleted text, unless stated otherwise. [Editor’s note: This Annex takes into account the proposals and legislative changes suggested in the consultation papers ‘Adapting our requirements for a changing pensions market’ (CP25/39) and ‘Targeted clarifications of Handbook materials’ (CP25/27) as if they were made final.] 1 Application … 1 Annex Application to TP firms and Gibraltar-based firms (see COBS 1.1.1CR) 2 Part 2: Gibraltar-based firms … 2. Application of COBS 2.1 R In addition to those rules applying by virtue of GEN 2.3.1R, a Gibraltar-based firm must also comply with: … (2) (to the extent that the rule does not already apply to such a Gibraltar￾based firm as a result of GEN 2.3.1R) the provisions in: … (m) COBS 19.13 (Pensions interactive digital simulations) in relation to business carried on from an establishment in the United Kingdom; and (n) COBS 19.14 (Non-advised pension transfers) in relation to business carried on from an establishment in the United Kingdom.; and (o) COBS 19A (Self-invested personal pension schemes and related arrangements), COBS 19B (Pension trustee money and asset handling rules) and COBS TP 2.8K to COBS TP 2.8U in relation to business carried on from an establishment in the United Kingdom. Page 4 of 51

FCA 202X/YY Insert the following new chapters, COBS 19A and COBS 19B, after COBS 19 (Pensions supplementary provisions). All the text is new and is not underlined. 19A Self-invested personal pension schemes and related arrangements 19A.1 General Application 19A.1.1 R (1) This chapter applies to an operator in respect of activities carried out in connection with self-investment options within a personal pension scheme. (2) Where the obligations on the operator as set out in this chapter in practice require action by a scheme trustee, or affiliated company, controlled by the operator, they are to be understood as obligations of the operator to ensure the scheme trustee takes the required action. Meaning of self-investment options 19A.1.2 R (1) In this chapter, references to self-investment options mean terms of a personal pension scheme that allow the client to direct the investment of some or all of the client’s individual pot into investments that are selected by: (a) the client, whether or not with the benefit of advice; or (b) an investment manager or other relevant third party who is selected by the client or acts on the instructions of, or under a mandate agreed with or on behalf of, the client. (2) The following choices open to a client under the terms of a personal pension scheme are not self-investment options within the meaning in (1): (a) investment pathways; (b) lifestyle options; or (c) investment funds, in each case designed without input from the client and offered by the operator as part of a range of pre-selected options. Meaning of ‘client’ 19A.1.3 G For avoidance of doubt, and in keeping with COBS 3.2.3R(2), references in this chapter to a client are references to a member (including a co-trustee) or beneficiary of the personal pension scheme, and not to the operator or a relevant third party, notwithstanding that there may be a client relationship between them. Purpose Page 5 of 51

FCA 202X/YY 19A.1.4 G (1) The purpose of this chapter is to set out due diligence obligations on an operator so as to reduce as far as reasonably possible the risk that clients suffer harm to their individual pot due to: (a) scams or frauds; or (b) investment propositions that seem unrealistic due to factors which a consumer may overlook but which a reasonably prudent and skilled firm should be reasonably able to identify. (2) The due diligence obligations set out in the rules in this chapter aim to ensure the operator undertakes appropriate screening and vetting of: (a) relevant third parties carrying on business activities closely related to self-investment options within the scheme, such as, for example, introducers referring new clients to the operator and discretionary investment managers making purchasing or dealing decisions on the instructions of the client; and (b) investments which may be held in the client’s individual pot within the scheme in connection with self-investment options, whether the screening or vetting is done directly in respect of each investment (or, where appropriate, type of investment) or by the setting of investment parameters which relevant third parties must follow in purchasing new or additional investments to be held within the scheme. 19A.1.5 G Operators are reminded of their obligations under: (1) Principle 2 to act with due skill, care, and diligence; (2) the client’s best interests rule to act honestly, fairly and professionally in accordance with the best interests of the operator’s client; and (3) the Consumer Duty to act to deliver good outcomes for retail customers, in particular to avoid causing foreseeable harm (PRIN 2A.2.8R), to act in good faith (PRIN 2A.2.2R), and to enable and support retail customers to pursue their financial objectives (PRIN 2A.2.14R). Due diligence: reasonable vigilance 19A.1.6 G (1) In keeping with its obligations under Principle 2, the client’s best interests rule and the Consumer Duty (as applicable), an operator should exercise reasonable vigilance and remain alive to information that comes to light at any point and which is indicative of a risk of harm to clients’ individual pots in connection with self-investment options. (2) An operator should not ignore concerning information about a relevant third party or investment that the operator is or becomes aware of, notwithstanding that the operator’s due diligence steps carried out in compliance with this chapter did not identify any material issues. Page 6 of 51

FCA 202X/YY (3) For example, where the operator identifies a reasonably obvious concern in relation to the conduct of a relevant third party the operator had already vetted, the operator should carefully consider whether: (a) continuing business arrangements with that relevant third party would be inconsistent with the operator’s obligation in COBS 19A.2.2R; and (b) the identified concerns point to a weakness or deficiency in the operator’s due diligence processes, policies or controls and, if so, take steps to address or remedy it. Due diligence: sourcing information 19A.1.7 R In undertaking the due diligence required under this chapter, the operator must: (1) obtain its own information through independent means wherever possible, and (2) ensure it does not unreasonably rely on information, documents, records or statements supplied by the relevant third party itself or, in the case of investments, the person who manufactures, provides, sells, promotes or distributes the investment. 19A.1.8 G In the FCA’s view, an operator’s reliance on the information, documents, records or statements supplied by the relevant third party is unreasonable where it undermines the harm avoidance aim of the due diligence obligations set out in this chapter. Agreements with relevant third parties 19A.1.9 R The operator must ensure, in good time before the relevant third party commences provision of introductions or of a service in relation to investments that are, or are proposed to be, held within the scheme, that: (1) a written agreement is in place that sets out the terms governing the roles and responsibilities of the parties and the provision of introductions or the service by the relevant third party clearly and at an appropriate level of detail, making it clear what the relevant third party will and will not do; and (2) any potential conflict arising from the relationships, holdings or positions of the relevant third party and the interests of the relevant client(s) are managed so as to ensure fairness to and avoid undue risk to the interests of client(s). [Note: see COBS TP 2.8K in relation to pre-existing arrangements with relevant third parties] 19A.2 Due diligence obligations: relevant third parties Page 7 of 51

FCA 202X/YY 19A.2.1 R A relevant third party is a person who provides, or proposes to provide, any of the following in connection with self-investment options within a personal pension scheme: (1) introductions of potential or new clients to the operator; (2) introductions, advice or arranging deals in relation to or with a view to the acquisition of investments other than designated investments that are held, or are proposed to be held, within the scheme; or (3) a service that is in the nature of or includes: (a) investment advice, where the service may or does include making arrangements with a view to transactions in investments; or (b) managing investments, in either case in relation to investments that are held, or are proposed to be held, within the scheme. General obligation 19A.2.2 R A firm must ensure that business arrangements for a relevant third party to provide introductions or a service are only entered into, or continued, where the operator’s due diligence gives it reasonable assurance that this will not involve undue risk to the individual pot of one or more clients arising from the conduct of the relevant third party. [Note: see COBS TP 2.8L in relation to pre-existing arrangements with relevant third parties] Due diligence: core checks and verifications 19A.2.3 R (1) Subject to (2), the operator’s compliance with COBS 19A.2.4R is sufficient for the purposes of COBS 19A.2.2R where the relevant third party is an authorised person. (2) Notwithstanding that a relevant third party is an authorised person, the operator must undertake additional due diligence where the operator is aware, or reasonably should be aware, of information relating to the relevant third party that is indicative or suggestive of a material risk to clients’ individual pots. 19A.2.4 R (1) An operator must take reasonable steps to undertake the following checks and verifications in relation to the relevant third party: (a) the identity of the relevant third party, including, as a minimum, its registration in Companies House or an overseas business registry, or personal identification documents, as applicable; Page 8 of 51

FCA 202X/YY (b) if the relevant third party provides, or proposes to provide, a service which involves the carrying on of a regulated activity, that: (i) it is an authorised person and holds appropriate permissions, where the service is or would be provided from an establishment in the UK; or (ii) it is appropriately authorised and regulated in the relevant overseas jurisdiction, where the service would be provided from an establishment overseas; (c) that the relevant third party is not undergoing, and has not been the subject of, any disciplinary or criminal proceeding, investigation, or conviction relevant to any introductions or any service they provide or propose to provide in connection with self￾investment options within the scheme; (d) that the relevant third party does not appear in any list or warning issued or maintained by the FCA of persons or entities suspected of scams, fraud or unauthorised business, or a comparable list or warning issued or maintained by a relevant authority in an overseas jurisdiction, as applicable; and (e) that there is no scope for the interests, business model or relationships of the relevant third party, or of a person closely connected with the relevant third party, to conflict with the interests of the client(s) in a way that cannot be managed so as to ensure fairness to and avoid undue risk to the interests of client(s). (2) References to a relevant third party in (1) also include a director, senior manager, an approved person or appointed representative of the relevant third party where relevant to the provision of the introduction or service in COBS 19A.2.1R. Additional due diligence steps 19A.2.5 R (1) The operator must undertake additional due diligence in respect of a relevant third party: (a) who is not an authorised person; or (b) in relation to whom such additional due diligence is required by virtue of COBS 19A.2.3R(2). (2) In considering what additional due diligence steps to undertake, the operator must have regard, in particular, to: (a) whether the relevant third party carries out its business and provides (or would provide) its introductions or services from the UK or from an overseas jurisdiction, and if so, which; and Page 9 of 51

FCA 202X/YY (b) what professional or regulatory authorisation, licensing or oversight, if any, applies to the business of the relevant third party in the UK or in the applicable overseas jurisdiction. 19A.2.6 G The following are examples of additional due diligence it may be appropriate for an operator to undertake in respect of a relevant third party: (1) reviewing publicly available information about the company and its directors – for example, under Companies House records or equivalent registrars in overseas jurisdictions – that is additional to the information already considered under COBS 19A.2.4R; or (2) taking steps to form a reasonable understanding of the nature of the relevant third party’s business and to consider whether its activities seem unusually risky from a legal or compliance perspective, or are otherwise unusual, irregular or unexpected in light of the nature of its business. Frequency of checks 19A.2.7 R The operator must undertake the due diligence before the commencement of the business relationship between the operator and the relevant third party, and at reasonable intervals thereafter. 19A.2.8 G While it is for the operator to consider how often the ongoing due diligence in COBS 19A.2.7R should be undertaken in light of relevant circumstances – including, for example, where the operator becomes aware of new information – the FCA would normally expect it to be undertaken at least annually. Adverse findings and material issues 19A.2.9 R (1) The obligations in (2) apply where the operator cannot be reasonably satisfied, due to concerns identified following due diligence, that: (a) accepting, or continuing to accept, introductions from the relevant third party; or (b) allowing, or continuing to allow, the relevant third party to provide services to the scheme, is consistent with its obligations under COBS 19A.2.2R. (2) The operator must: (a) not accept any new introductions from the relevant third party; (b) not enter into any new business arrangements with, or allow any new service to be provided by, the relevant third party in connection with the scheme; (c) take reasonable steps to expediently terminate any existing business arrangement with, and cease the provision of any service Page 10 of 51

FCA 202X/YY by, the relevant third party in connection with the scheme, subject to COBS 19A.2.12R(2); and (d) consider and implement reasonable steps to assess and mitigate the risk of harm to clients from prior business conducted with the relevant third party. 19A.2.10 R (1) The operator may delay the steps in COBS 19A.2.9R(2)(c) where, in its reasonable judgement, doing so would be consistent with its obligations in COBS 19A.2.2R – for example, where it considers that it would be in the interests of clients for the operator to await the outcome of a disciplinary investigation into the relevant third party. (2) The operator may retain existing business arrangements with, or the provision of any service by, the relevant third party in connection with the scheme where, in its reasonable judgement, compliance with COBS 19A.2.9R(2)(c) would exacerbate the risk of harm to clients. (3) Where the operator relies on (1) or (2), it must clearly document its reasoning and keep that record indefinitely so as to be able to demonstrate to the FCA its compliance with COBS 19A.2.9R. 19A.2.11 R In relation to any material issue identified following due diligence and not falling within the scope of application of COBS 19A.2.9R, the operator must carefully consider how to proceed in order to comply with its regulatory obligations, having regard in particular to COBS 19A.2.2R. 19A.3 Due diligence obligations: investments 19A.3.1 R This section applies where and to the extent an operator receives instructions from, or on behalf of, a client for investments to be acquired and held within the scheme. Internal policy on risk 19A.3.2 R The operator must carefully consider and set out a clear internal policy on its risk tolerance, having regard to the harm avoidance aims of its obligations under this chapter as well as the operator’s business model and resources. 19A.3.3 G The operator’s approach to compliance with the due diligence requirements in this section and the investment parameters agreed with any relevant third party under COBS 19A.4 should be informed by its internal policy on risk. General obligations 19A.3.4 R A firm must put in place appropriate due diligence processes and, where COBS 19A.4 applies, investment parameters for investments or types of investment in order to effectively: (1) identify assets or propositions that pose an undue risk of fraud, or are unlikely to be a credible investment proposition; and Page 11 of 51

FCA 202X/YY (2) ensure no new or further investments which fall into (1) are accepted into the scheme. 19A.3.5 R (1) The operator must undertake due diligence in respect of the initial instance of an investment or, where appropriate, the initial instance of a type of investment, that is proposed to be held within the scheme, and review that due diligence as necessary. (2) The obligations under this rule and the remainder of this section are replaced by COBS 19A.4 where a relevant third party instead of the operator is dealing, acquiring or managing investments. [Note: see COBS TP 2.8M in relation to existing investments held within the scheme] Due diligence: core checks and verifications 19A.3.6 R (1) Subject to (2), a due diligence process that incorporates the core verifications and checks required under COBS 19A.3.7R is sufficient for the purposes of the identification in COBS 19A.3.4R(1) where the investment is specified in (3). (2) Notwithstanding that an investment is specified in (3), the operator must undertake additional due diligence where the operator is aware, or reasonably should be aware, of information that is indicative or suggestive of a material risk to clients’ individual pots. (3) The following investments are specified for the purposes of (1): (a) a deposit issued by a deposit-taking firm, or an overseas person holding equivalent authorisation and subject to equivalent regulation; (b) a unit in any regulated collective investment scheme, including, for avoidance of doubt, a long-term asset fund; (c) a unit-linked policy or a with-profits policy; and (d) a readily realisable security which is not a non-mass market investment or a restricted mass market investment and meets one of the following conditions: (i) it has been admitted to the official list; (ii) it has been admitted to trading on a regulated market; or (iii) it is regularly traded on an overseas exchange which the operator reasonably considers to provide a sufficient standard of transparency and consumer protection, on the basis of the information and evidence available to it and having regard to its obligation in COBS 19A.3.4R. Page 12 of 51

FCA 202X/YY 19A.3.7 R An operator must take reasonable steps to verify and ensure that any investment which is proposed to be held within the scheme is: (1) not taxable property under the relevant UK tax legislation as applicable to the scheme; (2) an asset with a verifiable trail of ownership and documented origin, and to which good title has been, or can be, obtained; and (3) capable of being reliably valued, both initially and on an ongoing basis. Additional due diligence 19A.3.8 R (1) The operator must undertake additional due diligence in respect of any investment: (a) not specified in COBS 19A.3.6R(3); or (b) in relation to which additional due diligence is required by virtue of COBS 19A.2.3R(2). (2) It is for the operator to determine what additional due diligence steps to undertake having regard to its regulatory obligations – in particular, under COBS 19A.3.4R, the client’s best interests rule and the Consumer Duty (as applicable). 19A.3.9 G The following are examples of relevant checks and considerations that are normally relevant for an operator to undertake and take into account in complying with COBS 19A.3.8R(1): (1) checking that no persons involved in or associated with the investment appear in any list or warning issued or maintained by the FCA of persons or entities suspected of scams, fraud or unauthorised business, or a comparable list or warning issued or maintained by a relevant authority in an overseas jurisdiction, as applicable; (2) the market standing and publicly available information about the investment’s issuer or provider, promoter and associated parties, including consideration of whether enhanced checks on identity, regulatory status or adverse information may be warranted; (3) what, if any, protections are available under the FSCS or any comparable overseas investor protection scheme in respect of losses caused by the insolvency or misconduct of the investment provider or issuer; (4) the structure and business model of the underlying investment proposition and how realistic the prospects are that the investment will generate returns in line with promotional claims, or any reasonable return; Page 13 of 51

FCA 202X/YY (5) whether the structure or terms of the investment feature complex or unusual terms, or are otherwise opaque, which might be indicative of a higher risk of harm to the client; (6) whether investors’ contractual rights are clearly set out and enforceable in the applicable jurisdiction in the UK or overseas; (7) whether the level, structure and complexity of fees, commissions or other charges may be indicative of a higher risk of harm to the client – for example, due to conflicts of interests or excessive, unclear or unusual costs and charges; and (8) whether there are known issues, such as missed income payments, redemption delays, valuation concerns or prior defaults, that might indicate a need for deeper analysis of the investment issuer’s operational history or track record. Adverse findings and material issues 19A.3.10 R (1) Following the due diligence steps undertaken by the operator in compliance with this section and in accordance with COBS 19A.3.5R(1), if the operator considers that the investment should not be, or should no longer be, accepted into the scheme, it must take all reasonable steps to prevent new or further investment or acquisitions of the investment. (2) In complying with the obligation in (1), the operator must also ensure the exclusion of the investment is reflected in the parameters in COBS 19A.4.3R and take reasonable steps to bring to the attention of the investment manager or other relevant third party that the investment is not permitted (or is no longer permitted) to be held within the scheme. (3) The operator must also: (a) consider and implement reasonable steps to mitigate the risk of harm to clients from any holdings in that investment already within the scheme; and (b) take appropriate steps to meet the information needs of affected clients. 19A.4 Investment dealing, acquisition and managing by relevant third parties Purpose 19A.4.1 G (1) This section sets out requirements relating to due diligence where a relevant third party instead of the operator is dealing, acquiring or managing investments held within the scheme in relation to self￾investment options. Page 14 of 51

FCA 202X/YY (2) The obligations set out in relation to contractual arrangements between the operator and the investment manager or other relevant third party supplement the obligation in COBS 19A.1.9R. (3) The operator of the scheme is ultimately responsible for what investments are accepted into the scheme and must, therefore, have appropriate and effective arrangements in place to mitigate risks to clients where the decision to acquire an investment is made, or carried out on the client’s instructions, by a relevant third party instead of the operator. Application 19A.4.2 R The rules in this section apply in relation to an operator’s business arrangements with a relevant third party where the arrangements enable, or are intended to enable, the relevant third party, without the operator’s involvement, to deal in, acquire or manage investments that are, or are proposed to be, held within the scheme in connection with self-investment options. Investment parameters 19A.4.3 R (1) An operator must consider and set out its parameters for what investments, or types of investment, it will accept into the scheme and which it will not, in each case having regard to its internal policy on risk under COBS 19A.3.2R and to its reasonable view of the likelihood of an investment satisfying the operator’s due diligence under COBS 19A.3 if the investment were acquired directly by the operator. (2) The operator must undertake the parameter-setting exercise and comply with the other requirements in this section when entering into business arrangements with the relevant third party and before any investments are acquired by the relevant third party to be held within the scheme. [Note: see COBS TP 2.8N in relation to pre-existing business arrangements with relevant third parties] (3) The operator must review its investment parameters at reasonable regular intervals after the initial exercise in (2) to ensure they remain appropriate in light of any revision to its internal policy on risk and of updated information about each investment, or type of investment, to which the parameters relate. (4) The operator must ensure its parameters for permissible and non￾permissible investments and any updates to or revisions of those parameters are clearly communicated to the relevant third party and effectively implemented as part of its operation of the scheme. Agreement 19A.4.4 R In relation to business arrangements to which this section applies, the operator must ensure the agreement in COBS 19A.1.9R: Page 15 of 51

FCA 202X/YY (1) sets out what investments, or types of investment, the relevant third party is permitted, or not permitted, to acquire for holding within the scheme, so as to give effect to the parameters set under COBS 19A.4.3R; (2) requires the relevant third party to take all reasonable steps to rectify any breach of the parameters in (1); and (3) sets out what due diligence steps or other checks the relevant third party is required to undertake so as to enable the operator to comply with its relevant obligations under COBS 19A.3.4R. Checks of compliance with investment parameters 19A.4.5 R The operator must undertake checks at reasonable intervals on all assets held within the scheme which are managed by the relevant third party so to ensure that: (1) all assets reflect the parameters for permissible investments set by the operator; (2) the operator is able to: (a) give effect to the relevant third party’s obligation to take all reasonable steps to rectify any breach of the investment parameters, as per COBS 19A.4.4R(2); and (b) accurately calculate any capital requirements applicable to the operator under IPRU-INV 5.9. 19A.4.6 G In the FCA’s view, the checks in COBS 19A.4.5R should be undertaken on a quarterly basis. 19A.4.7 G (1) Where the operator identifies that the relevant third party has acquired one or more investments that are not permitted under the parameters the operator has set, it should take timely and appropriate action in compliance with its obligations under the rules set out in COBS 19A.1.5G – in particular, the operator’s obligation under the Consumer Duty to act in good faith and avoid foreseeable harm. (2) The operator should take particular care where the non-permitted investment that has been acquired by the relevant third party poses a high level of investment risk or carries high costs and charges, or affects the operator’s capital adequacy. (3) Steps the operator may take include but are not limited to: (a) restricting or terminating further dealings with the relevant third party; (b) assessing whether the investment should continue to be held within the scheme, in light of exit options; Page 16 of 51

FCA 202X/YY (c) escalating concerns to the operator’s senior management; and (d) considering, and taking appropriate steps to meet the information needs of affected clients. 19A.4.8 R The operator must additionally ensure its contractual arrangements with the relevant third party include a requirement that the relevant third party provide the operator with regular information to assist the operator in fulfilling its obligations under this chapter. 19A.4.9 G The operator should additionally consider whether to include in its contractual arrangements with the relevant third party a requirement on the relevant third party to indemnify the operator or a successor against all losses to the scheme arising out of, or in connection with, a breach of the parameters set out pursuant to COBS 19A.4.3R(1) or other obligations under the agreement. 19A.5 Governance, monitoring, and record-keeping Governance 19A.5.1 R (1) An operator must establish, implement and maintain due diligence processes, policies and internal monitoring and control mechanisms that are clear, effective and appropriate in light of its obligations under this chapter. (2) The operator must regularly review the processes, policies and controls in (1), at a frequency that is appropriate, having regard to the scale and nature of the operator’s business arrangements, the investments that are or may be held within the scheme under current arrangements and the risks to clients, and in any case at least once every 12 months. (3) Where the review in (2) identifies or suggests weaknesses or deficiencies in the operator’s due diligence processes, policies or controls, the operator must promptly take appropriate steps to address or remedy those weaknesses or deficiencies so as to ensure its ongoing compliance with its obligations under this chapter. (4) The operator must undertake the review in (2) promptly upon identification of any significant failure to comply with its obligations under this chapter – for example, where it becomes aware that a new investment was acquired and held within the scheme without undergoing due diligence. 19A.5.2 G As part of its compliance with COBS 19A.5.1R, the operator should: (1) establish internal benchmarking and indicators which reflect its business model and risk tolerance against which the operator may effectively measure the performance of its due diligence processes and controls in delivering the operator’s obligations under this chapter; and Page 17 of 51

FCA 202X/YY (2) consider what staff training and level of oversight by its governing body are required to enable and support the operator’s compliance with its obligations under this chapter. Monitoring 19A.5.3 R An operator must collect and review appropriate management information and use it to undertake an assessment of the effectiveness of the processes, policies and monitoring and control mechanisms in COBS 19A.5.1R(1) in ensuring compliance with COBS 19A.2.2R and COBS 19A.3.4R. 19A.5.4 G In undertaking the assessment in COBS 19A.5.3R, the operator should look to identify risks – for example, relating to a relevant third party – issues or trends where further investigation or remedial action may be required to ensure its processes, policies, and control mechanisms are appropriate to ensure compliance with COBS 19A.2.2R and COBS 19A.3.4R. 19A.5.5 G The management information in COBS 19A.5.3R should generally include at least the following: (1) the percentage of total investments which are subject to additional due diligence checks, as a share of the current value of investments held within the scheme in connection with self-investment options; (2) the percentage of investments subject to additional due diligence checks as a share of the current value of investments held within each client’s individual pot; (3) the steps and outcomes of the operator’s due diligence in respect of each investment, or type of investments (as appropriate), subject to additional due diligence, showing how the operator has satisfied itself that it has fulfilled its relevant obligations under this chapter; (4) the investments proposed to be held within the scheme and which the operator has: (a) concluded should not be permitted – where this is the case, the management information should include the reasons for this; or (b) otherwise identified as acquisitions that are not permissible; and (5) the information in (1) to (4) broken down by the relevant third party who introduced the client or relevant third party who proposed the investment, or any other relevant third party involved in proposing the investment. 19A.5.6 R An operator must ensure that its management information in COBS 19A.5.3R is: (1) updated periodically, with a frequency which is appropriate to the scale, nature and risks to clients of the operator’s business and, in any case, at least once every 6 months; and Page 18 of 51

FCA 202X/YY (2) carefully considered and reviewed by the operator following each update. 19A.5.7 R Following the review in COBS 19A.5.3R, the operator must ensure that reasonable steps are taken promptly to address any identified weaknesses or concerns about its processes, policies and controls in COBS 19A.5.1R. 19A.5.8 G As part of any action taken by an operator in accordance with COBS 19A.5.7R, an operator should consider whether it needs to notify the FCA of a breach of a rule for the purposes of SUP 15.3.11R(1)(a) and Principle 11. Record-keeping 19A.5.9 G (1) Firms are reminded of their obligations under SYSC 9 to keep sufficient records to enable the FCA to monitor or ascertain compliance by each firm with their obligations under this chapter. (2) The records in (1) should document, in particular, the operator’s due diligence processes, the outcomes of due diligence exercises on relevant third parties and on investments, investment parameters for relevant third parties (as applicable), written agreements with relevant third parties, and management information, including updates and revisions. 19A.5.10 R The operator must retain any records made in connection with the obligations in COBS 19A.5.3R, COBS 19A.5.6R and COBS 19A.5.7R indefinitely and make them available for inspection by the FCA on request. 19B Pension trustee money and asset handling rules 19B.1 Application 19B.1.1 R (1) This chapter applies to a firm which is the operator of a personal pension scheme in relation to scheme money and scheme assets where the money or asset is received, held, or handled by a scheme trustee. (2) Where the obligations on the operator as set out under the rules of this chapter in practice require action by a scheme trustee, or affiliated company, controlled by the operator, they are to be understood as obligations of the operator to ensure the scheme trustee takes the required action. 19B.1.2 G The analogous requirements in relation to client money and safe custody assets in CASS do not apply in relation to a scheme trustee as the scheme trustee is not a firm. Meaning of ‘client’ 19B.1.3 G For avoidance of doubt and in keeping with COBS 3.2.3R(2), references in this chapter to a client are references to a member (including a co-trustee) or beneficiary of the personal pension scheme, and not to the operator or a relevant third party, notwithstanding that there may be a client relationship between them. Page 19 of 51

FCA 202X/YY Purpose 19B.1.4 G (1) The rules in this chapter set out obligations on an operator to maintain robust systems and controls to ensure that scheme money and scheme assets are securely held, appropriately handled and accurately recorded at all times, so as to reduce, as far as possible, the risk of harm to clients’ individual pots. (2) These systems and controls should enable the operator to identify, keep track of and protect scheme money and scheme assets and support their timely transfer as needed, including in the event of the operator’s failure. 19B.2 Organisational and system requirements General 19B.2.1 R (1) An operator must establish and maintain appropriate organisational arrangements, systems, controls and procedures so as to minimise the risk of loss or diminution of scheme money or scheme assets or of any associated rights. This includes but is not limited to risks arising from misuse, fraud, poor administration, inadequate record-keeping and negligence. (2) The operator must keep scheme money and scheme assets segregated and separate from its own money or assets and must not use scheme money or scheme assets for its own purposes or any other improper purpose. (3) The operator’s internal organisation and systems must ensure: (a) effective oversight and control over directly held scheme money; (b) effective oversight over the arrangements under which relevant third parties hold, administer or manage indirectly held scheme money and scheme assets; and (b) accurate and current records of scheme money and scheme assets are kept for clients’ individual pots within the scheme. 19B.2.2 R As part of its compliance with COBS 19B.2.1R, the operator must ensure that, where scheme assets are held by a relevant third party, those assets are clearly registered as held for or on behalf of the scheme trustee. Operational oversight 19B.2.3 R An operator must allocate to a director or senior manager of sufficient skill and authority the responsibility for: (1) oversight of the operational effectiveness of the systems and controls the operator has in place to ensure compliance with the requirements in this chapter; and Page 20 of 51

FCA 202X/YY (2) reporting to the operator’s governing body in respect of that oversight. Policies and procedures 19B.2.4 R An operator must establish, implement and maintain clear, effective and appropriate policies and procedures designed to ensure compliance with the requirements set out in this chapter, including in relation to any services provided by a relevant third party, as described in COBS 19B.8. Such policies and procedures must at a minimum cover the following: (1) the frequency of the reconciliations the operator is required to carry out under this chapter; (2) the treatment of discrepancies and shortfalls under this chapter; (3) a risk management framework for identifying, assessing, monitoring and mitigating risks to the operator’s compliance with this chapter; and (4) the regularity with which the operator is required to review its arrangements for complying with this chapter. 19B.2.5 G See SUP 3.13.1R(4) for the FCA’s expectations around the use of a scheme report as a tool for evaluating the operator’s systems and controls. 19B.3 Allocation of receipts of scheme money 19B.3.1 R An operator must maintain appropriate processes which enable it, on an ongoing basis, to account for all receipts of scheme money for each individual pot . 19B.3.2 R (1) An operator must allocate any directly held scheme money to the relevant individual pot promptly and, in any case, no later than 10 business days after receipt or, where COBS 19B.3.3R applies, after its identification as scheme money. (2) Pending allocation to the relevant individual pot under (1), an operator must record the money received in its own records and accounts as unallocated directly held scheme money. 19B.3.3 R Where money is received into a scheme bank account and the operator cannot promptly determine whether it is scheme money, the operator must: (1) take all necessary steps to establish its correct status without delay; and (2) keep the full balance in the scheme bank account and separate from the operator’s own money and record it as unidentified scheme money until it completes the steps under (1), having regard to the need to ensure that any and all scheme money is adequately protected. 19B.3.4 R Where a client opts to make a contribution in the form of a cheque or other payable order, the operator must: Page 21 of 51

FCA 202X/YY (1) ensure the scheme money is paid in to a scheme bank account promptly and, in any event, no later than on the business day after it receives the money, and hold it in a secure location until then; (2) ensure the scheme money is allocated in accordance with COBS 19A.3.2R; and (3) record the receipt of the scheme money in the operator’s records and accounts in accordance with the requirements in COBS 19B.4. Interest 19B.3.5 R An operator must allocate any interest earned on directly held scheme money to an individual pot unless: (1) the operator has agreed otherwise in writing with the client; and (2) retaining all or part of the interest is compatible with the operator’s obligations under the Consumer Duty, where the client is a retail client. When scheme money ceases to be such 19B.3.6 R Scheme money will cease to be scheme money when it is: (1) due and payable to the operator for its own account; (2) paid out to the relevant client in benefits or paid out or transferred to another person pursuant to a court order (including a pension sharing order); (3) used to purchase or acquire a scheme asset upon the instructions, or with the specific consent, of the client, or within a mandate agreed with the client; (4) properly paid to a relevant third party for a service provided to the operator in respect of the scheme; or (5) otherwise paid or transferred in accordance with the relevant trust deed. 19B.4 Maintenance of records and accounts General requirements 19B.4.1 R An operator must establish and maintain its records and accounts in a manner that ensures their ongoing accuracy and completeness so as to ensure that the operator is able to: (1) ascertain the current total amount of directly held scheme money in each scheme bank account; (2) calculate the current total amount of scheme money within or corresponding to each individual pot within the scheme; and Page 22 of 51

FCA 202X/YY (3) distinguish scheme assets within or corresponding to one client’s individual pot from the scheme assets within or corresponding to any other client’s individual pot. 19B.4.2 G (1) An operator’s compliance with COBS 19B.4.1R should ensure that its records and accounts provide a complete, reliable and up-to-date audit trail for the handling of scheme money and scheme assets, and that they enable the operator to comply with the reconciliation rules in COBS 19B.5 and COBS 19B.6. (2) For the avoidance of doubt, the FCA acknowledges that records relating to indirectly held scheme money, may, for a limited period of time, contain a static figure pending receipt of the latest information in respect of indirectly held scheme money. However, the FCA expects that operators will update such records no less frequently than monthly. 19B.4.3 R The records and accounts created and maintained by the operator for the purposes of compliance with COBS 19B.4.1R must be separate and, so far as reasonably possible, independent from records, accounts or other data obtained from a bank or other relevant third party. 19B.4.4 G (1) The purpose of the separate records and accounts in COBS 19B.4.3R is to enable the operator to maintain effective oversight of scheme money and scheme assets held, administered or managed by the relevant third party, consistent with the organisational requirements in COBS 19B.2.1R. (2) While the operator may, in some circumstances, need to rely on information provided by a relevant third party to at least some extent for creating or updating its own records and accounts, the operator should ensure its reliance on that information is not unreasonable. (3) Arrangements between an operator and a relevant third party under COBS 19A.4 that enable or allow the relevant third party to carry out transactions in indirectly held scheme money or scheme assets without transaction-specific prior approval from, involvement of, or notification to the operator are an example of where the operator may need to rely on information provided by the relevant third party to update its records. (4) In the FCA’s view, the operator’s reliance on information obtained from a relevant third party is unlikely to comply with COBS 19B.4.3R where the information could reasonably have been obtained from a source independent of the relevant third party – for example, by ensuring that client instructions to the relevant third party, where applicable, are also communicated to the operator. Scheme asset specific holdings record 19B.4.5 R For each individual pot, the operator must create and maintain an accurate, complete and up-to-date holdings record of: (1) the total amount of scheme assets held for that individual pot; Page 23 of 51

FCA 202X/YY (2) the specific investments being held in that individual pot and their valuations; and (3) in relation to relevant third parties who hold, deal in, acquire or manage those scheme assets: (a) the name of each such relevant third party; and (b) the total amount of scheme assets held by that relevant third party for that individual pot. 19B.4.6 G (1) The obligation in COBS 19B.4.5R(2) is for the operator to record the identification and value of the specific investments held within each individual pot. (2) Accordingly, the operator will not satisfy the obligation in COBS 19B.4.5.R(2) where its records identify and value investments at the level of a tax, life assurance or other wrapper, or by reference to aggregate arrangements with a platform service or some other nominee arrangement, instead of identifying and valuing the specific investments underlying the wrappers or held within the service or arrangement. 19B.4.7 R The individual pot asset record in COBS 19B.4.5R must reflect a recent valuation of the scheme assets. 19B.4.8 G (1) The operator must ensure the valuation in COBS 19B.4.7R is reasonable, credible and sufficiently up to date. It must also ensure that the asset record for each individual pot includes any applicable caveats – for example, where the latest valuation of a scheme asset does not yet reflect a change in market conditions. (2) It is for the operator to consider how frequently it should obtain new or revised valuations for scheme assets, having regard to such factors as the investment’s liquidity, volatility and relevant market conditions. (3) For avoidance of doubt, compliance with the rules on external reconciliation of scheme assets in COBS 19B.6 does not require the operator to obtain an updated valuation of harder-to-value investments such as commercial real estate, unlisted equity or intellectual property rights on the same frequency as it undertakes the reconciliation itself. 19B.5 Scheme money – reconciliations Internal scheme money reconciliations 19B.5.1 R In this chapter: (1) ‘scheme money resource’ means the aggregate balance of scheme bank accounts and any amounts held by relevant third parties, calculated in accordance with COBS 19B.5.5R; Page 24 of 51

FCA 202X/YY (2) ‘scheme money obligation’ means the total amount of scheme money required to be held to fulfil obligations to clients, based on the aggregation of individual balances and calculated in accordance with COBS 19B.5.6R; and (3) ‘individual balance’ means, in relation to an individual pot, the net amount of scheme money attributable to that arrangement, calculated in accordance with COBS 19B.5.6R(2). 19B.5.2 G The purpose of an internal scheme money reconciliation is to check, by reference to the operator’s internal records and accounts, that the amount of scheme money held by or on behalf of the scheme trustee is sufficient to meet obligations to clients, as required by aggregating the relevant individual balances. 19B.5.3 R To carry out an internal scheme money reconciliation, the operator must: (1) calculate the scheme money resource in accordance with COBS 19B.5.5R; (2) calculate the scheme money obligation in accordance with COBS 19B.5.6R; (3) compare the scheme money requirement with the scheme money obligation to identify any discrepancies; and (4) treat any discrepancy identified as a result of (3) in accordance with COBS 19B.7.3R. 19B.5.4 R An operator must perform an internal scheme money reconciliation: (1) on each business day; and (2) based on the operator’s records and accounts as at the close of business on the previous business day. 19B.5.5 R An operator must calculate the scheme money resource by adding up the current aggregate balance of: (1) directly held scheme money; and (2) indirectly held scheme money. 19B.5.6 R An operator must calculate the scheme money obligation by following the steps in (1) to (5): (1) identify each client for whom the net amount of scheme money attributable to their individual pot is higher than £0; (2) for each client identified under (1), calculate the individual balance on their individual pot by: Page 25 of 51

FCA 202X/YY (a) adding the total amount of directly held scheme money allocated to the client’s individual pot in accordance with COBS 19B.3.2R; (b) adding the total amount of indirectly held scheme money attributable to the client’s individual pot; and (c) subtracting any amount due and payable by the client to the operator; (3) aggregating the positive individual balances calculated under (2); (4) adding any unallocated and unidentified amounts designated as scheme money, where applicable; and (5) include any directly held scheme money that is subject to a transaction where the operator has not yet remitted the money to, or to the order of, the relevant counterparty. 19B.5.7 G The amounts referred to in COBS 19B.5.6R(2)(a) should include any interest, cheques or payment orders attributable to the client’s individual pot. External scheme money reconciliations 19B.5.8 R (1) An operator must carry out, on a regular basis, reconciliations between its internal records and accounts and those of any relevant third parties that hold scheme money so as to ensure its internal records and accounts are up to date, accurate and consistent with the records and accounts of each relevant third party holding scheme money. (2) In carrying out each of the external scheme money reconciliations required under (1), the operator must compare: (a) for each scheme bank account, the balance recorded in the operator’s internal records and accounts with the balance shown in the most recent statement or other confirmation issued by the bank; and (b) for any indirectly held scheme money, the amount recorded in the operator’s internal records and accounts with the balance shown in the most recent statement or other confirmation issued by the relevant third party with whom the indirectly held scheme money is held. (3) The operator must promptly identify and resolve any discrepancies between the balances in accordance with COBS 19B.7.3R. 19B.5.9 R An operator must carry out an external scheme money reconciliation as regularly as necessary but, in any event, not allowing more than 1 month to pass between each external scheme money reconciliation. Page 26 of 51

FCA 202X/YY 19B.5.10 R When setting the regularity of external scheme money reconciliations, an operator must have regard to: (1) the frequency, number and value of transactions undertaken in respect of scheme money; and (2) the risks to which scheme money is exposed, including the nature, volume and complexity of the operator’s business and where, and with whom, scheme money is held. 19B.5.11 R (1) An operator must make and retain records sufficient to show and explain any decision it has taken under COBS 19B.5.10R when determining the frequency of its external scheme money reconciliations. Subject to (2), any such records must be retained indefinitely. (2) If any decision under COBS 19B.5.10R is superseded by a subsequent decision under that rule, the record of that earlier decision retained in accordance with (1) need only be retained for a further period of 5 years from the subsequent decision. 19B.5.12 G Where transactions in relation to directly held scheme money take place on a daily basis, the FCA would normally expect the operator to conduct an external scheme money reconciliation on each business day. Frequency of reconciliations following failure 19B.5.13 R (1) This rule applies to an operator in the event of a failure. (2) An operator must, as soon as reasonably practical after the failure, perform: (a) an internal scheme money reconciliation as at the time of the failure; and (b) an external scheme money reconciliation as at the time of the failure. (3) After carrying out the reconciliations in (2), the operator must perform further internal and external scheme money reconciliations as regularly as necessary so as to ensure that the operator is able to comply with its obligations under COBS 19B.4 (Maintenance of records and accounts). 19B.6 Scheme assets - record-keeping controls and reconciliations Record-keeping controls 19B.6.1 R (1) To support compliance with the operator’s record-keeping obligations in relation to scheme assets under COBS 19B.4.1R(3) and COBS 19B.4.5R, the operator must design its record-keeping processes, systems and controls in order to minimise the risk of inaccuracies. Page 27 of 51

FCA 202X/YY (2) The processes and controls referred to in (1) must be capable of at least the following: (a) testing the integrity of each individual pot asset holdings record created and maintained in accordance with COBS 19B.4.5R; (b) identifying discrepancies in the operator’s record-keeping processes, including over or understatement of scheme assets, negative balances and processing, journal entry or IT errors; and (c) ensuring that any data received from a relevant third party and relied upon by the operator for the purposes of complying with its obligations under this chapter is correctly received and accurately processed over the relevant period, and that weaknesses in the data are identified and addressed. Internal scheme asset reconciliation 19B.6.2 R (1) Where the operator opts to maintain an aggregate record of scheme assets as well as the individual pot asset holdings record required under COBS 19B.4.5R, it must compare the aggregate record of scheme assets against the individual pot asset holdings record and check that they match. (2) An operator must carry out the reconciliation in (1) as regularly as necessary but at least monthly. 19B.6.3 G (1) The purpose of the reconciliation in COBS 19B.6.2R is to ensure that the operator’s internal records and accounts of scheme assets are accurate and complete by checking that scheme asset balances recorded at aggregate level are fully supported by the individual pot asset holdings record. (2) An internal scheme asset reconciliation should be carried out using the operator’s internal records and accounts because the purpose of the reconciliation is to test the integrity of those records and accounts, rather than to compare them with records or statements obtained from banks or other relevant third parties that hold scheme assets, which is dealt with in the external reconciliations under COBS 19B.6.5R. External scheme asset reconciliations 19B.6.4 G The purpose of an external scheme asset reconciliation is to ensure the completeness and accuracy of the operator’s internal records and accounts of scheme assets by reference to the records and accounts of any relevant third parties that hold scheme assets (such as a custodian). 19B.6.5 R An operator must conduct, on a regular basis, reconciliations between its internal records and accounts of scheme assets against the records and accounts of any relevant third parties who hold scheme assets on behalf of the scheme trustee. Page 28 of 51

FCA 202X/YY 19B.6.6 R An operator must conduct external scheme asset reconciliations as regularly as necessary but, in any event, not allowing more than 1 month to pass between each external scheme asset reconciliation. 19B.6.7 R When setting the regularity of external scheme assets reconciliations, an operator must have regard to: (1) the frequency, number and value of transactions undertaken in respect of scheme assets; and (2) the risks to which scheme assets are exposed, such as the nature, volume and complexity of the operator’s business and where, and with whom, scheme assets are held. 19B.6.8 R (1) An operator must make and retain records sufficient to show and explain any decision it has taken under COBS 19B.6.7R when determining the frequency of its external scheme asset reconciliations. Subject to (2), any such records must be retained indefinitely. (2) If any decision under COBS 19B.6.7R is superseded by a subsequent decision under that rule, the record of that earlier decision retained in accordance with (1) need only be retained for a further period of 5 years from the subsequent decision. 19B.6.9 R In the event of a failure, an operator must: (1) as soon as reasonably practical after the failure, perform an external scheme assets reconciliation that relates to the time of the failure; and (2) perform further external scheme asset reconciliations as regularly as necessary thereafter so as to ensure that the operator is able to comply with its obligations under COBS 19B.4 (Maintenance of records and accounts). Verification of pension scheme assets in physical form 19B.6.10 R An operator must, at least once a year, verify that any scheme assets taking physical form and held in arrangements which are within the control of the operator are accurately and completely reflected in or match its internal records and accounts. 19B.6.11 G COBS 19B.6.8R is intended to ensure that any scheme assets taking physical form, such as original share certificates or title deeds, are checked against the operator’s internal records and accounts so that any discrepancy is identified promptly. 19B.7 Resolution of discrepancies and shortfalls Application Page 29 of 51

FCA 202X/YY 19B.7.1 R This section sets out the requirements an operator must follow where it identifies a discrepancy that results in, or reveals, a shortfall as a result of carrying out any reconciliation, or other verification or check, required under this chapter. 19B.7.2 R A shortfall for the purposes of this chapter is any amount by which the scheme money or scheme assets held by the scheme trustee, or by a relevant third party for or on behalf of the scheme trustee, is less than the amount of scheme money or scheme assets that should be held, in accordance with the operator’s records and accounts as required under this chapter. Scheme money discrepancies 19B.7.3 R Where an operator identifies a discrepancy between the scheme money resource and the scheme money obligation as a result of any reconciliation undertaken in compliance with the requirements set out in COBS 19B.5, or any other check or verification, it must: (1) promptly investigate the reason for the discrepancy and take appropriate steps to resolve it without delay, unless the discrepancy arises solely as a result of timing differences between the accounting systems of the party providing the statement or confirmation and that of the operator; and (2) take appropriate steps for the treatment of any shortfalls in accordance with COBS 19B.7.5R. 19B.7.4 R Where the discrepancy identified under COBS 19A.7.3R has arisen as a result of a breach of the rules in this chapter, the operator must also take appropriate steps to avoid a reoccurrence of that breach. Shortfalls – scheme money and assets 19B.7.5 R Promptly after identifying and investigating a shortfall in scheme money or scheme assets, the operator must consider and decide whether: (1) to use its own resources to resolve the shortfall itself, including (where relevant and where the operator is permitted to do so) by using its own resources; (2) where the operator reasonably considers that the shortfall has arisen due to a mistake or a breach of a relevant third party’s obligations, it will take reasonable steps to engage and cooperate with that relevant third party in order to resolve the shortfall; or (3) it will arrange for the shortfall to be resolved through a combination of (1) and (2). 19B.7.6 G (1) An operator may decide to resolve a shortfall itself under COBS 19B.7.5R(1), for example, where it considers it in the best interests of the clients to do so, even if it considers that another person is or may be responsible for the shortfall. Page 30 of 51

FCA 202X/YY (2) An operator’s decision to pursue a relevant third party for compensation so as to partially or fully resolve the shortfall should take into consideration the relevant rights and responsibilities arising under any contractual agreement with that relevant third party. (3) The factors to which an operator should have regard when determining who bears responsibility for a shortfall include: (a) whether it has identified any particular reasons for the shortfall – for example, misappropriation, scams or a fraud; and (b) the extent to which any acts or omissions by the operator or any relevant third party have caused or contributed to the shortfall arising, including, for example, human errors, security breaches or weaknesses in systems and controls. (4) An operator should consider whether it is appropriate to notify the FCA of the shortfall under Principle 11 and the requirements of SUP 15. 19B.7.7 R An operator must make a written record of its decision under COBS 19B.7.5R, including reasons for that decision, and of when and how the shortfall was in fact resolved. Unresolved shortfalls – notification requirements 19B.7.8 R If an operator foresees that a material shortfall in scheme money or scheme assets will not be resolved within a reasonable timeframe – for example, due to a protracted dispute with the relevant third party – it must, without delay: (1) decide whether it would be appropriate to notify each affected client in writing and, if so, the timing and content of that notification; and (2) notify the FCA in writing, setting out: (a) the reasons for the shortfall; (b) the amount of the shortfall and, if the shortfall is in scheme assets, the scheme assets involved; (c) the number of clients affected by the shortfall and, for each affected client, the impact of the shortfall on the client’s individual pot; (d) if applicable, the name of any relevant third party which the operator is holding responsible for the shortfall, whether in whole or in part, and the basis on which the operator considers it justified to hold that relevant third party responsible; (e) the operator’s expected timeframe for resolution of the shortfall, including detail on the steps which the operator and any relevant third parties intend to follow to achieve resolution; and Page 31 of 51

FCA 202X/YY (f) the approach the operator is taking in relation to client notifications under (a). 19B.7.9 R If an operator decides not to notify affected clients under COBS 19B.7.8R(1), it must keep that decision continuously under review until the shortfall in scheme money or scheme assets is resolved. Other notification requirements 19B.7.10 R An operator must inform the FCA in writing without delay if: (1) its internal records and accounts of scheme money and scheme assets are out of date, materially inaccurate or invalid; (2) it is unable to, or materially fails to, conduct an internal scheme money reconciliation in accordance with the requirements set out in this chapter; or (3) it will be unable, or materially fails, to conduct an external scheme money reconciliation or an external scheme assets reconciliation in accordance with the requirements set out in this chapter. Annual audit of compliance with trustee money and assets rules 19B.7.11 G Operators are reminded that the auditor of the operator is required to confirm in the report prepared in accordance with SUP 3.12 (Duties of auditors: notification and scheme report) that the operator has maintained systems and controls adequate to enable it to comply with the requirements in this chapter. 19B.8 Arrangements with relevant third parties: scheme money and assets Application 19B.8.1 R This section sets out the rules that apply where an operator: (1) opens or maintains a scheme bank account; (2) enters into or maintains business arrangements with a relevant third party for the provision of services that involve or include, or may involve or include, the handling by the relevant third party of indirectly held scheme money; or (3) enters into or maintains business arrangements with a relevant third party for the provision of services that involve or include, or may involve or include, dealing in, holding, or safeguarding scheme assets. 19B.8.2 G The rules in this section are intended to address the risk of loss or diminution of scheme money and/or scheme assets that may result from the appointment, particularly in cases where the relevant third party is not itself an authorised person, and/or is based overseas. Page 32 of 51

FCA 202X/YY Due diligence on relevant third parties holding etc scheme assets or money 19B.8.3 R The operator must ensure that accounts or other business arrangements with any relevant third party to accept deposits of scheme money, hold, deal in, or safeguard scheme assets, or hold or handle scheme money, are only opened, entered into or maintained, where the operator’s due diligence gives it reasonable assurance that: (1) this will not involve undue risk of loss of some or all of the scheme assets or scheme money; and (2) the relevant third party will provide the information and records that are reasonably required by the operator in order to comply with its own obligations under this chapter. 19B.8.4 G In complying with COBS 19A.8.3R the operator should consider, among any other relevant factors: (1) whether the relevant third party has the appropriate regulatory permissions for the services it would or does provide, either within the UK or in the jurisdiction in which it is based; (2) the robustness of arrangements that the relevant third party has in place for safeguarding the scheme money and scheme assets; (3) the expertise, capacity and capability, and market standing of the relevant third party in relation to the relevant services; (4) the capital reserves, financial resources and creditworthiness of the relevant third party; and (5) where the relevant third party is established outside the United Kingdom, the extent to which the local law and regulatory regime provide protections for money and assets. 19B.8.5 G The FCA would expect an operator to consider both the specific legal entity in question as well as that person’s group as a whole, where relevant. 19B.8.6 R The operator must undertake due diligence before the opening of the account or, otherwise, the commencement of the business relationship between the operator and the relevant third party, and at reasonable intervals thereafter. 19B.8.7 G While it is for the operator to consider the frequency of the periodic review required under COBS 19B.8.6R, having regard to what is reasonable and necessary in the circumstances, the FCA would generally expect such reviews to be carried out at least annually. Contractual arrangements with relevant third parties Page 33 of 51

FCA 202X/YY 19B.8.8 R An operator must ensure that a contractual agreement is put in place between the scheme trustee and any relevant third party approved or appointed to hold scheme money and/or scheme assets. This agreement should, as a minimum: (1) set out clearly the terms upon which the relevant third party holds assets; (2) set out clearly the services to be provided by the relevant third party; (3) remain in force for the duration of that arrangement; and (4) set out in a sufficient level of detail the information to be provided by the relevant third party, the frequency of its provision and the format in which it is to be provided to enable the operator to comply with its obligations relating to maintenance of books and records and reconciliation obligations set out in this chapter. 19B.8.9 G An operator should review carefully the terms of any agreement entered into with a relevant third party in accordance with COBS 19B.8.8R and satisfy itself that the arrangement is adequate to enable the operator to comply with its obligations under this chapter, including providing for: (1) the registration of scheme assets in the name of the scheme trustee in the relevant third party’s books and records; (2) appropriate restrictions on the circumstances in which the relevant third party may withdraw scheme assets from the relevant account; (3) the procedures (including appropriate authorities) for the passing of, giving and receiving of instructions to, or by, the operator; (4) the procedures for the claiming and receiving of dividends, interest payments and other entitlements accruing on the scheme asset; and (5) provisions allocating responsibility and liability for the loss of scheme money or a scheme asset arising from the fraud, wilful default or negligence of the relevant third party or any agent appointed by them. 19B.9 Record-keeping 19B.9.1 R Unless otherwise stated, an operator must ensure that any record made in accordance with the requirements of this chapter is retained for a period of 5 years starting from the later of: (1) the date it was created; and (2) if it has been modified since the date it was created, the date it was modified. 19B.9.2 R In respect of each reconciliation carried out, the operator must make a contemporaneous record of: Page 34 of 51

FCA 202X/YY (1) what kind of reconciliation was carried out and the date on which it was carried out; (2) the actions the operator took in carrying out the relevant process; and (3) a list of any discrepancies the operator identified, the action the operator took to resolve those discrepancies and when each discrepancy was resolved. Amend the following as shown. TP 2 Other Transitional Provisions (1) (2) (3) (4) (5) (6) TP Material to which the transitional provision applies Provision status Transitional provision Transitional provision: dates in force Handbook provisions: coming into force … 2.8J … … … … … 2.8K COBS 19A R (1) This rule applies during a transitional period commencing on [Editor’s note: insert the date on which this instrument is made] and ending on [Editor’s note: insert the date 12 months after this instrument is made]. (2) During the transitional period, an operator to whom the rules in COBS 19A apply (or would apply but for this rule): (a) must comply with COBS TP 2.8L; and (b) need not comply with any rule in COBS 19A except as required by COBS TP 2.8L. [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 12 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] Page 35 of 51

FCA 202X/YY 2.8L COBS 19A.2 R (1) This rule applies in relation to existing arrangements with relevant third parties as defined in COBS 19A.2.1R. (2) The operator must undertake the due diligence as required under COBS 19A.2 in [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 12 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] respect of each relevant third party with which it has existing arrangements. (3) The operator must consider, in light of the due diligence it has undertaken, whether continuing the business arrangements with the relevant third party is consistent with the operator’s regulatory obligations – in particular, under COBS 19A.2.2R. (4) Where the operator is not satisfied that continuing existing arrangements with a relevant third party would be consistent with its regulatory obligations, it must comply with COBS 19A.2.9R and COBS 19A.2.10R. (5) Where the operator is satisfied that continuing existing arrangements with a relevant third party is consistent with its regulatory obligations, it must ensure an agreement that complies with the requirements of COBS 19A.1.9R(1) and (2) is in place. Page 36 of 51

FCA 202X/YY (6) The steps in (2) to (5), as applicable, must be undertaken by [Editor’s note: insert the date 12 months after this instrument is made]. 2.8M COBS 19A.3 R (1) This rule applies in relation to existing investments held within the scheme at [Editor’s note: insert the date 12 months after this instrument is made]. (2) The operator must undertake the due diligence as required under COBS 19A.3 in respect of any further or additional acquisition of the investment (or, where appropriate, the type of investment) where the further or additional acquisition of the investment is proposed to be held within the scheme, treating it for the purposes of obligations in COBS 19A.3 as if it were an initial instance of the investment or, if appropriate, the initial instance of the type of investment. [Editor’s note: insert the date of the day after 12 months after this instrument is made] until indefinitely [Editor’s note: insert the date on which this instrument comes into force] 2.8N COBS 19A.4.3R(2) and COBS 19A.4.5R R (1) This rule applies in relation to business arrangements to which COBS 19A.4.2R applies that exist between the operator and the relevant third party (as defined in COBS 19A.2.1R) at [Editor’s note: insert the date 12 months after this instrument is made]. . [Editor’s note: insert the date of the day after 12 months after this instrument is made] until indefinitely [Editor’s note: insert the date on which this instrument comes into force] Page 37 of 51

FCA 202X/YY (2) COBS 19A.4.3R(2) is replaced with the following: ‘The operator must undertake the parameter￾setting exercise and comply with the other requirements in this section by [Editor’s note: insert the date of the day immediately before this instrument comes into force] before any further investments are acquired by the relevant third party to be held within the scheme.’ (3) COBS 19A.4.5R only applies in respect of new or further investments acquired on or after [Editor’s note: insert the date of the day after 12 months after this instrument is made], such that any previously acquired investments need not be checked against the investment parameters set in compliance with COBS 19A.4. 2.8O COBS TP 2.8K to COBS TP 2.8N G (1) COBS TP 2.8K disapplies COBS 19A during a 12-month implementation period, but allowing relevant rules to apply where switched on by COBS TP 2.8L. (2) COBS TP 2.8L requires the operator to carry out, during the implementation period, due diligence in relation to relevant third parties (as defined in COBS 19A.2.1R) with whom it [Editor’s note: insert the date on which this instrument is made] until indefinitely [Editor’s note: insert the date on which this instrument comes into force] Page 38 of 51

FCA 202X/YY has existing business arrangements. (3) COBS TP 2.8M modifies the rules in COBS 19A.3 so that additional or further acquisitions of an investment already held within the scheme (or of a type of investment already held within the scheme) are treated as initial instances of the investment in respect of which due diligence requirements apply under COBS 19A.3 with effect from the end of the 12- month implementation period. (4) COBS TP 2.8N requires that the operator set investment parameters with a relevant third party with whom the operator has existing business arrangements within the scope of COBS 19A.4 as of the end of the 12-month implementation period. The purpose of this transitional provision is to ensure that further acquisitions of investments by the relevant third party are governed by investment parameters set by the operator in the same way as if the business arrangements were newly entered into after the end of the 12-month implementation period. 2.8P COBS 19B R (1) This rule applies during a transitional period commencing on [Editor’s note: insert the [Editor’s note: insert the date on which this instrument is [Editor’s note: insert the date on which this Page 39 of 51

FCA 202X/YY date on which this made] until instrument instrument is made] until [Editor’s note: comes into and ending on [Editor’s insert the date 36 force] note: insert the date 36 months after this months after this instrument is instrument is made]. made] (2) During the transitional period, an operator to whom the rules in COBS 19B apply (or would apply but for this rule): (a) must comply with COBS TP 2.8Q, COBS TP 2.8R, COBS TP 2.8S and COBS TP 2.8T as applicable; and (b) need not comply with any rule in COBS 19B except as required by the transitional provisions in (a). 2.8Q COBS 19B.8 R (1) This rule applies during the first 24 months of the transitional period in COBS TP 2.8P. (2) The operator must ensure that any contractual arrangements entered into with a new relevant third party during the transitional [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 24 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] period comply with COBS 19B.8.8R. (3)The operator must by [Editor’s note: insert the date 24 months after this instrument is made] review and, if necessary, terminate and re-establish contractual arrangements with relevant third parties which are in place on [Editor’s note: insert the date on which this instrument is made] so as to ensure all those Page 40 of 51

FCA 202X/YY arrangements comply with the rules in COBS 19B.8.8R. 2.8R COBS 19B R (1) This rule applies during the first 24 months of the transitional period in COBS TP 2.8P. (2) The operator must, by [Editor’s note: insert the date 24 months after this instrument is made] put in place all organisational arrangements, systems, [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 24 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] policies, procedures, and internal governance arrangements to enable it to comply with all obligations in COBS 19B. 2.8S COBS 19B R (1) This rule applies during the first 24 months of the transitional period in COBS TP 2.8P. (2) Where, in the course of complying with COBS TP 2.8Q and COBS TP 2.8R, the operator identifies a dependency on any of its relevant [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 24 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] third parties which is sufficiently significant to prevent the operator from fully complying with COBS 19B by [Editor’s note: insert the date 24 months after this instrument is made], the operator must create and implement a clear and effective plan to resolve that dependency before the end of the transitional period in COBS TP 2.8P. 2.8T COBS 19B R (1) This rule applies during the final 12 months of the transitional period in COBS TP 2.8P. [Editor’s note: insert the date 24 months after this instrument is [Editor’s note: insert the date on which this Page 41 of 51

FCA 202X/YY (2) Subject to (3), the operator must comply with all obligations in COBS 19B during the period in (1). (3) Where an operator has established and is implementing a plan in accordance with COBS TP 2.8S(2) to resolve a dependency on a relevant third party, the operator may use the period in (1) to complete implementation of that plan. (4) An operator relying on (3) must continue to take all reasonable steps to comply with COBS 19B to the fullest extent possible whilst implementing the plan. made] until [Editor’s note: insert the date 36 months after this instrument is made] instrument comes into force] 2.8U COBS TP 2.8P, COBS TP 2.8Q, COBS TP 2.8R, COBS TP 2.8S and COBS TP 2.8T G (1) The effect of COBS TP 2.8P is to disapply COBS 19B during a 3- year transitional period, during which COBS 19B rules are replaced by the transitional rules in COBS TP 2.8Q, COBS TP 2.8R, COBS TP 2.8S and COBS TP 2.8T. (2) COBS TP 2.8Q requires the operator to revise its contractual arrangements with relevant third parties (including, if necessary, by terminating existing arrangements and setting up new ones) so as to ensure they are compliant with the requirements set out in COBS 19B.8.8 by the end of the 2-year transitional period. [Editor’s note: insert the date on which this instrument is made] until [Editor’s note: insert the date 36 months after this instrument is made] [Editor’s note: insert the date on which this instrument comes into force] Page 42 of 51

FCA 202X/YY (3) COBS TP 2.8R requires the operator to implement, during the first 2 years of the transitional period, any necessary changes to its internal arrangements so as to be ready to comply with COBS 19B. (4) COBS TP 2.8S is intended to ensure that, during the first 2 years of the transitional period, the operator identifies any significant dependency on a relevant third party that may prevent it from fully complying with COBS TP 2.8R. Where such a dependency is identified, the operator must put in place a clear and effective plan to resolve the dependency before the transitional period ends. (5) COBS TP 2.8T is intended to require an operator to comply with the rules in COBS 19B to the fullest extent possible over the final year of the transitional period. The only exception is where an operator has identified a dependency on a relevant third party in accordance with COBS TP 2.8S(2) and that discrepancy prevents compliance with a specific provision of COBS 19B. In that case, the operator may use the final year of the transitional period to complete implementation of the plan established to resolve that dependency. Page 43 of 51

FCA 202X/YY The operator should continue to comply with all other requirements in COBS 19B, in particular those relating to internally accessible information. … Page 44 of 51

FCA 202X/YY Annex C Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text, unless indicated otherwise. 3 Auditors 3.1 Application … 3.1.2 R Application sections (see SUP 3.1.1R) This table and the provisions in SUP 3 should be read in conjunction with GEN 2.2.23R to GEN 2.2.25G. In particular, the PRA does not apply any of the provisions in SUP 3 in respect of FCA-authorised persons. SUP 3.10 and SUP 3.11 are applied by the FCA only. (1) Category of firm (2) Sections applicable to the firm (3) Sections appliable to its auditor … (12) … … … (13) A firm which is subject to the rules set out in COBS 19B SUP 3.1 – SUP 3.7 SUP 3.13 SUP 3.1, SUP 3.2, SUP 3.8, SUP 3.12 … Insert the following new sections, SUP 3.12 and SUP 3.13, after SUP 3.11 (Review of auditor’s client assets report). All the text is new and is not underlined. 3.12 Duties of auditors: notification and scheme report Requirement to prepare a scheme report 3.12.1 R An auditor of an operator which is subject to the rules set out in COBS 19B must prepare a scheme report addressed to the operator’s governing body which: (1) addresses the matters set out in SUP 3.12.2R; Page 45 of 51

FCA 202X/YY (2) specifies the matters to which SUP 3.12.13R and SUP 3.12.14R refer; and (3) is prepared in accordance with a reasonable assurance engagement. Content and format of scheme report 3.12.2 R The auditor’s scheme report must state whether, in the auditor’s opinion: (1) the operator has maintained appropriate systems and controls to enable it to comply with the rules set out in COBS 19B throughout the period covered by the report; and (2) the operator was in compliance with the rules set out in COBS 19B as at the end of the period covered by the report. 3.12.3 R The auditor’s scheme report must be: (1) in the form prescribed by SUP 3 Annex 2; and (2) signed on behalf of the audit firm by the individual with primary responsibility for the operator’s scheme report and in the individual’s own name. 3.12.4 G SUP 3.12.1R provides that an auditor must ensure that a scheme report is prepared in accordance with the terms of a reasonable assurance engagement. The FCA also expects an auditor to have regard, as appropriate, to any material published by the Financial Reporting Council dealing specifically with the scheme report. In the FCA’s view, a scheme report prepared in accordance with any such material is likely to comply with SUP 3.12.1R and SUP 3.12.2R where the operator falls within its scope. 3.12.5 R (1) An auditor must ensure that the explanations provided to it by an operator in accordance with SUP 3.13 are included in the scheme report. (2) If, by the date on which the report is due to be submitted in accordance with SUP 3.12.7R, an auditor has not received the explanations referred to in SUP 3.13.1R, the auditor must submit the scheme report without that information, together with a short statement explaining why the information is missing. Period covered 3.12.6 R The period covered by an auditor’s scheme report under SUP 3.12.2R must end not more than 53 weeks after the period covered by the previous report on such matters, or, if none, after the operator becomes an authorised person or subject to the rules in COBS 19B, and its auditor becomes subject to SUP 3.12. Submission Page 46 of 51

FCA 202X/YY 3.12.7 R The auditor of an operator must submit its scheme report to: (1) the governing body of the relevant firm within 4 months of the end of each period covered; and (2) the FCA upon request. 3.12.8 R (1) If an auditor expects that it will fail to comply with SUP 3.12.7R(1), it must, no later than the end of the relevant 4-month period notify the FCA that it expects to be unable to deliver a scheme report by the end of that period. The report must be accompanied by: (a) a full account of the reasons for its expected failure; and (b) its proposed plan for submitting the report. (2) If an auditor fails to comply with SUP 3.12.7R(1), it must promptly notify the FCA of that failure, and ensure the notification is accompanied by a full account of the reasons for the failure and the auditor’s proposed plan for submitting the report. 3.12.9 R Following submission of a scheme report to the operator’s governing body in accordance with SUP 3.12.7R(1), the auditor must provide written confirmation to the FCA that the scheme report has been submitted to the operator’s governing body. 3.12.10 G The rights and duties of auditors are set out in SUP 3.8 (Rights and duties of auditors) and SUP 3.12 (Duties of auditors: notification and scheme report). SUP 3.8.10G also refers to the auditor’s statutory duty to report certain matters to the FCA imposed by regulations made by the Treasury under sections 342(5) and 343(5) of the Act (Information given by auditor or actuary to a regulator). An auditor should bear these rights and duties in mind when carrying out scheme report work, including whether any matters should be notified to the FCA immediately. 3.12.11 R An auditor must provide an operator with a draft of the scheme report in sufficient time to enable the operator to consider the auditor’s findings and to provide the auditor with comments of the kind referred to SUP 3.13.1R. Qualified opinions and identification of breaches 3.12.12 R If the auditor’s scheme report states that one or more of the requirements referred to in SUP 3.12.2R have not been met, the auditor must specify in the report each of those requirements and the respects in which they have not been met. 3.12.13 R (1) If an auditor identifies a breach of any of the requirements set out in COBS 19B, or of any other relevant rule, the auditor must ensure that the scheme report identifies each rule which has been breached. Page 47 of 51

FCA 202X/YY (2) If an auditor identifies no breaches, the auditor must ensure that the scheme report includes a statement to that effect. 3.12.14 R For the purpose of SUP 3.12.12R and SUP 3.12.13R, an auditor must ensure that the information prescribed under those rules is submitted using, respectively, Part 1 (Auditor’s opinion) and Part 2 (Breaches schedule) of SUP 3 Annex 2. 3.12.15 G (1) The FCA expects the list of breaches to include each breach of a rule in COBS 19B, or of any other relevant rule, insofar as that rule falls within the scope of the scheme report and is identified during the auditor’s review of the period covered by the report, whether identified by the auditor or disclosed to it by the operator, or identified by any relevant third party. (2) In determining whether to qualify its opinion or express an adverse opinion, the FCA expects an auditor to exercise its professional judgement as to the significance of a breach, taking into account its context, duration and any recurrence. The FCA also expects an auditor to consider the aggregate effect of any breaches when assessing whether an operator has failed to comply with the requirements set out in SUP 3.12.2R. 3.12.16 R If an auditor is unable to form an opinion as to whether one or more of the applicable requirements set out in SUP 3.12.2R have been met, the auditor must specify in the report under SUP 3.12.1R those requirements and the reasons why the auditor has been unable to form an opinion. 3.13 Scheme report: review, submission and notification Review of scheme report 3.13.1 R A firm to which this chapter applies must ensure that: (1) its auditor prepares a scheme report in accordance with the requirements set out in SUP 3.12; (2) it considers the draft report prepared by its auditor in accordance with SUP 3.12.12R in order to provide an explanation of: (a) the circumstances that gave rise to each of the breaches identified in the draft report; and (b) any remedial actions that it has taken or plans to undertake to correct those breaches; (3) the explanation provided in accordance with (2): (a) is submitted to its auditor in a timely fashion and, in any event, before the auditor is required to deliver a report in accordance with SUP 3.12.7R(1); and Page 48 of 51

FCA 202X/YY (b) is recorded in the relevant field in the draft report submitted to it by its auditor; and (4) it uses the scheme report as a tool for evaluating the effectiveness of its systems and controls for the purposes of complying with the requirements set out in COBS 19B.2. 3.13.2 G The FCA expects operators to ensure that the scheme report is integrated into the firm’s risk management framework and overall internal decision-making. 3.13.3 G SUP 3.4.2R provides that an operator must take reasonable steps to ensure that its auditor has the required skill, resources and experience to perform its functions. The FCA expects an operator to keep under review the adequacy of the skill, resources and experience of its auditor and critically assess the content of the scheme report as part of that ongoing review. Submission and notification 3.13.4 R A firm must ensure that the final scheme report delivered to it in accordance with SUP 3.12.7R(1) is reported to the operator’s governing body promptly after receipt. 3.13.5 R A firm must ensure that any scheme report which contains materially adverse findings is submitted to the FCA. 3.13.6 R A firm must submit any scheme report required to be submitted to the FCA in accordance with SUP 3.13.5R by electronic means made available by the FCA. Insert the following new annex, SUP 3 Annex 2, after SUP 3 Annex 1. All the text is new and is not underlined. [Editor’s note: The use of italics in the following provisions of SUP 3 Annex 2 indicate text to be completed in the Auditor’s scheme report and are not indicative of terms in the Glossary of definitions.] 3 Auditor’s PSMA report Annex 2 3 R Independent auditor’s scheme report to the governing body in respect of Annex [Firm name], firm reference number [number], for the period started 2.1 [dd/mm/yyyy] and ended [dd/mm/yyyy] Part 1: Auditor’s opinion We report in respect of [Firm name] (‘the operator’) on the matters set out below for the period started [dd/mm/yyyy] and ended [dd/mm/yyyy] (‘the period’). Page 49 of 51

FCA 202X/YY Our report has been prepared as required by SUP 3.12.1R and is addressed to the governing body of the operator. Basis of opinion We have carried out such procedure as we considered necessary for the purposes of this report in accordance with [specify standard/guidance used] issued by the [specify organisation name]. This opinion relates only to the period and should not be seen as providing assurance as to any future position, as changes to systems or control procedures may alter the validity of our opinion. Opinion In our opinion: [The operator has maintained] [Except for....the operator has maintained] [Because of….the operator did not maintain] systems adequate to enable it to comply with the rules contained in COBS 19B throughout the period since [the last date at which a report was made] [the operator was authorised] [the operator became subject to the rules set out in COBS 19B and we, its auditor, became subject to SUP 3.12].* [The operator was] [Except for…the operator was] [Because of….the operator was not] in compliance with the rules set out in COBS 19B as at the period end date.* Other matters The report should be read in conjunction with the breaches schedule that we have prepared and which is appended to it. [Our opinion expressed above does not extend to the breaches schedule.] [Signature of the individual with primary responsibility within the audit firm] [Typed name of signing individual] For and on behalf of [Name of the audit firm] [Registered office] [Date report] Instructions for Part 1

• If the auditor expresses an adverse opinion (ie, states the institution ‘did not maintain…’ or ‘was not in compliance…’) they must set out the reasons why. This can be done by reference to items in columns A to D in Part 2 of the auditor’s scheme report. Page 50 of 51

FCA 202X/YY If the auditor expresses a qualified opinion (ie, states that ‘except for …., the operator has maintained’ or that ‘except for …., the institution was in compliance’) they must do so by reference to items in columns A to D in Part 2 of the auditor’s scheme report. Part 2: Identified breaches that occurred during the period [Institution name], firm reference number [number], for the period started [dd/mm/yyyy] and ended [dd/mm/yyyy] In accordance with SUP 3.12.14R, Columns A to D are to be completed by and are the responsibility of the auditor. In accordance with SUP 3.13.1R, Column E should be completed by the operator. The auditor has no responsibility for the content of Column E. Column A Column B Column C Column D Column E Item No. Rule Reference Identifying breach Breach identified Firm’s comment 1 … Instructions for Part 2 In Columns A to D of the above schedule the auditor is to set out all the breaches by the operator occurring during the period subject to the auditor’s report. These must include the breaches the auditor has identified through its work (such as in the sample testing of reconciliations) and breaches identified by the operator or any other party (such as those included in the operator’s breaches register). In relation to any breach identified, the auditor must provide in Column D any information that it has as regards the context of the breach, the duration and any incidence of recurrence of the breach. The auditor must provide a ‘nil’ return for this part of the report where no COBS 19B rule breach has been identified. In Column E, the operator should set out any remedial actions taken (if any) associated with the breaches cited, together with an explanation of the circumstances that gave rise to the breach in question. Page 51 of 51

© Financial Conduct Authority 2026 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 1-009035 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts