Proposed regulatory framework for pensions dashboard service firms

Proposed regulatory framework for pensions dashboard service firms Consultation Paper CP22/25*** December 2022

2 CP22/25 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Moving around this document Use your browser’s bookmarks and tools to navigate. To search on a PC use Ctrl+F or Command+F on MACs. How to respond We are asking for comments on this Consultation Paper (CP) by 16 February 2023. You can send them to us using the form on our website. Or in writing to: Francesca Morphakis Financial Conduct Authority 12 Endeavour Square London E20 1JN Telephone: 020 7066 2409 Email: cp22‑25@fca.org.uk Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. Contents 1 Summary 3 2 The wider context 9 3 High level standards, supervision and enforcement 16 4 Prudential requirements and wind‑down procedures 32 5 Conduct standards 36 6 Senior Managers & Certification Regime 61 7 Dispute resolution 72 8 Authorisation 78 Annex 1 Questions in this paper 82 Annex 2 Cost benefit analysis 85 Annex 3 Compatibility statement 102 Annex 4 Abbreviations used in this paper 108 Appendix 1 Draft Handbook text Appendix 2 Draft Forms

3 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 1 Summary Why we are consulting 1.1 Pensions dashboards will be secure digital interfaces that allow consumers to find their pensions and view basic information about them. The Government has created the legislative framework for its pensions dashboard initiative and tasked the Money and Pensions Service’s (MaPS) delivery programme (the Pensions Dashboards Programme (PDP)) with setting standards for how dashboards should be delivered. 1.2 The Government intends to make us responsible for regulating commercial bodies that operate pensions dashboard services. It will achieve this by introducing a new regulated activity into the Regulated Activities Order (RAO). Once this legislative amendment is made, a firm wishing to operate and make a pensions dashboard service (PDS) available must: • be or become FCA authorised • obtain the regulatory permission to undertake the new regulated activity • meet our requirements for firms undertaking this activity 1.3 In advance of the RAO amendment, this paper sets out our proposed regulatory framework for this brand‑new market. 1.4 Executed well, pensions dashboard services have the potential to deliver genuine consumer benefits. The information shown to consumers on pensions dashboards will include administrative details, current value and an estimate of income in retirement – for all their pensions that are not yet in payment. Equipped with this information, consumers should be better able to plan for their retirement, get advice or guidance at the right time and ultimately make informed decisions. 1.5 These are good outcomes because we know consumers currently struggle to engage with pensions and often leave it very late to think about their retirement. There is also limited take‑up of advice or guidance. Based on data collected from all FCA regulated firms that provide pension and retirement income products, 53% of all pots accessed for the first time in 2021‑2022 were accessed without advice or guidance. Our Financial Lives Survey research (2020) shows that just 20% of active members have high levels of engagement with their defined contribution (DC) pensions. This means consumers might unknowingly save too little to meet their expectations in retirement or might not be able to make an informed decision on how to access their pension savings when the time comes. Pensions dashboard services will also help reconnect savers with lost pots, benefitting both individuals and the pensions industry. In October 2022, the Pensions Policy Institute estimated there were more than 2.8 million lost pension pots in the UK, worth an estimate £26.6 billion. 1.6 However, without a robust regulatory framework in place, consumers using pensions dashboard services would also be vulnerable to harms.

4 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 1.7 We want FCA authorised pensions dashboard services to be places where consumers can: • confidently and positively engage with their pensions, with a focus on planning for their retirement needs • be safely supported in retirement planning, with limited scope for becoming a target for scams or cross‑selling 1.8 Our proposals aim to strike an appropriate balance between protecting consumers and harnessing the opportunities dashboards create to engage savers with their pensions. The balance is a delicate one. 1.9 If our framework is too lax, consumers’ pensions information may be at risk and consumers could be led into making decisions which create poor outcomes in retirement. If our standards are too stringent, we may prevent desirable innovation that helps consumers, deter reputable firms from entering the market or limit beneficial opportunities for consumers to meaningfully engage with their pensions. 1.10 To achieve this equilibrium and while recognising that legislation bans firms from charging consumers to view their pensions information on a pensions dashboard, we propose to allow PDS firms to develop a range of business models that add services beyond the core ‘find and view’ function of a pensions dashboard. This will only be the case where the add‑on services: • have the potential to improve pension outcomes, and • meet rigorous conduct standards. 1.11 To help ensure users can trust these online pensions dashboard services, our proposals set clear expectations for the online journey a firm provides to a consumer and restrict how firms can use a consumer’s data. 1.12 To support innovation in the interests of consumers, we propose to frame our requirements primarily in terms of outcomes, rather than as prescriptive standards. 1.13 This is a new market, and a range of business models may emerge that could improve consumers’ engagement with their pensions. We foresee that PDS firms may wish to make their dashboard services more widely available by entering into arrangements with third parties, who in turn may wish to make dashboards accessible to their customers, employees or members, for example. It is our understanding that the regulated activity will allow for such arrangements while ensuring clear regulatory accountability of the dashboard operator. Who this consultation applies to 1.14 This consultation primarily affects firms interested in offering and making a pensions dashboard service available and who will need to get the new regulatory permission. This could include firms not currently FCA authorised and organisations regulated by other bodies, such as Master Trusts.

5 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 1.15 This consultation will also be of interest to: • bodies that want to help their customers or constituents to find and use a pension dashboard service (for example, employers and charities) • pension providers, trustees and administrators who will be supplying information to the dashboard services for their pension savers to view • individual consumers and bodies representing the interests of consumers 1.16 Other stakeholders who may be interested in our regulatory framework for pensions dashboard services could include individuals and firms providing advice, guidance and information on pensions and retirement planning. The wider context of this consultation 1.17 The ecosystem to which pensions dashboard firms will connect so users can find and view their pensions is outside our remit. How the ‘find’ process will operate and what information the user will be able to ‘view’ will be specified in: • Government regulations: the Department for Work and Pensions (DWP) consulted on these requirements in January 2022 and laid these regulations before Parliament in October 2022. • Binding standards: PDP, the dashboards delivery group, published most of these standards in November 2022. We refer to these standards as PDP’s standards, as they are published by the Pensions Dashboards Programme on behalf of MaPS. 1.18 PDS firms must comply with the relevant obligations in DWP’s regulations, DWP’s standards for state pension information and PDP’s standards. Our proposed regulatory framework complements standards set by the Government and PDP. We explain the interaction between these 3 sources of obligations in Chapter 2. What we want to change 1.19 The proposals in this paper broadly fall into 2 categories: • Requirements that are specific to this new activity, and the risks we consider firms undertaking this activity can pose to our strategic objective that markets function well. • Applying the minimum high standards we expect of all FCA regulated financial services firms to new firms undertaking this new activity. Firms that are already FCA authorised will be familiar with these expectations and how they apply in other parts of their business. Robust governance, systems, controls and oversight 1.20 Firms must have proper controls in place to manage risks. We propose to apply our Senior Managers and Certification Regime and our systems and controls rules on conflicts, risk management and outsourcing. We propose to apply these in a proportionate way to reflect that there will be no transactions or client money passing through dashboards and some firms in this new market may be relatively small. We provide further details in Chapters 3 and 6.

6 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Prudential requirements, resolution and redress 1.21 Consumers who suffer harm through the action or inaction of a PDS firm should be eligible for redress. So, PDS firms will be subject to our complaint‑handling requirements and dashboard users will also have recourse to the Financial Ombudsman Service. 1.22 At this stage, we are not proposing Financial Services Compensation Scheme (FSCS) cover for the new regulated activity as there are limited direct risks to consumers’ money from operating a pension dashboard service. We will keep this position under review as the market emerges and evolves. 1.23 Instead, the prudential requirements we outline in Chapter 4 are designed to ensure the PDS firm has adequate financial resources to meet redress liabilities and exit the market in an orderly fashion, should it need to. Specific standards: conduct standards to govern dashboard activities 1.24 In Chapter 5 we outline our key conduct proposals designed to give firms scope to innovate. This innovation must support consumers to continue their pensions engagement journey beyond seeing their basic pensions information. For example, these journeys could include tools, modellers and calculators, designed to enable the consumer to consider their pensions data in relation to their own needs and circumstances. 1.25 Our proposals set the minimum requirements. Firms must consider their obligations under other FCA rules, such as the recently finalised Consumer Duty. The Consumer Duty comes into force on 31 July 2023 for new and existing products or services that are open for sale or renewal. It includes requirements for firms to: • develop products and services to meet the needs, characteristics and objectives of a target market • provide appropriate information to enable consumers to make effective, timely and properly informed decisions • provide a level of support (before, during and after the sale of a product or service) that meets consumers’ needs on an ongoing basis • determine if the products and services offered to retail customers provide fair value Outcomes we are seeking 1.26 Below we outline some of the key outcomes we want to see from our proposals, categorised by the cross-cutting topline outcomes in Our Strategy with which they align: • Confidence. The scrutiny of our authorisations and permissions process gives consumers trust and confidence in using an FCA authorised pensions dashboard service to find and view their pensions. • Confidence and access. Users of FCA authorised pensions dashboard services know where and how they can access additional information, impartial guidance and financial advice.

7 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Suitability and treatment. FCA authorised pensions dashboard services offer innovative post‑view services that enable consumers to continue their pensions engagement journey in an informative and secure environment. • Fair value. Users of FCA authorised pensions dashboard services are made aware if, and how, they are paying for services on a dashboard beyond the core ‘find and view’ activity, which DWP’s regulations state must be free. This includes where payment takes the form of either personal or pensions data. • Fair value and confidence. Users of FCA authorised pensions dashboard services have a clear and easy route to redress should things go wrong. Measuring success 1.27 We consider our proposals to be compatible with the Government’s aim of making multiple pensions dashboards available to consumers and its long‑term objectives for the pensions dashboards initiative, which are to: • increase individuals’ awareness and understanding of their pension information and estimated retirement income to build a greater sense of individual control and ownership • reconnect individuals with lost pension pots • increase engagement, with more people taking advantage of guidance and financial advice • enable individuals to make more informed choices at the point of deciding how and when to access their savings 1.28 We will work with our delivery partners (Government, PDP, MaPS) and The Pensions Regulator (TPR) to collectively gather evidence to determine the extent to which these long‑term objectives are being achieved. 1.29 We consider success in terms of our regulatory framework for PDS firms will include: • multiple firms getting the new regulatory permission, with firms that cannot meet our standards and expectations denied the permission • authorised pensions dashboard services offering innovative, informative and safe ways for consumers to engage with their pensions and retirement planning • dashboard users seeking impartial guidance or regulated financial advice before making financial decisions 1.30 We expect pensions dashboard services to operate to high standards. So, an indicator of success will be that supervisory or enforcement interventions are rarely triggered, and complaint volumes are low. 1.31 In time, through a combination of regulatory reporting, record‑keeping requirements and PDP’s reporting standards, we will be able to gather data to assess changes in the evolving market, identify issues and take appropriate action on any potential poor conduct or other market risks. 1.32 Better consumer engagement with pensions is a long‑term endeavour. To measure progress against this objective, we will use relevant sources of data on financial markets and pensions engagement, such as our Financial Lives survey.

8 CP22/25 Chapter 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 1.33 As the market emerges and evolves, we will keep the regime under review to ensure that it continues to deliver good outcomes. Next steps 1.34 We invite your feedback on our proposals, including the draft Handbook text in Appendix 1. Please send us your comments by 16 February 2023. 1.35 When considering our proposals, we encourage stakeholders to also read: • PDP’s standards (data, technical, and reporting standards, plus the code of connection that encompasses security, service and operational standards) • PDP’s consultation on design standards • the Government’s response to its consultation on draft Pensions Dashboards Regulations 2022 1.36 We aim to publish our Policy Statement and finalised Handbook rules in Summer 2023. We aim to open the authorisations gateway shortly after we finalise the rules. Chapter 8 has more information on our authorisations and permissions process.

9 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 2 The wider context 2.1 In this chapter, we explain the role of different agencies in delivering the dashboard framework and how their standards and requirements fit together. We also explain our role in the pensions dashboards initiative. The pensions dashboards initiative 2.2 The Government owns and leads the pensions dashboards initiative. In 2019, it finalised the scope, design principles and anticipated outcomes for consumers. In 2021 and 2022, it established the legislative framework for pensions dashboards. To make pensions dashboards a reality, the Government also gave specific responsibilities to delivery partners. Money and Pensions Service (MaPS) 2.3 The Government tasked MaPS to: • Convene a delivery group (the Pensions Dashboard Programme (PDP)) to develop and implement the central digital architecture (CDA) that will enable dashboards to operate. The CDA includes the pensions finder service, consent and authorisation service, identity service and governance register. • Develop the required standards, specifications and technical requirements for all components and participants in the ecosystem. These include data, technical, design and reporting standards, alongside a code of connection. The code of connection encompasses security, service and operational standards, which are collectively designed to ensure the security, stability and effective operation of dashboards. • MaPS was also charged with developing a non‑commercial pensions dashboard service. A cross‑departmental team has been working to deliver this service as a digital entry point to other MaPS’ services, including MoneyHelper guides, directories, tools and calculators and guidance services such as Pension Wise. Financial Conduct Authority (FCA) 2.4 The Government placed a statutory duty on us to make rules requiring FCA regulated personal and stakeholder pension providers to provide information to pensions dashboards. In February 2022 we consulted on draft rules that corresponded, as far as appropriate, to the requirements for occupational scheme trustees in the Government’s draft Dashboard Regulations 2022. We published our final rules in November 2022. 2.5 The Government also committed to make the operators of commercial pensions dashboard services subject to FCA regulation. To deliver on this, the Government will soon propose a legislative amendment to introduce a new regulated activity. When made, this will mean that any entity (other than MaPS) that wants to operate a pensions dashboard service must:

10 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Be or become FCA authorised. Carrying on a regulated activity, or purporting to do so, without authorisation or exemption is a criminal offence. • Get the regulatory permission to carry out this specific activity. 2.6 Throughout this paper, we refer to authorised firms with this new permission as pensions dashboard service (PDS) firms. 2.7 We understand the new regulated activity to be introduced by the Government will include operating a pensions dashboard service and providing it to customers. This includes where a third party makes the dashboard available under an arrangement with the PDS firm. 2.8 This new regulated activity will bring within our regulatory remit the PDS firm that is connected to the CDA and through whose digital service the customer can request and see information about their pensions. We outline what information is available on a dashboard in Chapter 5. This pensions information is the customer’s ‘view data’. We refer to parts of the service through which the customer can request and get their view data as the ‘core dashboard’. 2.9 The proposals we outline in Chapters 3 – 8 of this consultation paper apply in respect of the core dashboard and permitted related services carried on by the PDS firm. By related services, we mean activities that are distinct from the regulated activity but are carried on in connection with it. We use the term ‘dashboard services’ in this paper to refer to both the core dashboard and any related services. 2.10 When we refer to ‘customer’ in relation to the regulated activity and related services, we mean a person who uses the services of a firm which carries on the new regulated activity. 2.11 This consultation paper focuses on our proposed regulatory framework for dashboard services offered by PDS firms. It covers: • the standards they will need to meet to either become and remain authorised, or get and keep the new permission • specific rules on how they undertake the new regulated activity • rules on related services connected to the new regulated activity 2.12 Dashboard services will be online or digital services. Our proposed framework has been devised on this basis. 2.13 The proposals in this paper are distinct from, and apply in addition to, the requirements proposed by the Government’s legislation, DWP’s standards on state pension information and PDP’s standards.

11 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms His Majesty’s Government

• Pension Schemes Act 2021
• Pensions Dashboards Regulations 2022
• Regulated Activities Order
• Standards on state pension information Pensions Dashboards Programme, established by the Money and Pensions Service
• Standards Financial Conduct Authority
• Handbook rules and guidance
• Application forms (authorisation and variation of permission) The overarching framework for firms operating pensions dashboard services The harms we are trying to reduce or prevent 2.14 Consumers who do not engage with their pensions during their working lifetime unknowingly run the risk of: • losing track of the pensions they hold • making false assumptions about the retirement lifestyle their pensions will fund • missing timely opportunities to improve their retirement outcomes by changing contribution levels or underlying investments • struggling to understand, or being overwhelmed by, the choices they need to make when they want to retire 2.15 Pensions dashboard services address these harms by making information more easily accessible. Dashboards reduce the time and effort for consumers to take the critical first step to get relevant information about their pensions. In this way, dashboard services remove an existing barrier to consumer engagement and may encourage previously deterred consumers to start engaging or engage further. 2.16 However, there is potential for consumer harm if those dashboard services are not appropriately governed. Our proposed framework is in addition to, and complements, requirements set by the Government and PDP. We outline in Table 1 below key elements of these requirements or processes and how they seek to mitigate potential harm.

12 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Table 1: Harms that are mitigated by Government and PDP requirements Potential harm Mitigant Source Rogue operators in the market Only FCA‑authorised pensions dashboard services, plus the MaPS dashboard, will be able to connect to PDP’s ecosystem. This is controlled by the PDP Governance Register. • Central digital architecture Consumers misunderstand pensions information (‘view data’) displayed on the core dashboard Standards will: • specify how dashboards present view data to users and the messaging that must accompany it • ensure dashboards present values consistently, accurately and clearly, and that information is not misleading • PDP’s standards • DWP’s state pension standards Consumers make irreversible transactions There is no transaction functionality in the central digital architecture. This means pension transfers and consolidation, for example, cannot be processed through the architecture. • Central digital architecture Consumers face high charges to use the core dashboard DWP’s regulations state that customers must not be charged to view their pensions information. • DWP regulations Consumers’ data is not secure PDP technical and security standards govern how data moves securely through the system. There will be no central repository of data in the PDP ecosystem. DWP’s regulations state the core dashboard must not store the view data other than in the form of temporary caching and only to display the view data in a single session. • PDP’s standards • Central digital architecture • DWP regulations Data is released to wrong person PDP identity service in the central digital architecture will confirm that user’s claimed identity actually belongs to them. Schemes and administrators will check the user has been through the consent and authorisation service and be confident when returning view data that they have correctly matched the data to the user. • Central digital architecture • Data providers The route to raise complaints or access redress is unclear Many parties are involved in processing each consumer’s request to find and view their pensions. If a consumer has a complaint or query about their experience or results, they may not know who they should contact. PDP is developing a central user support service to help consumers identify who might be able to consider their particular issue. All dashboard services must provide access to the central user support service. • Central digital architecture • DWP regulations 2.17 As well as these measures, our proposals in Chapters 3 – 8 of this paper aim to prevent the following harms for users of commercial pensions dashboard services. Harms that exist already, but where easy access to information about all a consumer’s pensions could increase the incidence and impact of those harms: • Dashboard users may become a target for investment scams. • Dashboard users may take irreversible action based on dashboard data alone without understanding the limitations of that information. For example, they may not understand they should consider additional important information before

13 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms making any financial or investment decisions, or that they could take advice or guidance. This could result in consumers entering or transferring into unsuitable products and even giving up important benefits. Harms inherent in permitting commercial parties to offer dashboards: • Dashboard providers may have commercial incentives to exploit consumer trust, information asymmetry and consumer biases to encourage activity that may not be in the user’s best interest. For example, cross‑selling products that offer less value for money than the user’s existing pensions. 2.18 Additionally, in outlining the design principles for the pensions dashboards initiative, the Government set a clear intention that consumers’ data should be secure and consumers should always remain in control over who has access to their data in the dashboards ecosystem. Our proposals are designed to ensure that the actions of PDS firms do not compromise this important protection against data theft and misuse. Our authorisations, supervision and enforcement regime 2.19 All firms that want to offer a pensions dashboard will need to get permission for the new regulated activity. Firms that are not currently FCA authorised can apply for this as part of their application for FCA authorisation. Firms that are already authorised will need to apply for a variation of permission. Chapter 8 gives more information on authorisations. 2.20 For a firm to make a successful authorisations application, it will need to demonstrate that it satisfies, and will continue to satisfy, the Threshold Conditions set out in the Financial Services and Markets Act 2000 (FSMA). These are the minimum standards a firm must meet to be authorised by us. 2.21 All applicants will also need to demonstrate that they meet, and will continue to meet, the standards of the Consumer Duty. For example, they will need to demonstrate: • how the Duty is embedded throughout their organisation • how they propose to monitor customer outcomes in line with the Duty • what processes they have in place to ensure they take appropriate action if they identify they are not delivering good customer outcomes 2.22 Appendix 2 includes our draft application forms (authorisation and variation of permission). We provide these now in draft so that: • Stakeholders can provide feedback on whether and why we should gather additional information to determine whether firms should be permitted to operate and make available a pensions dashboard service. • Potential applicants can start preparatory steps so they are well placed to complete the forms as soon as possible after the forms are finalised and the gateway opens. Early preparation could also include engaging with our Innovation Pathways service (see Chapter 5 for more information on Innovation Pathways).

14 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 2.23 We will supervise firms from the date we give them the new permission. Where necessary we will take appropriate supervisory and enforcement action against firms which do not comply with our rules. 2.24 We want to be as clear as possible with firms about what to expect when they interact with us. Through our supervision function, we maintain continued oversight of firms and of individuals controlling firms to reduce actual and potential harm to consumers and markets. The core elements of our supervisory approach are set out in our Supervision Manual. We discuss our approach to supervision and enforcement in more detail in Chapter 3. How it links to our objectives Consumer protection 2.25 The principal reason the Government committed to bring operators of commercial pensions dashboard services under our regulation was to ensure an appropriate degree of consumer protection. 2.26 Central to our framework is the expectation that authorised PDS firms will act fairly, honestly and professionally in consumers’ best interests and deliver good consumer outcomes. In line with our new Consumer Duty, our proposals emphasise that the services these firms offer must be fit for purpose, offer fair value and help consumers make effective choices or act in their own interests. 2.27 The proposals in Chapters 3, 6 and 8 set high standards for the parties entering this new market, so that consumers can have confidence in using their services. The proposals in Chapters 5 are designed to deliver on our strategic commitments that firms put consumers’ needs first and enable consumers to help themselves. The proposals in Chapters 4 and 6 are designed to minimise the impact of operational disruptions and reduce harm if things go wrong. 2.28 These proposals are among many measures put in place by delivery partners to ensure that the pensions dashboards initiative serves consumers’ needs and best interests (see Table 1 above). Competition 2.29 DWP’s regulations prevent PDS firms from charging customers to view their pensions information. Our proposals about the ‘post‑view services’ that PDS firms may offer are designed to allow firms to compete based on how effectively they innovate in the interests of consumers, and on the cost and quality of their services. 2.30 Pensions dashboards also have the potential to increase effective competition in adjacent markets – specifically among pension providers and among firms offering advice and guidance. The information provided on dashboards may increase consumer engagement. This engagement could drive effective competition and drive innovation in the interests of consumers by increasing pressure on providers and advisers to ensure that their products and services offer value for money and meet consumers’ needs and demands.

15 CP22/25 Chapter 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Equality and diversity considerations 2.31 We recognise that not all consumers will benefit from the Government’s pensions dashboards initiative. For example, as a digital solution, the digitally excluded will not be able to access pensions dashboards and consumers’ view data could become less comprehensive from age 55 as it will not include information about pensions from which benefits are in payment or have been paid. These are not consequences of the proposals in this paper but rather of the Government’s wider policy initiative. But we also note that pensions dashboards will not supersede existing mechanisms via which all consumers, including those with protected characteristics and characteristics of vulnerability, can currently request information about their pensions directly from their providers. 2.32 We do not consider that our proposals for regulating PDS firms materially impact any of the groups with protected characteristics under the Equality Act 2010. 2.33 However, we know that structural issues within society can influence good pensions outcomes. These include: • types of employment – self‑employed versus employed and the movement between the different types of employment • gender – the gender pay gap is reflected within pensions • ethnicity – with pensions participation varying across ethnicity • disability – which can lead to poorer pensions outcomes • other protected characteristics that cause pensions inequality 2.34 These factors can lead to lower incomes in retirement, lack of engagement with pensions and the risk of poor choices. Dashboard services may drive greater consumer engagement and empower consumers to make better informed decisions. 2.35 We will continue to consider the equality and diversity implications of the proposals during the consultation period and welcome your input. We will revisit the implications when making the final rules.

16 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 3 High level standards, supervision and enforcement 3.1 This chapter sets out which high‑level standards will apply to firms with the PDS permission. 3.2 We also summarise our proposed approach to supervision and enforcement, in line with our Supervision manual (SUP), Enforcement Guide (EG) and Decision Procedure and Penalties Manual (DEPP). High‑level standards 3.3 The FCA Handbook sets out rules and guidance we have made using the rule‑making powers given to us by the Financial Services and Markets Act 2000 (FSMA). 3.4 The Handbook is divided into sourcebooks which we refer to in this consultation with acronyms (for example, ‘PRIN’ and ‘SYSC’). For more information on the Handbook, please see our Handbook Readers Guide. 3.5 The Handbook includes high‑level standards. These standards provide firms with a clear statement of the standards of behaviour we expect from authorised firms and will help prevent the potential for harm in the new pensions dashboards market. 3.6 The key high‑level standards covered in this chapter are: • Principles for Businesses (PRIN). These are a general statement of the fundamental obligations that firms must comply with at all times. • Threshold Conditions (COND). These are the minimum conditions, set out in FSMA, which a firm is required to satisfy, and continue to satisfy, to get and keep its permissions. We provide guidance on these conditions in COND. • General Provisions (GEN). This sourcebook sets out some of the general standards that apply to all firms, including statutory disclosure statements and use of the FCA name or logo. • Systems and Controls. Our Senior Management Arrangements, Systems and Controls sourcebook (SYSC) sets out the organisational systems, controls and compliance arrangements that firms should have in place. • Fees. Our Fees Manual (FEES) sets out the fees that regulated firms have to pay. 3.7 There are some high‑level standards that apply to all FCA regulated firms and so will apply to all PDS firms. The Principles for Business, Threshold Conditions and General Provisions will apply to all PDS firms. 3.8 There are other high‑level standards, particularly SYSC, where the application of the sourcebook depends on the activities a firm carries out and any other permissions it holds. We set out below how we propose to apply SYSC to firms which only have the PDS permission (including the permission for agreeing to carry on the PDS activity and the proposed limited version of the making arrangements permission that would

17 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms apply only in relation to the additional services that we propose to permit a firm to offer on a dashboard). We refer to these firms in this paper as ‘PDS‑only firms’. We also set out below how we propose to apply SYSC to firms which hold additional permissions. Chapter 3, 5 and 6 cover this point in more detail. 3.9 We cover the application of the Senior Managers and Certification Regime (SM&CR) for PDS firms separately in Chapter 6. We also cover the Code of Conduct (COCON) and the Fit and Proper test for Employees and Senior Personnel (FIT) sourcebooks in Chapter 6. Principles for Businesses 3.10 Our Principles for Business (PRIN) will apply to all firms with the PDS permission. 3.11 PRIN sets out the fundamental obligations that FCA regulated firms must meet at all times. As well as setting out our overall expectations for firms, the Principles underpin other, more detailed, rules and guidance. A firm is liable for disciplinary sanctions if it breaches the Principles. 3.12 For new and existing retail business, the Consumer Duty will form part of PRIN from 31 July 2023. The Duty requires firms to act to deliver good outcomes for retail customers. All PDS firms will need to comply with the requirements of the Duty in respect of their dashboard services (both in providing the core dashboard and any related services) as dashboard users will be retail customers. 3.13 The Duty includes rules requiring firms to act in good faith, to avoid causing foreseeable harm and to enable and support retail customers to pursue their financial objectives. All PDS firms will also have to comply with the rules relating to the four outcomes we want to see under the Duty. These represent key elements of the firm‑customer relationship which are vital in helping to drive good outcomes for customers. The outcomes relate to: products and services, price and value, consumer understanding and consumer support. PDS firms should familiarise themselves with our expectations of firms under the Duty. Threshold Conditions 3.14 All firms must meet the Threshold Conditions to be authorised and must continue to meet the Threshold Conditions to remain authorised. This requirement is set out in FSMA. 3.15 All PDS firms should familiarise themselves with the Threshold Conditions sourcebook (COND). COND sets out our guidance on the Threshold Conditions that can help firms understand what is required and the impact of these conditions in more detail.

18 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms General Provisions 3.16 Our General Provisions (GEN) will apply to all firms with the PDS permission. GEN contains requirements covering the administrative duties that apply to the firms we regulate. These rules are designed to ensure consumers are not misled, that all firms operate on a level playing field and that firms are transparent about their regulatory status. 3.17 GEN contains: • a ban on firms claiming or implying we have endorsed their business • steps firms should take in emergency situations when they cannot comply with our rules • guidance on how to interpret our Handbook • rules on how firms authorised by us must disclose their regulatory status • restrictions on using our name and logo • a ban on taking out indemnity insurance against the risk of having to pay financial penalties • a ban on a firm that has entered into a contract with a consumer charging the customer more than a basic rate to call its telephone line 3.18 This is not a complete list, and we expect firms to familiarise themselves with GEN more broadly. Systems and Controls 3.19 Our Senior Manager Arrangements, Systems and Controls (SYSC) sourcebook sets out our rules and guidance about systems and controls. It also explains how firms should organise and manage their affairs. 3.20 Firms must have good organisational systems, controls and governance arrangements in place be effective and responsible. The rules and guidance in SYSC expand on Principle 3: ‘A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems’. They describe what we will expect from firms to comply with Principle 3. Those in charge of the firm should take responsibility for how it carries on its business, including acting in a way that enables us to monitor its business properly and to conduct its affairs responsibly. 3.21 We do not necessarily expect a firm dealing with a low number of customers to have the same systems and controls as a large provider. However, we do expect the same outcome, regardless of a firm’s size. 3.22 We propose that, in common with our approach to all FCA regulated firms, the application of SYSC to a PDS firm will depend on the activities a firm carries out and the permissions it holds. The broad application of the sourcebook is set out in SYSC 1.1A.1G. 3.23 Specifically, we propose that a firm which only holds the permission to carry on the PDS activity (which includes the permission for agreeing to carry on the PDS activity and the proposed limited version of the making arrangements permission that would apply in relation to the post‑view services we propose to permit a firm to offer on a dashboard) will be classed as a Limited Scope firm within the Senior Managers and

19 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Certification Regime (SM&CR). This means that these PDS‑only firms will have to follow the application of SYSC as it applies to ‘any other SMCR firm’ in SYSC 1.1A.1G. We provide details on the proposed application of the SM&CR to PDS firms in Chapter 6. 3.24 We anticipate there will be firms that hold the PDS permission alongside permissions for other activities. These other activities may bring the firms in scope of a different application of SYSC as set out in SYSC 1.1A.1G. We propose that these firms should follow the application of SYSC as it applies to those other activities. For example, we propose that a firm that is an insurer and holds the PDS permission will continue to follow SYSC as it applies to insurers. 3.25 Table 2 below summarises the key provisions that we propose will apply to PDS firms. It is not an exhaustive list and firms should familiarise themselves with the detail of SYSC. Table 2: Key Requirements in SYSC SYSC Chapter Key requirements and references SYSC 4 General organisational requirements A firm must have robust governance arrangements. (SYSC 4.1.1R) The senior personnel of a firm should be of sufficiently good repute and sufficiently experienced to ensure the sound and prudent management of the firm. (SYSC 4.2.1AG) A firm must allocate responsibility for ensuring that the firm complies with the regulatory system to those who direct the business. (SYSC 4.3.1R) SYSC 5 Employees, agents and other relevant persons A firm must employ personnel with the skills, knowledge and expertise necessary to discharge their responsibilities. (SYSC 5.1.1R) SYSC 6 Compliance, internal audit and financial crime A firm must have policies and procedures sufficient to ensure the firm complies with its regulatory obligations and to counter the risk that the firm might be used to further financial crime. (SYSC 6.1.1R) SYSC 7 Risk assessment A firm should establish, implement and maintain adequate risk management policies and procedures. This should include effective procedures for risk assessment, which identify the risks relating to the firm’s activities, processes and systems and, where appropriate, sets the level of risk tolerated by the firm. (SYSC 7.1.2AG) SYSC 8 Outsourcing A firm is responsible for the compliance of its outsourced operations. (SYSC 8.1.6G). We provide more information about outsourcing in Chapter 5. SYSC 9 Record‑keeping A firm must keep orderly records of its business and internal organisation to enable the FCA to monitor the firm’s compliance with regulatory requirements (SYSC 9.1.1R). We cover record‑keeping requirements in more detail below and in Chapter 5. SYSC 10 Conflicts of interest A firm must take appropriate steps to identify and to prevent or manage conflicts of interest between the firm and a client, or between two clients. (SYSC 10.1.3R) A firm must have arrangements to prevent these conflicts of interest from adversely affecting the interest of its clients. (SYSC 10.1.7R) If these preventative arrangements are not sufficient to manage the risks of damage, the firm must disclose the conflicts of interest to the client before undertaking business for them. (SYSC 10.1.8R) SYSC 18 Whistleblowing A firm must have appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers. (SYSC 18.3.1R) The FCA would regard as a serious matter any evidence that a firm had acted to the detriment of a whistle‑blower. (SYSC 18.3.9G)

20 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Systems to safeguard data 3.26 We consider there to be significant scope for consumer harm if customers’ personal or pensions information is compromised, such as being lost or misused. We are particularly concerned about the potential for harm, including fraud, if this information is not kept secure. We want to ensure firms have robust systems in place to safeguard this sensitive data. 3.27 So, in addition to existing provisions in SYSC, we propose a new rule in SYSC 4 for all PDS firms. SYSC 4.1.5AR will require these PDS firms to establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information. We think this additional rule will deliver a necessary level of consumer protection. 3.28 We propose that PDS firms must keep records of the systems and procedures they put in place to document compliance with this requirement. For more information on our approach to supervision, including reporting and record‑keeping requirements, please see paragraphs 3.43 – 3.66. 3.29 We also propose that PDS firms should notify us immediately in the event of an incident which may compromise the security, integrity and confidentiality of any personal or pensions information held by the PDS firm. Further details about this notification requirement are provided in Table 5 below. 3.30 This proposal is separate from, but builds on, requirements placed on PDS firms by PDP’s standards. While our proposals relate to a PDS firm’s systems, PDP’s standards place requirements on interfaces to the ecosystem and data moving within the ecosystem. PDP’s security standards (within the code of connection) require PDS firms to undergo an IT Health Check of the infrastructure and services they use to connect to the ecosystem. This must be carried out by an independent third-party scheme accredited by Council of Registered Ethical Security Testers (CREST). Q1: Do you agree with the way in which we propose to apply the Senior Management Arrangements, Systems and Controls (SYSC) sourcebook to pensions dashboard service (PDS) firms? Fees 3.31 We set out in this section our proposals for recovering the costs of introducing the new regulated activity and supervising PDS firms through application fees and periodic (annual) fees. Our approach to fees 3.32 FSMA allows us to make rules setting fees to meet the expenses we incur in carrying out our functions. We are funded entirely by fees and levies from the firms we regulate. We do not receive funding from other sources. We aim to structure our fees to distribute cost recovery fairly and consistently across regulated firms.

21 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 3.33 We have an annual cycle of consulting on fees. The cycle is as follows: • October – November: we consult on any changes to our policy on how we raise fees and levies. We give our feedback to the consultation responses in the Handbook Notice the following March. • January: we consult on the FSCS management expenses levy limit (MELL). This is a joint consultation with the Prudential Regulation Authority (PRA). We give our feedback to the consultation responses in the March Handbook Notice. • March – April: we consult on FCA periodic fee rates for the next financial year (which runs from 1 April to 31 March) and any proposed changes to application fees or other fees. We also consult on the Financial Ombudsman Service general levy, the Single Financial Guidance Body levies and illegal money‑lending levies for the next financial year. We publish our feedback to the consultation responses in a Policy Statement in June‑July. This Policy Statement covers final fees and levy rates. Application fees for PDS firms 3.34 We charge firms applying for authorisation a non‑refundable application fee to contribute towards the costs of processing the application. 3.35 To simplify our charges, we allocate applications for regulated activities to a scale of 10 pricing categories. The values of the categories may increase from time to time to keep them in line with inflation. The current values are set out in FEES 3, Annex 1A. 3.36 When we introduce a new regulatory regime, the application fees contribute towards recovering the project costs of establishing the new regime. We usually recover the balance of project costs through periodic fees in the first year of the new regime’s operation. 3.37 Although we expect the dashboard service market to be relatively small, we do not know for certain the size of this new market. Nor do we know when firms will apply for authorisation. For example, some interested parties might not apply when the authorisation gateway opens and instead might wait to see how the market develops before deciding whether to enter the market. So, we do not think it would be proportionate to recover project costs from PDS firms through their periodic fees in the first year of operation. We also think this would disadvantage firms which choose to enter the market first. Instead, we propose to recover a contribution towards the project costs through the application fee. So, we propose a category 5 application fee for PDS firms (currently £5,000) to cover both the costs of processing their applications and a fair and proportionate contribution to the recovery of our project costs. We do not consider a category 5 fee will deter new entrants. 3.38 As we explained in the Fees Policy Consultation Paper we published in November 2022, we propose to spread recovery of the balance of the project costs amongst the fee‑blocks containing firms which have a stake in the pensions dashboard regime: fee‑block A.4, which includes pension providers, fee‑block A.9, which includes fund managers and some pension providers and fee‑block A.13, which includes advisers and arrangers.

22 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Periodic fees for PDS firms 3.39 Firms we regulate pay an annual (periodic) fee, which covers the ongoing cost of supervising them. Firms with broadly similar permissions are grouped into fee‑blocks. We propose to create a new fee‑block (A.24) for PDS firms. 3.40 The fees in most fee‑blocks are graded according to the size of the fee‑payers, using a metric known as a tariff measure. The most common tariff measure is the firm’s income from regulated activities. This ensures the largest firms pay the highest fees. The FSMA fee‑blocks are defined in FEES 4 Annex 1A and the current fee rates are in FEES 4 Annex 2A. 3.41 As DWP’s regulations do not allow PDS firms to charge customers to use the core dashboard, we do not think income is an appropriate tariff measure to scale the periodic fees for the A.24 fee‑block. Instead, on the basis of our current assumptions about the market, we consider a flat‑rate fee of £10,000 will cover our average supervisory costs per firm. 3.42 We will keep the charge under review as the market develops. Meanwhile, we welcome views on the tariff measures we might consider in the future to take account of the scale of firms’ activities when calculating fees. Q2: Do you agree with our proposed approach to fees for PDS firms? Supervision and reporting 3.43 This section sets out the rules we propose to help us supervise PDS firms. This includes firms’ obligations to report key information, events and changes to us. 3.44 In line with the supervisory approach set out in our Supervision manual (SUP), we will analyse available data to identify poor conduct, weak financial resilience and areas of PDS firms’ operations which could result in harm to consumers and markets. Where we see indicators of systematic harm, we will move quickly. We have a range of supervisory tools to intervene and stop the harm occurring. We will then seek to ensure that the firm addresses the cause of the harm to prevent a recurrence. 3.45 We propose to apply the relevant sections of SUP to all firms with the PDS permission and require PDS firms to: • notify us of significant changes in their business • report to us key data on a regular basis • maintain adequate records to demonstrate compliance with the regulatory system 3.46 We invite stakeholders to comment on what data would provide us with the clearest insight on PDS firms’ behaviour and consumer trends, as well as the most proportionate way to collect the data. 3.47 Table 3 summarises key sections of SUP we propose to apply to PDS firms, or which will in any event apply where the sections are guidance on our statutory powers that apply to all firms. The list is not exhaustive, and firms should familiarise themselves with the detail of SUP.

23 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Table 3: Key Requirements in SUP SUP Chapter Key rule and references SUP 1A The FCA’s approach to supervision Sets out the relationship between the FCA and authorised firms, the ‘three pillar’ supervision model and the supervision tools we can use. SUP 2 Information gathering by the FCA or PRA on its own initiative The FCA can gather information in multiple ways: through meetings with firms, visits, information requests or mystery shopping. SUP 2 also explains the limitations of the FCA’s powers when accessing protected items or those subject to specific confidentiality. A firm must take reasonable steps to ensure that outsourced suppliers are open and co‑operative with the FCA’s information gathering work. SUP 5 Reports by skilled persons The FCA may appoint or require the appointment of a skilled person to provide it with a report. If a firm appoints a skilled person, they must require that person to co‑operate with the FCA and waive any duty of confidentiality. SUP 6 Applications to vary and cancel Part 4A permission and to impose, vary or cancel requirements This chapter explains: • how a firm might apply to vary or cancel its permissions • how a firm can apply to have a new requirement imposed on it or to vary or cancel a requirement • how the FCA will assess such applications SUP 7 Individual requirements The FCA can vary a firm’s permission to carry out a regulated activity and the FCA can set individual requirements and limitations on its own initiative. SUP 8 Waiver and modification of rules The FCA can waive or modify rules for firms if they have applied for or consented to those changes. This explains the procedure firms and the FCA must follow to do this. SUP 9 Individual guidance The FCA can give individual guidance to a firm. This chapter sets out the procedure for firms to get such guidance. SUP 10C FCA Senior Managers regime for approved persons in SMCR firms This chapter sets out the description of what each senior management function (SMF) under the SM&CR covers and which kind of function applies to which kind of SM&CR firm. It also sets out the way a firm must apply for the FCA’s approval for someone to perform a senior management function for the firm and other procedures and requirements for SMF managers. It only covers the FCA’s requirements, not those of the Prudential Regulation Authority (PRA). SUP 11 Controllers and close links A firm must notify the FCA in writing of a change of control. SUP 15 Notifications to the FCA Firms must notify the FCA either orally, in writing, or using a form (depending on the notification) about significant changes in business. SUP 16 Reporting requirements Sets out the information a firm should report to us on a regular basis. Q3: Do you agree with our proposed application of existing Supervision Manual (SUP) rules? Notification of significant changes in business 3.48 Principle 11 sets out that a firm must deal with the regulators in an open and cooperative way and must disclose to the FCA appropriately anything relating to the firm of which the regulator would reasonably expect notice.

24 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 3.49 As set out above, we propose to apply to PDS firms all notification requirements that apply to almost all FCA regulated firms. This means that PDS firms will have to notify us when there is a significant change in their business. 3.50 Table 4 below sets out existing notification requirements within SUP 15. Firms should familiarise themselves with SUP 15. Table 4: Existing notification requirements within SUP 15 SUP provision number Notification reason Notification method/timing 15.3.1R Matters having a serious regulatory impact such as failing to satisfy a Threshold Condition or any matter affecting the firm’s ability to provide adequate provision of services which could result in serious detriment to the consumer. Using the Notification Form, or if appropriate, telephone, as soon as the PDS firm is aware that event has or may have occurred or that it might occur in the future. 15.3.8G (Principle 11) Anything relating to the firm of which the FCA would reasonably expect notice, such as business restructuring or a significant failure in systems or controls. Orally or in writing within a time period depending on the event, but before making any internal or external commitments. 15.3.11R A significant breach of a rule or requirements in or under FSMA. Using the Notification Form as soon as the firm is aware, or has information which reasonably suggests, that such an event has, may have or might occur. 15.3.15R Civil, criminal or disciplinary proceedings brought against firm. Immediately. 15.3.17R A significant event involving fraud, errors or other irregularities. Immediately. 15.3.21R An event related to insolvency, bankruptcy and winding up. Immediately. 15.3.32R A significant infringement of any applicable competition law. Immediately on awareness or information reasonably suggesting infringement using Notification Form. 15.5.1R‑15.5.6R A change in name, address and telephone number. Reasonable advance notice using the Notification Form. 3.51 In addition to these notification requirements, we propose additional PDS‑specific notifications for all firms that hold the permission to undertake the new PDS activity. These event‑driven notifications target particular harms in the new market and will support our supervisory work. They will also help us understand the development of this new market.

25 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 3.52 We set out these additional PDS‑specific notifications in Table 5 below. Table 5: Specific notifications for PDS firms Handbook reference Proposed notification reason Notification timing and method SYSC 4.1.5CR The firm must notify us of any incident which may compromise the security, integrity and confidentiality of any personal or pensions information held by the PDS firm in its capacity as the operators of dashboard services. We outline below the details this notification must include. The incident • a description of the incident • the time of incident, where known • a description of steps the firm is taking following the incident, where applicable Immediately. The PDS firms must submit this information using a form on Connect. PDCOB 13.3 The firm must notify us of any changes to its third‑party arrangements. For example, if a firm enters into a new arrangement, terminates an existing arrangement or the details of an existing partner change. We outline below the details this notification must include. The change the firm is notifying us about • entering into a new third‑party arrangement • terminating an existing third‑party arrangement • updating the details of an existing third‑party partner The details of the third party Some of these fields might not be appropriate, depending on the third party. Where appropriate, details should be provided as registered with Companies House. The PDS will need to report the third party’s: • registered name • trading name(s) • registered company number • registered office • principal place of business • head office • website address • Firm Reference Number (in cases where the third party is an FCA authorised firm) • named contact and their contact details (email and telephone number) Where relevant, the Uniform Resource Locator (URL) where third‑party customers, employees or members can access the dashboard service. Only firms which enter into such arrangements will have to report these details. Our approach to where PDS firms enter into third‑party arrangements is covered in Chapter 5. Within 30 days of the event. The PDS firms must submit this information using a form on Connect.

26 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Handbook reference Proposed notification reason Notification timing and method PDCOB 13.4 The firm must notify us of any material changes to its post‑view services. For example, if a firm adds, removes or changes the substance of its post‑view service in such a way which impacts the customer’s experience of the post‑view service. We outline below the details this notification must include. The change the firm is notifying us about • adding a post‑view service • removing a post‑view service • a material change to a post‑view service, such as which impacts the customer’s experience of the post‑view service The details of the additional post-view service • a description of the post‑view service about which the firm is notifying us • a description of material changes to the post‑view service, where relevant • whether these changes are informed by user‑testing or complaints, where relevant Attestation The firm must also attest that it has considered whether it needs to vary its permissions as a result of these changes to post‑view services and has either: • Concluded that it does not. • Concluded that it does and has attained the necessary variation of permission (VOP). We will require firms to submit the date of their VOP. Only firms which offer post‑view services will have to report this information. Our approach to where PDS firms offer post‑view services is covered in Chapter 5. Within 30 days of the event. The PDS firms must submit this information using a form on Connect. PDCOB 13.2 The firm must notify us if it becomes aware of a scam relating to its dashboard, such as the existence of a clone dashboard or investment scams. We outline below the details this notification must include. The scam • a description of the scam • a description of any steps the firm is taking, where relevant Immediately. The PDS firms must submit this information using a form on Connect. 3.53 Upon receiving a notification from a PDS firm, we may ask the firm to supply further information, including sharing any relevant records the firm is required to keep to comply with its regulatory obligations. Q4: Do you agree with our proposed approach to notification requirements?

27 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Regulatory reporting requirements 3.54 To help us monitor and understand the new market, we propose a small number of regulatory reporting obligations for PDS firms. These are outlined in Table 6 below. Most FCA regulated firms are already required to submit these returns to us. Table 6: Regulatory reporting requirements SUP provision number Overview of reporting requirement SUP 16.4 Firm must submit annual controllers report. SUP 16.5 Firm must submit annual close links reports. SUP 16.7A Firm must submit annual reports and accounts. SUP 16.10 Firm must verify the firm’s details are accurate and up to date. SUP 16.12 Firm must submit a regulatory return to demonstrate compliance with Principle 4 and prudential requirements. We are proposing a new regulated activity group for PDS firms (RAG 13). We propose that PDS firms should use the new form in SUP 16, Annex 53A to submit this regulatory return. We provide guidance notes on completing the form in SUP 16, Annex 53B. SUP 16.26 Firm must report information about its Directory persons. 3.55 In addition to these regulatory reporting requirements in SUP, we propose that existing complaints reporting requirements in DISP (Disputes Resolution: Complaints sourcebook) apply to PDS firms. We outline complaints reporting in more detail in Chapter 7. 3.56 As well as these reporting requirements, we have proposed a number of record‑keeping requirements for PDS firms. We may look to turn these record‑keeping requirements into regulatory reporting requirements in future as the market develops. The section below provides further information on our record‑keeping proposals. 3.57 Separately, PDS firms will be required to report certain information to MaPS to support MaPS in monitoring the effectiveness and overall health of the pensions dashboard ecosystem. These requirements are set out in PDP’s reporting standards. Q5: Do you agree with our proposed approach to regulatory reporting? Record‑keeping requirements 3.58 All FCA regulated firms are required to keep orderly records of their business and internal organisation to enable the FCA to monitor their compliance with regulatory requirements and obligations to customers (SYSC 9). 3.59 In addition to records which firms are required to keep under SYSC 9, we propose bespoke record‑keeping requirements for all PDS firms. We specify these in the relevant chapters of this consultation paper where we outline the proposals to which these records relate. 3.60 To complement these rule‑specific record‑keeping requirements, we propose that all PDS firms must keep a record of their dashboard service customer journey for 6 years. This record must not include a customer’s personal data. A visual record would be an appropriate way of capturing each step (or page) of the customer journey. This

28 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms record must be updated when there is a material change to the customer journey. We recognise there will be some changes to the customer journey which are minor, such as updating the firm’s contact details or a formatting change. There will also be more substantive or material changes, such as adding or removing marketing from a dashboard service or adding functionality to the dashboard service. 3.61 We also propose to require firms to keep records of the volumes of activity on their dashboard services. Firms will have to keep records of the number of customers: • using the dashboard service • using a post‑view service • using all post‑view services (where the firm offers more than one post‑view service) • exporting their data to a) self, b) the firm and c) a connected person (where the PDS firm offers these options) 3.62 As well as the number of customers, we also propose to require PDS firms to keep records of the total volumes of activity, to capture repeat visits by the same customer. So, firms will have to keep records of the total number of times: • a post‑view service is used • all post‑view services are used (where the firm offers more than one post‑view service) • data is exported to a) self, b) the firm and c) a connected person (where the firm offers these options) 3.63 We anticipate that PDS firms will keep a record of this data for their own purposes and so we do not think it is onerous to require this. We think this aggregated data is important in understanding the development of the market, the number of customers using dashboard services and the ways customers use dashboard services. We propose these records must be kept for 6 years. 3.64 Where there is a third‑party arrangement, the PDS firm must keep a separate record for each third‑party dashboard provider and arrangement. See Chapter 5 for more details on third‑party arrangements. 3.65 Firms should note that we may request information from firms (and have powers to require it) so firms should make information from their records available upon request. 3.66 To clarify, we are not proposing to require PDS firms to keep records of any customers’ personal data. Q6: Do you agree with our record‑keeping proposals? Our approach to enforcement 3.67 This section explains why and how we enforce our rules. It outlines our powers, processes and the enforcement action we can take. 3.68 Our enforcement work aims to ensure there are real and meaningful consequences for firms and individuals who do not follow our rules and who cause actual or potential

29 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms harm to consumers. Our enforcement teams work closely with our authorisation and supervision functions, as well as with other regulators and law enforcement agencies to detect misconduct and unauthorised business. 3.69 FSMA sets out our enforcement powers, so we are not consulting on them. But we propose to apply the same approach to PDS firms when carrying out enforcement investigations, using sanctions and decision‑making, as we do with all other regulated firms. So, we propose to apply our Enforcement Guide (EG) and Decision Procedure and Penalties Manual (DEPP) to PDS firms. Opening an investigation 3.70 We will open an investigation if we suspect there has been serious misconduct. When we open an investigation, we do not assume there has been serious misconduct or that anyone involved in the investigation is guilty of misconduct. The purpose of the investigation is to get a clear understanding of the facts so we can decide whether, and if so, what, kind of action may be needed. 3.71 We have investigation powers which allow us to compel firms and individuals to give us information. These powers are set out in FSMA, and include the ability to: • require firms and individuals to give us information and documents • get a search warrant to search and seize documents • require individuals to give information in an interview 3.72 You can find more information about these powers in Chapter 3 of EG. See ‘More information about enforcement’ below. 3.73 When we have completed our investigation, we will determine whether there has been misconduct on the part of either a firm or individuals. Based on this, we will then consider the appropriate response. We can use a range of measures to best address a firm or individual’s wrongdoing. 3.74 Examples of our powers include the ability to: • censure firms and individuals through public statements • impose financial penalties • apply to the Court for an injunction to stop certain conduct or to freeze assets • seek an order requiring redress or restitution where the misconduct has caused harm to consumers • prosecute (in England and Wales) firms and individuals who carry out regulated activities without authorisation • withdraw a firm’s authorisation, preventing it from operating in financial services How we make decisions and impose penalties 3.75 DEPP sets out our policy and decision‑making procedures for giving statutory notices. These are warning notices, decision notices and supervisory notices. They set out our reasons for proposing and deciding to act. 3.76 DEPP sets out the framework we use to decide whether to impose a financial penalty and how we calculate the amount of penalty. There is no upper cap on the amount of the penalty we can impose. DEPP also sets out our policy on suspensions, restrictions

30 CP22/25 Chapter 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms and prohibitions, such as banning someone from holding any role in financial services. Chapters 6 and 6A of DEPP set out more information on these topics. Resolving and contesting cases 3.77 The FCA resolves many enforcement cases by settlement and Chapter 5 of DEPP explains the settlement process. In addition, we have a process in which a firm can contest some aspects of our case but still get some discount on the amount of our proposed penalty. This involves the firm entering a ‘focused resolution agreement’. This is explained further in Chapter 5 of DEPP. Generally, decisions on resolution will be taken by the Executive Directors in the FCA (‘settlement decision makers’), and our Regulatory Decisions Committee (the RDC) will decide any contested issues. 3.78 The RDC is a committee of the FCA’s Board but is separate from our executive management structure. Apart from the Chairman, the members of the RDC are not employed by the FCA and none of them will have been involved in the enforcement investigation. If the firm or individual disagrees with the RDC’s decision, they can refer a case to the Upper Tribunal (Tax and Chancery Chamber), and that Tribunal will consider it afresh. The Upper Tribunal is entirely independent from us. Chapter 3 of DEPP sets out more information on RDC. More information about enforcement 3.79 Our Enforcement Guide – This sets out our approach to enforcement and how we use our powers of investigation, gather information and investigate. It also sets out our approach to imposing financial penalties and other disciplinary sanctions, varying or cancelling a firm’s permissions, imposing prohibition orders on individuals, seeking injunctions and redress. 3.80 Explaining our approach to enforcement – in March 2018, we published our ‘Approach to Enforcement’ document. This explains how we address harm and add public value through our statutory powers to investigate and take relevant civil, criminal or disciplinary action. 3.81 We have also published a short enforcement information guide. It includes a flowchart that shows the process of a typical FCA enforcement case where we take action under FSMA for a breach of our Principles for Businesses and our Handbook rules. It sets out the options to contest or resolve a case, the opportunities to make representations and who the decision‑makers are. Q7: Do you have any comments on our proposal to apply the same approach to enforcement investigations and actions to PDS firms as we do to other regulated firms, as set out in our Enforcement Guide (EG)? Q8: Do you have any comments on our proposal to follow the same procedures for decision‑making and imposing penalties in relation to PDS firms and individuals set out in our Decision Procedure and Penalties Manual (DEPP)?

31 CP22/25 Chapter 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 4 Prudential requirements and wind‑down procedures 4.1 In this chapter, we set out our proposed prudential requirements for PDS firms. We also set out our proposals for the wind‑down procedures that PDS firms should follow if they plan to cease carrying on the PDS activity or are going out of business. 4.2 These rules are set out in PDCOB, the new Handbook sourcebook we propose to create for firms carrying out regulated pensions dashboard activity. Prudential requirements 4.3 Our approach to the firms we regulate prudentially is to focus on the harms they could cause to customers and markets. We set prudential requirements in proportion to the risk of such harm arising. 4.4 We believe that there is limited risk of consumer harm or market disruption if a PDS firm were unable to pay its operational expenses or failed financially. This is because PDS firms will not hold client money in connection with the specific PDS activity. Other dashboards and, as a minimum, the MaPS dashboard, will also be available as an alternative service. 4.5 So, prudential requirements for PDS firms will primarily be aimed at ensuring that a firm has adequate financial resources: • For contingencies, such as if software or systems need upgrading or otherwise repairing. • To exit the market in an orderly fashion, including safely disposing of any personal or pensions data it holds. • To meet the costs of any harms its causes. For example, paying redress liabilities, such as if data is misused or lost, perhaps because of a data leak. This is particularly important as we do not propose that FSCS cover should apply to PDS firms. 4.6 Our view is that prudential standards also help to drive the right kind of behaviour and ensure that firms have adequate resources to put things right when they go wrong. 4.7 We propose that PDS firms will need to comply with a: • general solvency requirement • core capital resources requirement 4.8 In addition to the proposals set out in this chapter, firms should also consider FG 20/1: Our framework on assessing adequate financial resources, which explains our approach to prudential regulation.

32 CP22/25 Chapter 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms General solvency requirement 4.9 All FSMA firms are required, under Principle 4 (‘A firm must maintain adequate financial resources’) and the Threshold Conditions (‘Appropriate resources’ (COND 2.4)) to have adequate financial resources. A key element of this is that the firm must, at all times, be able to meet its liabilities as they fall due. PDS firms will be authorised as FSMA firms and so subject to these requirements. 4.10 In addition, we propose to apply a general solvency requirement to PDS firms. This means that a firm must, at all times, maintain overall financial resources which are adequate, in both the amount and quality, to ensure there is no significant risk that the firm cannot meet its liabilities as they fall due. Firms will be expected to document in their records how they meet the general solvency requirement. 4.11 In common with our approach to other sectors, we are proposing Handbook guidance that as part of our day‑to‑day supervision of firms we may, in accordance with SUP 9.3, give a firm individual capital guidance, individual liquidity guidance, or both. This guidance would cover the amount or quality of capital or liquidity that we think a firm needs to hold to meet its general solvency requirement. 4.12 The Handbook guidance also explains that, if we are unable to agree with a firm on the level of capital or liquidity that it needs to hold to meet the general solvency requirement, we may instead use our powers to impose these on the firm by requirement. Core capital resources requirement 4.13 In addition to the general solvency requirement, we are proposing that PDS firms must hold additional capital resources to act as a buffer above their basic solvency. This follows our approach to our other prudential regimes, such as for insurance mediation (MIPRU 4), debt management firms (CONC 10), personal investment firms (IPRU‑INV 13) and claims management companies (CMCOB 7) and we consider this appropriate for PDS firms. Capital resources may include, for example, share capital, capital other than share capital, reserves, interim net profits, revaluation reserves and certain qualifying subordinated debt. 4.14 We propose that the core capital resources requirement for PDS firms should be £40,000. Firms must hold resources that are sufficient to meet this core capital resources requirement. 4.15 We recognise that the capital resources requirement in other Handbook sourcebooks generally works based on the amount being the higher of a relatively low fixed amount or an amount that scales upwards based upon the firm’s size, the complexity of its business and in proportion to its risk profile. For example, it may be linked to income, fixed overheads expenditure or volume of usage. However, we consider that it is currently difficult to calibrate a capital requirement to address the matters set out in paragraphs 4.4 – 4.6 for a new activity on a firm‑by‑firm basis when we do not yet have evidence based on business models or how the market will work. 4.16 Firms carrying out the nearest comparable activity, being a Registered Account Information Service Provider (RAISP) under the Payment Services Regulations 2017 (PSR), are not required to hold a capital resources requirement. These firms are instead

33 CP22/25 Chapter 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms required to take out Professional Indemnity Insurance (PII). We do not consider it appropriate to mandate PII at this point given the potential challenges for firms in getting PII to cover a new regulated activity. However, we encourage PDS firms to consider purchasing PII and cyber insurance cover as part of their risk management strategy. 4.17 As we set out in Table 5 in Chapter 3, we propose to require PDS firms to submit regular data to allow us to monitor their compliance with Principle 4 and prudential requirements. This reflects our approach to most firms we regulate prudentially. So, we are proposing amending SUP 16.12 to require PDS firms to submit this data to us. SUP 16 Annex 53A sets out the data items which we propose PDS firms must report to us. Guidance notes for completing the form are set out in SUP 16, Annex 53B. This data must be submitted half‑yearly and within 30 days of the firm’s accounting reference date. 4.18 Where a firm carries out other regulated activities in addition to the PDS activity, we propose that the firm will have to comply with whichever is the higher core capital resources requirement. Q9: Do you agree with our proposed prudential requirements for PDS firms? 4.19 We consider that a flat core capital resources requirement of £40,000 for PDS firms is a reasonable and proportionate starting point. We think it balances the issues set out in paragraphs 4.4 – 4.6 while not preventing smaller firms from being able to enter the market. However, we will keep this under review as the market develops, and welcome feedback as part of this consultation on how we might develop the capital resources requirement going forward. We also welcome feedback on whether there should be a liquidity requirement for PDS firms and, if so, how this might be calculated. Q10: Do you have any suggestions for how we might develop the capital resources requirement going forward, in particular to calibrate it to PDS firms as the market develops? Q11: Do you think there should be a liquidity requirement for PDS firms going forward and, if so, how this might be calculated? Wind‑down procedures 4.20 We expect firms we regulate to wind down in an orderly manner. An effective wind‑down plan aims to allow a firm to end its regulated activities and cancel its permission with minimal adverse impacts, such as disruption or reputational damage, on its customers, counterparties or the wider market. This includes scenarios where the firm undertakes a strategic exit as well as unexpected crisis or insolvency that makes the firm unviable. A wind‑down plan can also help a firm to assess if it would have adequate resources to wind down in an orderly manner, especially under challenging circumstances.

34 CP22/25 Chapter 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 4.21 We propose that PDS firms must prepare a wind‑down plan to facilitate an orderly wind‑down of the business and to minimise detriment. We may ask to see this plan as part of the authorisation application. In our Wind‑down Planning Guide (WDPG), we provide guidance to help firms develop an effective wind‑down plan. 4.22 PDS firms should consider the sensitivity of the data they hold and appropriate measures and protections for handling sensitive data on wind-down. They will also need to consider any relevant requirements in PDP’s standards or in legislation, such as UK GDPR. The Information Commissioner’s Office (ICO) has published guidance on deleting personal data. Q12: Do you agree with our proposed approach to wind‑down procedures for PDS firms?

35 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5 Conduct standards 5.1 This chapter sets out our proposed conduct of business rules for all PDS firms. Except where otherwise stated, these provisions will be included in the new PDCOB sourcebook for firms carrying on regulated pensions dashboard activity. 5.2 We understand the new regulated activity being developed by the Government is expected to include operating a pensions dashboard service and making it available to customers. We understand that the new regulated activity will focus on ensuring regulatory responsibility of the dashboard operator where a third party makes the dashboard available under an arrangement with the PDS firm. 5.3 This will bring within our regulatory remit the PDS firm that is connected to the CDA and through whose digital service the consumer can request and see information about their pensions (their view data). We refer to parts of the service through which the consumer can request and get their view data as the ‘core dashboard’. 5.4 The proposals we outline in this paper apply in respect of the core dashboard and permitted related services offered by the PDS firms. As explained in paragraph 2.9, where we use the term ‘dashboard services’, we are referring to both the core dashboard and any related services. We explain these related services in this chapter. 5.5 Our proposals aim to set high standards across dashboard services offered by PDS firms. Our proposals also aim to ensure that dashboard services enable consumers to: • confidently and positively engage with their pensions • be safely supported in retirement planning, with limited scope for becoming a target for cross‑selling or distracted from the pensions engagement mindset 5.6 So, we propose to: • Require PDS firms to disclose appropriate information, signposts and warnings. We want the consumer to always know with whom they are dealing, understand the risks of acting on dashboard data alone, and know where and how to get additional information and services. • Permit PDS firms to offer dashboard users the option of exporting their pensions information to themselves or to the PDS firm that is displaying their view data. We are proposing restrictions and controls designed to ensure export supports innovation in the interests of consumers and does not expose them to inappropriate levels of risk. • Offer PDS firms the scope to develop and offer innovative post‑view services to dashboard users. We want these services to support good customer outcomes and engage customers in either pensions or retirement planning. 5.7 DWP’s regulations permit PDS firms to offer ‘delegated access’. This is a function managed via the CDA through which customers can grant access for a MaPS guidance specialist or an FCA authorised person with the relevant permissions to advise on pensions (investments and/or transfers) to see the customer’s view data on the core dashboard. See p.109 of DWP’s consultation on the draft Pensions Dashboards Regulations for more information on delegated access. We do not want PDS firms to

36 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms be burdened with creating two dashboard service interfaces – one for customers, one for delegated access. So, we propose all our conduct rules and guidance will apply, regardless of whether the user is the customer or a delegate. General conduct of business rules 5.8 In common with our approach in many other financial services markets that we regulate, we propose to include rules to: • Require PDS firms to act honestly, fairly and professionally in accordance with the best interests of their customers. We consider this a key statement of firms’ overarching obligation to treat customers fairly and resolve conflicts appropriately. • Ban PDS firms from seeking to exclude or restrict any duty or liability to a customer, unless the duty or liability arises other than under our regulatory system and it is reasonable to do so. • Ban PDS firms from accepting payments or non‑monetary benefits which would conflict with the firm’s duty to act in the customer’s best interests. • Ban firms from charging customers (or entering agreements where a charge is, or may become, payable) for data export and post-view services unless the customer has actively opted-in. Q13: Do you agree with our proposals on general conduct of business rules? Disclosures, signposts and warnings 5.9 We want firms’ communications to support and enable customers to make informed decisions. We want consumers to be given the information they need, at the right time and presented in a way they can understand. 5.10 We outline in this section our proposals requiring PDS firms to communicate disclosures, signposts and warnings to dashboard users. 5.11 For the avoidance of doubt, a PDS firm must display these disclosures, signposts and warnings every time a customer uses dashboard services. It would be a breach of our rules to only display them the first time a customer uses dashboard services. 5.12 Our disclosure, signpost and warning proposals are format neutral. While the firm must communicate these during a digital customer journey, we do not propose to specify the medium or format in which they must be presented to the customer. For example, such communications could take the form of infographics, animations or static text. Firms should consider the most effective and engaging way of conveying information to customers. 5.13 Record‑keeping requirements: We propose to require PDS firms to keep records of all the disclosures, signposts and warnings they display to satisfy requirements in this section for 6 years.

37 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Obligations under the Consumer Duty 5.14 Firms must consider their obligations under the Duty, in particular the consumer understanding outcome when considering how to communicate the disclosures, signposts and warnings proposed below. 5.15 As well as ensuring individual communications are fair, clear and not misleading, PDS firms will need to consider their overall approach to communicating information. They must make sure they equip retail customers to make effective, timely and properly informed decisions. They should meet the information needs of their retail customers while not overloading customers with too much information. Under the Duty, PDS firms will need to monitor and test their communications, depending on their role in the distribution chain and the content of the communication and adapt their communications, so they can demonstrate they have acted to deliver this outcome and support their retail customers. Where this is not the case, the firm must take appropriate action to address the situation. 5.16 PDS firms must consider how they communicate with retail customers, ensuring that relevant information is provided at an appropriate time, through effective channels and in a way retail customers can understand. For example, firms should consider how they can avoid or explain industry jargon. 5.17 We do not propose to prescribe the wording of disclosures, signposts and warnings. Where PDS firms have discretion over the wording of communications, they should test relevant communications. Testing is an important part of the consumer understanding outcome in the Duty and embodies the Duty’s outcomes‑focused approach by placing emphasis on what works in practice. We have published non‑Handbook guidance which sets out guidance for testing communications to support consumer understanding. Firms must make changes to improve their communications if there are common areas of misunderstanding among retail customers identified through a firm’s testing or monitoring. 5.18 Monitoring is an important part of the Duty. A PDS firm must identify the needs, characteristics and objectives of the target market, including customers with characteristics of vulnerability. Firms must regularly monitor to determine whether their retail customers have been sold products which are designed to meet their needs, characteristics and objectives. Where this is not the case, the firm must take appropriate action to address the situation. About the firm and its dashboard service 5.19 Consumers need to know with whom they are interacting when they use dashboard services. So, we propose largely outcome‑focused rules that require PDS firms to disclose information about the firm and the dashboard service. This information must enable customers to: • Understand the nature of the dashboard services being provided. • Identify in advance where a charge is, or may become, payable for some aspect of the dashboard services, noting that DWP’s regulations prohibit PDS firms from charging customers to use the core dashboard. • Identify the PDS firm. This is particularly important where there is a third‑party arrangement and so the PDS firm may not be the entity with which a customer thinks they are interacting. See paragraphs 5.71-5.109 below for further details on third‑party arrangements.

38 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Understand the PDS firm’s regulatory status. • Communicate effectively with the PDS firm, including raising a complaint. 5.20 We also want customers to understand the limitations of the core dashboard and that a customer’s pensions might not all be displayed on a dashboard. So, we propose to require PDS firms to disclose that a customer might not be able to view all their pensions on a dashboard and to briefly explain why this might be the case. For example, if the scheme or provider is not connected to the ecosystem or if the customer has started taking their benefits. 5.21 We do not want this warning to discourage customers from using dashboard services. However, we want customers to understand whether using dashboards services is right for them. This will help set expectations and build trust in dashboards. For example, there is little value in a pensioner who has already started taking all their pensions using a dashboard. We think customers whose pensions will not be displayed on a dashboard service would be frustrated to start the dashboard journey, only for the limitations of dashboards to be disclosed later in the journey. 5.22 PDS firms must prominently disclose this information about the firm and the dashboard service in a manner that is easy to understand before the PDS firm passes the customer to the CDA to verify their identity and send a find request. About view data 5.23 In the context of the core dashboard, DWP’s regulations require PDS firms to display to the user the following basic information about the dashboard user’s pensions that are not yet in payment (this pensions information is referred to as view data): • basic administrative data, for example, details about the pension, the provider and, where applicable and known, details about the relevant employer • the current (accrued) value • projections of the value of the pension at retirement, where available • signposts to certain additional information, such as website addresses where members can access information on costs and charges and, where applicable, the annual report of the independent governance committee or governance advisory arrangement • contextual information 5.24 View data will be provided directly to the PDS firm’s core dashboard, in line with DWP’s regulations and PDP’s standards. DWP’s standards on state pension information and PDP’s standards will specify how the view data should be presented on the core dashboard and what additional information should accompany view data to ensure a consistent experience across all core dashboards. 5.25 In the main, view data is a narrow subset of the information that a consumer could expect to see on an annual benefit statement (where applicable) or get by contacting the provider directly. 5.26 Consumers need to understand the limitations of view data, so we propose that PDS firms must display a prominent warning communicating that: • Figures are indicative or estimated and not guaranteed. • Assumptions have been used to calculate figures.

39 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Figures may change (increase or decrease) and may be influenced by changes in investment performance, contributions and the date the user decides to take their pension. • View data is supplied for illustrative purposes. • More up‑to‑date figures and more details may be available from the pension provider or scheme administrator. • All figures are shown before tax. • Some pensions may not be displayed on a dashboard. For example, if a pension provider or scheme administrator is not connected to the ecosystem or if the customer has started taking their benefits. 5.27 We propose that the most appropriate time for the consumer to receive this warning is at the view data stage, to help moderate expectations and communicate the limitations of view data before a customer sees their pensions information. We welcome respondents’ thoughts on whether this is the most appropriate point in the consumer journey. 5.28 We recognise the potential for consumer harm if consumers are overwhelmed by warnings. We do not want to clutter the dashboard display with this warning once the consumer has read it. So, we propose to permit PDS firms to offer customers the option of dismissing, collapsing or hiding this warning. For the avoidance of doubt, it would be a breach of the rule for the warning to be hidden or similar by default, or for the PDS firm to collapse it if the customer has not taken a positive action to hide it. About decision‑making and further sources of information or support 5.29 We are concerned that consumers may take financial, and often irreversible, decisions on the strength of view data alone. Given the limitations of view data, this could potentially result in poor consumer outcomes. 5.30 So, we propose to require PDS firms to prominently display at every step of the dashboard service journey: • A warning that discourages consumers from making financial decisions based only on view data. • Signpost(s) appropriate sources of information, support and guidance. As a minimum, this must include signposting users to: – MoneyHelper resources and guidance – contact the pension providers or administrators of the relevant schemes if they want more information about that pension. 5.31 The only exception to this requirement is when the PDS firm or member of the same group is delivering investment advice as a post-view service. In this instance, the firm must not display this warning to that specific customer during an advice session but must display the warning at every other step of the customer journey. Q14: Do you agree with our proposals on disclosures, signposts and warnings? Q15: We want disclosures, signposts and warnings to be displayed at the most important moment for consumers. Do you have any evidence as to when PDS firms should communicate these disclosures, signposts and warnings?

40 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms When multiple parties contribute to bringing a dashboard service to market 5.32 We understand that the definition of the new regulated activity will not preclude authorised firms from involving third parties in bringing dashboard services to market. For example, through outsourcing or making legitimate dashboard services operated by regulated PDS firms available to consumers via third parties. 5.33 We want to avoid regulatory arbitrage and ensure that the consumer is no less protected if a third party is involved in the creation, development or route to market, of the dashboard services they use. Below we outline our expectations and proposed requirements for PDS firms entering such arrangements with third parties. Outsourcing functions to third parties 5.34 The FCA recognises the benefits that outsourcing and third‑party products and services can bring, such as cost savings, catalysing innovation and often providing greater resilience than firms’ own technology infrastructure. Outsourcing arrangements include where a service provider performs a process, service or activity which the authorised firm would otherwise carry out itself, on behalf of the authorised firm. In common with our approach to many other FCA regulated firms, PDS firms using outsourcing arrangements should reduce the risk of operational disruption and harm to their customers by effectively managing these service providers in accordance with our requirements in SYSC 8. 5.35 The PDS firm will not be permitted to delegate any part of its regulatory responsibility to a third party and will remain responsible for the compliance of its outsourced operations. It should: • Have sufficient oversight arrangements in place to be satisfied that all aspects of the outsourced function comply with the relevant regulatory requirements. This includes having appropriate people with sufficient expertise to oversee any functions that are outsourced. • Take responsibility for managing risk arising from those outsourcing arrangements. This includes identifying and managing the associated operational risks throughout the life span of third‑party arrangements from beginning to end. 5.36 Some PDS firms may hold certain other permissions which bring the firms in scope of a different application of SYSC to ‘any other SM&CR firm’ in SYSC 1.1A.1G. For example, a PDS firm that is also a life insurer. These firms will continue to follow a separate application of SYSC that applies to their existing business mix, rather than the SYSC 8 requirements summarised above. We provide more information on SYSC in Chapter 3. Further details on the permissions that a PDS firm may hold and remain a Limited Scope firm for SM&CR purposes are detailed below in paragraphs 5.83 to 5.85. Q16: Do you agree with our approach to outsourcing? Dashboard services made available by third parties 5.37 We anticipate that some PDS firms may wish to enter arrangements to make their dashboard services accessible to third‑party customers, members or employees. Examples could include white labelling, licensing, syndication or third‑party hosting. Such an approach will help consumers encounter dashboard services operated by

41 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms regulated PDS firms in a wide range of places, particularly where they have either existing or trusted relationships. 5.38 To avoid confusion, throughout this paper we use terms such as ‘third‑party arrangements’ or ‘dashboard service supplied to a third party’, to signify the types of arrangements described above in paragraph 5.37. 5.39 The third party in the arrangement may not be an FCA regulated or authorised firm. So, to ensure consumers can be confident using dashboard services made available by third parties, we propose to make PDS firms responsible for ensuring that the arrangement doesn’t create scope for consumer harm. 5.40 Where a PDS firm enters into third‑party arrangements, the PDS firm will remain responsible for complying with all regulatory responsibilities, including the actions of the third party in relation to the dashboard. We propose to require the PDS firm to satisfy itself before entering into a third‑party arrangement and routinely thereafter that a third party is a suitable and reputable entity through which to make its pensions dashboard service available. We also propose that before the third party is able to offer the dashboard to anyone, the PDS firm must ensure there is an enforceable, written agreement between the firm and the third party. The terms of this agreement must: • allow the PDS firm to monitor the third party’s operations • prevent the third party from making changes to the pensions dashboard service • prevent the third party from promoting or directing its customers, members or employees to the dashboard service supplied by the PDS firm in such a way that compromises any protections in our regulatory framework • prevent the third party from charging, or attempting to charge, a customer for any services connected to the dashboard • require the third party to comply with all regulatory obligations regarding the dashboard service • require the third party to indemnify the firm against all losses arising from, or connect to, the third party breaching the agreement • allow the PDS firm to terminate the third party’s access to the dashboard in specific circumstances of breach of the agreement (these are set out in detail in PDCOB) 5.41 As the PDS firm will remain responsible for complying with all regulatory responsibilities, we propose that the dashboard service supplied to the third party cannot be edited or altered by the third party. While the third party can suggest changes for the PDS firm to make to the dashboard service, it must be the PDS firm which makes any changes. 5.42 We want to ensure there are not ways for the third party to circumvent our requirements and protections when a customer accesses the dashboard service supplied to the third party. So, we propose that no other part of the third party’s website or similar is visible alongside the dashboard service on the screen. 5.43 To the extent that is currently foreseeable, these proposals limit the ability of a third party to cause consumer harm. However, as we cannot presuppose how this new market will develop or what business models will emerge, we propose that PDS firms will be responsible for ensuring that the third party complies with our requirements. 5.44 It is important that consumers know with whom they are interacting when using dashboard services made available by a third party. This information helps consumers

42 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms to make informed decisions about whether to use those dashboard services and how to interact with the PDS firm. So, as explained above in paragraph 5.19, we propose that PDS firms must prominently disclose to users that: • it is the PDS firm operating and making the dashboard service available, and not the third party • complaints about the dashboard services should be directed to the PDS firm, not the third party 5.45 Record‑keeping requirement: We propose that PDS firms must keep records of any third‑party arrangements into which they enter, including the contractual terms of agreements and any changes to these arrangements for 6 years. 5.46 We propose that a PDS firm must disclose, at the point of applying for authorisation or a change or permission, the details of any entities with which it has third‑party agreements, and the Uniform Resource Locators (URLs) through which consumers will access these third‑party dashboard services. 5.47 A PDS firm will also have to notify us on an‑going basis via Connect of any changes to its third‑party arrangements. For example, when it enters into a new agreement, or the details of an existing third‑party partner change. This notification must include the details of the third party and, where relevant, the URLs through which consumers access these third‑party dashboard services. See Table 5 in Chapter 3 for more information about notifications. 5.48 We outline in the relevant sections below additional rules for PDS firms which enter into third‑party arrangements. This includes requirements around any data export, related services and marketing. Q17: Do you agree with our proposals relating to where third parties make dashboard services available? Export of customers’ data 5.49 ‘Data export’ describes the process by which a customer’s view data is extracted or ‘exported’ outside the PDP ecosystem. 5.50 The Government concluded that the right to data portability under UK General Data Protection Regulation (UK GDPR) is not created when a consumer uses the core dashboard to find and view their pensions. This means it falls to the FCA to decide whether PDS firms should be permitted to offer any form of data export. 5.51 We have explored different types of data export and considered the extent to which each: • ensures consumers remain in control of how their personal and pensions data is processed • can ensure the data is used to support consumers in retirement planning • might result in consumers’ data either being misused or being handed to disreputable parties

43 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.52 So, we propose to permit PDS firms to take one of three approaches to data export. • Not offer data export. • Offer customers the option to export data to themselves. Many savers receive annual benefit statements for some, or all, of their pensions. In the main, these statements include considerably more information than will be displayed on dashboards. Legislation requires providers to supply these to consumers (hard copy, soft copy or online) at specified intervals. We consider it would be artificial and inconsistent to deny dashboard users the opportunity to get and keep a record of their view data. It may also lead consumers to use less secure means of capturing their data, such as taking screen shots. However, we recognise that some PDS firms may not wish to offer any data export functionality. • Offer the customer two options: export to self and export to the PDS firm used by the customer to view their data (or regulated firms within the same group with the permission to advise on investments, exclusively for the purpose of advising the customer). Industry representatives indicated in their responses to DWP’s consultation on the draft Pensions Dashboards Regulations and through industry forums that the primary benefit of permitting data export would be to auto‑populate tools, calculators and other services that a PDS firm may wish to offer its dashboard users to support retirement planning and engagement. 5.53 We propose to ban other types of data export. While some industry participants want consumers to have the option of exporting their data to all FCA regulated firms or indeed to any party the consumer wants, we consider the risk of consumer harm that attaches to these versions of data export outweighs the benefit. This is because: • Scammers would have an incentive to encourage consumers to export their data to them. • The use of exported data by parties other than PDS firms would not be subject to the controls and protections we can require when allowing export to PDS firms. There would be no assurance the exported data would be used in ways that support consumer engagement with pensions. • Depending on the party to whom the consumer wishes to export their data, the PDS firm might not be able to disclose to the consumer the purpose for which the data would be used. 5.54 Organisations which are not PDS firms may wish to offer consumers a pensions engagement or retirement planning service that is auto‑populated by, or otherwise uses, the consumer’s exported view data. In our view, these organisations should consider getting the new PDS permission, and following the corresponding rules. Q18: Do you agree with our proposal that data should only be exported to either the customer, the PDS firm, or a firm in the same group as the PDS firm with permission to give investment advice? 5.55 Although we are permitting versions of data export, we are setting expectations and requirements to prevent poor consumer outcomes when firms offer this related activity. 5.56 PDS firms should also familiarise themselves with any obligations within UK GDPR (which is in the remit of the ICO) and how these will apply to their PDS business.

44 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.57 We propose to supplement existing data legislation in a manner we consider necessary and proportionate to protect consumers who export data about the pensions they, and in many cases, their employers, have contributed to across their entire working lives. We outline our proposed conduct rules for firms processing data in this way. 5.58 PDS firms will also need to consider the Consumer Duty, which is due to come into force on 31 July 2023 for new products and services (and existing products that continue to be open for sale). The Duty’s price and value rules require firms to consider non‑financial costs to consumers when assessing the value of a service. An example of a non‑financial cost relates to consumers’ provision of personal data and the way firms subsequently use it. Firms must take account of this cost when considering if their service offers fair value. Firms must also act in good faith and avoid causing foreseeable harm to retail customers, including when considering the use of their customers’ personal data. 5.59 We propose below restrictions on how PDS firms can process customers’ personal data. These restrictions do not extend to data which is not personal data and from which individual customers cannot be identified. For example, operational data such as management information (MI) which is generated by customers using a dashboard may not contain personal data. Management information could include the number of customers who choose to export their data or how long customers spend on the different stages of the dashboard service customer journey. We anticipate that firms will want to use this operational data to assess the performance of the dashboard service and for research purposes to develop new products and services. We do not propose to set requirements on how firms use this operational data but, where any data includes or constitutes personal data, PDS firms will need to comply with the relevant obligations in data protection legislation. Rules on data export to customer 5.60 Data export to the customer takes place when the customer agrees to the PDS firm processing the view data and either sending the customer a copy or permitting the customer to download a copy. The proposed conduct rules outlined in this section deal with anticipated consumer harm that may arise if we do not place protections around data export.

45 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.61 Our proposed conduct rules in Table 7 below apply in addition to the requirements in existing legislation, such as UK GDPR. Table 7: Requirements when exporting data to consumers Desired outcome Our proposals The consumer must be given appropriate information to make an informed decision. PDS firms must get a user’s agreement before exporting view data. PDS firms must provide the consumer with appropriate information to help them make an informed decision. This information must be communicated in a fair, clear and not misleading way. It must include the name of the data controller who will be processing the data and the purpose for which the data is being processed (by which we mean, to provide a copy to the customer). When providing this information, PDS firms should bear in mind our proposed rule which requires the firm to prominently disclose to the customer if there is a third‑party arrangement. When getting a user’s agreement, the PDS firm must not: • use defaults (such as pre‑ticked boxes) • bundle this agreement (such as asking the customer to agree to their data being added to the firm’s marketing database at the same time as asking the customer to agree to data export) • make data export a pre‑condition of using a dashboard We do not propose to prescribe the wording of the message. However, firms should consider their obligations under the Consumer Duty’s consumer understanding outcome when obtaining customers’ agreement to data export. The data must be securely transmitted to the customer. PDS firms should transfer the data by secure means. PDS firms must warn consumers of the security risk of exporting their data to a shared device. The customer’s copy of the data must be easy to read. The customer copy must be in an accessible format which is useful to the customer and which the customer can read and understand. It must not, for example, be a string of code which is unreadable to a member of the general population. Firms should also consider any accessibility obligations in legislation. The customer’s copy of the data must be useful to the customer. The customer copy must include: • all the information that is shown to the consumer at the view stage, including any display explanations and contextual information required by PDP’s standards and DWP’s standards on state pension information • warnings against making decisions based on view data alone (see paragraph 5.30) • signposts to source of additional information, guidance and how to find regulated advice (see paragraph 5.30)

46 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Desired outcome Our proposals The customer must be made aware of scam risks when looking at their data or considering sharing it with a third party. We recognise that consumers may choose to send their data to a third party. We cannot control with whom consumers choose to share their data. However, we propose that the PDS firm must include warnings in the customer copy of the data, including a: • Warning about scams. Firms must warn customers that, if they are asked to discuss or share data with a third party, they should: • Check the party is who they say they are. • Use the FCA Register to check whether any claim to be authorised or exempt is true. • Warning targeted at the particular risk of data sharing. This warning should remind customers: • Their view data is sensitive and valuable. • They should keep their data safe. • To think carefully about whether the third party really needs to see the data. • Signpost to our ScamSmart campaign We do not propose to prescribe the wording of these warnings. However, firms should consider their obligations under the Consumer Duty’s consumer understanding outcome when communicating warnings. Limit scammers’ ability to initiate irreversible transactions if they get the customer copy. PDS firms must only export part of the customer’s pension reference, so that: • it is an inadequate field with which to initiate a transaction, but • the consumer can still cross reference and match with any other records. We have suggested in Handbook guidance that exporting only the last four digits/characters would be appropriate, but we welcome views on how else this data item should be redacted to achieve the desired outcome. 5.62 Record‑keeping requirement: We propose that PDS firms must keep records of how they obtain users’ agreement to data export, including the content of messages. We also propose that firms should keep records of the warnings displayed to customers as part of the data export journey. These records must be kept for 6 years. Rules on data export to PDS firm 5.63 Data export to a PDS firm occurs when the customer consents to the PDS firm processing the view data to transfer it to the PDS firm’s systems outside the PDP ecosystem. 5.64 We propose that PDS firms must only process customers’ personal or pensions information to deliver post‑view services which engage customers in pensions or retirement planning. These post‑view services should support good customer outcomes. PDS firms will not be permitted to process customers’ personal or pensions data for other purposes (other than as explained in Table 8). 5.65 We do not think it is in most customers’ interests for data to be shared with third or fourth parties, other than with a connected person with permission to advise on investments – and only if the PDS firm has the customer’s agreement to do so. We want sufficient supervisory oversight of the firms processing customers’ pensions information.

47 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.66 The proposed conduct rules outlined in this section seek to address anticipated consumer harm that may arise if we do not place protections around data export. Table 8: Requirements when exporting data to PDS firms Desired outcome Our proposals The consumer must be given appropriate information to make an informed decision. PDS firms must have a user’s agreement before exporting view data. PDS firms must provide the consumer with appropriate information to help them make an informed decision. This information must be communicated in a fair, clear and not misleading way. It must include the name of the data controller who will be processing the data and the purpose for which the data is being processed. When providing this information, PDS firms should bear in mind our proposed rule which requires the firm to prominently disclose to the customer if there is a third‑party arrangement. When getting a user’s agreement, the PDS firm must not: • use defaults (such as pre‑ticked boxes) • bundle this agreement (such as asking the customer to agree to their data being added to the firm’s marketing database at the same time as asking the customer to agree to data export) • make data export a pre‑condition of using a dashboard We do not propose to prescribe the wording of the message. However, firms should consider their obligations under the Consumer Duty’s consumer understanding outcome when obtaining customers’ agreement to data export. Customers’ information should not be shared either within complex data chains or opaque sharing agreements beyond the PDS firm. PDS firms are only permitted to share the data where: • the party they are sharing the data with is a firm in the same group with the permission to advise on investments; • the data is shared for the purpose of advising on investments; and • the customer agrees to this sharing of data. See the relevant section below for further details on post‑view services. The data must be securely transmitted to the PDS firm’s systems. PDS firms should transfer the data by secure means. Data cannot be exported for the immediate purpose of initiating a transaction. PDS firms must not use exported pensions data to auto‑populate application forms. PDS firms must only export part of the customer’s pension reference, so that: • it is an inadequate field with which to initiate a transaction, but • the consumer can still cross reference and match with any other records. In guidance we have suggested that exporting only the last four digits/characters would be appropriate, but we welcome views on how else this data item should be redacted to achieve the desired outcome. There should be a limit on how long the PDS firm can retain the data. PDS firms must not retain the customer’s data beyond the period it is useful to the customer. For example, using out-of-date information when more recent information is available may not be an effective way to support consumers’ retirement planning. We outline in paragraphs 5.101 – 5.103 below our proposed rules for data retention. 5.67 Record‑keeping requirement: We propose that PDS firms must keep records of how they obtain users’ agreement to data export, including the content of messages. Where relevant, we also propose that firms must keep records of with which members

48 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms of their group they share customers’ data and the number of customers whose data has been shared in this manner. These records must be kept for 6 years. Q19: Do you agree that the requirements we propose to place around how data is exported and processed ensure an appropriate degree of consumer protection? Data Protection Impact Assessments 5.68 A Data Protection Impact Assessment (DPIA) is a process to help firms identify and minimise the data protection risks of processing data. DPIAs can help firms identify and assess any risks in processing personal data, as well as help them to identify measures to prevent any risks. 5.69 UK GDPR requires firms to complete a DPIA before beginning any type of processing that is likely to result in a high risk to individuals. It is good practice for firms to do a DPIA when processing personal data and PDS firms should consider completing a DPIA before processing either any personal or pensions information. 5.70 Record‑keeping requirement: We propose that where a PDS firm completes a DPIA, the firm should keep a record of their DPIA. We also propose that where a PDS firm does not complete a DPIA, the firm should keep a record of their reasoning for not doing so. These records must be kept for 6 years. Post‑view services 5.71 We consider there is significant potential for harm if consumers do not engage with their pensions or plan for their retirement. We think pensions dashboards can play an important role in engaging people with their pensions and retirement planning. We also think consumers would find the dashboard customer journey frustrating if it was limited to the core find and view activity. So, we want to ensure that our regulatory framework provides scope for firms to innovate and create good post‑view journeys that engage and support customers. 5.72 We expect some PDS firms may want to offer their users additional services beyond the find and view of the core dashboard to engage and support savers. These might include a wide range of offerings, such as advice (including robo‑advice), guidance, modellers, calculators or similar tools. 5.73 We propose to permit PDS firms to offer additional services beyond the find and view of the core dashboard, but only after displaying a customer’s pensions information. We propose that only the PDS firm (or a connected person giving regulated investment advice) will be able to offer and, where they choose to, charge for any services accessed via the dashboard. 5.74 Where a PDS firm links to an additional service after displaying a user’s view data, this service will be a ‘post‑view service’ for the purposes of our requirements. Some of these services may constitute a regulated activity. For example, regulated investment advice. Where a post‑view service is a regulated activity, PDS firms will also have to comply with relevant requirements in our Handbook for the activity. Other post‑view services will not be regulated activities but will be related services as they are

49 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms connected to the regulated activity of operating a dashboard service. For example, pensions guidance linked to from the core dashboard. 5.75 For the avoidance of doubt, where a PDS firm offers services which it does not link to from a dashboard service, these services will not be post‑view services and will be out of scope of our conduct rules for these services. For example, if a PDS firm – and particularly one which is also a pension provider – offers a range of pensions and retirement planning services but these are not linked to, or accessible, from the dashboard service, these will not be considered post‑view services. 5.76 We recognise the potential for consumer harm if post‑view services are unclear or misleading, or if they lead consumers to take actions that result in poor outcomes. To ensure post‑view services help users to understand and engage with their pensions and plan for retirement, and to build trust in pensions dashboards, we set out below our proposed conduct rules for firms which offer post‑view services. Firms will also need to comply with the relevant obligations in data protection legislation in respect of their post‑view services. 5.77 We do not propose to prescribe an exhaustive list of the form that post‑view services may or may not take. We think this may stifle innovation. However, we propose to set parameters within which PDS firms can innovate in the interests of consumers. Post-view services other than investment advice 5.78 We propose that post-view services must only be accessible after the customer has viewed their pensions information. While a firm may signpost to the availability of post￾view services at any stage of the customer’s dashboard journey, PDS firms will not be permitted to make the post-view service accessible (for example, by hyperlink or other direction) before, or instead of, the customer seeing their view data. 5.79 We propose that a post-view service other than investment advice must also: • Be operated by the PDS firm. Where a PDS firm enters a third-party agreement, any post-view services must be operated and provided by the PDS firm and not the third party. The PDS firm must ensure any post-view services comply with regulation and Handbook requirements. • Be user-tested. • Be a service and not a product. • Relate to pensions or retirement planning, to ensure these services promote the wider outcome of encouraging engagement with pensions. Retirement planning is a broad term and we are not defining this as we recognise that customers may need a broad range of support. • Support customers in understanding or taking decisions in relation to their pension(s). • Not lead customers into products. For example, a post-view service must not be, and must not include, an application form. • Not be defined benefit (DB) pension transfer advice, including abridged advice. 5.80 We recognise that the ‘halo’ effect of these services being provided as part of a dashboard service might influence consumers’ understanding and behaviour, so we are proposing requirements for PDS firms offering these services. 5.81 There are many online retirement planning services already available to pension savers or prospective savers, free of charge. Where a PDS firm charges consumers to use a

50 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms post‑view service that it also makes available elsewhere without charge, we propose that it must disclose this to the dashboard user in good time and before the customer either uses the service or incurs the charge. 5.82 We anticipate that some post‑view services may be services that are subject to existing FCA Handbook requirements. They may even be another regulated activity. Where this is the case, PDS firms must have the necessary permissions and adhere to the relevant rules. 5.83 PDS firms should be aware that they might stray into carrying out the regulated activity of making arrangements with a view to transactions in investments (referred to here as the ‘making arrangements’ permission) when offering post‑view services. For example, if the service offered as a post‑view service could be seen as part of the overall arrangements for a customer to transfer a pension after the customer’s dashboard service journey. This could be the case even though a PDS firm will not be allowed to offer to sell, or to sell, a customer any investments on the dashboard service. 5.84 To reflect the above, we are proposing a new limitation to the making arrangements permission. If a PDS firm decides that the post‑view services it wishes to offer could stray into the making arrangements activity and it does not want to arrange any deals in investments off the dashboard, then it would be able to apply for a limited making arrangements permission. This means it can only provide arranging that amounts to any of the post‑view services that are permitted in the Handbook. We refer to this as the ‘making arrangements limited to post‑view services’ permission. A firm with this permission could provide its post‑view services but not carry out any transactions in investments. 5.85 A firm would be a Limited Scope firm for the purposes of the SM&CR if the only permissions it holds are the permissions to: • carry out the new regulated activity • agree to carry out the new regulated activity, and • make arrangements limited to post‑view services. 5.86 Additionally, some firms, and particularly those new to FCA regulation or unfamiliar with the pensions market, might: • inadvertently stray into other regulated activities, such as advising on investments • fail to realise that their post‑view service is subject to existing Handbook requirements 5.87 Firms which make such oversights and omissions could be liable to enforcement action, or to legal action by the customer. 5.88 PDS firms should consider our Perimeter Guidance Manual (PERG) which provides guidance on the perimeter and the circumstances in which permission is required to carry out activities. 5.89 We propose that firms will have to demonstrate whether and how they have considered if additional permissions are required for any post‑view services they wish to offer in our proposed authorisation application and variation of permission application forms. These forms are included in Appendix 2.

51 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.90 We also encourage potential PDS firms to make use of our Innovation Pathways service. The service can help potential PDS firms to understand how regulation will apply to their proposed post‑view services, even ahead of applying for the PDS permission. In turn, this could better enable applicants to submit a robust and thorough application for either authorisation or a change of permission. 5.91 We also propose that authorised PDS firms must notify us if they add, remove, amend or materially change their post‑view services in such a way which impacts the customer’s experience of the post‑view service. We outline the details of this notification requirement in Table 5 of Chapter 3. 5.92 The incoming Consumer Duty will require a firm to design and conduct appropriate tests of relevant products and services to ensure they meet the needs, characteristics and objectives of the target market, including consumers with characteristics of vulnerability. Aligned with these requirements, we propose to require PDS firms to user‑test their post‑view services before offering them to their customers. Where user‑testing identifies that firms can improve their post‑view services, we propose to require firms to take appropriate action. These requirements are designed to ensure these innovative services support users and build trust and confidence in the wider pensions dashboard ecosystem. 5.93 Record‑keeping requirement: we propose that firms must keep records of their user testing for post‑view services and any subsequent changes made to these services for 6 years. 5.94 To help customers understand post‑view services, we propose that PDS firms will be required to: • clearly disclose the purpose of the post‑view services • keep records of disclosures about post‑view services • display all the same risk warnings and signposts as set out above in the section on disclosures, signposts and warnings • continue to adhere to the marketing restrictions outlined in paragraphs 5.110 ￾5.123 in this post-view service environment • ensure consumers know where they can raise a query or complaint about the PDS firm’s post‑view services • ensure the post‑view services are not misleading and are capable of being understood by customers 5.95 When ensuring that post‑view services are not misleading and are capable of being understood by customers, firms should consider whether: • customers might perceive post‑view services as giving them guarantees of what their pension will be worth or personal recommendations • assumptions underpinning tools and modellers are disclosed clearly and prominently 5.96 Except where the post-view service is investment advice, the PDS firm should also consider whether a customer might perceive a post‑view service as giving them a personal recommendation and take appropriate action so the firm does not give this impression.

52 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.97 We recognise that some PDS firms may wish to auto‑populate post‑view services with exported view data and perhaps supplement this auto‑populated data with additional data input or otherwise supplied by the user (broadly termed ‘self‑asserted data’). Equally, we recognise that some PDS firms may wish to offer post‑view services that only require self‑asserted data. We think that these are both valid models. So, post‑view services may be auto‑populated, based on self‑asserted data or a combination of the two. 5.98 In either scenario, we propose that both personal and pensions data, as well the outcome of post‑view services (broadly termed ‘manipulated data’), must not be shared with any entities beyond the PDS firm or a firm within the same group which holds the permission to give regulated investment advice (see paragraphs 5.104 – 5.109 below). Where the data is shared with a firm within the same group, this sharing must only be to facilitate a post‑view service which is regulated investment advice and only with the customer’s agreement. 5.99 We propose that, when a PDS firm exports a customer’s view data to a post-view service, it should consider whether it is appropriate to include any contextual information which DWP’s regulations (including PDP’s standards and DWP’s standards on state pension information) require the PDS firm to display alongside view data. This is to help a customer understand the post‑view service. This may not be relevant to some post‑view services, such as those which rely entirely on self‑asserted data. 5.100 We recognise that customers might want to keep a copy of the results of a post‑view service. For example, the results of a modeller or calculator. We propose to require firms to offer customers the option of downloading or sending themselves a copy of the results, where appropriate, and that this data must be sent to the customer via secure means. 5.101 Firms may wish to offer customers the option to save their data for a future browsing session and we propose to allow firms to offer this functionality. However, we do not think it would be in the customer’s interests for firms to retain data beyond the period it is useful for the customer. For example, using out-of-date information when more recent information is available may not be an effective way to support customers’ retirement planning. The core dashboard will only display static data. The view data is an indicative snapshot, not a live‑feed from the pension scheme or provider. In some cases, the value data might have been calculated over a year before the consumer’s request to view them. Retaining this data for future calculations may be of limited benefit to the consumer as the view data will soon be out of date. It is likely the consumer will be better off requesting the latest view data, even if this is a longer process than using stored old data. So, we propose that PDS firms can only store customers’ data for 30 days. This 30‑day requirement is a rolling requirement. The clock restarts each time the customer logs in within 30 days. 5.102 We think this is an appropriate period in which a consumer might want to continue engaging with their pensions data and post view results. It is also the period in which a consumer can contact their pension provider to resolve a partial match. 5.103 If a customer does not return to the dashboard service within this period, the firm must delete all exported and self‑asserted data. This ultimately serves as a mechanism to revoke the PDS firm’s access to the individual’s pensions and personal information. This means that if a consumer wanted to use a post‑view service more than 30 days after last used, they would need to generate a new view request, and so ensure the

53 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms post‑view service is informed by the data most recently supplied to the dashboard. This can often be done without having to start at the beginning of the dashboard service journey or to generate a new find request because the Pension Identifier tokens (PeIs) that the PDS firms use to get the view data for the consumer are stored at the central consent and authorisations service. Investment advice as a post-view service 5.104 We want customers to be supported on their dashboard service journey. So, we propose to permit firms to offer investment advice as a post-view service. We set out in this section our proposed requirements where firms offer investment advice as a post-view service. 5.105 A post-view service must only be accessible after the customer has viewed their pensions information and not before, or instead of, the customer seeing their view data. However, a firm may signpost to the availability of post-view services at any stage of the customer’s dashboard journey. 5.106 We propose that a post-view service that is investment advice must: • Only be provided by the PDS firm with the permission to give investment advice, or a member of the same group with the permission to give investment advice (a ‘connected person’). Where a PDS firm enters a third-party agreement, the third party is not permitted to give investment advice as a post-view service, even if the third party holds the relevant permission. • Comply with all relevant Handbook requirements that apply to firms providing investment advice. • Relate to pensions and retirement planning. • Support customers in understanding or taking decisions in relation to their pension(s). • Not be DB pension transfer advice, including abridged advice. 5.107 Where a connected person offers investment advice as a post-view service, we propose the connected person must comply with, and the PDS firm must ensure that the connected person complies with, the relevant rules in PDCOB. 5.108 Where a firm or connected person offers investment advice as a post-view service, the relevant rules in PDCOB are the proposed: • restrictions on adding a customer or a customer’s details to their marketing database (paragraphs 5.120 – 5.123 below) • requirements for obtaining a customer’s agreement to cookies or similar tracking technologies (paragraphs 5.124 – 5.129 below) • requirement to only process the customer’s pensions or personal information to deliver investment advice • restrictions on sharing the customer’s pensions or personal information (including manipulated data) with a third party 5.109 Firms offering investment advice as a post-view service will also have to comply with relevant notification and record-keeping requirements for post-view services. Q20: Do you agree that our proposals on post‑view services achieve an appropriate balance between allowing scope for innovation and protecting consumers?

54 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Marketing 5.110 We recognise that most PDS firms will want to advertise their dashboard service to discrete audiences or to the general public. We do not consider that knowing dashboards exist and where to find them presents any foreseeable harm to consumers. 5.111 We understand that Treasury does not plan to bring the activity of operating and making a dashboard service available within the scope of section 21 of FSMA (Restrictions on Financial Promotion). This means that PDS firms will not be subject to our financial promotion rules in our Conduct of Business sourcebook (COBS 4) when publicising their dashboard service. However, PDS firms promoting their dashboards will have to comply with our proposed requirement for communications to be fair, clear and not misleading. And, if a PDS firm also promotes other products or services alongside promotions for its dashboard services, it will need to ensure it adheres to any applicable COBS 4 requirements in the advertisement. 5.112 Separately, we recognise that PDS firms may want to: • advertise other products and services that they offer as a means of generating revenue through these advertised products and services • charge to host adverts for other parties’ products or services 5.113 In considering whether such advertising should be permitted, we have taken into account: • the potential for consumer harm if a PDS firm promotes scams or inappropriate products or if marketing is misleading or confusing • products and services that could be beneficial for some consumers • a blanket prohibition on marketing might disincentivise reputable firms from entering the market 5.114 At this time, we propose not to permit marketing for any products anywhere on a dashboard service, including on post‑view services. This prohibition includes pension products because we are concerned that: • The presence of marketing on a dashboard service might create the impression or expectation that a consumer should act or transact after finding and viewing their pensions (for example, transfer, consolidate or change underlying investments). For many consumers, not taking further action beyond finding and viewing their pensions information could be a sufficient and reasonable outcome. • Consumers might wrongly assume that any products promoted to them in this space constitute a tailored recommendation because either the PDS firm is authorised or because the consumer has used the dashboard service to find information about their pensions. • Entering into advertised pension products without advice or guidance could lead to consumers entering into products that do not meet their needs or giving up important benefits and features on their existing pensions. • Marketing for products that are not related to pensions or retirement planning might distract or discourage customers from engaging with their pensions. 5.115 However, we do propose to allow PDS firms to communicate financial promotions for regulated investment advice. We consider it may be useful for some consumers to see

55 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms promotions for advice when they are using a dashboard service and in the mindset of planning for retirement. Such promotions could enable customers to receive suitable advice at an appropriate time. Promotions for regulated investment advice currently are, and will remain, subject to the expectations and protections of our financial promotions rules in COBS 4. We propose to allow them to be communicated anywhere along the dashboard service customer journey. 5.116 For the avoidance of doubt, the proposal we outline in paragraph 5.115 above does not permit PDS firms to promote DB transfer advice. We recognise the importance of transfer advice in retirement planning. However, we are concerned about the ‘halo’ effect of a dashboard service creating the impression that a transfer is in a user’s best interests, given our view that it will be in most users’ best interests to keep a defined benefit pension. 5.117 Record‑keeping requirement: We propose that, before the PDS firm displays a promotion for regulated investment advice, it must check that the firm or individual being promoted holds the relevant permission and keep records of this check for 6 years. We think this is necessary given the ‘halo’ effect of dashboard services and to build trust in dashboards. 5.118 In addition to permitting financial promotions for regulated investment advice, we propose to: • Allow PDS firms to highlight and explain what post‑view services they offer. • Prevent PDS firms from allowing a third party to place advertising on or around its dashboard service. For example, a firm permitting GoogleAds to appear on or around its dashboard service display would breach this rule. • Ban PDS firms from displaying on the dashboard service webpages anything other than financial promotions for regulated advice, signposts to their post‑view services and what is required by DWP’s regulations, DWP’s standards on state pension information, PDP’s standards and our rules. 5.119 We also propose rules on how firms should display marketing to avoid causing confusion or customer misunderstandings. We propose that PDS firms communicating a financial promotion must: • ensure that marketing does not conceal or reduce the prominence of any messages, signposts or warnings required by our rules, DWP’s regulations, DWP’s standards on state pension information or PDP’s standards • ensure that the promotion does not create the impression that the service is either tailored to the customer’s pensions information or is an appropriate service for the customer’s personal circumstances • consider the impact of the placement and volume of marketing, such as considering whether they are overwhelming the customer, and take appropriate action to avoid creating a misleading impression • keep records for 6 years to evidence how they have considered user experience and customer understanding and, where relevant, any action taken • keep records for 6 years of any financial promotions communicated on a dashboard service, as required by COBS 4.11.1R • keep records for 6 years of any remuneration received for communicating marketing

56 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.120 We recognise that a PDS firm may want to market to dashboard users outside the dashboard ecosystem or after a customer has used a dashboard. We propose that a PDS firm can only add a customer (and a customer’s data) to their marketing database if they have the customer’s agreement to do so. 5.121 We propose PDS firms must get this agreement in the following way: • the PDS firm will have to clearly disclose how and why the data will be processed (by which we mean, for marketing purposes) by the PDS firm • we do not propose to prescribe the wording of this message • the PDS firm must not use defaults such as pre‑ticked boxes; bundle, such as bundling the customer’s agreement for their data to be processed for marketing purposes with the customer’s agreement for their data to be exported; or require the customer to agree as a pre‑condition to using a dashboard service 5.122 We propose that the PDS firm can only get the user’s agreement for their data to be added to the PDS firm’s marketing database and not that of a third party. For example, it would be a breach for a PDS firm to ask a customer to agree to the customer’s data being used for marketing purposes by a third party, including by a firm in the same group as the PDS firm. 5.123 Firms should also note that getting a customer’s agreement for their data to be used in their way will not affect what marketing the PDS firm will be allowed to display on a dashboard service. Q21: Do you agree with our proposals on marketing? Marketing triggered by using a dashboard service 5.124 Research by PDP identified that consumers are concerned about being marketed to because they have visited a dashboard service. We want to build trust in the ecosystem and ensure that customers are presented with the option of disabling cookies and similar tracking technologies in a straightforward and clear way. This will help consumers who do not wish to be tracked or marketed to because they have visited a dashboard to exercise this choice and to limit their ‘footprint’. 5.125 Firms should familiarise themselves with, and adhere to the applicable requirements, on the use of cookies or similar tracking technologies set out in the Privacy and Electronic Communications Regulations (PECR). This includes the requirement to: • tell users what cookies and other tracking technologies will be used, and for which purposes for which they will be used • get a user’s consent to cookies 5.126 We propose PDS firms must present customers with the option of consenting to only essential cookies alongside any other options. This is to ensure it is easy for customers, and particularly those with low digital literacy or characteristics of vulnerability, to express their preferences. These proposals are in addition to requirements in the PECR. We also propose that firms must not give prominence to one cookie option over another when presenting options to get the user’s consent. This is to ensure that firms do not exploit presentational or behavioural biases.

57 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 5.127 We propose to ban firms from requiring customers to accept non‑essential cookies as a precondition of using a dashboard service. We do not think this is appropriate in the context of dashboard services as we think this form of consent is unlikely to be freely given. 5.128 If the user ignores a PDS firm’s cookie consent request, the firm should not place cookies unless: • the use of the cookie or similar tracking technology is necessary for the transmission of a communication • the cookie is ‘strictly necessary’ for the provision of the online service the user requests, such as cookies used for authentication or security purposes 5.129 Record‑keeping requirement: We propose that PDS firms must keep records of the text and presentation of consent options for cookies or similar technologies for 6 years. Q22: Do you agree with our proposals on cookies and similar tracking technologies? Scam Prevention 5.130 Pension scams can be catastrophic for an individual’s quality of life in retirement. We work with other public bodies in gathering intelligence on pension scams and unsuitable advice to put money into high risk or illiquid investments. We act on that information through our supervisory work and, where necessary, by stopping firms from doing business. In serious cases, we can use our enforcement powers to hold individuals to account. 5.131 We are also active in protecting consumers through a broad range of consumer education initiatives, like our ScamSmart, where we work with TPR to inform and educate consumers about the risks of scams and how to avoid them. Launched nationally in 2014, ScamSmart targets specific audiences (all investors aged 21 to 75) using evidence-based, creative communications developed in line with behavioural science principles. 5.132 We recognise that consumers who use a dashboard service may become a target for scams. We have designed the whole regulatory framework from the perspective of minimising the risk of scams and protecting consumers. We outline here specific protections we propose to apply to PDS firms. Pension and investment scams 5.133 We anticipate the potential for customers using dashboard services to become a target for pension and investment scams. Pension savings are an attractive target for scammers due to the sums of money involved. As described above, we are restricting what marketing can appear on a dashboard service, prohibiting PDS firms from exporting the full pension reference and requiring signposts to our ScamSmart campaign in consumer copies of exported data. 5.134 In addition, we propose that on each occasion a customer uses the PDS, the firm must display warnings targeted at the particular risk of screen sharing, which is an

58 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms increasingly popular tool for scammers. We do not propose to prescribe the wording, but these warnings should remind consumers: • that their view data is sensitive and valuable • to use the FCA Register to check whether the third party is who they say they are • to think carefully about whether this third party really needs to see the information on the screen 5.135 The warnings should also discourage customers from giving a third party control of their device by explaining that a third party which has control of the customer’s device can access and control even more than what is visible on the dashboard. This could include the customer’s personal information, social media accounts and online banking. 5.136 Firms will need to determine at what point in the digital journey this information should be given for it to serve as an effective warning. 5.137 These proposals build on existing protections against pensions and investment scams, including: • The Conditions for Transfers Regulations introduced in November 2021, which help minimise the risk of consumers transferring their existing pensions into a scam scheme. This legislation gives trustees and scheme managers the power to require information and evidence from members, make assessments of the scam risks and decide whether a transfer request should proceed, be stopped or be paused while the member takes scam‑specific guidance from MoneyHelper. • The advice requirement. Any member requesting to transfer a DB scheme (or other safeguarded benefits) with a value of more than £30,000 to a DC scheme must receive advice from an FCA regulated pension transfer adviser before they can proceed with a transfer. Personal data scams 5.138 In addition to pension and investment scams, we anticipate there may be scams that attempt to get an individual’s personal data and use this personal data for fraudulent purposes. 5.139 Scammers may set up fake dashboards which are not connected to the PDP ecosystem, and which seek to get unsuspecting users’ personal data by purporting to require the consumer to input their personal information to create an account or to search for their pensions. 5.140 We propose to leverage our wider organisational capabilities in this space to reduce the risk of consumers encountering scam dashboards and falling victim to fraud. Specifically, we propose: • To reinforce the messaging broadcast by the ScamSmart campaign to communicate the risk of scams and what consumers can do to stay safe. This messaging includes checking whether firms appear on our Register and making sure the customer is interacting with a legitimate (regulated and authorised) dashboard service directly or via a third party.

59 CP22/25 Chapter 5 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Proactive scanning by our Financial Promotions and Enforcement Taskforce (FPET) for websites hosting clone dashboards, which could lead us to close down these firms and publish a clone alert. 5.141 We propose to require PDS firms to notify us if they are made aware of scams relating to their dashboard services. For example, the existence of a clone dashboard purporting to be operated or made available by the PDS firm. This notification requirement is designed to support our organisational anti‑scam capabilities. We outline the details of this notification in Table 5 of Chapter 3. Q23: Do you agree with our proposals to protect dashboard users from scams?

60 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6 Senior Managers & Certification Regime 6.1 In this chapter, we set out requirements which aim to encourage greater individual accountability and set a high standard of personal conduct. Firms that provide other financial services and are already authorised should be familiar with the Senior Managers and Certification Regime (SM&CR). 6.2 Personal accountability of the type achieved through the SM&CR forms part of our regulatory expectations for all PDS firms. We expect Senior Managers in PDS firms to create an environment where consumers are protected from harm. 6.3 We set out below how we propose to apply the SM&CR to PDS firms, both PDS-only firms and those that carry on other regulated activities alongside the PDS activity. 6.4 The requirements of the SM&CR span multiple sourcebooks, and SYSC 23.3 provides a list of the rules that apply and where they can be found in the Handbook. Firms should consult these rules and relevant guides. The SM&CR 6.5 The Senior Managers & Certification Regime is a set of rules and guidance that sets standards relating to professionalism, conduct and governance and holding senior members of a firm to account. The aim of the SM&CR is to reduce harm to consumers and strengthen market integrity by making individuals more accountable for their conduct and competence. These rules also mean that, if an individual or a firm breaches our rules, it is easier for the firm and for the FCA to hold them to account. 6.6 In general, the SM&CR rules aim to ensure: • people take responsibility for their actions • there is good conduct at all levels • it’s easy to understand who does what 6.7 There are three key parts to the SM&CR: • the Senior Managers Regime – rules that relate to individuals in certain senior roles, to ensure that they are fit and proper to perform these roles, and that certain prescribed responsibilities are allocated to these Senior Managers • the Certification Regime – rules that require firms to ensure that individuals who perform certain functions within the firm are fit and proper to do their jobs • the Conduct Rules – these are high‑level standards of behaviour that apply to almost all employees within regulated financial services firms 6.8 Each of these parts is explained in more detail below. 6.9 The SM&CR applies to firms authorised under FSMA with a Part 4A permission. Different requirements apply to different firms, depending on the firm’s size and

61 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms complexity and the potential harm to consumers. Solo‑regulated firms can be classified as Limited Scope, Core or Enhanced. 6.10 In most cases, the Certification Regime and the Conduct Rules apply in the same way to all types of firms. For the Senior Managers Regime for solo‑regulated firms, there is a distinction in the rules that apply depending on whether a firm is classified as Limited Scope, Core or Enhanced. There are additional requirements for the small number (fewer than 1%) of solo‑regulated firms whose size, complexity and potential impact on consumers warrant more attention – these additions are called the ‘enhanced regime’. Some firms that we consider pose more limited risk of harm are classed as Limited Scope and have fewer SM&CR requirements. The firms falling into these categories are defined in our Handbook. Our key proposals 6.11 We propose that PDS‑only firms that have no other regulatory permissions should be Limited Scope firms for SM&CR purposes. As explained earlier in this CP, when we refer to PDS‑only firms, we include firms which hold the PDS permission, the permission for agreeing to carry on the pensions dashboard service activity and the limited version of the making arrangements permission that would apply only in relation to post‑view services. We think Limited Scope is appropriate for PDS‑only firms as we consider these firms pose a more limited risk of harm to consumers than firms carrying out other activities, such as where client money is held. 6.12 The following elements will therefore apply to these PDS‑only firms. • The Senior Managers Regime – these rules relate to individuals in certain senior roles (‘Senior Managers’). The main elements are as follows: – Firms need to identify ‘Senior Management Functions’ and assign them to Senior Managers. These are roles, held by the most senior people in a firm, that have the greatest potential to cause harm or impact upon market integrity. – Senior Managers must be approved by us before carrying out their role. – Firms must assess whether the Senior Managers are fit and proper before approval, and on an ongoing basis. – All Senior Managers need to have a Statement of Responsibilities. – Normally, a firm needs to allocate Prescribed Responsibilities (explained below) to its most appropriate Senior Managers, but Limited Scope firms do not need to allocate any Prescribed Responsibilities. • Certification Regime – these rules apply to an individual whose job meets the definition of being a ‘Certification Function’. Under the Certification Regime: – firms will need to make sure that those performing Certified Functions are fit and proper to do their job – these individuals will not need our approval (unlike Senior Managers) – individuals performing Certification Functions will appear on the FCA Register • Conduct Rules – these high‑level standards of behaviour (‘Conduct Rules’) will apply to almost all employees in a PDS firm. Additional Conduct Rules apply to Senior Managers.

62 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6.13 A firm that is currently a Limited Scope firm and varies its permission to add the new permission to offer pensions dashboard services will become a Core firm. 6.14 If a PDS firm is already performing other regulated activities alongside the PDS activity, its classification as a Core or Enhanced firm will not change. Senior Managers Regime Senior Management Functions 6.15 Some senior roles are classed as ‘Senior Management Functions’ (SMFs). These are roles, held by the most senior people in a firm, that have the greatest potential to cause harm or impact upon market integrity. The SMFs are listed and defined in Chapter 10C of the Supervision manual (SUP). 6.16 We require firms to identify which individuals within the firm are undertaking specific SMFs and ensure that the FCA knows who a firm’s most senior decision makers are and that they are fit and proper to do their role. Approval of individuals performing Senior Management Functions 6.17 People performing SMFs need to be approved by the FCA before starting their role. 6.18 Firms will therefore need to identify who their Senior Managers are and have them approved by the FCA. Applications (a Form A and a Statement of Responsibilities (“SOR”)) for all those individuals that will hold a SMF will need to be submitted at the same time as the firm applies for authorisation or for a variation of permission. These forms request information about each individual, and firms will need to demonstrate the individual’s fitness and propriety (including undertaking a criminal records check) and competence to perform the role. 6.19 Once approved, firms need to assess all their Senior Managers at least once a year, to make sure they remain ‘fit and proper’ to do their jobs. We describe our rules around fitness and propriety below. 6.20 If a firm subsequently wants to appoint new Senior Managers, they cannot start their jobs until approved by the FCA. Roles classed as Senior Management Functions for Limited Scope firms 6.21 Limited Scope SM&CR firms generally need to identify fewer SMFs than Core or Enhanced SM&CR firms as we consider these Limited Scope firms pose more limited risk of harm. 6.22 We propose to require Limited Scope PDS firms to allocate the Limited Scope Function (SMF29) to a Senior Manager. The holder of this function is responsible for ensuring that significant business responsibilities are clearly and appropriately divided among the directors and Senior Managers of the firm and overseeing the putting in place and maintenance of systems and controls.

63 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6.23 We are not proposing that Limited Scope PDS firms will need to appoint the Compliance Oversight Function (SMF16) or the Money Laundering Reporting Function (SMF17). The holder of the Compliance Oversight Function is responsible for overseeing the firm’s regulatory compliance and for reporting to the governing body. The holder of the Money Laundering Reporting Function is responsible for oversight of the firm’s compliance with our rules on systems and controls against money laundering. That means the only senior management function that will apply to a Limited Scope PDS firm is the Limited Scope function. Statement of Responsibilities 6.24 Every Senior Manager in a firm will need to have a ‘Statement of Responsibilities’. 6.25 The Statement of Responsibilities is a single document that clearly sets out the Senior Manager’s role and what they are responsible for. It’s an important document for the firm, the individual and the FCA as it helps everyone understand who is accountable for what at the most senior level. 6.26 Firms will need to submit a Senior Manager’s Statement of Responsibilities to us when applying for a Senior Manager to be approved. After we have approved a Senior Manager, the firm will need to update and resubmit the ‘Statement of Responsibilities’ whenever there is a significant change to a Senior Manager’s responsibilities. Forms 6.27 Firms will need to use different forms in relation to the SM&CR. Forms are needed, for example, to have Senior Managers approved to perform a specified SMF, to notify us of changes (such as changes in personal information) and to notify us of significant changes in responsibilities of a Senior Manager. 6.28 Annex 3 of the Senior Managers and Certification Regime: Guide for FCA solo‑regulated firms, provides a list of the relevant regulatory forms. 6.29 Firms should use our Connect system to complete and submit the relevant forms. Duty of responsibility and Prescribed Responsibilities 6.30 Senior Managers have a ‘duty of responsibility’. This means that if a firm breaches one of our rules or other FSMA requirements, we can hold a Senior Manager accountable if that Senior Manager was responsible for managing any of the firm’s activities in relation to which the breach occurred and if that Senior Manager did not take ‘reasonable steps’ to prevent or stop the breach. Our approach to Enforcement is detailed in Chapter 3. The burden of proof lies with us to show that the Senior Manager did not take steps to avoid the breach. 6.31 The FCA has defined a list of responsibilities that must be allocated to appropriate Senior Managers. We call these Prescribed Responsibilities. However, Limited Scope PDS‑only firms do not need to allocate any Prescribed Responsibilities. 6.32 There are also specific Conduct Rules that apply to Senior Managers. We explain these below in the ‘Conduct Rules’ section.

64 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Overseas Senior Managers 6.33 There is no territorial limitation on the Senior Managers Regime. This means that it will apply to anyone who performs a Senior Manager role, whether they are based in the UK or overseas. Certification Regime 6.34 We propose to apply the Certification Regime to all PDS firms, as it applies to all other regulated firms. What is the Certification Regime? 6.35 The ‘Certification Regime’ applies to people who perform certain roles, known as ‘Certification Functions’. They are people who are involved in aspects of a firm’s business that involve, or might involve, a risk of significant harm to the firm or its consumers. These roles are detailed in SYSC 27.8. 6.36 The Certification Regime is a set of rules that requires firms to make sure that these key people are fit and proper to do their jobs. 6.37 We set out the Certification Functions in SYSC 27.7.3R in our Handbook. Firms need to familiarise themselves with SYSC 27.7 in our Handbook and decide whether any individuals in their firm should be classed as Certified Staff, because their job matches the description of one or more of the functions. 6.38 The relevant Certification Functions for firms which only hold the PDS permission are: • the significant management function • anyone who supervises or manages a certification employee (directly or indirectly), but who is not a Senior Manager 6.39 We do not propose to bring the new pensions dashboard activity in scope of the client‑dealing function of the Certification Regime. We consider operating and making dashboard services available to be a different activity to those such as advising on investments, which are in scope of the client‑dealing function. 6.40 An individual working at a firm can perform more than one Certification Function. In such cases, the firm will need to ensure that the individual is fit and proper to perform each of the functions. In general, a person who holds an SMF will not be performing a Certification Function. However, a person can perform both kinds of function where the activities involve in the two functions are different. 6.41 The same list of Certification Functions applies to all firms in scope of SM&CR. However, the functions only apply where the firm has people in these roles. This means that it is possible that in very small firms, there will be no Certified Staff. Certifying that people performing Certification Functions are fit and proper 6.42 Firms need to ensure that anyone doing a Certification Function has been certified.

65 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6.43 Certifying someone means assessing whether the person is fit and proper to do a particular role. Firms need to do this assessment either at the point of recruitment or before a person performs a Certification Function if they are already employed. 6.44 If the firm considers the person to be fit and proper for the role, it will need to issue them with a certificate. The firm will need to re‑assess whether the person is fit and proper to perform the role at least once a year, and if the person continues to perform the function must renew the certificate. 6.45 The certificate needs to state: • that the firm is satisfied that the person is a fit and proper person to perform the function the certificate sets out, and • what aspect of the firm’s affairs the person will be involved in as part of performing their function. 6.46 We describe the ‘fit and proper’ assessment in more detail later in this chapter. 6.47 If a firm does a ‘fit and proper’ assessment on an employee, and then decides not to issue a certificate, the employee must cease to perform the Certification Function. The firm must notify the person, in writing, of: • the decision not to reissue the certificate • what steps (if any) the firm proposes to take about the person as a result of the decision • the reasons for proposing these steps Territorial limitation of the Certification Regime 6.48 For UK firms, the Certification Regime is limited to people performing a Certification Function who are either based in the UK or, if based outside the UK, are dealing with (have contact with) UK consumers. We call this the ‘territorial limitation’. This means that if a person based overseas does not deal with UK consumers, but will otherwise have been carrying out one of the functions listed in our rules, the Certification Regime may not apply to them. 6.49 There is an exception to this, but this exception does not apply to PDS‑only firms. And where a firm is already FCA authorised, holding the PDS permission will not affect whether the exception applies. Fit and proper requirements 6.50 A key feature of the SM&CR is to ensure that firms take responsibility for their staff being ‘fit and proper’ to do their jobs. This requirement will apply to Limited Scope PDS firms as it does to all other regulated firms subject to the SM&CR. 6.51 Firms will need to ensure that anyone performing a SMF or a ‘Certification Function’ is fit and proper to do so. Firms will also need to assess people in these roles on an ongoing basis, and at least once a year.

66 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6.52 When making these ‘fit and proper’ assessments, firms must have regard to any general rules that we have about the qualifications, training, competence and personal characteristics required of an individual for that role. 6.53 The Fit and Proper test for Employees and Senior Personnel (FIT) sourcebook sets out the factors that firms should look at when assessing people as fit and proper. This includes factors like a person’s honesty, integrity and reputation, their competence and capability and their financial soundness. Evidence requirements 6.54 As part of the fit and proper requirements under the SM&CR, we require firms to collect certain evidence when assessing candidates for Senior Manager roles and Certification Functions. This evidence includes criminal record checks and references from previous employers. Criminal record checks for Senior Managers 6.55 As with other firms in the SM&CR, PDS firms, including Limited Scope PDS firms, will have to undertake a criminal record check as part of each Senior Manager’s application for approval. 6.56 The Disclosure and Barring Service (DBS), and the equivalent agencies in Scotland and Northern Ireland, run these criminal record checks. PDS firms will have to register with the DBS. Smaller firms may need to use an umbrella organisation to carry out checks on their behalf. 6.57 We also propose that, where a candidate has spent a considerable amount of time working or living outside the UK, firms should consider undertaking an equivalent check with the appropriate overseas regulatory body where available. 6.58 We do not propose requiring firms to undertake criminal record checks for Certification Functions, but firms may choose to conduct these checks for these and other staff where they are legally allowed to do so. This is for the firms to decide. 6.59 Core and Enhanced Scope PDS firms will also have to undertake a criminal record check before appointing a director who is not a Senior Manager. Regulatory references for Senior Managers and Certification Functions 6.60 Firms are also required to request a reference from Senior Manager and Certification Function candidates’ past employers – known as ‘regulatory references’. 6.61 These references will help firms to make better informed decisions about candidates. The rules require firms to request a reference from all previous employers in the past six years for people applying for Senior Manager and Certification roles. A firm requesting a reference should ask for the: • Reference to be given in a standard template (which is set out in the Handbook) if the person giving it is an authorised firm.

67 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • Disclosure of specified information going back six years, including details of any disciplinary action taken due to breaches of the Conduct Rules and any findings that the person was not fit and proper. • Disclosure of any other information relevant to assessing whether a candidate is fit and proper, such as the number of complaints which have been upheld. This information must cover the previous six years – unless it relates to serious misconduct, which has no time limit – and firms will need to use their judgement when considering what is relevant, on a case‑by‑case basis. 6.62 A firm asked to give a reference must do so in accordance with those requirements. In order that a firm can give a reference to another firm if asked to, a firm must: • retain records of all disciplinary and fit and proper findings going back six years • not enter into arrangements that conflict with their disclosure obligations, such as non‑disclosure agreements 6.63 A firm that has given a regulatory reference must update it where new, significant information comes to light. 6.64 A firm’s compliance with the regulatory referencing requirements will also need to be consistent with its common law duties and other relevant legislation, such as those about the rehabilitation of offenders and spent convictions. Directory of Certified and Assessed Persons in the Financial Services 6.65 The FCA publishes and maintains a directory of ‘certified and assessed persons’ on the Financial Services Register, so consumers and professionals can check the details of key individuals working in financial services. Firms must submit details about the following individuals to us: • all Certified staff • directors who are not performing Senior Manager Functions (SMFs) – both executive and non‑executive 6.66 We then publish the names (and any previous names) of those individuals, along with details of their roles and activities undertaken. 6.67 Once published, firms need to keep their information up to date, and confirm annually that their data is accurate if they don’t otherwise make any changes to it. Conduct Rules 6.68 The Conduct Rules in our Code of Conduct sourcebook (COCON) will apply to all PDS firms. These apply to all other authorised firms subject to the SM&CR. These are rules that relate to the conduct of certain persons working in firms. 6.69 A key part of the SM&CR is the application of conduct rules to a broad range of staff. This set of enforceable rules set basic standards of good personal conduct, against which we can hold people to account. They can be found in the COCON chapter of our Handbook. This is aimed at creating and maintaining high standards of individual behaviour in regulated firms, and individual accountability and awareness of conduct issues.

68 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Key conduct rules 6.70 There are two tiers of Conduct Rules that apply to all firms. The first is a general set of rules that applies to most employees and directors in a firm. The second tier consists of rules that only apply to Senior Managers. There is also one Senior Manager rule, SC4, that applies to all non‑executive and executive directors as well as to Senior Managers. 6.71 Table 9 below sets out the key conduct rules that will apply. Table 9: Conduct Rules First Tier – Individual Conduct Rules

1. You must act with integrity
2. You must act with due care, skill and diligence
3. You must be open and cooperative with the FCA, the PRA and other regulators
4. You must pay due regard to the interests of consumers and treat them fairly
5. You must observe proper standards of market conduct Second Tier – Senior Manager Conduct Rules SC1. You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively SC2. You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system SC3. You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively SC4. You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice 6.72 Firms should note that a sixth individual conduct rule (individuals must act to deliver good outcomes for retail customers) will come into force on 31 July 2023 as part of the Consumer Duty. All PDS firms will need to comply with the Consumer Duty. 6.73 Firms will need to train individuals who are subject to the Conduct Rules on how the rules apply to them. Who do the conduct rules apply to? 6.74 The Conduct Rules apply to a firm’s regulated activities, activities connected to regulated activities, certain other unregulated financial services activities and activities that could have a negative effect on the firm’s ability to meet its fit and proper or financial resources obligations. The full details can be found in COCON 1.1. 6.75 As in other firms that are subject to the SM&CR, the Conduct Rules apply to: • all Senior Managers • all Certified Persons • all directors, whether executive or non‑executive, who are not Senior Managers (these individuals will be subject to the individual Conduct Rules and SC4 – the Senior Manager Conduct Rule to ‘disclose appropriately any information of which the FCA or PRA would reasonably expect notice’) • all other employees, except people who are listed in paragraph 6.77 below

69 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 6.76 The Conduct Rules apply to the majority of employees working in firms. This is important, as it ensures firms and the FCA can hold people accountable to ensure we are able to protect consumers and ensure market integrity. 6.77 However, there are some roles to which we consider it will not be proportionate to apply the Conduct Rules. These are: • receptionists • switchboard operators • post room staff • reprographics/print room staff • property/facilities management • events management • security guards • invoice processing • audio‑visual technicians • vending machine staff • medical staff • archive records management • drivers • Corporate Social Responsibility staff • data controllers and processors under the Data Protection Act • cleaners • catering staff • personal assistants and secretaries • Information Technology support (ie helpdesk) • Human Resources administrators/processors 6.78 People in these roles may also deal with sensitive information and activities, but they are subject to other rules and laws governing their behaviour, such as laws relating to fraud or insider trading. Due to the nature of these roles, we consider those other rules sufficient. Breaching conduct rules and reporting breaches 6.79 We provide guidance and examples of when we would consider someone to have breached a Conduct Rule in COCON 4. 6.80 A firm will need to notify us if it takes disciplinary action (a formal written warning, suspension, dismissal or reduction/recovery of their remuneration) against someone subject to Conduct Rules if the reason for the disciplinary action also amounts to a Conduct Rule breach. In the case of a Senior Manager, the firm must notify us within 7 business days of the firm becoming aware of the matter. For other individuals, the notification is made every year. 6.81 Firms will also need to notify us if they are made aware of information which would reasonably be material to the assessment of the fitness and propriety of one of its Senior Managers.

70 CP22/25 Chapter 6 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms When will the SM&CR rules apply? 6.82 The SM&CR rules will apply to PDS firms once they become authorised. We provide more information on authorisation in Chapter 8. 6.83 By the time of submitting the authorisations application, PDS firms will need to have: • submitted Form A applications for all individuals who will perform a Senior Management Function • identified individuals who will be subject to the Certification Regime and Conduct Rules and provided training • have certified all Certified Persons as fit and proper and issued them a certificate • submitted information about Directory Persons to the Register • be ready to comply with all other regime requirements Q24: Do you agree with our proposal to apply the Senior Managers and Certification Regime (SM&CR) to PDS firms? Q25: Do you agree with our proposals to treat PDS‑only firms (firms that have no other regulatory permissions) as Limited Scope firms? Q26: Are there any provisions within Senior Managers and Certification Regime (SM&CR), including the Fit and Proper test for Employees and Senior Personnel (FIT) and Code of Conduct (COCON), that apply to most firms but should not apply to PDS firms?

71 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 7 Dispute resolution 7.1 This chapter concerns our Dispute Resolution: Complaints sourcebook (DISP) which covers how firms should handle complaints and when complaints must be referred to the Financial Ombudsman Service (hereafter the Financial Ombudsman). In this chapter we also set out how we propose to apply DISP to PDS firms to ensure that complaints against PDS firms are handled fairly. 7.2 The FCA is responsible for setting the rules for complaints under the Financial Ombudsman’s compulsory jurisdiction (CJ). We expect customers to have access to a complaints mechanism and for PDS firms to deal with any complaints received in a fair and prompt manner, offering to put things right when things have gone wrong. PDS firms having robust, fair procedures for resolving complaints will help to reduce harms in the PDS market. Where a customer remains unhappy with how a PDS firm has dealt with a complaint, the customer should be entitled to refer that complaint to the Financial Ombudsman. 7.3 The Financial Ombudsman is an independent body set up by Parliament to resolve certain complaints between eligible complainants and businesses that provide financial services. Its role is to resolve these disputes quickly and with minimum formality, based on what is fair and reasonable in all the circumstances of the case. Having the Financial Ombudsman consider complaints helps to build eligible complainants’ trust that they will get a fair outcome when they complain. Complaints 7.4 When we refer to ‘customer’ in relation to the regulated activity and related services, we mean a person who uses or may use the services of a firm which carries on the new regulated activity. So, an individual using dashboard services will be a customer of the PDS firm. 7.5 Customers who want to complain about their experience of using dashboard services may direct complaints to the PDS firm, as they have a direct relationship with the firm. 7.6 However, many factors could impact a customer’s experience of dashboard services and lead to complaints. Not all these factors are within the control of the PDS firm or the responsibility of the PDS firm. For example, if a pension scheme or provider supplies incorrect pensions information to the PDS firm or if a customer experiences difficulties verifying their identity at the consent and authorisation service. 7.7 So, references to complaints about a PDS firm in this chapter are complaints which relate to an act of omission by a PDS firm in its capacity as the operator of dashboard services and any related services. We provide here two examples of potential complaints for illustrative purposes. • A PDS firm does not display warnings mandated by our rules, such as warning the customer not to make financial decisions based only on their view data. The

72 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms customer is not shown this warning and makes financial decisions which may not be in their best interest. • A PDS firm offers a modeller as a post‑view service. The purpose and limitations of the modeller are not clearly presented. A customer gets the wrong impression when using the modeller and subsequently takes action based on this false impression. Our proposals 7.8 We propose to: • apply our complaint handling requirements in DISP to ensure complaints against PDS firms are dealt with promptly, consistently and fairly • bring PDS firms carrying on business in the UK within the Financial Ombudsman’s CJ The Financial Ombudsman 7.9 The Financial Ombudsman has a statutory duty to resolve disputes ‘quickly and with minimum formality’, offering an alternative to the Courts. Its decisions are based on what it considers to be fair and reasonable in all the circumstances of the case. 7.10 The Financial Ombudsman is free for complainants. If the Financial Ombudsman decides to uphold a complaint, it can require the firm to make a monetary award to the complainant for an amount it considers is fair compensation for the loss or damage suffered. The Financial Ombudsman can also direct the firm to take steps that it considers ‘ just and appropriate’ in relation to the complaint. 7.11 The Financial Ombudsman has a statutory award limit of up to £375,000 for complaints about acts or omissions on or after 1 April 2019 (which are referred to the Financial Ombudsman on or after 1 April 2022). On 1 April each year, for complaints referred to the Financial Ombudsman on or after this date up to and including 31 March in the following year, the limits referred to above are adjusted by applying the percentage increase in the Consumer Prices Index (CPI) between January 2019 and January of that year and rounding down to the nearest £5,000. 7.12 Where the Financial Ombudsman has issued a decision, which is the final stage in its process, it may award redress up to relevant statutory award limit. This is binding on firms if it is accepted by the complainant. While the Financial Ombudsman can recommend that a firm pay redress in excess of the statutory award limit, this is not binding on a firm, and it is up to a firm whether it pays a higher amount. Compulsory jurisdiction of the Financial Ombudsman and complaints handling rules (DISP) 7.13 We propose to apply our complaints handling rules and guidance in DISP to all PDS firms. This means that complaints about the acts or omissions of authorised PDS firms will come within the compulsory jurisdiction of the Financial Ombudsman.

73 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 7.14 Table 10 below summarises the key sections of DISP that we propose applying to PDS firms, in line with other firms that we regulate. Table 10: Key requirements in DISP Sourcebook chapter Key rules and references DISP 1.2 Consumer awareness rules A firm must publish information about internal procedures for handling complaints about the Financial Ombudsman. DISP 1.3 Complaints handling rules A firm must have procedures in place to reasonably and promptly handle complaints and must ensure that complaints can be made free of charge. The procedures should recognise that complaints require resolution. The procedures should ensure that lessons are learned from complaints. Firms must take steps to address any recurring or systemic problems. A firm must appoint an individual within the firm to have responsibility for oversight of the firm’s compliance with DISP. DISP 1.4 Complaints resolution rules Complaints must be investigated competently, diligently and impartially. They must be assessed fairly, consistently and promptly and resolved at the earliest possible opportunity. Redress must be offered where appropriate and a clear explanation must be given about the assessment of the complaint. DISP 1.5 Complaints resolved by close of the third business day When a complaint has been resolved by close of the third business day following receipt of the complaint a ‘summary resolution communication’ must be sent to the complainant. This must refer to the availability of the Financial Ombudsman. DISP 1.6 Complaints time limit rules A firm must send a prompt written acknowledgement of the complaint and keep the complainant informed thereafter. The firm must, by the end of eight weeks after receiving the complaint: • send a ‘final response’ which offers redress of remedial action where appropriate or clearly explains why the complaint has been rejected, or • send a written response which explains why the firm has been unable to provide a final response and when it expects to provide one, and • in either case, send information about referral rights to the Financial Ombudsman together with an explanatory leaflet DISP 1.7 Complaints forwarding rules If a firm considers another firm is solely or jointly responsible for the matter being complained about, a firm should forward the complaint to the responsible party, if known. DISP 1.8 Complaints time barring rules A firm may reject a complaint received outside the relevant time limits, but it must explain its decision to do so in a final response letter. The time limits are generally 6 years after the event or, if later, 3 years from the date when the complainant became aware (or ought reasonably to have become aware) of the cause for complaint. DISP 1.9 Complaints record rules A firm must retain records of complaints for 3 years from the date the complaint was received. DISP 1.10 Complaints reporting rules A firm must submit a report of complaints to the FCA annually. 7.15 The above table is not an exhaustive list of all the DISP rules that will apply to PDS firms. Firms should familiarise themselves with DISP more generally, including DISP 2: Jurisdiction of the Financial Ombudsman Service and DISP 3: Complaints handling procedures of the Financial Ombudsman Service.

74 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Q27: Do you agree with our proposals to apply our complaint handling rules and guidance in the Dispute Resolution: Complaints Sourcebook (DISP), including the compulsory jurisdiction of the Financial Ombudsman Service, to PDS firms? 7.16 The Financial Ombudsman also has its own voluntary jurisdiction (VJ) which covers some types of complaint not covered by the CJ but which: • financial services firms may choose to participate in • the Financial Ombudsman oversees. 7.17 The Financial Ombudsman is planning not to mirror proposed changes to the CJ in the VJ. Given the nature of the regulated activities in question, the Financial Ombudsman does not anticipate that the VJ would provide any coverage for complaints beyond the coverage which the CJ will provide. 7.18 As a result, the Financial Ombudsman is proposing to make certain amendments to the VJ rules, guidance and standard terms (as set out in the instrument annexed to this consultation), in order to make it clear that activities relating to pensions dashboards are not covered by the VJ. 7.19 As such, the section of this consultation that relates to the VJ rules is issued jointly by the FCA and the Financial Ombudsman. Q28: Do you agree with the Financial Ombudsman Service’s proposals to exclude activities relating to pensions dashboard services from the voluntary jurisdiction? Complaints reporting 7.20 DISP 1.10 requires firms to submit complaints data to us. PDS firms will need to submit their complaints data as set out in DISP 1 Annex 1R. 7.21 We propose minor amendments to DISP 1 Annex 1R to make provision in the form for the new dashboard service activity. 7.22 DISP 1.10.4R sets out that the complaints reporting periods are the six months immediately following the firm’s accounting reference date (ARD) and the six months immediately preceding the firm’s ARD. We recognise that some firms with the new PDS permission may have an ARD which falls close to the date they are authorised or their variation of permission date. We expect some of these firms may not be able to report good quality complaints data about their pensions dashboard service for that first six‑month period when they begin operating a pensions dashboard service. In these cases, a firm may wish to consider applying for a waiver in respect of this first complaints report. 7.23 As with all waiver and modification applications, the firm would need to: • state which waiver or modification is sought and why • demonstrate how complying with the rule would be unduly burdensome or not achieve its purpose

75 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • evidence how granting a waiver or modification will not adversely affect our 3 objectives to protect consumers, enhance market integrity and promote competition 7.24 Each application is considered on a case‑by‑case basis. If a firm’s application were to be successful, they would have to report (as normal) for the period following their ARD and thereafter. Under the first report that subsequently falls due, the firm would need to include data for the period from its authorisation or variation of permission date. More information about the process of applying for a waiver or modification is available here. Q29: Do you agree with our complaints reporting proposals for PDS firms? Redress 7.25 Under existing rules, where a complaint is determined in favour of the complainant, the Financial Ombudsman can order the firm pays redress in one or more of the following ways: • a money award against the respondent • an interest award against the respondent • a costs award against the respondent • a direction to the respondent 7.26 We propose to enable the Financial Ombudsman to have the power to make any of the above awards (as appropriate) if a complaint is upheld against a PDS firm. We currently think these types of outcomes cover all the different types of awards the Financial Ombudsman need to make to resolve a complaint against a PDS firm. Q30: Do you agree with our approach to redress? How is the Financial Ombudsman funded? 7.27 The Financial Ombudsman is free for consumers to use. The businesses it covers pay a combination of: • annual fees (levies) which are collected by the FCA for the CJ • case fees – which are usually invoiced and collected by the Financial Ombudsman once cases have been resolved 7.28 In each of the Financial Ombudsman’s jurisdictions, the annual budget reflects the total expected to be raised by levies, plus the total expected to be raised by case fees for the relevant financial year. 7.29 The FCA and the Financial Ombudsman share the powers to make rules on funding the Financial Ombudsman. • We make rules on the amount of the Financial Ombudsman’s annual budget that will be raised by way of the CJ general levy. We are proposing to amend FEES 5 Annex 1R to add a new industry funding block for firms undertaking the new regulated activity. We propose that the tariff base should be a fixed fee of £65.

76 CP22/25 Chapter 7 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • The Financial Ombudsman makes rules on the payment of fees (‘case fees’) by firms in relation to cases referred to the Financial Ombudsman (currently £750). This includes the number of cases that are handled each year without a fee being charged (currently 3 cases). 7.30 PDS firms will begin to pay the CJ general levy and case fees from the year in which they become subject to the Financial Ombudsman’s compulsory jurisdiction, which will be the year in which we grant them permission to undertake the new regulated activity. Q31: Do you agree with our approach to the Financial Ombudsman Service’s fees and levy? The Financial Services Compensation Scheme 7.31 The Financial Services Compensation Scheme (FSCS) is the UK’s statutory compensation scheme of last resort. It can pay compensation to customers if a firm is unable, or is likely to be unable to, pay claims against it. 7.32 At this stage, we are not proposing FSCS cover in respect of the new regulated activity. As no financial transactions will pass through the PDS firm’s connection to the central digital architecture, there should be no loss of client money if a PDS firm failed financially. Furthermore, a consumer should not incur harm from no longer having access to the failed firm's services as other dashboard services and, as a minimum, the MaPS dashboard, will remain available for the consumer to find and view their pensions. We will keep this position under review as the market emerges and evolves. 7.33 Where a post‑view service constitutes another regulated activity (for example, regulated investment advice), the customer of the failed PDS firm may be eligible for the relevant FSCS cover that applies to that activity. The FSCS’s protection covers deposits, insurance provision and distribution, investment business, home finance advice, debt management and funeral plans.

77 CP22/25 Chapter 8 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 8 Authorisation 8.1 This chapter sets out information regarding our proposed approach to authorising PDS firms. Applying for the permission to operate and make a dashboard service available 8.2 It is important that all PDS firms are aware of what they need to do and when. The key elements are: • Firms which are not currently FCA authorised and intend to operate dashboard services must apply to the FCA for authorisation. • Firms which are already authorised and intend to operate dashboard services in addition to their existing activities must submit a variation of permission application. • When submitting an application, all firms must demonstrate how they meet the minimum standards as set out in FSMA (known as the Threshold Conditions), both at the time of authorisation and on an ongoing basis. All FCA regulated firms must meet the Threshold Conditions to be able to undertake the regulated activities they intend to carry out. • The authorisations gateway for applications is planned to open shortly after we publish final rules in Summer 2023. Applications for authorisation or variation of permission and supporting documentation can be submitted at any time after we open the authorisations gateway. • Firms will not be able to transition to the live environment of the PDP ecosystem (and therefore cannot carry on the PDS activity) until they have been granted authorisation and the relevant permission(s). 8.3 The authorisations gateway is an assessment process firms go through to become FCA authorised or to amend their existing permissions. Firms should start work to prepare their business for FCA regulation and prepare their new firm authorisation or variation of permission application in good time before they intend to start operating dashboard services. This is important because, in our experience, it takes time for a firm new to statutory regulation to adapt to the new regulatory standards and prepare a high‑quality application. This is particularly the case for either large firms or firms that have a complex business model. 8.4 We expect that the majority of PDS firms that submit new firm authorisation or variation of permission applications will do so electronically. We are creating a tailored application form to make it simpler for firms to provide the information we need to assess their applications. We will make the finalised version of this form available as early as possible prior to the gateway opening. For illustrative purposes, we have included draft application forms at Appendix 2 of this CP. 8.5 The application form is important because the information supplied, and documents submitted with it, form the basis on which we make our assessment of the firm’s readiness for authorisation and will contribute to our decision on whether to authorise

78 CP22/25 Chapter 8 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms the firm or approve the variation of permission. It is important that firms provide all the information requested to help avoid delays in progressing the application. 8.6 A key piece of information that will be reviewed when we assess an application is the firm’s business plan. The firm’s business plan should provide us with detailed information about its business, such as: • the activity the firm proposes to carry out • the key regulatory, operational and other risks involved • how the firm will reduce these risks • how it will comply with its regulatory obligations on an ongoing basis 8.7 We want to ensure the application assessment gives us sufficient oversight of a PDS firm’s activities and its dashboard services. So, we propose to incorporate the following sections into the new firm authorisation or variation of permission application forms: • Unregulated business. A firm will have to disclose any unregulated business activities. • Outsourcing. A firm which intends to outsource will have to disclose any functions it intends to outsource, including details of the parties, which functions will be outsourced and how the firm will monitor and control the outsourced functions. • Third‑party arrangements. A firm which intends to enter into an arrangement where its dashboard services are made available to a third party’s customers, members or employees will have to disclose the details of this arrangement. This includes explaining how it will disclose to the customer that there is a third‑party arrangement and how the firm will ensure that the third party complies with our requirements. As we explain in Chapter 5, the PDS firm retains responsibility for the dashboard services and for the actions of the third party in relation to the dashboard services. • Financial promotions. A firm which intends to display financial promotions on or around its dashboard service will have to explain how it will ensure financial promotions (whether their own or those of a third party) comply with the relevant PDCOB and COBS 4 requirements. The firm will also have to disclose whether it intends to approve any financial promotions. • Data export. A firm which offers data export will have to provide a description of its dashboard service’s data export functionality and the customer journey to enable us to assess the journey from the customer’s perspective. • Post‑view services. A firm which offers post‑view services will have to disclose the nature of these services. Where applicable, the firm will have to submit an attestation stating that it does not consider additional permissions are required for any post‑view services it wishes to offer. Except where the post-view service is investment advice, the firm will have to provide confirmation that it has undertaken user‑testing on its post‑view services. It will also have to disclose charges for post‑view services and sources of remuneration, to help us understand the firm’s business model. • Remuneration. A firm will have to disclose if it intends to generate revenue from any activities that are not post‑view services, to help us understand its business model.

79 CP22/25 Chapter 8 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Senior Manager approvals 8.8 We set out in Chapter 6 how we propose to apply the Senior Managers and Certification Regime (SM&CR) to PDS firms. Under the SM&CR, those who hold Senior Manager positions within the firm will need to be individually approved by the FCA, as part of the application, and will be accountable for their actions in their capacity as a Senior Manager. For example, firms which are Limited Scope for SM&CR purposes will need to appoint SMF29 (the Limited Scope function). Senior Manager applications should be made at the same time as the firm’s application. Individuals applying for Senior Manager Functions (SMFs) will need to demonstrate they have relevant skills and knowledge to conduct their role. It is also important that they disclose all relevant information as part of their application. International firms 8.9 Many international firms provide services in the UK and make an important contribution to UK financial services. We are committed to a competitive and open financial system. Open and vibrant markets help us meet our objectives and can drive competition and innovation. The new regulated activity of operating and making a pensions dashboard service available will be carried on in the UK, and both UK based firms and international firms can apply for authorisation. 8.10 International firms which want to become authorised should read Our Approach to International Firms and familiarise themselves with our expectations. This document sets out how we approach the authorisation and supervision of international firms and the factors we consider when assessing whether such firms can appropriately manage the additional risks of harm of operating as an international firm. This will help international firms understand our expectations as they prepare their applications for authorisation and should help inform a firm’s decision about how it may want to structure its business to provide regulated financial services in the UK. 8.11 All authorised firms must be capable of being effectively supervised, taking into account the complexity of the firm’s regulated activities, products and how the business is organised. In our view, effective supervision includes being able to access relevant information, monitor on an ongoing basis and making regulatory interventions to respond to specific harm or events. We expect international firms to have appropriate arrangements for their operations, systems and controls, and personnel and decision‑making in relation to their regulated activities in the UK. This includes having an active place of business in the UK, to ensure we can effectively supervise the UK based regulated services they provide. It will typically not suffice if a firm’s local presence is little or nothing more than a UK registered address. The Senior Managers Regime does not have a territorial limit and although decisions will be taken on a case‑by‑case basis, we would also typically expect Senior Managers who are directly involved in managing a firm’s UK activities to spend an adequate and proportionate amount of their time in the UK to ensure those activities are suitably controlled. This will impact international firms that do not have any UK presence but wish to be authorised to operate in the UK in future. Firms that already have an establishment in the UK are likely to be less impacted.

80 CP22/25 Chapter 8 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 8.12 We also expect that these firms mitigate the risks of harm outlined in Our Approach to International Firms, in addition to any other risk of harm identified in our assessment of individual firms. Q32: Do you agree with our proposed approach to authorising international PDS firms? What to expect 8.13 We recognise that some applicants for the new permission will be new to regulation, and we will provide information to support firms and individuals with understanding the changes necessary to become authorised. However, the gateway assessment process is not open‑ended. Firms should be prepared to engage substantively with the process from the moment their application is submitted, have a clear vision of how their business will function post authorisation and have commensurate controls in place. Firms will need to demonstrate at the point of application that, should their application be successful, they are ready, willing and organised to commence regulated activities. This means that at the time of applying for authorisation or a variation of permission, applicants will in practice also need to be ready to meet the requirements in Part 2 of DWP’s regulations and have completed the pre-connection audit which the regulations prescribe – even though they do not form part of the Threshold Conditions. 8.14 We will engage with firms during and after the consultation to answer questions and explain our standard processes, to support their preparations. 8.15 In our experience, some firms may not be able to meet the conditions for authorisation. Firms should reflect now on their ability to meet the Threshold Conditions and, if changes are required to meet them, make these changes before the application gateway opens. If firms do not believe they can meet the Threshold Conditions, they should not apply for authorisation. Where firms apply but are not able to demonstrate they meet the Threshold Conditions, the case officer will ask the firm to withdraw its application or will recommend that the application be formally refused authorisation. 8.16 We are required to determine all applications for authorisation within 6 months from submission of complete applications, or 12 months from the date of submission if the application is incomplete. Future business changes 8.17 Once authorised, a firm which either wants to carry out additional regulated activities that it doesn’t have the necessary permission for, or ceases to carry out a regulated activity, will need to submit a variation of permission application. 8.18 Additionally, if the ownership (control) of a firm is to change, the FCA must be notified via a Change in Control application. The FCA can object to a change or increase in control on various grounds. This includes the reputation, knowledge, skills and experience of the proposed controller who will direct or have influence over the firm, if it is deemed unsuitable.

81 CP22/25 Annex 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Annex 1 Questions in this paper Q1: Do you agree with the way in which we propose to apply the Senior Management Arrangements, Systems and Controls (SYSC) sourcebook to pensions dashboard service (PDS) firms? Q2: Do you agree with our proposed approach to fees for PDS firms? Q3: Do you agree with our proposed application of existing Supervision manual (SUP) rules to PDS firms? Q4: Do you agree with our proposed approach to notification requirements? Q5: Do you agree with our proposed approach to regulatory reporting? Q6: Do you agree with our record‑keeping proposals? Q7: Do you have any comments on our proposal to apply the same approach to enforcement investigations and actions to PDS firms as we do to other regulated firms, as set out in our Enforcement Guide (EG)? Q8: Do you have any comments on our proposal to follow the same procedures for decision‑making and imposing penalties in relation to PDS firms and individuals set out in our Decision Procedure and Penalties Manual (DEPP)? Q9: Do you agree with our proposed prudential requirements for PDS firms? Q10: Do you have any suggestions for how we might develop the capital resources requirement going forward, in particular to calibrate it to PDS firms as the market develops? Q11: Do you think there should be a liquidity requirement for PDS firms going forward and, if so, how this might be calculated? Q12: Do you agree with our proposed approach to wind‑down procedures for PDS firms? Q13: Do you agree with our proposals on general conduct of business rules?

82 CP22/25 Annex 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Q14: Do you agree with our proposals on disclosures, signposts and warnings? Q15: We want disclosures, signposts and warnings to be displayed at the most important moment for consumers. Do you have any evidence as to when PDS firms should communicate these disclosures, signposts and warnings? Q16: Do you agree with our approach to outsourcing? Q17: Do you agree with our proposals relating to where third parties make dashboard services available? Q18: Do you agree with our proposal that data should only be exported to either the customer, the PDS firm, or a firm in the same group as the PDS firm with permission to give investment advice? Q19: Do you agree that the requirements we propose to place around how data is exported and processed ensure an appropriate degree of consumer protection? Q20: Do you agree that our proposals on post‑view services achieve an appropriate balance between allowing scope for innovation and protecting consumers? Q21: Do you agree with our proposals on marketing? Q22: Do you agree with our proposals on cookies and similar tracking technologies? Q23: Do you agree with our proposals to protect dashboard users from scams? Q24: Do you agree with our proposal to apply the Senior Managers and Certification Regime (SM&CR) to PDS firms? Q25: Do you agree with our proposals to treat PDS‑only firms as Limited Scope firms? Q26: Are there any provisions within the Senior Managers and Certification Regime (SM&CR), including the Fit and Proper test for Employees and Senior Personnel (FIT) and the Code of Conduct (COCON), that apply to most firms but should not apply to PDS firms? Q27: Do you agree with our proposals to apply our complaint handling rules and guidance in the Dispute Resolution: Complaints Sourcebook (DISP), including the compulsory jurisdiction of the Financial Ombudsman Service, to PDS firms?

83 CP22/25 Annex 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Q28: Do you agree with the Financial Ombudsman Service’s proposals to exclude activities relating to pensions dashboard services from the voluntary jurisdiction? Q29: Do you agree with our complaints reporting proposals for PDS firms? Q30: Do you agree with our approach to redress? Q31: Do you agree with our approach to the Financial Ombudsman Service’s fees and levy? Q32: Do you agree with our proposed approach to authorising international PDS firms? Q33: Do you think the combination of our proposals in this paper provide adequate scope for an innovative market to emerge, within the parameters set by Parliament? Q34: Do you have any comments on our cost benefit analysis in Annex 2?

84 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Annex 2 Cost benefit analysis Introduction

1. The Financial Services and Markets Act 2000 (FSMA), as amended by the Financial Services Act 2012, requires us to publish a cost benefit analysis (CBA) of our proposed rules. Specifically, section 138I requires us to publish a CBA of proposed rules, defined as ‘an analysis of the costs, together with an analysis of the benefits that will arise if the proposed rules are made’ and ‘an estimate of those costs and of those benefits’.
2. Section 138I also provides that if, in our opinion, the costs or benefits cannot reasonably be estimated or it is not reasonably practicable to produce an estimate, the cost benefit analysis need not estimate them. In that case, the CBA must include a statement of our opinion and an explanation of it.
3. This analysis presents estimates of the significant impacts of our proposal. We provide monetary values for the impacts where we believe it is reasonably practicable to do so. For others, we provide estimates of outcomes in other dimensions. Our proposals are based on carefully weighing up these multiple dimensions and reaching a judgement about the appropriate level of consumer protection, taking into account all the other impacts we foresee. Problem and rationale for intervention
4. Pensions dashboards will be secure digital interfaces that allow consumers to find their pensions and to view basic information about them. Government intends to introduce a new regulated activity to make us responsible for regulating commercial parties which offer a pensions dashboard service. Once this legislative amendment is made, entities wishing to operate and make pensions dashboards services available must: • be or become FCA authorised • obtain the regulatory permission to undertake the new regulated activity • adhere to the requirements we set for firms undertaking this activity
5. In anticipation of the amendment to the Regulated Activities Order (RAO), we are consulting on our proposed regulatory framework for this brand‑new market.
6. Executed well, pensions dashboards have the potential to deliver genuine consumer benefits. Equipped with the information shown on pensions dashboards (administrative details, current value and an estimate of income in retirement – for pensions that are not yet in payment), consumers might be better placed to engage in retirement planning, obtain the right advice or guidance at the right time and ultimately make informed decisions.

85 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 7. However, without a robust regulatory framework in place, consumers using pensions dashboards would also be vulnerable to harms. Our proposed framework, together with the requirements set, or processes introduced, by Government and PDP (summarised in Table 1 in Chapter 2) are intended to mitigate these. 8. As we explain in Chapters 1 and 2, our proposals seek to strike an appropriate balance between consumer protection on one hand and, on the other, harnessing the potential of pensions dashboards and the opportunities that this new digital activity creates for pensions engagement. This is a delicate balance. Impacts and outcomes of our proposals 9. We set out in Diagrams 1‑5 below the expected impacts and outcomes of the proposals we outline in this consultation paper. Diagram 1: Expected impact of PDS firms complying with high‑level standards Firms comply with the high-level standards of behaviour expected of them Outcomes: Senior Managers take responsibility for firms’ conduct and compliance Consumers have confidence in the market; consumers use dashboards and engage with their retirement planning. Firms have effective systems and controls to minimise the risk of consumer harm arising Firms act to deliver good outcomes for retail investors Firms and individuals which do not comply are subject to supervisory, and possibly also enforcement, action

86 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Diagram 2: Expected impact of prudential requirements and complaints resolution rules for PDS firms Outcomes: Consumers have confidence in the market; consumers are more likely to receive the service, or to receive appropriate compensation when things go wrong. Prudential rules Firms hold sufficient capital to meet regulatory requirements Consumers have right of complaint to the Financial Ombudsman Consumer can complain to firm Firms manage prudential risks The Financial Ombudsman can require firms to pay redress, where appropriate Reduced risk of disorderly firm failure Firms can pay redress DISP rules - complaints and access to the Financial Ombudsman Firms have the resources to put things right when they go wrong Firm satisfactorily resolves complaint

87 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Diagram 3: Expected impact of conduct rules Conduct rules for PDS firms General conduct of business rules require high conduct standards from PDS firms, such as acting in customers’ best interests PDS firms clearly communicate information in disclosures, signposts and warnings PDS firm is always responsible and accountable even where multiple parties contribute to bringing dashboard services to market Consumers have confidence in the market; consumers receive the right support to make informed decisions. Consumers are not sold or mis-sold products which may be inappropriate for their needs Consumers are supported to make informed decisions Consumers are protected from scams Clear accountability reduces the likelihood of consumer harm Outcomes:

88 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Diagram 4: Expected impact of conduct rules for data export and post‑view services Rules permitting data export and post-view services Consumers agree to the PDS firm exporting the data to the consumer Firms have an incentive to enter the market Consumers agree to the PDS firm exporting the data to itself Consumers are better able to keep track of their pensions and plan for retirement Consumers are supported to make more informed decisions Consumer data is not misused. There is recourse to redress if it is Consumers share a copy of their data with a regulated adviser or MaPS guider Firms develop innovative services to support consumers with pensions and retirement planning Consumers are empowered to engage in retirement planning, which may increase competition in the market for retirement products and services; market innovation in the interests of consumers Outcomes: Diagram 5: Expected impact of conduct rules for marketing on dashboard services Rules restricting marketing Firms can communicate promotions for investment advice but not products Consumers can easily opt-out of non-essential cookies Firms have an incentive to enter the market, with a reduced risk of conflict of interest More consumers may take financial advice Consumers are not sold or mis-sold products which may be inappropriate for their needs Consumers have confidence in the market; the market develops; consumers understand where they can access information, guidance and advice. Outcomes:

89 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Our analytical approach 10. This CBA looks at the following elements to understand the potential impact of our proposals for regulating PDS firms: • likely costs to firms • elements of our proposals that may generate costs to consumers • costs to the FCA • likely benefits to consumers • likely benefits to industry 11. We have taken a largely narrative, rather than quantitative, approach to this CBA. This analytical approach reflects how we have considered costs and benefits and how we have factored these into designing our proposals. 12. This narrative approach is necessary because: • Operating and making a pensions dashboard service available will be a new activity and no firm is currently offering this service. So, we do not have a basis upon which to confidently estimate costs. We have not conducted a market survey as we think a market survey for a new activity and a market that does not currently exist would have limited value. To quantify costs for this CBA, we consider we would have to make too many assumptions to confidently state that our figures accurately reflected costs. • Our proposed framework gives firms discretion over their business models and the functionality of their dashboard services. We expect costs arising from the firm’s business model and functionality choices to be absorbed in the firm’s initial build cost for the service. 13. However, where appropriate, we have estimated costs based on our standardised cost model and past precedents for new regulated activities, such as the cost‑benefit analyses for our Funeral Plans and Claims Management Companies regulatory frameworks. Baseline and key assumptions 14. We anticipate that the greatest costs for PDS firms arise from decisions or requirements made by other partners in the Government-led pensions dashboards initiative. This includes the Government’s decision to make operating and making pensions dashboard services available a new FCA regulated activity. It also includes compliance with the standards published by the Pensions Dashboards Programme (PDP), on behalf of the Money and Pensions Service (MaPS). This CBA, however, considers only the impacts of the FCA proposals we outline in the first 8 chapters of this paper. 15. Operating and making a pensions dashboard service available will be a new activity and no firm is currently offering this service. 16. We anticipate that some firms that wish to operate a pensions dashboard will already be FCA regulated for other business, such as life insurers and open banking participants. We expect there may be other firms, for example, technology firms and software providers, which have no prior experience of financial services regulation.

90 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 17. This CBA assumes that firms already regulated by us are already complying with relevant Handbook (and, where applicable, Prudential Regulation Authority (PRA) Rulebook) requirements and that they will only incur costs where our proposals impose requirements beyond this. This CBA also assumes that firms which are not currently regulated by us are not currently complying with any regulatory requirements and will therefore need to implement our requirements from this baseline. 18. This is a new market which does not currently exist, so we cannot state with certainty how many firms will enter the market or the size of those firms. We consider that it is not reasonably practicable to provide an estimate of the total costs of our proposals for firms as a whole, given these uncertainties. Instead, we provide an estimate of those costs on a per‑firm basis, where this is reasonably practicable. Where we estimate costs on a per‑firm basis, we have generally done so for large, medium and small firms. In light of this being a new activity and the uncertainties described above, we do not attempt to define what each of these types of firms looks like. 19. Given the nature of the activity and its digital format, we consider the cost estimates for medium and small firms are more likely to be representative of the costs most firms will incur. However, firms will need to take account of their own specific circumstances when considering this CBA. 20. For the avoidance of doubt, individual PDS firms may in practice bear costs greater or lesser than the per‑firm figures provided in this CBA. Alternatively, they may incur more than minimal costs where we have assumed that a firm already regulated by us will not be significantly impacted by needing to comply with our proposals in addition to the regulatory requirements they currently comply with. This will depend, among other things, on the firm’s individual size, composition and current practices. Firms should consider our proposals in relation to their specific operations and provide feedback on this basis, supported by evidence where they believe costs differ. 21. As pensions dashboards are a new activity, we anticipate that PDS firms will be developing their new service alongside consideration of how to implement our proposals. PDS firms will also be required to comply with obligations in DWP’s regulations, PDP’s standards and other relevant legal requirements. So, we expect that some of the costs involved in meeting our requirements will already be required as part of that wider development work or in meeting those other requirements and standards. Where we consider this to definitely be the case, we have taken this into account as part of our analysis. 22. Unless stated otherwise, all references to ‘average’ are the mean average and: • all price estimates are in nominal terms • when estimating net present value of costs and benefits we use a 3.5% discount rate as in the Treasury’s Green Book • we assume that firms will fully comply with the rules we implement 23. We do not include any application of the Fees Manual (FEES) in this CBA. Under section 138I of FSMA, the FCA is exempt from the requirement to carry out and publish a cost‑benefit analysis for such proposals.

91 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Summary of costs and benefits 24. As we explain above, we do not consider it reasonably practicable to estimate all costs in quantitative terms. Where we have been able to estimate costs in quantitative terms, we summarise the estimated costs for new entrant firms in Table 1. Table 1: Summary of estimated costs for new entrant firms Average cost (per firm) Medium Large Familiarisation and legal review £9,500 £29,000 Data security (systems and controls) £28,000 £98,000 Reporting and record‑keeping (supervision) £3,000 £18,000 Prudential requirements £40,000 £40,000 25. We also provide, in Diagrams 1 – 5 above, a visual summary of the expected benefits of our proposals. 26. We set out below more detailed analyses of these costs and benefits for each area of our proposals. Costs to firms Familiarisation and legal review costs 27. We expect parties interested in offering dashboard services to read the proposals in this consultation paper and familiarise themselves with the detailed requirements of our proposed rules and guidance and conduct a legal review, including a gap analysis where appropriate. 28. We have estimated the familiarisation costs to firms using the standardised cost model and set out our estimates in Table 2. Table 2: Familiarisation and legal review costs Firm category Familiarisation cost per firm Legal review cost per firm Total costs per firm Large £15,000 £14,000 £29,000 Medium £4,000 £5,500 £9,500 Small £1,200 £700 £1,900 High‑level standards 29. As we explain in Chapter 3, high‑level standards that apply to all FSMA regulated firms will also apply to PDS firms. This includes the Principles for Business (PRIN), Threshold Conditions (COND) and General Provisions (GEN). We are not consulting on the application of these requirements. These standards apply because of the Government’s decision to make operating/providing a pensions dashboard service a new regulated activity. This CBA does not include an assessment of the direct impacts of the Government’s decisions.

92 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 30. The Consumer Duty will form part of PRIN for new and existing products and services from 31 July 2023. CP21/36 includes a CBA which analyses the costs to firms of implementing the Duty. This CBA uses a baseline of firms which are already regulated, and so is not necessarily reflective of costs a PDS firm which is not already regulated may incur. Given the uncertainties in the new dashboard services market, we do not consider it to be reasonably practicable to estimate the costs and benefits of complying with the Duty for firms new to regulation. Systems and Controls (SYSC) and the Senior Managers and Certification Regime 31. As we explain in Chapter 3, firms we regulate must comply with our rules on systems and controls. These rules set out how firms should organise and manage their affairs. The specific application of SYSC depends on the activities a firm carries out and the permissions it holds. However, the baseline application of SYSC arises from the Government’s decision to make operating/providing a pensions dashboard service a new regulated activity. This includes the application of the Senior Managers and Certification Regime (SM&CR), which we set out in Chapter 6. This CBA does not include an assessment of the direct impacts of the Government’s decisions. 32. We propose that PDS‑only firms are Limited Scope firms and so should follow the application of SYSC as it applies to ‘any other SM&CR firm’ in SYSC 1.1A.1G. We assume new entrant firms will not have appropriate systems and controls in place and so will incur costs in setting up and maintaining the necessary processes and procedures. However, as explained above, we do not include an assessment of these costs in this CBA. 33. Firms which carry out other activities alongside the regulated dashboard service activity will be Core firms, except where the only other permissions the firm holds are agreeing to carry on a regulated activity and the new limited permission for making arrangements with a view to transactions in investments. Firms which hold other permissions will also have to apply SYSC as ‘any other SM&CR firm’ unless as explained in the next paragraph they are brought into a different application of SYSC. 34. Where PDS firms hold the new dashboard service permission alongside permissions for other activities which bring the firms in scope of a different application of SYSC, we propose that they continue to follow the application of SYSC as it applies to those other activities. For example, a firm that is an insurer and holds the PDS permission will have to follow SYSC as it applies to insurers. These firms should already have compliant systems and controls in place to ensure they conduct their business responsibly. 35. In addition to existing requirements in SYSC, we propose a new rule for all PDS firms. This new requirement requires PDS firms to establish, implement and maintain adequate systems and procedures to safeguard the security, integrity and confidentiality of information, with accompanying record‑keeping and notification requirements which we address below. We propose this additional rule as we consider there to be significant scope for consumer harm if customers’ personal or pensions information is compromised, such as being lost or misused. This proposal is separate from, but builds on, requirements placed on PDS firms by PDP’s standards and data protection legislation.

93 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 36. We recognise that PDS firms will likely incur IT costs as a result of this proposed requirement. IT systems may need to be changed or upgraded to safeguard the security, integrity and confidentiality of the data. 37. The size of the IT project will vary according to the solution the firm chooses, and how this overlaps with both the firm’s approach to risk management and any requirements set by PDP’s standards. Assuming the project size is 'small' or 'minor', our standardised cost model suggests the project will take between 46 and 546 total person days for large firms and between 8 and 156 total person days for medium firms with in‑house IT. Across the standard IT project team structure, this leads us to a total one‑off cost per firm of £18,000 to £214,000 for a large firm and £3,000 to £59,000 for a medium firm. We would expect the costs for large and medium firms to be towards the higher end of these ranges. We also estimate that the costs for small firms will closely mirror those for medium firms. Supervision, reporting and record‑keeping 38. To ensure we can effectively regulate and supervise PDS firms, we propose to require firms to comply with the relevant sections of our Supervision (SUP) manual. Supervision is part of being an FCA regulated firm. The application of SUP to PDS firms arises from the Government’s decision to make operating a pensions dashboard service a new regulated activity and so we do not include an assessment of any resulting costs for firms in this CBA. 39. SUP includes reporting and notification requirements. In addition to these general requirements, we propose specific reporting and notification requirements for PDS firms. We set out these requirements in Chapter 3 of this Consultation Paper. 40. We propose proportionate reporting and notification requirements for PDS firms. We have targeted our proposed requirements where we consider there to be the greatest potential for consumer harm. We have proposed record‑keeping requirements in place of reporting and notification requirements in many cases. 41. We expect firms to collect or have in‑house the data we are requesting them to either keep or report to us. However, we anticipate that firms will incur IT costs as a result of these proposals, particularly those new to regulation. Firms which are currently regulated by us will likely already be required to comply with similar reporting and notification requirements in respect of their current business. However, we recognise that there will be a cost to firms which are currently FCA regulated to incorporate additional requirements into their existing IT systems. We consider it likely that all firms will need to make changes to their IT systems to ensure data is stored safely and effectively and can be uploaded to meet our proposed reporting and notification requirements. 42. Using our standardised cost model and assuming this is a small IT project for a new entrant firm, we estimate that the project will take 46 total person days for large firms and 8 total person days for medium firms with in‑house IT. Across the standard IT project team structure, this leads us to a total initial cost per firm of £18,000 for a large firm and £3,000 for a medium firm. We estimate that the costs for small firms will closely mirror those for medium firms.

94 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 43. The costs outlined in paragraph 42 represent the one‑off costs to establish the necessary systems. Firms will have on‑going costs to report and we assume that these costs will not be higher than the set‑up costs. 44. We expect that firms which are already regulated by us will incur smaller costs than outlined in paragraph 42 as they should just have to adjust existing systems set up to meet the record‑keeping, notification and reporting requirements to which they are already subject to reflect the additional requirements as a result of being a PDS firm. Prudential requirements and wind‑down procedures 45. We propose to require PDS firms to hold core capital resources of £40,000. As discussed in Chapter 4 of this CP, we believe this is a reasonable and proportionate starting point to ensure firms are financially stable without being a high barrier to entry. Prudential requirements provide a cushion against losses and ensure firms hold adequate financial resources for contingencies, can put things right when they go wrong and can exit the market in an orderly fashion. 46. We recognise that requiring PDS firms to hold core capital resources of £40,000 is an opportunity cost to firms, as the required capital could instead be used to generate returns elsewhere or to take advantage of other investment opportunities. We also recognise there is a risk of default, where owners may lose their capital if the PDS firm fails. However, we do not consider prudential requirements to be a ‘sunk’ cost or expenditure. Instead, capital resources provide a primary source of funding that, for example, allows the firm to purchase assets or hire staff to generate the firm’s revenue. 47. PDS firms which are authorised for other regulated activities will have to comply with the prudential requirements for whichever activity requires the higher sum of core capital. So, PDS firms which are already required to hold capital greater than £40,000 will therefore incur no additional costs in relation to our proposals. And firms which are already authorised for an activity where the capital requirement is less than £40,000 will have to meet the higher dashboard service specific requirement. The cost to these firms will be the difference between the cope capital sums. 48. We have considered whether to introduce a requirement for Professional Indemnity Insurance (PII) cover but, given the potential challenges for firms in obtaining PII to cover a new regulated activity, we concluded this would place too heavy a burden on PDS firms and likely restrict the development of the market. Conduct rules General conduct rules 49. We propose to require firms to act honestly, fairly and professionally in their customer’s best interests. We have similar rules in several other sectors that we regulate. We do not consider it is reasonably practicable to provide a general estimate of costs. This is because: • costs are inextricably linked to the costs of complying with the more detailed rules • acting in the customer’s best interests may depend on particular circumstances and may in some cases require firms to take different actions with regards to different customers, for which a general estimate of costs cannot be given ex ante

95 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 50. For firms which are already regulated by us, we note that firms should already be meeting these standards in respect of their current business in any case. 51. We are also proposing rules to: • ban firms from seeking to exclude or restrict any duty or liability to a customer, unless the duty or liability arises other than under our regulatory system and it is reasonable to do so • ban firms from accepting payments or non‑monetary benefits which would conflict with the firm’s duty to act in the best interests of the client • ban firms from entering into an agreement with a customer where a charge is, or may become, payable for an optional additional product or to charge the customer for that optional additional product unless the customer has actively opted in 52. We recognise there may be an opportunity cost as a result of the proposals outlined in paragraph 51. However, as operating a dashboard service is a new activity, no firm will currently be doing anything contrary to these requirements and we therefore consider that the cost of complying with these requirements will be minimal for firms beyond familiarisation, which is already captured above. Disclosures, signposts and risk warnings 53. We propose to require PDS firms to display disclosures, signposts and risk warnings to help customers make informed decisions. These communications cover information about the firm and its dashboard service; information about view data; information about decision making and further sources of support; and scam warnings. We outline these requirements in Chapter 5. 54. As a dashboard service is an online or digital service, firms will have to communicate these requirements in a digital medium. We expect compliance with these requirements will form part of firms’ overall IT project to create the dashboard service, and is therefore unlikely to add more than minimal costs to those already calculated. Multiple parties contributing to bringing a dashboard to market 55. We anticipate that the definition of the new regulated activity will permit authorised firms to involve third parties in bringing dashboard services to market. For example, through outsourcing or making legitimate dashboard services operated by regulated PDS firms available to consumers via third parties. PDS firms which choose to enter into such arrangements will be responsible for ensuring the arrangements don't create scope for consumer harm and will have to comply with relevant requirements in our proposed framework. We explain this further in Chapter 5. 56. We think this may benefit industry by permitting firms to collaborate, including pooling resources and buying‑in expertise. This may allow firms to deliver cost‑effective or innovative dashboard services. We also expect this may benefit consumers as it may help the dashboard market develop and so increase the likelihood of consumers encountering pensions dashboards. 57. We anticipate these proposals will also benefit the third parties. Third parties will be able to make a dashboard available to their customers, members or employees without having to meet the costs of building and operating dashboard services or becoming FCA authorised. So, we do not anticipate that third parties entering into third‑party arrangements will bear costs other than minimal costs as a result of our proposed framework.

96 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 58. There may be additional compliance costs for PDS firms which enter into third‑party arrangements. We do not consider it is reasonably practicable to provide a general estimate of these costs – or the benefits – as these are inextricably linked to the nature and terms of the arrangement. It will be for firms to weigh up the costs and benefits given their specific business model and contractual terms and to decide whether to enter into third‑party arrangements. Export of customers’ data 59. We propose to permit PDS firms to offer data export to consumers and to the PDS firm. The proposals we outline in Chapter 5 seek to balance the utility of the export function for consumers and industry with the potential for consumer harm if data is passed to disreputable parties or used for purposes which do not deliver good consumer outcomes. 60. We recognise that industry would like us to be more liberal and to permit data export to any regulated entity. We recognise there is a lost opportunity in prohibiting this, as: • PDS firms cannot monetise the sharing of customers’ data with other regulated entities • other regulated entities cannot receive and subsequently use customers’ data for commercial benefit 61. However, we believe allowing exported data to be shared so widely would dilute the principle of customers being in control of how their data is used and shared and increase the likelihood of data being lost or misused. We consider that our more restrictive approach is also beneficial to PDS firms. PDS firms will have an advantage over competitors which do not invest in bringing a PDS to market. 62. We also note that a consumer may choose to share their copy of their exported data with firms with which they have a trusted relationship and so we are not precluding firms which no do not hold the PDS permission from offering services which use pensions dashboard data. 63. We recognise that our conduct rules restrict how firms can use and retain customers’ pensions information and so will limit a PDS firm’s ability to monetise customers’ data. There will be an opportunity cost to these firms. However, these restrictions are to prevent harm to consumers from conflicts of interests and misaligned incentives, such as information asymmetries or selling customers’ data. 64. We anticipate there will be additional build, operation and compliance costs for firms which choose to offer data export functionality. This is why we are not mandating that firms offer export, even though data export may improve a customer’s experience of using dashboard services. 65. We do not consider it is reasonably practicable to provide a general estimate of costs for a firm which offers data export functionality. Costs are inextricably linked to which types of data export the firm chooses to offer and how the firm operates this function. For example, we are giving firms discretion in deciding how to supply customers with a copy of their exported data and there may be varying costs associated with the different ways of offering this functionality. 66. Despite costs associated with data export, we expect there may be a resulting commercial gain for firms which choose to offer data export functionality. It will be

97 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms for firms to weigh up the costs and benefits from the perspective of their specific business model and decide whether to offer post‑view services. Post‑view services 67. We propose to permit PDS firms to offer customers additional services beyond the core dashboard. Where a PDS firm links to an additional service after displaying a user’s view data, this will be a ‘post‑view service’. We think these post‑view services have the potential to play an important role in engaging people with their pensions and retirement planning. We consider there is significant potential for harm if consumers do not engage with their pensions or plan for their retirement. We also think consumers would be frustrated if dashboard services were limited to only displaying view data. So, we want to ensure that our regulatory framework provides scope to create good post‑view journeys that engage and support consumers. 68. We do not propose to prescribe an exhaustive list of the form that post‑view services may or may not take as we do not want to stifle innovation. However, we propose to set parameters within which PDS firms can innovate in the interests of consumers and to set conduct rules to ensure that customers understand post‑view services. We set out these parameters and restrictions in Chapter 5. 69. We recognise that restricting what form a post‑view service can take may limit, to a certain extent, a PDS firm’s ability to monetise its dashboard services. However, these restrictions are to prevent harm to consumers from conflicts of interests and misaligned incentives, such as information asymmetries. We also consider there to be considerable scope for firms to offer innovative and engaging services to support good customer journeys and, where the firm wishes to, to charge for these services. 70. We anticipate there will be additional build, operation and compliance costs for firms which choose to offer post‑view services. For example, the requirement to user‑test these post‑view services and, where appropriate, to give customers the option of securely retaining a copy of the results of a post‑view service. 71. We do not consider it is reasonably practicable to provide a general estimate of costs associated with our proposed requirements for post‑view services. This is because costs are inextricably linked to the nature of the PDS firm’s post‑view services and how the firm chooses to operate this function. We are not mandating that firms offer post‑view services. PDS firms will have to weigh up the costs and benefits from the perspective of their specific business model and decide whether to offer post‑view services. Marketing 72. We propose to restrict marketing on dashboard services to balance the potential utility of certain marketing against the potential scope for consumer harm if scams or products that might be unsuitable for some pension savers are promoted on dashboard services or if marketing is misleading, confusing or aggressive. We set out these proposed restrictions in Chapter 5. 73. We have considered the costs and benefits of our marketing proposals. We appreciate that industry, and particularly pension providers, may wish to use dashboards to communicate the range of products they offer and that in prohibiting this marketing we may be removing a commercial incentive for them to enter the market. This may have an adverse effect on the development of the market. However, we consider the potential harm to consumers arising from this form of marketing to outweigh the benefits to industry. We consider that our proposed restrictions on marketing will

98 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms prevent harm to consumers from conflicts of interests and misaligned incentives, including information asymmetries. 74. We are not banning all marketing and we consider that our proposals to allow firms to promote regulated investment advice provide scope for firms to monetise their dashboard services by hosting compliant financial promotions. It will be for firms to decide whether including permitted marketing on a dashboard is appropriate for its target market and business model. Dispute resolution 75. As we explain in Chapter 7, firms we regulate must comply with our dispute resolution rules (DISP) unless they are specifically exempted. The DISP sourcebook sets out rules for how firms should handle complaints and when complaints can be referred to the Financial Ombudsman Service. The application of DISP to PDS firms arises from the Government’s decision to make operating and making a pensions dashboard service available a new regulated activity. As with the high‑level principles, this CBA does not include an assessment of the direct impacts of the Government’s decisions. 76. We expect prospective PDS firms which are currently FCA authorised for other business will already be subject to DISP in respect of their current activities and so will only incur minimal costs to extent these procedures to their pensions dashboard services. Costs to consumers 77. It will be for firms to determine their own business models, within the parameters of our proposed regulatory framework. Some firms may look to cross‑subsidise the costs of dashboard services from other activities within their business or group. So we cannot say for certain whether firms will pass on costs to consumers directly or indirectly. 78. DWP’s draft regulations prevent a PDS firm from charging to display a customer’s view data on the core dashboard service. This may make firms more likely to pass on the costs of dashboard services indirectly. However, our proposals do not prevent a PDS firm from charging for additional services, including post‑view services. Costs to the FCA 79. As this is an entirely new market, the costs to the FCA of authorisation, supervision and enforcement cannot be predicted with certainty. The actual costs will ultimately depend upon: • when and how many firms apply for the new permission • the business models of those applicants • the nature of any post view services they introduce

99 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms 80. In chapter 3, we explain our proposals to: • charge applicants a non‑refundable application fee of £5,000 to contribute towards the costs of processing the application and the project costs of establishing the new regime • charge PDS firms a flat periodic fee of £10,000 Benefits to consumers 81. We believe that, executed well, pensions dashboards can deliver real benefits to consumers. Our proposed framework aims to set a high standard of conduct for PDS firms, so that consumers can have confidence in the market. It also aims to support the development of the market, so consumers encounter pensions dashboards in multiple locations and are encouraged to use them. 82. We expect dashboard services will also deliver important benefits to help customers make informed decisions, such as helping them: • track down lost pension pots • consider whether they can make changes to improve their retirement outcomes, such as changing their contribution levels • understand the choices they will need to make when they want to retire 83. Dashboard services will play an important role in delivering these benefits by making pensions information more easily available. In reducing the time and effort needed to take the critical first step for engagement – acquiring relevant information – dashboard services remove an existing barrier to consumer engagement and may incentivise disengaged customers to start engaging or engage further. 84. We have designed our proposed framework to ensure consumers receive the right support to make informed decisions about their retirement planning, which may increase competition in the market for retirement products and services and facilitate market innovation in the interests of consumers. 85. So, we consider the main benefits to consumers from our proposals to be: • engaging consumers with their retirement planning and supporting them to make informed decisions which may, in turn, lead to better consumer outcomes in retirement • creating opportunities for consumers to take advice or guidance, or to seek further support and information • ensuring consumers receive a good service and are treated fairly • ensuring consumers are in control of how their data is used • reducing the risk of conflicts of interests or misaligned incentives so consumers are not sold or mis‑sold products which may be inappropriate for their needs • ensuring consumers receive appropriate compensation when things go wrong • supporting the development of the dashboard services market • fostering market innovation in the interests of consumers • increasing competition in the market for retirement products and services • building confidence in the new dashboard services market and in the pensions industry more widely

100 CP22/25 Annex 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Benefits to industry 86. We anticipate that pensions dashboards will deliver benefits to industry. 87. By setting clear requirements for this new market, we are ensuring that all firms will meet a specified level of conduct. This removes the risk that firms who do not act properly receive a competition advantage and makes it more likely that firms will compete on quality of their dashboard services. This should also lead to improved confidence in the sector, which may encourage more consumers to use dashboard services. 88. We also believe that our regulatory framework will allow firms to innovate in the interests of consumers. As stated above, the development of dashboards may also increase competition as more informed consumers consider their retirement options, so benefiting firms which offer good products and services. 89. Our proposed rules will only apply to firms who choose to become PDS firms. We therefore expect that firms will only incur the costs of becoming a regulated PDS firm and being subject to our rules if the private benefits of doing so outweigh the costs for that firm. Q33: Do you think the combination of proposals in this paper provide adequate scope for an innovative market to emerge, within the parameters set by Parliament? Q34: Do you have any comments on our cost benefit analysis?

101 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Annex 3 Compatibility statement Compliance with legal requirements

1. This Annex records the FCA’s compliance with a number of legal requirements applicable to the proposals in this consultation, including an explanation of the FCA’s reasons for concluding that our proposals in this consultation are compatible with certain requirements under the Financial Services and Markets Act 2000 (FSMA).
2. When consulting on new rules, the FCA is required by section 138I(2)(d) FSMA to include an explanation of why it believes making the proposed rules is (a) compatible with its general duty, under s. 1B(1) FSMA, so far as reasonably possible, to act in a way which is compatible with its strategic objective and advances one or more of its operational objectives, and (b) its general duty under s. 1B(5)(a) FSMA to have regard to the regulatory principles in s. 3B FSMA. The FCA is also required by s. 138K(2) FSMA to state its opinion on whether the proposed rules will have a significantly different impact on mutual societies as opposed to other authorised persons.
3. This Annex also sets out the FCA’s view of how the proposed rules are compatible with the duty on the FCA to discharge its general functions (which include rule‑making) in a way which promotes effective competition in the interests of consumers (s. 1B(4)). This duty applies in so far as promoting competition is compatible with advancing either the FCA’s consumer protection or integrity objectives.
4. In addition, this Annex explains how we have considered the recommendations made by the Treasury under s. 1JA FSMA about aspects of the economic policy of His Majesty’s Government to which we should have regard in connection with our general duties.
5. This Annex includes our assessment of the equality and diversity implications of these proposals.
6. Under the Legislative and Regulatory Reform Act 2006 (LRRA) the FCA is subject to requirements to have regard to several high‑level ‘Principles’ in the exercise of some of our regulatory functions and to have regard to a ‘Regulators’ Code’ when determining general policies and principles and giving general guidance (but not when exercising other legislative functions like making rules). This Annex sets out how we have complied with requirements under the LRRA.

102 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms The FCA’s objectives and regulatory principles: Compatibility statement Strategic objective 7. We consider these proposals are compatible with the FCA’s strategic objective of ensuring that the relevant markets function well because they will drive higher service standards, provide greater consumer protection and promote competition. For the purposes of the FCA’s strategic objective, “relevant markets” are defined by s. 1F FSMA and include the markets for regulated financial services. Operational objectives 8. The proposals set out in this consultation are primarily intended to advance the FCA’s operational objective of consumer protection. They are also relevant to our objective of promoting competition. Consumer Protection objective 9. The mandate of the FCA includes the requirement to secure an appropriate degree of protection for consumers. We have had regard in this consultation to the 8 matters listed in s. 1C(2)(a)‑(h) FSMA on consumer protection. We consider our proposals are compatible with our consumer protection objective. 10. Our proposed systems, controls and governance requirements aim to set high standards for firms entering the new dashboard services market, so consumers can have confidence in using these services. We consider these requirements create an environment where consumers are protected from harm by ensuring firms are effective and responsible and manage risk. In particular, the Senior Manager and Certification Regime sets standards relating to professionalism, conduct and governance and allows the firm and the FCA to hold individuals to account. 11. Our proposed prudential requirements advance our consumer protection objective by promoting financial stability. Requiring firms to hold sufficient capital (of suitable quality) ensures firms are financially sound and can withstand shocks to their finances. This helps to prevent operational risks which may lead to consumer harm. Prudential requirements also drive the right kind of behaviour and mean the firm can put things right when they go wrong and wind‑down in an orderly manner. This helps to protect consumers. 12. Our proposed conduct rules are designed to ensure an appropriate degree of consumer protection. For example, the proposed requirements for PDS firms to act in consumers’ best interests, to disclose important information to support informed decision making and the marketing proposals designed to minimise cross‑selling or consumers entering into products and services which are not suitable for their needs. 13. We consider our proposed rules on complaints and dispute resolution advance our consumer protection objective by ensuing consumers have recourse to complain and, where appropriate, receive redress. Having robust and fair procedures for firms dealing with complaints helps to reduce harms in this new market while having the independent Financial Ombudsman Service consider complaints helps to build trust.

103 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Competition objective and our Competition Duty 14. The mandate of the FCA includes the requirement to promote competition. We have had regard in this consultation to the 5 matters listed in s. 1E(2)(a)‑(e) FSMA on promoting competition and consider our proposals are compatible with our competition objective and our Competition Duty under s.1(B)(4). 15. Our proposed conduct rules, particularly our proposals for data export and post‑view services, advance our competition objective. These requirements are designed to allow firms to compete based on how effectively they innovate in the interests of consumers, and on the cost and quality of their services. Our proposed rules for post‑view services require these services to engage consumers with pensions and retirement planning. Greater consumer engagement could drive effective competition by increasing pressure on pension providers and advisers to ensure the products and services they provide to consumers offer value for money and meet consumers’ needs and demands. The FCA’s regulatory principles 16. In preparing the proposals set out in this consultation, the FCA has had regard to the regulatory principles set out in s. 3B FSMA. The need to use our resources in the most efficient and economic way 17. We have largely based our rules for PDS firms on where potential harm may emerge in this new market. This allows us to use our resources in the most efficient way. 18. Our approach to authorising firms will ensure we prevent harm by identifying poor practice and bad actors at the gateway. This will ensure we use our supervisory resources efficiently as firms we authorise will already meet the Threshold Conditions and our wider expectations. The principle that a burden or restriction should be proportionate to the benefits 19. We have had regard to this principle and considered the impact of proposals on both firms and consumers. We have undertaken a cost‑benefit analysis (CBA) of our proposals, which is included in Annex 2. We consider the costs are proportionate to the benefits. The desirability of sustainable growth in the economy of the United Kingdom in the medium or long term 20. Our proposals have regard to the desirability of sustainable growth in the medium and long term. We consider our proposals facilitate engagement with pensions, innovation in digital markets and competition in the interests of consumers. These forces may drive sustainable economic growth. 21. Firms entering this new market should be more sustainable due to our prudential requirements, and should provide a higher standard of service overall due to our conduct regime.

104 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms The general principle that consumers should take responsibility for their decisions 22. Our proposals have regard to this principle. Our proposals require PDS firms to clearly communicate necessary information to consumers at the right stage in the customer journey. Consumers will remain responsible for their decisions but will be in a position to know what steps to take to make informed decisions. The responsibilities of senior management 23. We have had regard to this principle and have proposed to apply the Senior Managers and Certification Regime (SM&CR) to PDS firms. The SM&CR aims to reduce harm to consumers and strengthen market integrity by creating a system that enables firms and the FCA to hold individuals to account. This will help to: • encourage staff to take personal responsibility for their actions • improve conduct at all levels • make sure firms and staff clearly understand and can demonstrate who does what The desirability of recognising differences in the nature of, and objectives of, businesses carried on by different persons including mutual societies and other kinds of business organisation 24. We have had regard to this principle and do not believe that our proposals are relevant for this principle. Our proposals do not discriminate between different business models. This is intended to ensure a level playing field for all firms in the market. The desirability of publishing information relating to persons subject to requirements imposed under FSMA, or requiring them to publish information 25. We have had regard to this principle and do not believe that our proposals undermine it. The principle that we should exercise of our functions as transparently as possible 26. We have engaged regularly, and worked closely, with other delivery partners in the Government‑led pensions dashboard initiatives, including the Department for Work and Pensions (DWP), the Pensions Dashboards Programme (PDP) and the Treasury. We have also engaged with consumer protection representatives and industry while shaping our proposals and we will continue to do so as part of this consultation process before making final rules. Financial crime 27. In formulating these proposals, the FCA has had regard to the importance of taking action intended to minimise the extent to which it is possible for a business carried on (i) by an authorised person or a recognised investment exchange; or (ii) in contravention of the general prohibition, to be used for a purpose connected with financial crime (as required by s. 1B(5)(b) FSMA). We do not consider this relevant in relation to our proposals. Expected effect on mutual societies 28. The FCA does not expect the proposals in this paper to have a significantly different impact on mutual societies than any other PDS firm or present them with any more or less burden than other PDS firms.

105 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Equality and diversity 29. We are required under the Equality Act 2010 in exercising our functions to ‘have due regard’ to the need to eliminate discrimination, harassment, victimisation and any other conduct prohibited by or under the Act, advance equality of opportunity between persons who share a relevant protected characteristic and those who do not, to and foster good relations between people who share a protected characteristic and those who do not. 30. As part of this, we ensure the equality and diversity implications of any new policy proposals are considered. The outcome of our consideration in relation to these matters is summarised in Chapter 2 of the Consultation Paper. Legislative and Regulatory Reform Act 2006 (LRRA) 31. We have had regard to the principles in the LRRA for the parts of the proposals that consist of general policies, principles or guidance. We consider that the proposals are proportionate and promote our operational objectives of consumer protection and effective competition, as well as our strategic objective to ensure that markets function well. We consider that the proposals will result in an appropriate level of consumer protection without creating undue burdens on the industry or adversely affecting competition. Regulators’ Code (2014) 32. We have had regard to the Regulators’ Code for the parts of the proposals that consist of general policies, principles or guidance and consider that our proposals meet the following principles: • regulators should carry out their activities in a way that supports those they regulate to comply and grow • regulators should base their regulatory activities on risk • regulators should ensure clear information, guidance and advice is available to help those they regulate meet their responsibilities to comply • regulators should ensure that their approach to their regulatory activities is transparent Treasury recommendations about economic policy 33. In the remit letters published by the Chancellor of the Exchequer on 23 March 2021 and 7 April 2022, the Chancellor affirmed the importance of a resilient, effectively regulated and competitive financial system that provides vital financial services while protecting consumers. In setting out aspects of the Government’s economic policy to which the FCA should have regard, the Chancellor addressed several considerations. These included that the Government wants to see:

106 CP22/25 Annex 3 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms • more competition, including minimising barriers to entry and growth, as well as ensuring a diversity of business models within the industry • innovation in financial services, including encouraging new methods of engaging with consumers, recognising differences in the nature and objectives of business models, promoting effective competition and ensuring burdens are proportionate 34. We have had regard to the Treasury’s recommendations under section 1JA FSMA. As set out within this Consultation Paper and Annex, we consider that our proposals will foster effective competition and innovation while protecting consumers from harm.

107 CP22/25 Annex 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Annex 4 Abbreviations used in this paper Abbreviation Description ARD Accounting reference date CBA Cost benefit analysis CDA Central digital architecture CJ Compulsory jurisdiction (of the Financial Ombudsman Service) CMCOB Claims Management: Conduct of Business sourcebook COBS Conduct of Business Sourcebook COCON Code of Conduct sourcebook COMP Compensation sourcebook CONC Consumer Credit sourcebook COND Threshold Conditions sourcebook CP Consultation Paper CPI Consumer Prices Index CREST The Council of Registered Ethical Security Testers DB Defined benefit pension DC Defined contribution pension DEPP Decision Procedure and Penalties Manual (DEPP) DISP Disputes Resolution: Complaints sourcebook DPIA Data Protection Impact Assessment DWP Department for Work and Pensions EG Enforcement Guide FCA Financial Conduct Authority

108 CP22/25 Annex 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Abbreviation Description FEES Fees Manual FIT Fit and Proper test for Employees and Senior Personnel sourcebooks FPET Financial Promotions and Enforcement Taskforce FSCS Financial Services Compensation Scheme FSMA Financial Services and Markets Act 2000 GEN General Provisions sourcebook HMT His Majesty’s Treasury ICO Information Commissioner’s Office IPRU‑INV Interim Prudential sourcebook for Investment Business LRRA Legislative and Regulatory Regime Act 2006 MaPS Money and Pensions Service MELL Management Expenses Levy Limit MI Management information MIPRU Prudential sourcebook for Mortgage and Home Finance Firms, and Insurance Intermediaries PDCOB Pensions Dashboard Conduct of Business sourcebook PDP Pensions Dashboards Programme PDS Pensions Dashboard Service PECR Privacy and Electronic Communications Regulations PeI Pension Identifier PERG Perimeter Guidance Manual PII Professional Indemnity Insurance PRA Prudential Regulation Authority PRIN Principles for Business sourcebook PS Policy Statement

109 CP22/25 Annex 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Abbreviation Description PSR Payment Services Regulations 2017 RAG Regulated activity group RAISP Registered Account Information Service Provider RAO Regulated Activities Order RDC Regulatory Decisions Committee SC Senior Manager Conduct Rule SM&CR Senior Managers and Certification Regime SMF Senior Manager Function SOR Statement of Responsibilities SUP Supervision manual SYSC Senior Management Arrangements, Systems and Controls sourcebook TPR The Pensions Regulator UK GDPR UK General Data Protection Regulation URL Uniform Resource Locator VJ Voluntary jurisdiction (of the Financial Ombudsman Service) VOP Variation of permission WDPG Wind‑down Planning Guide

110 CP22/25 Annex 4 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms We make all responses to formal consultation available for public inspection unless the respondent requests otherwise. We will not regard a standard confidentiality statement in an email message as a request for non‑disclosure. Despite this, we may be asked to disclose a confidential response under the Freedom of Information Act 2000. We may consult you if we receive such a request. Any decision we make not to disclose the response is reviewable by the Information Commissioner and the Information Rights Tribunal. All our publications are available to download from www.fca.org.uk. If you would like to receive this paper in an alternative format, please call 020 7066 7948 or email: publications_graphics@fca.org.uk or write to: Editorial and Digital team, Financial Conduct Authority, 12 Endeavour Square, London E20 1JN Sign up for our news and publications alerts

CP22/25 Appendix 1 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Appendix 1 Draft Handbook text

FCA 2023/XX PENSIONS DASHBOARD SERVICE INSTRUMENT 2023 Powers exercised by the Financial Conduct Authority A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 137A (The FCA’s general rules); (2) section 137T (General supplementary powers); (3) section 139A (Power of the FCA to give guidance); and (4) section 226 (Compulsory jurisdiction). B. The rule-making provisions listed above are specified for the purposes of section 138G(2) (Rule-making instruments) of the Act. C. The FCA consents to and approves the rules and guidance and standard terms made and amended and fixed and varied by the Financial Ombudsman Service Limited, as set out at Annex G. Powers exercised by the Financial Ombudsman Service Limited D. The Financial Ombudsman Service Limited makes and amends the rules and guidance for the Voluntary Jurisdiction and fixes and varies the standard terms for Voluntary Jurisdiction participants, as set out in Annex G to this instrument, in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 227 (Voluntary jurisdiction); (2) paragraph 8 (Information, advice and guidance) of Schedule 17; (3) paragraph 18 (Terms of reference to the scheme) of Schedule 17; and (4) paragraph 20 (Voluntary jurisdiction rules: procedure) of Schedule 17. E. The making and amendment of the rules and guidance and the fixing and varying of the standard terms by the Financial Ombudsman Service Limited, as set out at paragraph D above, is subject to the consent and approval of the Financial Conduct Authority. Commencement F. This instrument comes into force on [date]. Amendments to the Handbook G. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2) below.

FCA 2023/XX Page 2 of 87 (1) (2) Glossary of definitions Annex A Principles for Business sourcebook (PRIN) Annex B Senior Management Arrangements, Systems and Controls sourcebook (SYSC) Annex C Fees manual (FEES) Annex D Supervision manual (SUP) Annex F Dispute Resolution: Complaints sourcebook (DISP) Annex G Making the Pensions Dashboards: Conduct of Business sourcebook (PDCOB) H. The FCA makes the rules and gives the guidance in accordance with Annex E to this instrument. I. The Pensions Dashboards: Conduct of Business sourcebook (PDCOB) is added to the Business Standards block within the Handbook, immediately after FPCOB. Notes J. In the Annexes to this instrument, the “notes” (indicated by “Editor’s note:”) are included for the convenience of readers but do not form part of the legislative text. Citation K. This instrument may be cited as the Pensions Dashboard Service Instrument 2023. By order of the Board of the Financial Conduct Authority [date] By order of the Board of the Financial Ombudsman Service Limited [date]

FCA 2023/XX Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. Insert the following new definitions in the appropriate alphabetical position. The text is not underlined. [Editor’s note: this instrument takes into account changes introduced by the Pension Schemes (Information to Dashboards) Instrument 2022 (FCA 2022/38), which comes into force on 30 March 2023.] Dashboard Regulations means [The Pensions Dashboards Regulations 2022]. data export (in PDCOB) the service by which a customer’s pensions dashboard view data is transferred outside the MaPS pensions dashboard ecosystem. data export to the firm (in PDCOB) data export to a firm or a connected person in accordance with PDCOB 9.2.1R(2). PDCOB Pensions Dashboards: Conduct of Business sourcebook. pensions dashboard platform means: (1) view services; and (2) (where applicable) permitted dashboard services. permitted dashboard service means: (1) data export; and (2) post-view services that: (a) (i) are provided by a firm with the permission to carry on regulated pensions dashboard activity; (ii) are not advising on investments (except pension transfers and pension opt-outs; and (iii) meet the requirements of PDCOB 10.3.1R(1); or

FCA 2023/XX Page 4 of 87 (b) (i) are either provided by a firm with the permission to carry on regulated pensions dashboard activity or a connected person; and (ii) amount to advising on investments (except pension transfers and pension opt-outs) that meet the requirements of PDCOB 10.3.1R(2). post-view services services, other than data export, provided after the view services that a customer accesses via the pensions dashboard service. regulated pensions dashboard activity the regulated activity in article [X] of the Regulated Activities Order. third party dashboard access provider a person that, under an arrangement with a firm that has permission to carry on regulated pensions dashboard activity, is permitted to make that firm’s pensions dashboard platform available to a customer. third party dashboard arrangement an arrangement, entered into by a firm with permission to carry on regulated pensions dashboard activity, under which another person is permitted to make that firm’s pensions dashboard platform available to a customer. view services services providing the display of pensions dashboard view data by a firm carrying on regulated pensions dashboard activity. Amend the following definitions as shown. connected person … (7) (in PDCOB) a member of the same group as the firm that has permission to advise on investments (except pension transfers and pension opt-outs). core capital resources requirement … (2) for a firm with a Part 4A permission to carry on funeral plan distribution to which FPCOB 15 applies and that does not also carry on any other regulated funeral plan activity, the requirement specified in FPCOB 15.6.1R; or (3) for a firm with a Part 4A permission to carry on any other regulated funeral plan activity to which FPCOB 15 applies, the requirement specified in FPCOB 15.5.1R.; (4) for a firm with a Part 4A permission to carry on regulated pensions dashboard activity to which PDCOB applies, the requirement specified in PDCOB 11.5.1R; or

FCA 2023/XX Page 5 of 87 (5) for a firm to which PDCOB applies that also has a Part 4A permission to carry on other regulated activities, the requirement specified in PDCOB 11.6.1R. customer … (B) in the FCA Handbook: (1) (except in relation to SYSC 19F.2, ICOBS, retail premium finance, a credit-related regulated activity, regulated claims management activity, regulated funeral plan activity, regulated pensions dashboard activity, MCOB 3A, an MCD credit agreement, CASS 5, PRIN in relation to MiFID or equivalent third country business, DISP 1.1.10-BR, PROD 1.4 and PROD 4) and in relation to payment services and issuing electronic money (where not a regulated activity) a client who is not an eligible counterparty for the relevant purposes. … (10) (in relation to regulated pensions dashboard activity) a pensions dashboard user or a potential pensions dashboard user. customer’s best interests rule (1) … (-2) (in relation to regulated pensions dashboard activity) PDCOB 2.1.1R. (2) … fair, clear and not misleading rule … (2) … (-3) (in relation to regulated pensions dashboard activity) PDCOB 4.2.1R. (3) (for all other purposes) COBS 4.2.1R. general solvency requirement (1) (in relation to regulated funeral plan activity) the requirement specified in FPCOB 15.2.1R. (2) (in relation to regulated pensions dashboard activity) the requirement specified in PDCOB 11.2.1R. individual capital guidance (1) (other than in (2) and (3)) guidance given to a firm about the amount and quality of capital resources that the appropriate regulator thinks the firm should hold at all times under the

FCA 2023/XX Page 6 of 87 overall financial adequacy rule as it applies on a solo level or a consolidated level. … (3) (in PDCOB 11) guidance given to a firm about the amount and quality of capital resources that the FCA thinks the firm should hold at all times under PDCOB 11.2.1R (General solvency requirement). individual liquidity guidance … (3) (in PDCOB 11) guidance given to a firm about the amount and quality and funding profile of liquidity resources that the FCA thinks the firm should hold at all times under PDCOB 11.2.1R (General solvency requirement). pensions dashboard find data (1) (in COBS 19.11) data which enables pensions dashboard matching to take place, comprising: (a) pensions dashboard verified identity attributes; (b) pensions dashboard self-asserted data elements; and (c) any other data elements that the Money and Pensions Service may add as part of the services that it provides. (2) (in PDCOB) (a) data which enables pensions dashboard matching to take place, comprising: (i) pensions dashboard verified identity attributes; (ii) pensions dashboard self-asserted data elements; and (iii) any other data elements that the Money and Pensions Service may add as part of the services that it provides; or (b) ‘find data’ as defined in Schedule 1 of the Dashboard Regulations, as applicable. pensions dashboard user a consumer who is using a pensions dashboard service (either directly or via a delegate as defined under Regulation 8(7) of the Dashboard Regulations) to locate information in relation to their pensions. pensions dashboard view data (1) (in COBS 19.11) the data comprising: (a) administrative data;

FCA 2023/XX Page 7 of 87 (b) signpost data; (c) value data; and (d) contextual information. (2) (in PDCOB) the data comprising the information that must be displayed on a pensions dashboard service under Regulations 8, 9 and 10 of the Dashboard Regulations. regulated activity … (B) in the FCA Handbook: (in accordance with section 22 of the Act (Regulated activities)) the activities specified in Part II (Specified activities), Part 3A (Specified activities in relation to information) and Part 3B (Claims management activities in Great Britain) of the Regulated Activities Order, which are, in summary: … (tv) … (tw) regulated pensions dashboard activity; … …

FCA 2023/XX Page 8 of 87 Annex B Amendments to the Principles for Business sourcebook (PRIN) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Rules about application … 3.2 What? 3.2.1A R PRIN applies with respect to the carrying on of: … (3) ancillary activities in relation to designated investment business, home finance activity, regulated funeral plan activity, credit￾related regulated activity, insurance distribution activity, regulated pensions dashboard activity and accepting deposits; and … 3.4 General Clients and the Principles 3.4.-1 R PRIN 3.4.1R, PRIN 3.4.2R and PRIN 1 Annex 1 do not apply with respect to: … (4) … (-5) regulated pensions dashboard activity; or (5) …

FCA 2023/XX Page 9 of 87 Annex C Amendments to the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Application and purpose … 1 Annex 1 Detailed application of SYSC … Part 2 Application of the common platform requirements (SYSC 4 to 10) … 2.10 R The provisions on record-keeping in SYSC 9 and articles 21 and 72 of the MiFID Org Regulation apply as set out in SYSC 1 Annex 1.2.8R and SYSC 1 Annex 1.2.8AR, except that they only apply to the carrying on of ancillary activities that are performed in relation to: … (4) credit-related regulated activity.; (5) regulated pensions dashboard activity. … Part 3 Tables summarising the application of the common platform requirements to different types of firm … Table A: Application of the common platform requirements in SYSC 4 to SYSC 10 Provision SYSC 4 COLUMN A Application to a common platform firm other than to a COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a full-scope UK AIFM of an authorised AIF COLUMN B Application to all other firms apart from insurers, UK ISPVs,

FCA 2023/XX Page 10 of 87 UCITS investment firm managing agents, the Society, full￾scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 4.1.5R … SYSC 4.1.5AR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity. SYSC 4.1.5BR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity. SYSC 4.1.5CR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity. … Provision SYSC 6 COLUMN A Application to a common platform firm other than to a UCITS COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a full-scope UK AIFM of an authorised AIF COLUMN B Application to all other firms apart from insurers, UK ISPVs, managing agents, the

FCA 2023/XX Page 11 of 87 investment firm Society, full￾scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 6.3.9R Rule For firms carrying on a credit-related regulated activity or regulated claims management activity, or operating an electronic system in relation to lending, applies only where the Money Laundering Regulations apply to the firm. Rule does not apply to a firm for which a professional body listed in Schedule 1 to the Money Laundering Regulations, and not the FCA, acts as the supervisory authority for the purposes of those regulations. (FCA Handbook only). Rule does not apply to a firm carrying on

FCA 2023/XX Page 12 of 87 regulated pensions dashboard activity. … 3 Systems and controls … 3.2 Areas covered by systems and controls … Investment strategy and investment decision making … Operators of pensions dashboard services: security, integrity and confidentiality 3.2.24 R A firm carrying on regulated pensions dashboard activity must comply with the requirements set out in SYSC 4.1.5AR, SYSC 4.1.5BR and 4.1.5CR as if those rules applied to firms to which SYSC 3 applies. … 4 General organisational requirements 4.1 General requirements … Mechanisms and procedures for a firm … 4.1.5 R … Operators of pensions dashboard services: security, integrity and confidentiality 4.1.5A R A firm carrying on regulated pensions dashboard activity must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of any personal or pensions information held by the firm, taking into the account the nature of the information in question.

FCA 2023/XX Page 13 of 87 4.1.5B R A firm carrying on regulated pensions dashboard activity must keep appropriate records to demonstrate compliance with SYSC 4.1.5AR. 4.1.5C R (1) If there is an incident which may compromise the security, integrity and confidentiality of any personal or pensions information held by the firm, the firm must immediately notify the FCA using the relevant form in Connect. (2) A notification under (1) must contain: (a) a description of the incident; (b) the time of the incident (where known); and (c) a description of the steps the firm is taking since being made aware of the incident (where applicable). … 23 Senior managers and certification regime: Introduction and classification … 23.2 Definitions and types of firms … 23.2.3 G Broadly speaking, firms covered by the senior managers and certification regime that are regulated by the FCA are divided into three categories: … (3) Firms whose business is limited to certain types. These are called “limited scope SMCR firms”. A large number of firms will be in this category. The main examples are: … (f) a firm that only has permission for benchmark activities and has the benefit of a waiver treating it as a limited scope SMCR firm as described in SYSC 23 Annex 1 6.12R (Benchmark firms: Waiver applying limited scope status); and (g) a firm that only has permission for funeral plan distribution.; and (h) a firm that only has permission for regulated pensions dashboard activity and, if applicable, making arrangements with a view to transactions in investments which has a limitation to activities which are post-view services as permitted under PDCOB 10. …

FCA 2023/XX Page 14 of 87 23 Annex 1 Definition of SMCR firm and different types of SMCR firms … Part Six: Definition of limited scope SMCR firm … 6.27 G … Pensions Dashboard Service 6.28 R A firm is a limited scope SMCR firm if it meets the following conditions: (1) it has permission to carry on regulated pensions dashboard activity; and (2) either: (i) it does not have permission to carry on any other regulated activity; or (ii) it does not have permission to carry on any other regulated activity except for: (a) permission to carry on making arrangements with a view to transactions in investments which has a limitation to activities which are post-view services as permitted under PDCOB 10; and/or (b) permission for agreeing to carry on a regulated activity in respect of regulated pensions dashboard activity. 6.29 G The FCA considers that, if a firm offers post-view services as permitted under PDCOB 10, the firm may need permission to carry on the regulated activity of making arrangements with a view to transactions in investments which has a limitation to activities which are post-view services as permitted under PDCOB 10. In that scenario, the firm will be a limited scope SMCR firm if it meets the requirement in SYSC 23 Annex 1 6.28R.

FCA 2023/XX Page 15 of 87 Annex D Amendments to the Fees manual (FEES) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Application, Notification and Vetting Fees … 3 Annex 1R Authorisation fees payable ... Part 2 – Pricing categories applicable to applications made in the following activity groupings in the A, B, C, CC and CMC fee blocks Activity grouping Description Applicable pricing category in FEES 3 Annex 1AR ... A.23 Carrying out a funeral plan contract as provider and entering as provider into a funeral plan contract … A.24 Carrying on regulated pensions dashboard activity 5 ... 4 Periodic fees … 4.2 Obligation to pay periodic fees ... 4.2.7K R Where the measure is not cumulative (e.g. the number of traders for fee￾block A10), the firm must use the figure relating to the valuation date specified in FEES 4 Annex 1R Part 5 (e.g. 31 December for A10). Table A

FCA 2023/XX Page 16 of 87 sets out the reporting requirements for the key fee-blocks when full actual data is not available: Table A: calculating tariff data for second and subsequent years of authorisation when full trading figures are not available Fee-block Tariff base Calculation where trading data are not available ... A.23 ... A.24 Flat fee Not applicable ... 4 Annex 1AR FCA activity groups, tariff bases and valuation dates Part 1 This table shows how the FCA links the regulated activities for which a firm has permission to activity groups (fee-blocks). A firm can use the table to identify which fee-blocks it falls into based on its permission. Activity group Fee payer falls into the activity group if: ... A.23 Funeral plan intermediaries and funeral plan providers … A.24 Pensions dashboard firms Its permissions include carrying on regulated pensions dashboard activity. ... Part 3 This table indicates the tariff base for each fee-block set out in Part 1. The tariff base in this Part is the means by which the FCA measures the amount of business conducted by a firm for the purposes of calculating the annual periodic fees payable to the FCA by that firm.

FCA 2023/XX Page 17 of 87 Activity group Tariff base ... A.23 ANNUAL INCOME Annual income as defined in FEES 4 Annex 11AR. A.24 Not applicable ... Part 5 This table indicates the valuation date for each fee-block. A firm can calculate its tariff data in respect of fees payable to the FCA by applying the tariff bases set out in Part 3 with reference to the valuation dates shown in this table. Activity group Valuation date IN THIS TABLE, REFERENCES TO SPECIFIC DATES OR MONTHS ARE REFERENCES TO THE LATEST ONE OCCURRING BEFORE THE START OF THE PERIOD TO WHICH THE FEE APPLIES, UNLESS OTHERWISE SPECIFIED - E.G. FOR 2013/14 FEES (1 APRIL 2013 TO 31 MARCH 2014), A REFERENCE TO DECEMBER MEANS DECEMBER 2012. Where a firm’s tariff data is in a currency other than sterling, it should be converted into sterling at the exchange rate prevailing on the relevant valuation date. ... A.23 Annual income for the financial year ended in the calendar year ending 31 December. A.24 Not applicable ... 4 Annex 2A FCA Fee rates for the period from 1 April 2022 to 31 March 2023 Part 1 This table shows the tariff rates applicable to each of the fee blocks set out in Part 1 of FEES 4 Annex 1AR. ...

FCA 2023/XX Page 18 of 87 Activity group Fee payable … A.23 Band Width (£ thousands of annual income (AI)) Fee (£/£ thousand or part £ thousand of AI)

100 [tbc] A.24 £10,000 ... 5 Financial Ombudsman Service Funding … 5 Annex 1R Annual General Levy Payable in Relation to the Compulsory Jurisdiction for 2022/23 … Compulsory jurisdiction – general levy Industry block Tariff base General levy payable by firm … 26 – firms carrying on regulated pensions dashboard activity Flat fee Levy of £65 …

FCA 2023/XX Page 19 of 87 Annex E Pensions Dashboards: Conduct of Business sourcebook (PDCOB) In this Annex, all of the text is new and is not underlined. [Editor’s note: this instrument takes into account changes introduced by the Pension Schemes (Information to Dashboards) Instrument 2022 (FCA 2022/38), which comes into force on 30 March 2023.] 1 Application and purpose 1.1 Application 1.1.1 G (1) The Pensions Dashboards: Conduct of Business sourcebook (PDCOB) is the specialist sourcebook for firms carrying on regulated pensions dashboard activity and connected persons that offer investment advice as post-view services. (2) PDCOB applies as described in the General Application provisions in PDCOB 1.3, unless modified in the manner described in the application provisions of a particular chapter, section or rule. 1.1.2 G Firms are reminded that they may require permissions to carry on regulated activities other than regulated pensions dashboard activity – for example, advising on investments (except pension transfers and pension opt-outs) in which case firms will need to comply with the conduct requirements in the FCA Handbook that are relevant to those activities in the usual way. 1.1.3 G Firms are also reminded that they may need to comply with other conduct of business focused sourcebooks in the FCA Handbook (for example, COBS) where they also fall within the application provisions of those sourcebooks. 1.2 Purpose 1.2.1 G The purpose of PDCOB is to set out the detailed obligations that are specific to a firm carrying on regulated pensions dashboard activity and any related services carried on by that firm that are permitted under the rules in this sourcebook. PDCOB 15 refers to the other high-level obligations in the FCA Handbook that apply to such firms, for example, PRIN, SYSC and GEN. 1.3 General application Who? What? 1.3.1 R This sourcebook applies to a firm in relation to any of the following activities it carries on, offers or allows access to: (1) regulated pensions dashboard activity; (2) any post-view services;

FCA 2023/XX Page 20 of 87 (3) data export; (4) any other activity which could be carried out in a way that is connected to the pensions dashboard service, including: (a) any marketing related to regulated pensions dashboard activity or post-view services; and (b) any communications related to (1) to (3) above. 1.3.2 R Where a firm involves a third party dashboard arrangement in any part of the activities listed in PDCOB 1.3.1R, the rules in PDCOB 8 apply. 1.3.3 G Where a connected person offers investment advice as a post-view service, it will be a firm that is subject to the rules in this sourcebook that are applicable to the provision of investment advice as a post-view service. In such situations, a reference in the rules to a ‘firm’ is to be read as including a reference to a ‘connected person’. 1.3.4 R To the extent that a connected person is offering investment advice to a customer as a permitted post-view service, the firm with permission to carry out regulated pensions dashboard activity must also procure that the connected person complies with the rules in this sourcebook that apply to a firm in relation to the provision of investment advice as a post-view service. A reference in the rules to a ‘firm’ providing or offering services is to be read as including services offered or provided by to a ‘connected person’. 1.3.5 R For the purposes of PDCOB 1.3.3G and PDCOB 1.3.4R, the rules in this sourcebook that apply to a firm or a connected person that provide investment advice as a post-view service are PDCOB 7.2, PDCOB 7.3, PDCOB 9.5.5R and PDCOB 10.7.1R. Where? 1.3.5 R The sourcebook applies to all regulated pensions dashboard activity wherever in the world the customer accesses the pensions dashboard platform. 1.3.6 R A Gibraltar-based firm with permission for regulated pensions dashboard activity must comply with the provisions of PDCOB relating to regulated pensions dashboard activity. 2 General principles 2.1 The customer’s best interests rule 2.1.1 R A firm must act honestly, fairly and professionally in accordance with the best interests of its customer (the customer’s best interests rule). 2.2 Exclusion of liability

FCA 2023/XX Page 21 of 87 2.2.1 R A firm must not seek to exclude or restrict, or rely on any exclusion or restriction of any duty or liability it may have to a customer, unless: (1) it is reasonable for it to do so and it is consistent with the firm’s obligations under the customer’s best interest rule; and (2) the duty or liability arises other than under the regulatory system. 2.2.2 G The general law, including the CRA, also limits the scope for a firm to exclude or restrict any duty or liability to a customer. 2.3 Active election by a customer 2.3.1 R In this sourcebook, references to an active election by a customer must not be read to include an omission by a customer. 2.3.2 G A failure by a customer to change a default option such as a pre-ticked box on a website is an example of an omission by a customer for the purposes of PDCOB 2.3.1R. 2.4 Inducements 2.4.1 R A firm must not pay or accept any fee or commission, or provide or receive any non-monetary benefit, unless the payment or acceptance of the fee or commission, or provision or receipt of the non-monetary benefit, would not impair compliance with the firm’s duty to act honestly, fairly and professionally in the best interests of the customer. 2.4.2 G (1) Principle 8 requires a firm to manage conflicts of interest fairly, both between itself and its customers and between a customer and another customer. This principle extends to soliciting or accepting inducements where this would conflict with a firm’s duties to its customers. A firm that offers such inducements should consider whether doing so conflicts with its obligations under: (a) Principle 1 to act with integrity; (b) Principle 12 to act to deliver good outcomes for retail customers; and (c) the customer’s best interests rule. (2) An inducement is a benefit offered to a firm, or any person acting on its behalf, with a view to that firm, or that person, adopting a particular course of action. This can include, but is not limited to, cash, cash equivalents, commission, goods, hospitality or training programmes. (3) Firms should also refer to the rules on charging for the pensions dashboard service and post-view services (PDCOB 2.5 and PDCOB 10.4.1R to 10.4.3R).

FCA 2023/XX Page 22 of 87 2.5 Restrictions on charging in relation to dashboard services 2.5.1 G Firms are reminded that the Dashboard Regulations require that view services must be provided without charge. Prohibition on charging other than for permitted dashboard services 2.5.2 R A firm must not impose a charge on a customer for any service other than for a permitted dashboard service. Prohibition on charging by other parties 2.5.3 R A firm must not permit any other person (other than a connected person in relation to investment advice) to charge in relation to any services on or from the firm’s pensions dashboard platform. Application to members of the firm’s group 2.5.4 G Firms are reminded that the only permitted dashboard service that can be provided by any other person is that a connected person can provide investment advice (see PDCOB 10.2.1R). Prohibition on providing a service for which a charge is payable without active election 2.5.5 R A firm must not impose a charge on a customer for a permitted dashboard service, or enter into an agreement with a customer under which a charge is, or may become, payable for a permitted dashboard service, unless the customer has actively elected to receive that service and pay that charge. 2.5.6 R A firm must not invite or induce a customer to receive services for which a charge will be, or may become, payable if the firm knows or has reasonable cause to suspect that the services are not permitted dashboard services or that an active election to be charged is unlikely to be made. Impact of auto-renewals on active election 2.5.7 R If, under the terms and conditions of a permitted dashboard service there is to be an automatic renewal of the agreement on substantially the same terms, it suffices for the purposes of PDCOB 2.5.5R if the customer actively elects before entering into the initial agreement or a preceding renewal to obtain the permitted dashboard service. 2.5.8 R An automatic renewal of the agreement is not to be regarded as being on substantially the same terms if, following the renewal, a charge, or a significant charge, will or may become payable for the permitted dashboard service for the first time (in which case, PDCOB 2.5.5R applies at the time of the renewal). Meaning of charge

FCA 2023/XX Page 23 of 87 2.5.9 R For the purposes of this section, a charge includes any direct or indirect financial or non-financial consideration of any kind, whether payable to the firm or any other person. 2.5.10 G Firms are reminded that a similar prohibition on opt-out selling of add-on products is imposed by The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (available at https://www.legislation.gov.uk/uksi/2013/3134) in relation to additional payments under a contract where the main sale is not a financial service or product. 3 What is a firm permitted to do? 3.1 Permitted offers to customers 3.1.1 R A firm is only permitted to offer to customers: (1) view services; (2) data export in accordance with PDCOB 9; and (3) permitted post-view services. 3.1.2 G Whilst a firm must provide view services as part of regulated pensions dashboard activity, data export and post-view services are optional activities that a firm may choose to provide. 3.2 Other permitted activities 3.2.1 R A firm is only permitted to undertake the following other activities: (1) communications in relation to PDCOB 3.1.1R(1) to (3) amounting only to: (a) information which the firm is required to display by law, including information under the Dashboard Regulations; and (b) communications which the firm is permitted or required to make under PDCOB or other rules; (2) the placement of advertisements as permitted under PDCOB 6.3 to PDCOB 6.4; (3) other marketing activities as permitted under PDCOB 7; (4) entry into a third party dashboard arrangements in accordance with PDCOB 8; and (5) other activities necessary for the proper functioning of the activities in COBS 3.1.1R(1) and, where applicable, COBS 3.1.1R(2) and (3), including those required under PDCOB and other rules.

FCA 2023/XX Page 24 of 87 4 Communications: General Principles applying to all communications 4.1 Application 4.1.1 R This chapter applies with respect to a firm’s communications in relation to a pensions dashboard platform. 4.2 General principles applicable to all communications: the fair, clear and not misleading rule 4.2.1 R A firm must ensure that any communication it makes is fair, clear and not misleading. 4.2.2 G A firm should consider whether the omission of any relevant fact could result in a communication being insufficiently clear or unfair, or could result in the communication being misleading. 4.2.3 G If a communication names the FCA, the PRA or both as the regulator of a firm or other provider and refers to matters not regulated by the FCA, the PRA or both, the firm should ensure that the communication makes clear that those matters are not regulated by the FCA, the PRA or both. 4.2.4 G Part 7 (Offences relating to Financial Services) of the Financial Services Act 2012 (available at https://www.legislation.gov.uk/ukpga/2012/21/contents) creates criminal offences relating to certain misleading statements and practices. 4.3 General principles applicable to communications: additional requirements including comprehensibility, prominence and notification of changes 4.3.1 R A firm must communicate information: (1) in the manner and form most likely to be comprehensible to a customer, and in good time, having regard to their expected ability to comprehend information, including the abilities of customers with characteristics of vulnerability; (2) in English or in any other language agreed by the parties; (3) free of charge; and (4) prominently. 4.3.2 R The requirement to communicate to the customer prominently includes ensuring that the communication is visible and that the communication is accessible to customers without requiring them to expand a window or text box. 4.3.3 R A firm must notify a customer in good time about any material change to any information communicated to the customer which is relevant to a service that the firm is providing, or is proposing to provide, to that customer.

FCA 2023/XX Page 25 of 87 4.3.4 G (1) In determining what constitutes the provision of information ‘in good time’, a firm should take into account, having regard to the urgency of the situation, the customer’s need for sufficient time to read and understand the information before taking a decision. (2) A customer is likely to require more time to review information given on a complex or unfamiliar service, or a service a customer has no experience with, than a customer considering a simpler or more familiar service, or where the customer has relevant prior experience. 4.3.5 G The rules in this sourcebook regarding communications to customers do not prescribe the exact wording or formatting of the communications. To comply with the customer’s best interests rule, Principle 12 (Communications with clients), and the rules on communications in this sourcebook in relation to general communications, a firm should consider the information needs of, and seek to make general communications appropriate and comprehensible for, a customer in their target market, including considering: (1) what a customer needs in order to understand the relevance of any information provided by the firm; (2) the point at which information will be most useful to the customer to enable them to make an informed decision; and (3) the firm’s obligations under PRIN 2A.5. 4.4 General principles applicable to communications: additional requirements for content to be balanced with appropriate warnings 4.4.1 R A firm must ensure that any communication it makes is balanced and contains appropriate risk warnings and, in particular: (1) does not emphasise any potential benefits that may be available to customers without also giving a fair and prominent indication of any relevant risks or downsides; (2) does not disguise, omit, diminish or obscure important items, statements or warnings; and (3) ensures that any comparisons or contrasts are meaningful and are presented in a fair, balanced way. 4.5 General principles applicable to communications: additional requirements in relation to the use of advertisements 4.5.1 R A firm must ensure that advertisements do not have the effect of impairing the quality of the firm’s communications, including not concealing or reducing their prominence or allowing for them to give a misleading impression, taking into account the requirements in the FCA’s Handbook, and the other requirements that a firm is subject to under law, including the Dashboard Regulations.

FCA 2023/XX Page 26 of 87 4.6 The reasonable steps defence to an action for damages 4.6.1 R If, in relation to a particular communication, a firm takes reasonable steps to ensure it complies with the fair, clear and not misleading rule, a contravention of that rule does not give rise to a right of action under section 138D of the Act. 5 Disclosure requirements 5.1 Information about a firm and its services 5.1.1 R Before each time the firm directs a customer to the MaPS dashboards digital architecture to generate pensions dashboard find data, the firm must provide the customer with at least the following: (1) the name and address of the firm, and the contact details necessary to enable a customer to communicate effectively with the firm; (2) appropriate information about the services offered by the firm, including regulated pensions dashboard activity and (if applicable) any data export and post-view services; (3) a statement that some pensions may not be displayed on a pensions dashboard service and at least two of the possible reasons; (4) a statement of the fact that the firm is authorised by the FCA; (5) if the firm has entered into a third party dashboard arrangement, a statement of this fact, and the name of the third party that has given the customer access to the pensions dashboard platform; (6) information, or a link to a location containing information, about how a customer could register complaints about the firm with the firm and the Financial Ombudsman Service; and (7) any other information which the firm deems necessary so that the customer is reasonably able to understand the nature of the pensions dashboard platform that is being offered. 5.1.2 G A firm disclosing details of its authorisation should refer to the appropriate forms of words set out in GEN 4 Annex 1R. 5.1.3 G For the purposes of the statement in PDCOB 5.1.1R(3), examples of the reasons why a pension might not be shown on a pensions dashboard service include: (1) if a pension provider is not connected to the MaPS pensions dashboards ecosystem; or (2) if the customer is entitled to the present payment of the pension benefits.

FCA 2023/XX Page 27 of 87 5.2 Fees disclosure 5.2.1 R Before each time the firm directs a customer to the MaPS dashboards digital architecture to generate pensions dashboard find data, the firm must inform the customer that: (1) the view services are free of charge; and (2) a fee may become payable for services other than view services, but only for those services which amount to permitted dashboard services. 5.2.2 G PDCOB 10.4 applies to a firm that imposes a fee in connection with any permitted dashboard service. 5.2.3 R Where a fee may become payable for a permitted dashboard service, the firm must inform the customer of the amount of the fee before the customer incurs a liability to pay the fee. 5.3 Disclosure warnings about the possibility of scams 5.3.1 R On each occasion that the customer uses the pensions dashboard platform, a firm must display a message warning the customer that if they are approached by a third party who asks for the customer’s data or asks to screen share, the customer should check who they are dealing with. 5.3.2 G Firms should consider warning customers to use the FCA Register to check whether a third party that claims to be authorised or exempt is who they say they are. 5.3.3 R On each occasion that the customer uses the pensions dashboard platform, a firm must display a message: (1) warning the customer about the risks of: (a) screen sharing with a third party; (b) giving a third party access to the customer’s device, including remote access; and (2) explaining that a third party with control of the customer’s device can access and control more than what is visible on the screen. The firm must include one or more examples of what a third party can access remotely on a customer’s device. 5.3.4 G Firms should consider whether the messages referred to in PDCOB 5.3.3R should: (1) remind customers that pensions dashboard view data is sensitive and valuable and so customers should seek to keep their data safe;

FCA 2023/XX Page 28 of 87 (2) remind customers to think carefully about whether the third party needs to see the information on the screen; (3) alert customers to the potential type of a scam that might occur in relation to a firm’s pensions dashboard platform, such as: (a) a clone or fake dashboard; or (b) an investment scam. 5.3.5 G For the purposes of PDCOB 5.3.3R(2), one of the examples given to a customer of what a third party can access remotely should include the customer’s: (1) personal information; (2) social media accounts; or (3) online banking. 5.3.6 G Firms are reminded of the notification requirement relating to scams in PDCOB 13.2. 5.4 Disclosure information in relation to view data 5.4.1 R Immediately prior to the customer accessing their pensions dashboard view data, a firm must communicate to the customer the limitations of pensions dashboard view data, including that: (1) the figures are indicative or estimated and not guaranteed; (2) assumptions have been used to calculate the figures; (3) figures may change (increase or decrease) and may be influenced by changes in investment performance, contributions and the date the user decides to take their pension; (4) pensions dashboard view data is supplied for illustrative purposes; (5) more up-to-date figures and more details may be available from the pension provider or scheme administrator; and (6) all figures are shown before tax. 5.5 Disclosure warnings about decision-making solely in reliance on view data and post-view services, and disclosure of further information to help customers 5.5.1 R A firm must communicate to a customer each time a customer is provided with view services or post-view services:

FCA 2023/XX Page 29 of 87 (1) stating that the customer should not make a financial decision based on the information displayed on the view services or (where applicable) post-view services, unless it is a post-view service which consists of advising on investments (except pension transfers and pension opt-outs); and (2) signposting the customer to sources of support, information and guidance on pensions and retirement planning, including the following information about MoneyHelper: (a) the MoneyHelper website details: [www.moneyhelper.org.uk]; and (b) a brief explanation that there is pensions guidance and support available at [www.moneyhelper.org.uk]. 5.5.2 G Where a firm provides a post-view service which consists of advising on investments (except pension transfers and pension opt-outs), the effect of PDCOB 5.5.1(1)R is that a firm should not communicate the message at PDCOB 5.5.1(1)R during the provision of that advice. 5.5.3 G A firm should consider whether the message in PDCOB 5.5.1(2)R should also include: (1) signposting that the customer can take investment advice; and (2) a reminder about the contact details of their pension provider(s). 5.5.4 R A firm may offer customers the option of collapsing, hiding or dismissing the information after it has been communicated. However, a firm may only collapse, hide or dismiss the warning if the customer has taken positive action to allow that. 5.6 Other specific disclosures 5.6.1 G Firms are reminded that certain other specific disclosures are only required to be made depending on how the firm chooses to operate its business. These disclosures include where the firm: (1) has entered into third party dashboard arrangements (see PDCOB 8.6.1R); (2) provides data export to the customer (see PDCOB 9.4.1R to PDCOB 9.4.2R and PDCOB 9.4.6R); (3) provides data export to the firm (see PDCOB 9.5.1R); or (4) provides post-view services (see PDCOB 10.5.1R to PDCOB 10.5.2R). 5.7 Form of messages

FCA 2023/XX Page 30 of 87 5.7.1 G The rules in this chapter do not prescribe the form in which messages should be communicated by firms to customers. Firms should consider the most effective and engaging way that they can convey the messages to customers. 6 Restrictions on advertising permitted on a pensions dashboard 6.1 Application 6.1.1 R (1) PDCOB 6.2 to PDCOB 6.4 apply to a firm that places advertisements on or around its pensions dashboard platform. (2) In this sourcebook, reference to the placement of advertisements encompasses the placement of advertisements for services by third parties as well as advertisements for the firm’s services. 6.2 Purpose 6.2.1 G The purpose of the rules in this chapter is to ensure that firms are only permitted to place certain types of advertisements on a pensions dashboard platform and only in a particular manner. 6.3 Restriction on types of advertisement 6.3.1 R A firm must not place advertisements on its pensions dashboard platform other than advertisements offering: (1) advising on investments (except pension transfers and pension opt￾outs); and/or (2) permitted post-view services. 6.3.2 R Before a firm places an advertisement offering advising on investments (except pension transfers and pension opt-outs), the firm must check that the firm offering those services holds the relevant permission. 6.3.3 R A firm must ensure that an advertisement does not create the impression that the service is an appropriate service for the customer’s circumstances. 6.3.4 G Firms are reminded of the requirements under COBS 4 that apply to any financial promotions in relation to advising on investments (except pension transfers and pension opt-outs). 6.3.5 R Only a firm may place advertisements on or around its pensions dashboard platform, and must not permit any other person to have control over the placement of advertisements. 6.4 Restrictions on manner in which advertisements are placed 6.4.1 R A firm must ensure that the placement and volume of advertisements on or around its pensions dashboard platform does not lead to any impairment in a

FCA 2023/XX Page 31 of 87 customer’s ability to get the full benefit of the services available on the pensions dashboard platform. 6.4.2 G Firms are reminded of the need to ensure that their use of advertisements does not impair the quality of their communications taking into account requirements in FCA rules, see PDCOB 4. 7 Restrictions on marketing: permitted tracking technology and use of customer information on a dashboard platform 7.1 Obligations on firms under general privacy laws 7.1.1 G Firms are reminded of the need to comply with data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). 7.2 Cookies 7.2.1 R If a firm wishes to use cookies, pixels, tags or similar technologies to track customers, it must obtain the customer’s consent for that technology to be used, unless the conditions in PDCOB 7.2.7R are satisfied. 7.2.2 R When seeking the customer’s consent, a firm must first properly explain to the customer: (1) the cookies, pixels, tags or other technologies which the firm is proposing to use; (2) the function of any such technology; and (3) which organisation or firm will be using the technology. 7.2.3 R When presenting options for the customer to consent to, a firm must not give prominence to one option over another. 7.2.4 R The firm must provide customers with the option of rejecting non-essential cookies. 7.2.5 G A firm should ensure that the option of rejecting non-essential cookies is as straightforward to select as the option of consenting to non-essential cookies. 7.2.6 R A firm must not make the acceptance of non-essential cookies a pre￾condition of using any of the services on the pensions dashboard platform. 7.2.7 R If a customer does not consent to cookies or other similar tracking technologies, a firm is not permitted to use cookies or other similar tracking technologies unless they are: (1) necessary for the transmission of a communication; and (2) strictly necessary for the provision of the service which the customer is using.

FCA 2023/XX Page 32 of 87 7.3 Obtaining a customer’s details for marketing purposes 7.3.1 R A firm must not: (1) add a customer’s details to its marketing database, unless the customer has actively elected to be added; or (2) undertake direct marketing to the customer, unless the customer has actively elected to receive direct marketing from the firm. 7.3.2 R Before requesting that a customer actively elects to receive direct marketing from the firm, the firm must provide the following information to the customer: (1) how and why the customer’s details will be processed; and (2) the entity which will be processing the details. 7.3.3 R A firm must not require the customer to agree to direct marketing as a condition of using the pensions dashboard platform. 7.3.4 R A firm must not provide a customer’s details to another person (including a connected person) for marketing purposes. 8 Third party dashboard arrangements 8.1 Application 8.1.1 R This chapter applies to a firm that enters into a third party dashboard arrangement. 8.2 Purpose 8.2.1 G The purpose of this chapter is to ensure that, where a firm enters into a third party dashboard arrangement, the arrangement does not, as far as is reasonably possible, create scope for consumer harm. This chapter imposes additional obligations upon a firm that enters into a third party dashboard arrangement. 8.2.2 G A firm that enters into a third party dashboard arrangement must continue to comply with all of the other rules in PBCOB. 8.3 Requirements for the arrangement 8.3.1 R Before a third party dashboard access provider is able to offer a firm’s pensions dashboard platform to a customer, the firm must ensure that there is an enforceable written agreement in place between the firm and the third party dashboard access provider that:

FCA 2023/XX Page 33 of 87 (1) allows the firm reasonable access to the third party dashboard access provider’s operations as necessary to allow the firm to carry out proper monitoring; (2) requires the third party dashboard access provider to represent and warrant that it will not: (a) modify, edit or alter the pensions dashboard platform; (b) charge or attempt to charge a customer for any services connected to the firm’s pensions dashboard platform; (c) promote the firm’s pensions dashboard platform in a way that may breach any protections within the FCA’s regulatory framework or the general law; (3) requires the third party dashboard access provider to comply with the rules in PDCOB and all other FCA rules, to the extent that they are applicable to the actions of the third party dashboard access provider in relation to the firm’s pensions dashboard platform; (4) requires the third party dashboard access provider to take all reasonable steps to remedy a breach of the requirements in (2) or (3); (5) requires the third party dashboard access provider to indemnify the firm (or, where applicable, a successor) against all losses suffered by the firm (or, where applicable, a successor) arising out of, or in connection with, a breach by the third party dashboard access provider of any of the requirements set out in (2) and (3); (6) permits the firm to terminate the third party dashboard access provider’s access to the pensions dashboard platform: (a) immediately where the third party dashboard access provider has: (i) breached, or attempted to breach, one of the requirements in (2); or (ii) breached the requirements in (3) where the firm has reasonable grounds to conclude that the breach could result in consumer harm: and (b) where the third party dashboard access provider has otherwise breached the requirements in (3) and that breach has not been remedied to the satisfaction of the firm within a period of 14 working days. 8.3.2 R A firm must ensure that it monitors compliance by a third party dashboard access provider with the requirements in PDCOB 8.3.1(2) and (3).

FCA 2023/XX Page 34 of 87 8.3.3 G PDCOB 8.3.1R does not prescribe the exact wording of the written agreement with the third party dashboard access provider. 8.4 Responsibility for the actions of the third party dashboard access provider 8.4.1 R The firm: (1) retains responsibility for compliance with the rules in PDCOB and any other relevant FCA rules in relation to the pensions dashboard platform. This includes responsibility for the actions of a third party dashboard access provider in relation to the firm’s pensions dashboard platform; and (2) is responsible for ensuring that the third party dashboard access provider complies with the rules in PDCOB and all other FCA rules, to the extent that they are applicable to the actions of the third party dashboard access provider in relation to the firm’s pensions dashboard platform. 8.4.2 R Prior to entering into a third party dashboard arrangement and routinely thereafter, a firm must satisfy itself that the third party dashboard access provider is a suitable and reputable entity through which to make its pensions dashboard platform available to customers. 8.5 Restrictions on changes to the pensions dashboard platform 8.5.1 R A firm must ensure that the pensions dashboard platform is not capable of being altered, modified or edited by another person. 8.5.2 G A firm is permitted to make changes to its pensions dashboard platform which are suggested by a third party dashboard access provider, but it must be the firm making the changes and not the third party dashboard access provider. 8.5.3 R A firm must ensure that, when a customer accesses the firm’s pensions dashboard platform under the third party dashboard arrangement, no part of the third party dashboard access provider website or other application or similar is visible alongside the pensions dashboard platform. 8.5.4 G Under PDCOB 10.2.1R, a firm is not permitted to allow any other person to offer post-view services other than a connected person in relation to advising on investments (except pension transfers and pension opt-outs). 8.6 Disclosures to the customer about third party dashboard arrangements 8.6.1 R A firm must ensure that, where a customer accesses the pensions dashboard platform through a third party dashboard arrangement, the first point of contact with a customer on a pensions dashboard platform contains a prominent message that:

FCA 2023/XX Page 35 of 87 (1) the firm is authorised to carry on regulated pensions dashboard activity and make it available; (2) the firm is responsible for the pensions dashboard platform; (3) the third party dashboard services provider has entered an arrangement with the firm to make the pensions dashboard platform available to customers; and (4) complaints about the pensions dashboard platform should be directed to the firm, not the other person. 8.7 Notifications to the FCA 8.7.1 G Firms are reminded of the notification requirements relating to third party dashboard arrangements in PDCOB 13.3. 9 Specific requirements where firms offer data export 9.1 Application 9.1.1 R This chapter applies to a firm which chooses to offer or provide data export. 9.2 Permitted data export functionality 9.2.1 R A firm is not permitted to offer or provide data export, apart from: (1) data export to the customer; or (2) data export to: (a) itself; or (b) a connected person. 9.2.2 R A firm must not permit another person (including a connected person) to offer or provide data export from the firm’s pensions dashboard platform. 9.2.3 R A firm which chooses to offer data export to the firm must also offer data export to the customer. 9.2.4 G Data export will involve a firm processing personal data. Accordingly, firms processing such data are data controllers or data processors and are obliged to comply with data protection legislation and, in particular, to adhere to the data protection principles. 9.3 Restrictions on providing data export 9.3.1 R A firm must not provide data export to the customer, to itself or to a connected person unless the customer has actively elected to select that specific type of data export.

FCA 2023/XX Page 36 of 87 9.3.2 R A firm must not require the customer to agree to data export as a condition of using the pensions dashboard service. Restrictions on the content, format and manner of data export 9.3.3 R The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 9.3.4R. 9.3.4 R The firm must not export the customer’s full pension reference. 9.3.5 G For the purposes of PDCOB 9.3.4R, a firm should include only the last four characters of the pension reference. 9.3.6 G A firm should transfer the pensions dashboard view data securely to the customer, itself or a connected person (as applicable). Firms are reminded of their obligation to comply with the principle of integrity and confidentiality in article 5(1)(f) of the General data protection regulation. 9.4 Restrictions on providing data export to the customer Specific disclosures prior to the provision of data export to the customer 9.4.1 R In good time before the customer elects to receive data export, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export. This information must include: (1) the name of the person who is the data controller; (2) the nature of the processing which will take place to export the data; and (3) the purpose for which the data will be processed. 9.4.2 R Before the customer agrees to data export, a firm must clearly and prominently display a warning to the customer about the risks of data export to the customer, including that: (1) their data is valuable; (2) it is important that they keep their data safe; and (3) if the data export is being facilitated by download, the customer should avoid downloading the data on a shared device. Restrictions on the content, format and manner of data export to the customer 9.4.3 R A firm must ensure that pensions dashboard view data exported to a customer is in a format which is accessible to a member of the general population.

FCA 2023/XX Page 37 of 87 9.4.4 G A firm should consider whether the format of data export engages any accessibility obligations, such as under the Equality Act 2010. 9.4.5 R The information exported by data export to the customer must include: (1) subject to PDCOB 9.3.4R, the customer’s pensions dashboard view data; and (2) any display explanations and contextual information which is required by PDCOB 5 and other legislation, such as the Dashboard Regulations. Specific disclosures when providing information by data export to the customer 9.4.6 R The information provided by data export to the customer must be prominently accompanied by the following messages: (1) the warning at PDCOB 5.5.1R(1); (2) if the customer is asked to share their data with a third party, the customer should check whether the third party is who they say they are, and if they claim to be authorised or exempt should use the FCA Register to check; (3) a signpost to the ScamSmart campaign, such as a link to https://www.fca.org.uk/scamsmart; (4) the customer’s pensions dashboard view data is sensitive and valuable and the customer should seek to keep their data safe; (5) if the customer is asked to share their data with a third party, the customer should think carefully about whether a third party needs to see the data; and (6) signposts to sources of additional information, free guidance and how to find regulated advice. 9.5 Data export to the firm Specific disclosures prior to the provision of data export to the firm 9.5.1 R In good time before the customer elects to data export to the firm, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export to the firm. This information must include: (1) the name of the persons who will be the data controllers both before and after the data is exported; (2) the nature of the processing which will take place to export the data and once the data is exported; and

FCA 2023/XX Page 38 of 87 (2) the purpose for which the data will processed both during data export to the firm and once the data has been exported. 9.5.2 R Once the data is exported to the firm, the firm must not share the data with any entities other than a connected person which has permission to advise on investments (except pension transfers and pension opt-outs). The data may only be shared with a connected person if the customer has actively elected for their data to be shared with the connected person. Restrictions on the content, format and manner of data export to the firm 9.5.3 R The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 9.3.4R. 9.5.4 G Depending on the nature of the post-view services which the firm is offering, a firm should consider whether it is appropriate to include any display explanations or contextual information required by PDCOB 5 and other legislation such as the Dashboard Regulations. 9.5.5 R Once the customer’s data has been exported to the firm, the firm must only process that data to deliver permitted post-view services and to which the customer has consented. 9.6 Data retention 9.6.1 R Where data has been obtained from data export, a firm is permitted to store that data for 30 days after the customer last accessed the pensions dashboard platform, after which period it must be deleted. 9.6.2 R Where data has been obtained from the customer following the customer directly inputting that data into the pensions dashboard platform, a firm is permitted to store that data for 30 days after the customer last accessed the pensions dashboard platform, after which period it must be deleted. 10 Post-view services 10.1 Purpose 10.1.1 G The purpose of the rules in this chapter is to place specific additional requirements on firms that offer post-view services. 10.2 Restrictions 10.2.1 R A firm must not permit any other person to offer any services or products to customers from the pensions dashboard platform other than a connected person in relation to investment advice other than advising on pension transfers and pension opt-outs. 10.2.2 G Firms are reminded that they must not offer or provide any services or products to customers from the pensions dashboard platform other than the

FCA 2023/XX Page 39 of 87 permitted post-view services and data export under PDCOB 9 (see PDCOB 3.1.1R). 10.3 Permitted post-view services 10.3.1 R A firm or a connected person must only offer or provide post-view services that: (1) in relation to post-view services that are not investment advice: (a) are provided by the firm; (b) are provided only once the view services have been provided and are accessed via the view services; (c) do not include: (i) an offer to sell (which includes sending an application form for a product); (ii) an offer to arrange for the sale or purchase of; (iii) selling; or (iv) arranging for the sale or purchase of (which includes sending an application form for a product), an investment to or for a customer; (d) have been user-tested in accordance with PDCOB 10.6.1R; (e) relate to pensions and retirement planning; (f) do not include advising on pension transfers and pension opt￾outs; and (g) are a type of service that supports customers in understanding and/or taking decisions in relation to their pension(s); (2) in relation to post-view services that are investment advice: (a) are provided by the firm or a connected person; and (b) which comply with PDCOB 10.3.1R(1)(b), (e) to (g). 10.3.2 G A firm is permitted to ask a customer to input data into the post-view service, such that post-view services can be provided, either by way of auto-populated data from the view services, self-asserted data from the customer or a mixture of both. 10.3.3 G Firms are reminded that they may require permission to carry on regulated activities other than regulated pensions dashboard activity if any post-view

FCA 2023/XX Page 40 of 87 services amount to regulated activities – for example, advising on investments (except pension transfers and pension opt-outs). 10.3.4 G Firms are reminded of the obligations in PRIN 2 and PRIN 2A. In particular, of the obligation that a firm must act to deliver good outcomes for retail customers (PRIN 2.1.1(12)) when providing post-view services. This will require a firm to ensure that post-view services are fit for purpose, offer fair value and help customers to make effective choices or act in their interests. 10.3.5 G Pursuant to PDCOB 10.3.1R(6), a firm is not permitted to offer a post-view service which amounts to advising on pension transfers and pension opt￾outs. This includes abridged advice. However, a firm is permitted to offer post-view services which support and engage customers with their safeguarded benefits. A firm should ensure that such support and engagement does not stray into the regulated activity of advising on pension transfers and pension opt-outs and should consider the guidance in PERG 2.7.16GG. 10.3.6 G Firms should consider how assumptions about future investment returns and charges can influence customers’ decision-making on transferring or converting safeguarded benefits. Firms should ensure that such assumptions do not result in the firm to be advising on pension transfers and pension opt￾outs. 10.4 Specific fees restrictions in relation to post-view services 10.4.1 R A firm must not require the customer to pay for, or to agree to pay for, any permitted dashboard service as a condition of accessing their pensions dashboard view data. 10.4.2 G Firms should also refer to the rules on charging in PDCOB 2.5.2R to PDCOB 2.5.9R. 10.4.3 R If a firm is charging for a post-view service, and the firm offers the same service significantly cheaper or free of charge outside the pensions dashboard platform, a firm must inform the customer of that fact in good time before providing the post-view service. 10.5 Disclosures to be provided to customers in relation to post-view services 10.5.1 R A firm must ensure that any offer for post-view services is accompanied by prominent information which: (1) explains the nature and purpose of the post-view service; (2) explains the limitations of the post-view service; (3) explains how customers can raise a query or complaint about the post￾view service; and (4) includes the messages required under PDCOB 5.5.

FCA 2023/XX Page 41 of 87 10.5.2 G In order to ensure that the nature of the post-view service is not misleading and is capable of being understood by customers, a firm should consider including information which: (1) ensures that customers do not perceive post-view services as giving them guarantees of what their pension(s) will be worth in retirement; (2) apart from when the post-view service is advising on investments (except pension transfers and pension opt-outs), ensures that customers do not perceive post-view services as giving them personal recommendations; and (3) where relevant, explains the assumptions underpinning modellers, projections, calculations or similar. 10.6 User testing 10.6.1 R The user testing referred to in PDCOB 10.3.1R(4) must be designed to ensure that the nature of the post-view services is capable of being easily understood and easily used and are not likely to mislead or confuse customers. 10.6.2 R Where user testing identifies deficiencies in post-view services and/or how they are presented, or improvements which should be made, the firm must make changes to the post-view services to remedy the deficiency or make the improvement. 10.6.3 G A firm should consider whether further user testing is necessary when a material change has been made to any post-view services which it provides. 10.7 Use of data 10.7.1 R A firm must not share customers’ information, including the outcome of post￾view services, with any other persons, other than with a connected person for the purposes of them undertaking the regulated activity of advising on investments (except pension transfers and pension opt-outs). A firm may only share customers’ information with a connected person if the customer has actively elected for that information to be shared with the connected person. 10.8 Access to the results of post-view services 10.8.1 R A firm must allow a customer to receive a copy of the results of the post-view service, where applicable, and the firm is not restricted by the rules in relation to data export in PDCOB 9. 10.8.2 G A firm should transfer the results referred to in PDCOB 10.8.1R securely to the customer. Firms are reminded of their obligation to comply with the principle of integrity and confidentiality in article 5(1)(f) of the General data protection regulation. 10.9 Notifications to the FCA

FCA 2023/XX Page 42 of 87 10.9.1 G Firms are reminded of the notification requirements in relation to post-view services in PDCOB 13.4R. 11 Prudential Requirements 11.1 Application and purpose General application 11.1.1 R Subject to PDCOB 11.1.2R, this chapter applies to firms with a Part 4A permission for regulated pensions dashboard activity. 11.1.2 R This chapter does not apply to a PRA-authorised person. Purpose 11.1.3 G (1) The purpose of PDCOB 11 is to set out the detailed prudential obligations that apply to regulated pensions dashboard activity. (2) Adequate financial resources are necessary for the effective management of prudential risks. The rules in this chapter therefore impose requirements relating to the financial resources of a firm to which this chapter applies. (3) The rules concern the adequacy of the financial resources that a firm needs to hold in order to be able to meet its liabilities as they fall due (the general solvency requirement). These resources include both capital and liquidity resources. (4) The rules also place a core capital resources requirement on a firm to which this chapter applies. 11.2 General solvency requirement 11.2.1 R A firm must at all times maintain overall financial resources which are adequate, both as to amount and quality, to ensure that there is no significant risk that its liabilities cannot be met as they fall due. This includes capital resources and liquidity resources. 11.2.2 G The liabilities referred to in the general solvency requirement include: (1) a firm’s contingent and prospective liabilities; (2) liabilities that arise both in scenarios where the firm is a going concern and where the firm ceases to be a going concern; and (3) claims that could be made against a firm, which ought to be paid in accordance with fair treatment of customers, even if such claims could not be legally enforced. 11.2.3 G The liabilities referred to in the general solvency requirement exclude liabilities that might arise from transactions that a firm has not entered into

FCA 2023/XX Page 43 of 87 and which it could avoid. This could include, for example, by taking realistic management actions such as ceasing to transact new business after a suitable period of time has elapsed. 11.2.4 G A firm should therefore make its assessment of adequate financial resources on realistic valuation bases of assets and liabilities, taking into account the actual amounts and timing of cash flows under realistic adverse projections. 11.2.5 G Risks may be addressed through holding capital to absorb losses that unexpectedly materialise. The ability to pay liabilities as they fall due also requires liquidity. Therefore, firms should consider both capital and liquidity needs in assessing the adequacy of its financial resources. A firm should also consider the quality of its financial resources such as the loss-absorbency of different types of capital and the time required to liquidate different types of assets. 11.2.6 G As part of its day-to-day supervision of a firm, the FCA may review whether the amount and quality of capital and liquidity resources that a firm holds to comply with its general solvency requirement is sufficient. 11.2.7 G Where necessary, the FCA may consider the use of its powers under section 166 of the Act (Reports by skilled persons) to assist with the review referred to in PDCOB 11.2.6G. 11.2.8 G (1) Following such a review, the FCA may conclude that a firm should hold an additional amount or quality of capital or liquidity resources to comply with the general solvency requirement. (2) Where this is the case, the FCA will normally specify an amount or quality of capital or liquidity resources that the firm should hold by: (a) issuing individual capital guidance; (b) issuing individual liquidity guidance; or (c) imposing a requirement on the firm. (3) The amounts in (2) will typically represent the FCA’s assessment of the firm’s general solvency requirement. However, in some cases, it may be specified on a different basis (such as by reference to a specific component of the general solvency requirement or to a particular risk or harm). (4) The FCA may choose to conduct reviews of the sector of firms carrying on regulated pensions dashboard activity, or aspects of it. In such cases, the FCA may subsequently choose to issue guidance on a sectoral basis or to impose additional requirements on all, or only a subset of, the entities included within that review. The guidance or requirement may relate to:

FCA 2023/XX Page 44 of 87 (a) additional amounts or quality of capital or liquidity resources that such firms must hold; or (b) other actions that such firms must undertake. 11.2.9 G The FCA will determine whether a requirement or guidance is more appropriate. Where the FCA chooses to issue guidance, this will normally explain how the FCA will approach supervising the general solvency requirement in relation to the firm. The FCA expects that the firm would normally confirm to the FCA that the firm will hold the amounts specified in that guidance going forward (and will therefore hold the relevant capital and or liquidity resources to comply with the general solvency requirement), unless the firm subsequently determines that higher amounts are required. 11.2.10 G Where the FCA considers that it is appropriate to apply a requirement in connection with the general solvency requirement, it may invite a firm to make a voluntary application under section 55L(5) of the Act to impose a requirement on the firm to hold the level of capital or liquidity resources that the FCA has assessed as being required by the firm in order to meet the general solvency requirement. 11.2.11 G Guidance on the general solvency requirement issued by the FCA will apply until the FCA issues revised guidance (or varies or removes the requirement relating to the general solvency requirement) in relation to the firm. 11.2.12 G If a firm subsequently determines, as a result of its own assessment, that it needs to hold a higher level or quality of capital or liquidity resources to satisfy the general solvency requirement, it must hold that higher level. This is because the FCA’s assessment (or a requirement applied to the firm by the FCA) reflects an assessment carried out at that point in time and does not relieve the firm of its obligation to ensure that it is meeting the general solvency requirement at all times. 11.2.13 G A firm’s business model or operating model may undergo a significant change, with the result that the firm considers that the amount or quality of capital or liquidity resources specified in the guidance issued by, or the requirement applied by, the FCA exceeds the amount or quality of capital or liquidity resources that the firm requires to comply with the general solvency requirement. In this case, the firm: (1) should undertake its own assessment of the amounts that the firm now requires to comply with the general solvency requirement or, where applicable, to address the risks in relation to which the requirement was imposed; and (2) having undertaken the determination in (1), may contact the FCA to request a review of the existing guidance or requirement. 11.2.14 G The FCA will not give individual capital guidance or individual liquidity guidance to the effect that the amount of capital advised in that guidance is

FCA 2023/XX Page 45 of 87 lower than the amount of capital which a firm should hold to meet its core capital resources requirement. 11.3 Core capital resources requirement 11.3.1 R A firm must at all times maintain capital resources equal to or in excess of its core capital resources requirement. 11.4 Capital resources: relevant accounting principles 11.4.1 R A firm must recognise an asset or liability, and measure its amount, in accordance with the relevant accounting principles applicable to it for the purpose of preparing its annual financial statements. 11.5 Core capital resources requirement for regulated pensions dashboard activities 11.5.1 R Subject to PDCOB 11.6.1R, for a firm with a Part 4A permission to carry on regulated pensions dashboard activities, the core capital resources requirement is £40,000. 11.6 Core capital resources requirement for a firm carrying on other regulated activity 11.6.1 R Where a firm to which this chapter applies also has a Part 4A permission to carry on other regulated activities, the capital resources requirement is the higher of: (1) the core capital resources requirement in PDCOB 11.5.1R; and (2) a capital resources requirement (however described) applied to the firm by any other rule or requirement. 11.7 Calculation of core capital resources The calculation of a firm’s core capital resources 11.7.1 R A firm must calculate its capital resources for the core capital resources requirement from the items that are eligible to contribute to a firm’s capital resources, as set out in items 1 to 6 in the table at PDCOB 11.7.3R. 11.7.2 R In arriving at its calculation of its capital resources for the core capital resources requirement, a firm must deduct the items set out in items 1 to 5 in the table at PDCOB 11.7.5R. 11.7.3 R The items that are eligible to contribute to the capital resources of a firm are set out in the following table: Item Additional explanation 1 Share capital This must be fully paid and may include:

FCA 2023/XX Page 46 of 87 (1) ordinary share capital; or (2) preference share capital (excluding preference shares redeemable by shareholders within 2 years). 2 Capital other than share capital (for example, the capital of a sole trader, partnership or limited liability partnership) (1) The capital of a sole trader is the net balance on the firm’s capital account and current account. (2) The capital of a partnership is the capital made up of the partners’: (a) capital account, which is the account: (i) into which capital contributed by the partners is paid; and (ii) from which, under the terms of the partnership agreement, an amount representing capital may be withdrawn by a partner only if: (A) the person ceases to be a partner and an equal amount is transferred to another such account by their former partners or any person replacing them as their partner; or (B) the partnership is otherwise dissolved or wound up; and (b) current accounts according to the most recent financial statement. (3) For the purpose of calculating capital resources in respect of a defined benefit occupational pension scheme: (a) a firm must derecognise any defined benefit asset; (b) a firm may substitute for a defined benefit liability the firm’s deficit reduction amount, provided that the election is applied consistently in respect of any one financial year. 3 Reserves (Note) (1) These are (subject to the Note) the audited accumulated profits retained by the firm (after deduction of tax, dividends and proprietors’ or partners’ drawings) and other reserves created by appropriations of share premiums and similar realised appropriations. Reserves also include gifts of capital, for example, from a parent undertaking.

FCA 2023/XX Page 47 of 87 (2) For the purposes of calculating capital resources, a firm must make the following adjustments to its reserves, where appropriate: (a) A firm must deduct any unrealised gains or, where applicable, add back in any unrealised losses on debt instruments held, or formerly held, in the available￾for-sale financial assets category. (b) A firm must deduct any unrealised gains or, where applicable, add back in any unrealised losses on cash flow hedges of financial instruments measured at cost or amortised cost. (c) In respect of a defined benefit occupational pension scheme: (i) a firm must derecognise any defined benefit asset; (ii) a firm may substitute for a defined benefit liability the firm’s reduction amount, provided that the election is applied consistently in respect of any one financial year. 4 Interim net profits (Note) If a firm seeks to include interim net profits in the calculation of its capital resources, the profits must (subject to the Note), be verified by the firm’s external auditor, net of tax, anticipated dividends or proprietors’ drawings and other appropriations. 5 Revaluation reserves Revaluation reserves such as reserves arising from the revaluation of land and buildings, including any net unrealised gains for the fair valuation of equities held in the available-for-sale financial assets category. 6 Subordinated loans/debt Subordinated loans/debt must be included in capital on the basis of the provisions in this chapter that apply to subordinated loans/debts. Note: Reserves and Interim net profits Reserves must be audited, and interim net profits, general and collective provisions must be verified by the firm’s external auditor unless the firm is exempt from the provisions of Part 16 of the Companies Act 2006 (section 477 (Small companies: conditions for exemption from audit)) relating to the audit of accounts. 11.7.4 G A firm should keep a record of, and be ready to explain to its supervisory contacts in the FCA the reasons for, any difference between the deficit reduction

FCA 2023/XX Page 48 of 87 amount and any commitment the firm has made in any public document to provide funding in respect of a defined benefit occupational pension scheme. 11.7.5 R In arriving at its calculation of its capital resources for the core capital resources requirement, a firm must deduct the items set out in the following table: Item Additional explanation 1 Investments in own shares 2 Investments in subsidiaries (Note 1) 3 Intangible assets (Note 2) 4 Interim net losses (Note 3) 5 Excess of drawings over profits for a sole trader or a partnership (Note 3) Notes: 1. Investments in subsidiaries are the full balance sheet value. 2. Intangible assets are the full balance sheet value. 3. The interim net losses in row 4, and the excess of drawings in row 5, are in relation to the accounting period following the date as at which the capital resources are being computed. Personal assets 11.7.6 R In relation to a sole trader’s firm or a firm which is a partnership, the sole trader or a partner in the firm may use personal assets to meet the core capital resources requirement, to the extent necessary to make up any shortfall in meeting that requirement, unless: (1) those assets are needed to meet other liabilities arising from: (a) personal activities; or (b) another business activity not regulated by the FCA; or (2) the firm holds client money or other client assets in relation to regulated activities other than regulated pensions dashboard activity. 11.7.7 G A sole trader or a partner may use any personal assets, including property, to meet the capital requirements of this chapter, but only to the extent necessary to make up a shortfall. Subordinated loans

FCA 2023/XX Page 49 of 87 11.7.8 R A subordinated loan/debt must not form part of the capital resources for the core capital resources requirement of the firm unless it meets the following conditions: (1) it: (a) has an original maturity of at least 5 years; or (b) it is subject to 5 years’ notice of repayment; (2) the claims of the subordinated creditors must rank behind those of all unsubordinated creditors; (3) the only events of default must be non-payment of any interest or principal under the debt agreement or the winding up of the firm; (4) the remedies available to the subordinated creditor in the event of non-payment or other default in respect of the subordinated loan/debt must be limited to petitioning for the winding up of the firm or proving the debt and claiming in the liquidation of the firm; (5) the subordinated loan/debt must not become due and payable before its stated final maturity date, except on an event of default complying with (3); (6) the agreement and the debt are governed by the law of England and Wales, or of Scotland or of Northern Ireland; (7) to the fullest extent permitted under the rules of the relevant jurisdiction, creditors must waive their right to set off amounts they owe the firm against subordinated amounts owed to them by the firm; (8) the terms of the subordinated loan/debt must be set out in a written agreement that contains terms that provide for the conditions set out in this rule; and (9) the loan/debt must be unsecured and fully paid up. 11.7.9 R When calculating its capital resources, the firm must exclude any amount by which the aggregate amount of its subordinated loans/debts exceeds the amount calculated as follows: A - B where: A is equal to the sum of items 1 to 6 (inclusive) in the table of items in PDCOB 11.7.3R, which are eligible to contribute to a firm’s capital resources. B is equal to the sum of items 1 to 5 (inclusive) in the table of items in PDCOB 11.7.5R, which must be deducted in arriving at firm’s capital resources.

FCA 2023/XX Page 50 of 87 11.8 Systems, strategies, processes and reviews Purpose 11.8.1 G In addition to adequate financial resources, adequate systems and controls are necessary for the effective management of prudential risks. The rules in this section therefore impose requirements relating to such systems and controls. 11.8.2 G This section also has rules requiring a firm to identify, assess and document: (1) risks to it being able to meet its liabilities as they fall due; (2) how it intends to mitigate these risks; and (3) the amount and nature of financial resources that the firm considers necessary to address any remaining risks. 11.8.3 G The FCA may review this assessment as part of its own assessment of the adequacy of a firm’s financial resources. Systems, strategies and processes 11.8.4 R A firm must use sound, effective and comprehensive systems, strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of financial resources that it considers adequate to cover: (1) the nature and level of the risks to which it is or might be exposed; and (2) the risk that the firm might not be able to meet its core capital resources requirement and general solvency requirement in the future. Documentation of risk assessments 11.8.5 G The FCA may review the written record of the assessment as set out under PDCOB 14.10.1R as part of its own assessment of the adequacy of a firm’s financial resources as part of its day-to-day supervision of firms. 11.9 Action for damages 11.9.1 R A contravention of the rules in PDCOB 11 does not give rise to a right of action by a private person under section 138D of the Act, and each of those rules is specified under section 138D(3) of the Act as a provision giving rise to no such right of action. 12 Resolution requirements 12.1 Wind-down planning 12.1.1 R A firm must prepare and keep up to date a wind-down plan.

FCA 2023/XX Page 51 of 87 12.1.2 G A firm should refer to the FCA’s Wind-down Planning Guide (WDPG) to develop an effective wind-down plan. 12.1.3 G Firms are reminded of the disclosure requirements under Principle 11 and in SUP 16.3.21R (Insolvency, bankruptcy and winding up). 13 Notifications 13.1 Notifications general provisions 13.1.1 G This chapter sets out the requirements imposed on firms to notify the FCA of certain issues. In addition to the requirements set out in this chapter, firms must also comply with the notification requirement contained in SYSC 3.2.24R or SYSC 4.1.5C, as applicable. 13.1.2 G Firms are reminded that PDCOB also imposes requirements to notify customers of certain matters. Those requirements are set out elsewhere in PDCOB. 13.2 Specific notification requirement: scams 13.2.1 R If a firm becomes aware of a scam relating to its pensions dashboard platform, the firm must immediately notify the FCA in writing using the relevant form in Connect. 13.2.2 R A notification under PDCOB 13.2.1R must contain: (1) a description of the scam; and (2) a description of the steps the firm is taking since being made aware of the scam. 13.2.3 G For the purposes of PDCOB 13.2.1R, a scam relating to a firm’s pensions dashboard platform might include the existence of a clone or fake dashboard, or an investment scam. 13.3 Specific notification requirement: third party dashboard arrangements 13.3.1 R If a firm enters into a new third party dashboard arrangement, terminates an existing third party dashboard arrangement, or if any of the details set out in PDCOB 13.3.2R(2) change in relation to an existing third party dashboard arrangement, a firm must notify the FCA in writing using the relevant form in Connect within 30 days of the change coming into effect. 13.3.2 R A notification under PDCOB 13.3.1R must contain the following details: (1) the change the firm is notifying the FCA about (i.e., entering into a new third party dashboard arrangement, terminating an existing third party dashboard arrangement, or changing any of the details set out in PDCOB 13.3.2R(2));

FCA 2023/XX Page 52 of 87 (2) the third party access provider’s; (a) registered name; (b) trading name(s); (c) registered company number; (d) registered office; (e) principal place of business; (f) head office; (g) website address; (h) Firm Reference Number; and (i) named contact and their contact details; and (3) the uniform resource locators (URLs) through which customers can access the pensions dashboard platform. 13.3.3 G Where appropriate, the details provided in accordance with PDCOB 13.3.2R should be provided as registered with Companies House. 13.4 Specific notification requirement: post-view services 13.4.1 R If a firm adds, removes or makes any material changes to its post-view services, a firm must notify the FCA in writing using the relevant form in Connect within 30 days of the change coming into effect. 13.4.2 R A notification under PDCOB 13.4.1R must include: (1) the change the firm is notifying the FCA about (i.e., adding a post￾view service, removing a post-view service or a material change to a post-view service); (2) The details of the post-view service (i.e., a description of the new or removed post-view service, or a description of material changes to the post-view service where this is a relevant field) and a statement as to whether these changes are informed by user testing or complaints where this is a relevant field; (3) an attestation that the firm has considered whether it needs to vary its permissions as a result of the change; (4) where a firm has concluded that it does not need to vary its permission, an attestation of that fact; and (5) where a firm has concluded that it does need to vary its permission, an attestation of that fact and that it has attained the necessary

FCA 2023/XX Page 53 of 87 variation of permission, as well as the date of the variation of permission. 13.4.3 G A material change to post-view services includes, but is not limited to alteration of a post-view service in such a way which impacts the customer’s experience of the post-view service. 14 Record keeping 14.1 General record-keeping provisions 14.1.1 G Firms will need to decide what records they need to keep in line with the high-level record-keeping requirements elsewhere in the FCA Handbook, including in the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) (see SYSC 4.1.5B and SYSC 9.1.1R) and in SYSC 3, e.g. SYSC 3.2.24R, for insurers, as well as for their own business needs. 14.1.2 R In order to deal with requests for information from the FCA, as well as queries and complaints from customers, firms must keep sufficient evidence and must make and maintain adequate records of how they have complied with the requirements in PDCOB, including evidence of the specific requirements set out in PDCOB 14.2 to PDCOB 14.10 below. 14.1.3 R In complying with the record-keeping rules in this chapter, a firm must not retain the personal data of customers, save as necessary in order to show compliance with the rules – for example, where the record is of correspondence with an individual arising out of a complaint or enquiry. 14.1.4 G A firm may seek to comply with the record-keeping rules in this chapter by keeping a visual record, such as screenshots, of the relevant stages of the pensions dashboard platform and screenshots of where the advertising is placed on the platform and how the advertisements are presented. Duration of record retention 14.1.5 R A firm must retain each record referred to in this sourcebook for at least 6 years. 14.2 Specific record-keeping requirements Specific record-keeping requirements: the customer journey 14.2.1 R A firm must make and keep a record of the information customers were presented with at each stage of the pensions dashboard platform and how the information was presented. 14.2.2 R (1) A firm must make and keep a record of each version of the pensions dashboard platform, and the information required by PDCOB 14.2.1R, and the dates when each version was accessible by a customer.

FCA 2023/XX Page 54 of 87 (2) The requirement to record a new version is prompted each time there is a material change to the information set out on the pensions dashboard platform and/or the way it is presented. (3) A material change is anything that could have an impact on the way a customer may understand the services offered on the pensions dashboard platform, or the way in which a customer is able to use the services, which includes (but is not limited to): (a) adding or removing advertising or changing its method of marketing; and (b) adding or removing functionality. 14.3 Specific record-keeping requirements: customer volumes 14.3.1 R A firm must make and keep a record of: (1) the number of customers using their pensions dashboard platform; (2) the number of customers using their post-view services; (3) the number of customers using each of their post-view services; (4) the total number of times their post-view services are used; (5) the total number of times each of their post-view services are used; (6) in relation to data export: (a) the number of customers deciding to export their data in accordance with PDCOB 9; (b) the number of customers using data export to the firm; (c) the number of customers using data export to a connected person and a breakdown of the numbers for each connected person with whom the data has been shared; and (d) the total number of times that data export has been used. 14.4 Specific record-keeping requirements: warning and signposting 14.4.1 R A firm must make and keep a record of each version of the warning and signposting information provided to customers to comply with PDCOB 5 and the dates that each version was available to a customer. 14.5 Specific record-keeping requirements: advertisements 14.5.1 R (1) A firm must make and keep a record of the advertisements which it places on the pensions dashboard platform, and how those

FCA 2023/XX Page 55 of 87 advertisements are placed, including the size, prominence and positioning of the advertisements. (2) A firm must make and keep a record of the steps which it has taken to comply with PDCOB 6.3.3R. (3) A firm must make and keep a record of the remuneration it receives for placing advertisements. (4) A firm must make and keep a record of the checks which it has conducted to comply with PDCOB 6.3.2R. 14.5 Specific record-keeping requirements: consents 14.5.1 R A firm must make and keep a record of the text and presentation of consent options for cookies or similar tracking technologies. 14.6 Specific record-keeping requirements: third party dashboard arrangements 14.6.1 R A firm must make and keep a record of any third party dashboard arrangement into which it enters, including the contractual terms of agreements entered into, and of any changes to such arrangements. 14.7 Specific record-keeping requirements: data export 14.7.1 R A firm must make and keep a record of: (1) the information presented to the customer prior to their data export election; (2) where data export to the customer is used, the warnings and messages displayed to customers in accordance with PDCOB 9.4.1R, PDCOB 9.4.2R and PDCOB 9.4.6R; (3) where data export to the firm is used, the warnings and messages displayed to customers in accordance with PDCOB 9.5.1R; and (4) where applicable, the details of the connected person with which the customer’s data has been shared. 14.8 Specific record-keeping requirements: data protection impact assessments 14.8.1 R Where a firm completes, or updates, a data protection impact assessment in relation to its pensions dashboard platform, it must keep a record of that assessment. 14.8.2 R Where a firm decides not to complete a data protection impact assessment in relation to its pensions dashboard platform, it must make a record of its reasons for not completing the assessment and retain that record. 14.9 Specific record-keeping requirements: post-view services

FCA 2023/XX Page 56 of 87 14.9.1 R A firm must keep a record of: (1) the information which it provides to customers to comply with PDCOB 10.5.1R; (2) the post-view services offered and the dates when they were available; (3) the purpose of the post-view services offered; and (4) details of changes to any post-view services included where post-view services are added or removed. 14.9.2 R A firm must make an adequate record of the user testing which it has conducted to comply with PDCOB 10.3.1(4)R, including a record of what, if anything, was changed as a result of the testing. 14.10 Specific record-keeping requirements: prudential requirements 14.10.1 R A firm must make a written record of the assessments required under PDCOB 11.8.4R. In particular, it must make a written record of: (1) the major sources of risk identified in accordance with PDCOB 11.8.4R; and (2) how it intends to deal with those risks. 14.10.2 R A firm must retain the records of its assessments referred to in PDCOB 14.10.1R for at least 3 years. 15 Application of other parts of the Handbook 15.1 Application of other parts of the Handbook 15.1.1 G This chapter applies to firms carrying out regulated pensions dashboard activity. It is intended to draw a firm’s attention to the application of other key parts of the FCA Handbook, as set out in the table at PDCOB 15.1.2G. 15.1.2 G Application of other parts of the Handbook and of Regulatory Guides: Module Relevance to firms carrying on regulated pensions dashboard activity Principles for Businesses sourcebook (PRIN) PRIN sets out high-level requirements imposed by the FCA. It provides a general statement of regulatory requirements. The Principles apply to all firms. Senior Management Arrangements, Systems and SYSC 1, SYSC 4 to SYSC 10, SYSC 18, SYSC 21 to SYSC 24 and SYSC 27 apply to firms carrying out regulated pensions dashboard activity. Insurers

FCA 2023/XX Page 57 of 87 Controls sourcebook (SYSC) carrying out regulated pensions dashboard activity will be subject to the provisions of SYSC applicable to insurers when carrying out that activity. Code of Conduct sourcebook (COCON) This contains rules and guidance that are directly applicable to a firm’s SMF managers, certification employees and other conduct rules staff. It also contains guidance for firms on giving their staff training about COCON and general factors to which the FCA will have regard when assessing compliance with the COCON rules. Threshold Conditions sourcebook (COND) In order to become authorised under the Act, all firms must meet the threshold conditions. The threshold conditions must be met on a continuing basis by firms. Failure to meet one of the conditions is sufficient grounds for the exercise by the FCA of its powers. Fit and Proper test for Employees and Senior Personnel sourcebook (FIT) The purpose of FIT is to set out and describe the criteria that a firm should consider when assessing the fitness and propriety of a person: (1) in respect of whom an application is being made for approval to undertake a controlled function under the senior managers regime; (2) who has already been approved; (3) who is a certification employee; or (4) whom a firm is considering appointing to be a certification employee. It also sets out and describes criteria that the FCA will consider when assessing the fitness and propriety of a candidate for a controlled function position and that it may consider when assessing the continuing fitness and propriety of approved persons. Training and Competence sourcebook (TC) TC sets out rules and guidance regarding the competence of a firm’s employees, continuing professional development and associated record￾keeping requirements. General Provisions sourcebook (GEN) GEN contains rules and guidance on general matters, including interpreting the FCA Handbook, statutory status disclosure, the FCA’s logo and insurance against financial penalties.

FCA 2023/XX Page 58 of 87 Fees manual (FEES) This manual sets out the fees applying to firms. Conduct of Business Sourcebook (COBS) This sets out rules and guidance regarding conduct of business in relation to investment services, such as investment advice. Supervision manual (SUP) SUP sets out the relationship between the FCA and firms. As a general rule, SUP contains material that is of continuing relevance after authorisation. Decision, Procedure and Penalties manual (DEPP) DEPP sets out: (1) the FCA’s decision-making procedure for giving statutory notices. These are warning notices, decision notices and supervisory notices (DEPP 1.2 to DEPP 5); and (2) the FCA’s policy with respect to the imposition and amount of penalties under the Act (see DEPP 6). Dispute Resolution: Complaints sourcebook (DISP) DISP sets out rules and guidance in relation to treating complainants fairly and the Financial Ombudsman Service. The Enforcement Guide (EG) The Enforcement Guide (EG) describes the FCA’s approach to exercising the main enforcement powers given to it by the Act and by other legislation. Financial Crime Guide: A firm’s guide to countering financial crime risks (FCG) and Financial Crime Thematic Reviews (FCTR) FCG and FCTR provide guidance on steps that a firm can take to reduce the risk that it might be used to further financial crime. The Perimeter Guidance manual (PERG) PERG gives guidance about the circumstances in which authorisation is required, or exempt person status is available, including guidance on the activities which are regulated under the Act and the exclusions which are available. The Unfair Contract Terms and Consumer Notices Regulatory Guide (UNFCOG) UNFCOG explains the FCA’s policy on how it will use its powers under the Consumer Rights Act 2015 in relation to unfair terms and consumer notices.

FCA 2023/XX Page 59 of 87 The Wind-Down Planning Guide (WDPG) WDPG gives guidance about how to develop an effective wind-down plan. Sch 1 Right of action for damages Sch 1.1 G The table below sets out the rules in PDCOB the contravention of which by an authorised person may be actionable under section 138D of the Act (Actions for damages) by a person who suffers loss as a result of the contravention. Sch 1.2 G If a ‘Yes’ appears in the column headed ‘For private person?’ the rule may be actionable by a private person under section 138D (or, in certain circumstances, that person’s fiduciary or representative; see article 6(2) and (3)(c) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256)). A ‘Yes’ in the column headed ‘Removed’ indicates that the FCA has removed the right of action under section 138D(2) of the Act. Where this is the case, a reference to the rule in which it is removed is also given. Sch 1.3 G The column headed ‘For other person?’ indicates whether the rule may be actionable by a person other than a private person (or their fiduciary or representative) under article 6(2) and (3) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256). Where this is the case, an indication of the type of person by whom the rule may be actionable is given. Rights of action under section 138D Chapter Section / Annex Paragraph For private person? Removed? For other person? The fair, clear and not misleading rule in PDCOB 4.2.1R Yes In part (Note 1) No Any rule in PDCOB which prohibits an authorised person from seeking to make provisions excluding or restricting any duty or liability Yes No Yes The prudential rules for firms carrying on regulated pensions dashboard activity in PDCOB 11 No Yes (see PDCOB 11.9.1R) No All other rules in PDCOB Yes No No Notes

FCA 2023/XX Page 60 of 87

1. PDCOB 4.6.1R provides that if, in relation to a particular communication, a firm takes reasonable steps to ensure it complies with the fair, clear and not misleading rule, a contravention of that rule does not give rise to a right of action under section 138D of the Act.

FCA 2023/XX Page 61 of 87 Annex F Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. 10C FCA senior managers regime for approved persons in SMCR firms … 10C Annex 1 What functions apply to what type of firm … Part Seven: Functions applying to limited scope firms 7.1 R Limited scope SMCR firms are divided into the following categories for the purposes of SUP 10C Annex 1: (1) … … (9) a firm that comes within SYSC 23 Annex 1 6.11R (claims management) that is not a Class 1 firm as defined in CMCOB 7.2.5R(1).; (10) a firm falling within SYSC 23 Annex 1 6.28R (pensions dashboard service). … 7.3 R (1) The table in SUP 10C Annex 1 7.4R sets out which FCA controlled functions apply to a limited scope SMRC firm covered by SUP 10C Annex 1 7.1R(1), (2), (2A), (3), (4), (4A), (8), or (9), or (10). … Part 2 (Claims management, and funeral plan, and pensions dashboard firms) (1) (2) (3) (4) (5) (6) Brief description of functions Function number Class 1 claims management firms Other claims management firms Funeral plan firms Pensions dashboard firms

FCA 2023/XX Page 62 of 87 Required functions Compliance oversight function SMF 16 … … … x Limited scope function SMF 29 … … … √ Notes to the table Note (1): The categories of firm in the column headings of this table are to be interpreted in accordance with the classification of firms at SUP 10C Annex 1 7.1R. Therefore: … (7) column four of Part 2 of the table (Other Claims management firms) refers to SUP 10C Annex 1 7.1R(9); and (8) column five of Part 2 of the table (Funeral plan firms) refers to SUP 10C Annex 1 7.1R(2A).; and (9) column six of Part 2 of the table (Pensions dashboard firms) refers to SUP 10C Annex 1 7.1R(10). … 16 Reporting requirements … 16.12 Integrated Regulatory Reporting … Purpose 16.12.2 G (1) Principle 4 requires firms to maintain adequate financial resources. The prudential sourcebooks, which are contained in the Prudential Standards block in the Handbook, for firms engaged in regulated funeral plan activity, FPCOB and, for firms engaged in regulated pensions dashboard activity, PDCOB, set out the FCA’s detailed capital adequacy requirements. By submitting regular data, firms enable the FCA to monitor their compliance with Principle 4 and their prudential requirements. … Reporting requirement

FCA 2023/XX Page 63 of 87 16.12.3 R (1) Any firm permitted to carry on any of the activities within each of the RAGs set out in column (1) of the table in SUP 16.12.4R must: (a) (i) … (ii) unless (iii) applies, where a firm is required to submit completed data items for more than one RAG, that firm must only submit the data item of the same name and purpose in respect of the lowest numbered RAG applicable to it, RAG 1 being the lowest and RAG 12 13 the highest; … … … 16.12.4 R Table of applicable rules containing data items, frequency and submission periods (1) (2) (3) (4) RAG number Regulated activities Provisions containing: applicable data items reporting frequency/period due date … RAG 12 … RAG 13 regulated pensions dashboard activity SUP 16.12.29E SUP 16.12.29E SUP 16.12.29E … 16.12.29C R … Regulated Activity Group 13 16.12.29D R SUP 16.12.29ER does not apply to a local authority. 16.12.29E R The applicable data items, reporting frequencies and submission deadlines referred to in SUP 16.12.4R are set out in the table below. Reporting frequencies are calculated from a firm’s accounting reference date, unless indicated otherwise. The due dates are the last day of the periods given in the table below following the relevant reporting frequency period.

FCA 2023/XX Page 64 of 87 Description of data item Data item (note 1) Frequency Submission deadline Balance sheet Section A FIN075 Half yearly 30 business days after the half year end Profit and loss account Section B FIN075 Half yearly 30 business days after the half year end Audited accounts Section C FIN075 Half yearly 30 business days after the half year end Core capital resources requirement Section D FIN075 Half yearly 30 business days after the half year end Capital resources Section E FIN075 Half yearly 30 business days after the half year end Capital adequacy position Section F FIN075 Half yearly 30 business days after the half year end Note 1 When submitting the completed data item required, a firm must use the format of the data item set out in SUP 16 Annex 53A. Guidance notes for the completion of the data items are set out in SUP 16 Annex 53B. After SUP 16 Annex 52 (Guidance notes for the MIF008), insert the following new annexes: SUP 16 Annex 53AR (Pensions Dashboard Service Firms - Half-Yearly Prudential Return) and SUP 16 Annex 53BG (Guidance notes for the Pensions Dashboard Service Firms – Half￾Yearly Prudential Return). The text is all new and is not underlined. 16 Annex 53AR Pensions Dashboard Service Firms – Half-Yearly Prudential Return This annex consists only of one or more forms. The forms can be found below: Pensions Dashboard Service Firms – Half-Yearly Prudential Return (FIN075)

Completion Guidance Row A B C PART ONE: FINANCIAL STATEMENT INFORMATION (as at end date of Reporting Period) FIXED ASSETS 1 Intangible assets 2 Tangible assets 3 Investments 4 TOTAL FIXED ASSETS CURRENT ASSETS 5 Stocks 6 Debtors (see Memo (1)) 7 Investments held as current assets (see Memo (2)) 8 Cash at bank and in hand 9 Other assets 10 TOTAL CURRENT ASSETS CURRENT LIABILITIES (amounts falling due within one year) 11 Bank loans and overdrafts 12 Other liabilities falling due within one year 13 TOTAL CURRENT LIABILITIES 14 Net current assets 15 Total assets less current liabilities 16 Other liabilities falling due after more than one year 17 Provisions for liabilities and charges 18 Net assets 19 Guarantees provided by firm CAPITAL AND RESERVES Capital account (incorporated businesses excluding Limited Liability Partnerships) 20 Ordinary share capital 21 Preference share capital 22 Share premium account 23 Profit and Loss account (retained earnings) 24 Other reserves 25 TOTAL CAPITAL AND RESERVES Capital account (unincorporated businesses and Limited Liability Partnerships) 26 Sole trader / Partners' capital account / Members' capital 27 Other reserves 28 TOTAL CAPITAL AND RESERVES Memo (1) 29 Total amount falling due within one year from directors, fellow group undertakings or undertaking in which the firm has a participating interest where included in Debtors. Memo (2) 30 Value of shares in group undertakings where such investments are held as current assets. (for the period corresponding to the Reporting Period) REVENUE (Income accrued during the reporting period) 31 Revenue from all regulated qualifying pensions dashboard services activities 32 Revenue from all FCA regulated activities Monetary answers must completed in Sterling. Item SECTION A: BALANCE SHEET Regulatory return for PDS firms (SUP 16 Annex 53A) PENSIONS DASHBOARD SERVICES (PDS) FIRMS - PRUDENTIAL - HALF-YEARLY RETURN Column SECTION B: PROFIT AND LOSS ACCOUNT Part One, Part Two and Part Three must be completed. Memos (1) and (2) to be completed, where applicable, by all pensions dashboard service firms subject to [PDBOB sourcebook]. FCA 2023/XX Page 65 of 87

(including regulated qualifying pensions dashboard services activities) 33 Revenue from all non-FCA regulated activities 34 TOTAL REVENUE EXPENDITURE (Expenditure incurred during the reporting period) 35 TOTAL EXPENDITURE 36 Profit/(Loss) on ordinary activities before taxation 37 Profit/(Loss) on extraordinary activities before taxation 38 Taxation 39 Profit/(Loss) for the period before dividends and appropriations 40 Dividends and other appropriations 41 Retained Profit Annual Report and accounts 42 Date of most recent annual report and accounts dd/mm/yyyy 43 Please provide an attachement or the link to the publication of your most recent annual report and accounts https:// PART TWO: SUPPLEMENTARY INFORMATION Row A B C 44 small firms exemption from having its accounts audited? Yes / No 45 If the firm is required to submit audited accounts, please report the date on which your accounts were last audited dd/mm/yyyy Row A B C PART THREE: REGULATORY CAPITAL (as at the firm's most recent accounting reference date) 46 Base requirement 40000 47 CORE CAPITAL RESOURCES REQUIREMENT (as at the firm's most recent accounting reference date) (as at the firm's end date of the Reporting Period) Incorporated businesses excluding Limited Liability Partnerships 48 Share capital 49 Reserves 50 Interim net profits 51 Revaluation reserves 52 Eligible subordinated loans 53 less investments in own shares 54 less intangible assets 55 less interim net losses 56 TOTAL CAPITAL RESOURCES (as at the firm's end date of the Reporting Period) Unincorporated businesses and Limited Liability Partnerships 57 Capital of a sole trader or partnership 58 Eligible subordinated loans 59 Personal assets not needed to meet non-business liabilities 60 less intangible assets 61 less interim net losses 62 less excess of drawings over profits for a sole trader or partnership 63 TOTAL CAPITAL RESOURCES (as at the firm's end date of the Reporting Period) (as at the firm's end date of the Reporting Period) 64 CAPITAL RESOURCES SURPLUS/(DEFICIT) (as at the firm's end date of the Reporting Period) Item SECTION F: CAPITAL ADEQUACY POSITION SECTION D: CORE CAPITAL RESOURCES REQUIREMENT Column Column Item If your firm is incorporated, does your firm qualify for the Companies House SECTION C: AUDITED ACCOUNTS SECTION E: CAPITAL RESOURCES Page 66 of 87 FCA 2023/XX

FCA 2023/XX Page 67 of 87 16 Annex 53BG Guidance notes for the Pensions Dashboard Service Firms – Half-Yearly Prudential Return This annex consists only of one or more forms. The forms can be found below: Guidance notes for completion of the Pensions Dashboard Service Firms – Half￾Yearly Prudential Return (FIN075)

FCA 2023/XX Page 68 of 87 SUP 16 Annex 53B Guidance Notes for the completion of the data items as set out in FIN075 – Pensions Dashboard Services (PDS) Prudential Return Introduction This data provides the FCA with information on the solvency of the pensions dashboard service firms. The data item is intended to reflect the underlying adequate financial resources requirements contained in PDCOB 11 and allows monitoring against the requirements set out there, and also against those individual requirements placed on firms. We have included references to the underlying rules to assist in its completion. The data assists the FCA in the ongoing supervision of firms engaged in regulated pensions dashboard activity. This data item applies to all pensions dashboard service firms. In the text below, we have identified where elements do not apply to all firms. This guidance note does not constitute individual or general FCA guidance. The purpose of this guidance note is to help firms complete the prudential return (FIN075). This summary is not a substitute for reading the actual text of the FCA Handbook. It is important to note that this guidance may be subject to periodic review. Currency All figures should be reported in Sterling (unless otherwise stated). Figures should be reported in single currency units (unless otherwise stated). Defined terms The descriptions indicated in these notes are designed simply to repeat, summarise or amplify the relevant statutory or other definitions and terminology, including, where appropriate, the pensions dashboard service firm’s accounting framework, without departing from their full meaning or effect. The defined terms are not meant to replace, redefine, or reinterpret relevant accounting standards or corresponding accounting terms. Data elements or items These are referred to by row first, then column.

FCA 2023/XX Page 69 of 87 Basis of completion PART ONE: FINANCIAL STATEMENT INFORMATION SECTION A: BALANCE SHEET FIXED ASSETS 1B – Intangible assets Pensions dashboard service firms should enter the amount of intangible assets that they hold. Intangible assets are identifiable non-monetary assets that are without physical substance. For example, goodwill, copyrights, patents and intellectual property. 2B – Tangible assets Pensions dashboard service firms should enter the amount of tangible assets that they hold. Tangible assets are assets that have physical substance and for which a measurable value can be attached. Examples include property, real estate, plant and equipment beneficially owned by the firm. 3B – Investments Pensions dashboard service firms should enter the amount of assets held for long-term investment purposes. This represents the firm’s long-term investments, including shares, bonds, real estate, exchange-traded funds, money market funds, cash or cash equivalents that are held for long-term investment purposes. 4B – Total fixed assets This amount should be the sum of items 1B (intangible assets), 2B (tangible assets) and 3B (investments). CURRENT ASSETS 5A – Stocks (or inventories) Pensions dashboard service firms should enter the monetary equivalent amount of their inventory held. These are assets held for sale in the ordinary course of business (finished goods), assets in the production process for sale in the ordinary course of business (work in progress), and materials or supplies that are consumed during production (raw materials). 6A – Debtors Pensions dashboard service firms should enter the amount of debtors. This includes loans and securities, and both trade and non-trade debtors. It also includes the total amount falling due within one year from directors, fellow group undertakings or undertakings in which the firm has a participating interest where included as debtors. 7A – Investments held as current assets Pensions dashboard service firms should enter the amount of assets held for short-term investment purposes. These are short-term investments that a firm holds for resale or pending their sale with a maturity date of less than one year and are generally, easily converted to cash. These can include short-terms investments in, for example, equities,

FCA 2023/XX Page 70 of 87 debt securities and exchange-traded funds. It also includes the value of shares in group undertakings where such investments are held as current assets. 8A – Cash at bank and in hand Pensions dashboard service firms should enter the amount of cash held by a business in the form of notes and coins (e.g. petty cash) or which are held at a bank in the form of on demand deposits. 9A – Other assets Pensions dashboard service firms should enter the amount of other current assets held by the firm where they are not reported in items 5A (stocks or inventories), 6A (debtors), 7A (investments held as current assets) and 8A (cash at bank and in hand). 10A – Total current assets This amount should be the sum of items 5A (stocks or inventories), 6A (debtors), 7A (investments held as current assets), 8A (cash at bank and in hand) and 9A (other assets). CURRENT LIABILITIES 11A – Banks loans and overdrafts Pensions dashboard service firms should enter the amount of any borrowings sourced from banks or building societies. 12A – Other liabilities falling due within one year Pensions dashboard service firms should enter the amount of any borrowings that are not sourced from banks or building societies. These are short-term financial obligations that are not reported in item 11A (banks loans and overdrafts) to be settled within one year or within a normal operating cycle. 13A – Total current liabilities This amount should be the sum of items 11A (bank loans and overdrafts) and 12A (other liabilities falling due within one year). 14B – Net current assets This should equal item 10A (total current assets) minus item 13A (total current liabilities). 15B – Total assets less current liabilities This should equal the sum of item 4B (total fixed assets) and item 10A (total current assets), less item 13A (total current liabilities). 16B – Other liabilities falling due after more than one year Pensions dashboard service firms should enter the amount of any long-term borrowings, including loans (e.g. mortgage, bank loans or debt securities issued) that are due to be repaid after more than one year and debt securities with maturities greater than one year.

FCA 2023/XX Page 71 of 87 17B – Provisions for liabilities and charges Pensions dashboard service firms should enter the amount of any provisions for liabilities and charges. These represent liabilities of uncertain timing or amount. They come about because of a present obligation (legal or constructive) that has arisen as a result of a past event(s) (i.e. an event that creates a legal or constructive obligation and their no realistic alternative but to settle the obligation). The payment is probable in that it is more likely than not to occur, and the amount can be estimated reliably. 18B – Net assets Net assets represent the residual interest that owners (or shareholders) have in the firm once the assets of the firm are used to settle all outstanding liabilities. This should equal item 15B (total assets less current liabilities) minus item 16B (other liabilities falling due after more than one year) and minus item 17B (provisions for liabilities and charges). Please note that this figure must be the same figure as item 25A (total capital and reserves); otherwise, the balance sheet (or statement of financial position) will not balance. 19B – Guarantees provided by firm Pensions dashboard service firms should enter the total value of guarantees provided by the firm to cover the indebtedness of other persons or entities. CAPITAL AND RESERVES Capital account (incorporated businesses excluding Limited Liability Partnerships) 20A – Ordinary share capital Pensions dashboard service firms should enter the face value of shares that have been issued and for which cash has been received. 21A – Preference share capital Pensions dashboard service firms should enter: (1) the face value of shares that have been issued and for which cash has been received, and (2) where the holders of these shares have preferential rights over the holders of ordinary shares. 22A – Share premium account Pensions dashboard service firms should enter the difference between the cash received in exchange for ordinary share capital and the face value of the shares issued. 23A – Profit and loss account (retained earnings) Pensions dashboard service firms should enter the retained earnings of the firm. This represents the accumulation of all profits previously retained by the firm (after the deduction of tax and dividends) since the birth of the firm. It would also include the profit retained by the firm in the financial year that is brought across from the firm’s profit and loss account statement (i.e. it would include item 41B). 24A – Other reserves Pensions dashboard service firms should enter the amount of any other reserves that they hold and that are not reported in item 23A (retained earnings). This may include

FCA 2023/XX Page 72 of 87 reserves created by appropriations of share premiums and similar realised appropriations, gifts of capital (such as those from a parent undertaking), and revaluation reserves (e.g. reserves arising from the revaluation of land and buildings). 25A – Total capital and reserves Pensions dashboard service firms should enter the sum of item 20A (ordinary share capital), item 21A (preference share capital), item 22A (share premium account), item 23 (profit and loss account (retained earnings)), and item 24A (other reserves). Please note that this figure must be the same figure as item 18A (net assets); otherwise, the balance sheet (or statement of financial position) will not balance. Capital account (unincorporated businesses and Limited Liability Partnerships) 26A – Sole trader / Partners' capital account / Members' capital For a pensions dashboard service firm that is a sole trader, the firm should enter the net balance on the firm’s capital account and current account. For a pensions dashboard service firm that is a partnership, the firm should enter the capital of the partnership (i.e. capital made up from the partners). 27A – Other reserves Pensions dashboard service firms should enter the amount of any other reserves that they hold. 28A – Total capital and reserves Pensions dashboard service firms should enter the sum of item 26A (Sole trader / Partners' capital account / Members' capital) and item 27A (other reserves). Please note that this figure must be the same figure as item 18A (net assets); otherwise, the balance sheet (or statement of financial position) will not balance. 29A – Memo (1) Pensions dashboard service firms should enter the total amount of debtors falling due within one year from directors, fellow group undertakings or undertakings in which the firm has a participating interest where included as debtors. 30A – Memo (2) Pensions dashboard service firms should enter the total value of shares in group undertakings where such investments are held as current assets. SECTION B: PROFIT AND LOSS ACCOUNT REVENUE 31B – Revenue from all regulated pensions dashboard activities Pensions dashboard service firms should enter the total income accrued during the reporting period from regulated pensions dashboard activities. 32B – Revenue from all FCA regulated activities

FCA 2023/XX Page 73 of 87 Pensions dashboard service firms should enter the total income accrued during the reporting period from all FCA regulated activities. This includes the income accrued during the reporting period from regulated pensions dashboard activities. 33B – Revenue from all non-FCA regulated activities Pensions dashboard service firms should enter the total income accrued during the reporting period from all non-FCA regulated activities. 34B – Total revenue Pensions dashboard service firms should enter the sum of item 32B (revenue from all FCA regulated activities) and item 33B (revenue from all non-FCA regulated activities). EXPENDITURE 35B – Total expenditure Pensions dashboard service firms should enter the total expenditure incurred during the reporting period both in relation to its regulated and non-regulated activities. It should exclude taxation payable on the firm’s profits during the reporting period. 36B – Profit/(Loss) on ordinary activities before taxation This figure is produced by deducting the total expenditure from ordinary activities (both regulated and non-regulated) incurred during the reporting period from the total revenue (both regulated and non-regulated) accrued during the reporting period. If the firm has not undertaken any extraordinary activities, this should be equal to item 34B (total revenue) minus item 35B (total expenditure). 37B – Profit/(Loss) on extraordinary activities before taxation Pensions dashboard service firms should enter any profits/losses on extraordinary activities before taxation during the reporting period. This should consider the proportion of total revenue obtained because of extraordinary activities, less the total expenditure incurred as a result of these extraordinary activities. An extraordinary event is a one-off (or non-recurring) event that has either generated a material profit or loss. Examples of an extraordinary activity may be the sale of a building, or the purchase of new premises. 38B – Taxation Pensions dashboard service firms should estimate the tax that will be payable on its profits and insert that figure in this field. 39B – Profit/(Loss) for the period before dividends and appropriations This figure should be calculated by taking item 34B (total revenue), less item 35B (total expenditure) and less item 38B (taxation). 40B – Dividends and other appropriations Pensions dashboard service firms should enter any dividends and other appropriations, which include dividends paid to shareholders, staff bonuses and wages paid to self (sole trader) etc. 41B – Retained profit

FCA 2023/XX Page 74 of 87 Pensions dashboard service firms should calculate this by taking item 39B (profit/(loss) for the period before dividends and appropriations) less item 40B (dividends and other appropriations). Annual Report and accounts 42B – Date of most recent annual report and accounts Pensions dashboard service firms should enter the date (in the format of dd/mm/yyyy) at which the firm’s most recent annual report and accounts were prepared. 43B – Please provide an attachment or the link to the publication of your most recent annual report and accounts Pensions dashboard service firms should provide either an attachment or the link to the firm’s most recent annual report and accounts.

FCA 2023/XX Page 75 of 87 PART TWO: SUPPLEMENTARY INFORMATION SECTION C: AUDITED ACCOUNTS 44B – If your firm is incorporated, does your firm qualify for the Companies House small firms’ exemption from having its accounts audited? Answer ‘Yes’ or ‘No’. Pensions dashboard service firms should indicate in the affirmative (‘Yes’) if the firm is incorporated and has prepared their accounts under this exemption because the firm has qualified to apply the Companies House small firms’ exemption from having their accounts audited. Otherwise, the firm should indicate ‘No’ if this is not the case. 45B – If the firm is required to submit audited accounts, please report the date on which your accounts were last audited. If a pensions dashboard service firm is required to submit audited accounts, the firm should enter the date (in the format of dd/mm/yyyy) on which the firm’s accounts were last audited.

FCA 2023/XX Page 76 of 87 PART THREE: REGULATORY CAPITAL SECTION D: CORE CAPITAL RESOURCES REQUIREMENT 46B – Base requirement Guidance not required. With reference to PDCOB 11.5.1R, for a firm with a Part 4A permission to carry on regulated pensions dashboard activities, the base requirement is equal to £40,000. 47B – Core capital resources requirement The core capital resources requirement should be calculated in accordance with PDCOB 11.5.1R. Pensions dashboard service firms should enter the firm’s core capital resources requirement. SECTION E: CAPITAL RESOURCES Incorporated businesses excluding Limited Liability Partnerships 48A – Share capital In accordance with PDCOB 11.7.3R, pensions dashboard service firms should enter the firm’s ordinary share capital and preference share capital (excluding preference shares redeemable by shareholders within 2 years) at the end of reporting period. 49A – Reserves In accordance with PDCOB 11.7.3R, pensions dashboard service firms should enter the firm’s accumulated total of all retained profit, and other reserves created by appropriations of share premiums and similar realised appropriations at the end of reporting period. Reserves would also include gifts of capital, for example, from a parent undertaking. Refer to PDCOB 11.7.3R, to take into account the necessary adjustments that firms must make to its reserves, where appropriate. 50A – Interim net profits In accordance with PDCOB 11.7.3R, pensions dashboard service firms should enter the firm’s total interim profits net of tax, anticipated dividends or proprietors' drawings and other appropriations. 51A – Revaluation reserves In accordance with PDCOB 11.7.3R, pensions dashboard service firms should enter the firm’s revaluation reserves such as reserves arising from the revaluation of land and buildings, including any net unrealised gains for the fair valuation of equities held in the available-for-sale financial assets category. 52A – Eligible subordinated loans In accordance with PDCOB 11.7.3R and PDCOB 11.7.8R, pensions dashboard service firms should enter the firm’s eligible subordinated loans. A subordinated loan/debt cannot be included as part of the firm’s capital resources to meet the firm’s core capital resources requirement unless it meets the conditions set out in PDCOB 11.7.8R. 53A – Less investments in own shares

FCA 2023/XX Page 77 of 87 In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter any of the firm’s 'investments' in the balance sheet which are invested in the firm's own shares must be inserted in this field for deduction. 54A – Less intangible assets In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter the firm’s intangible assets for deduction. 55A – Less interim net losses In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter the firm’s interim losses, where they have not already been incorporated into the firm’s 'reserves', for deduction. 56A – Total capital resources In accordance with PDCOB 11.7, pensions dashboard service firms should calculate their total capital resources as at the firm’s end date of the reporting period by using the following formula: item 48A (share capital) + item 49A (reserves) + item 50A (interim net profits) + item 51A (revaluation reserves) + item 52A (eligible subordinated loans) - item 53A (investments in own shares) - item 54A (intangible assets) - item 55A (interim net losses). Unincorporated businesses and Limited Liability Partnerships 57A – Capital of a sole trader or partnership In accordance with PDCOB 11.7.3R, pensions dashboard service firms should enter the firm’s total net balance on the firm's capital accounts and current account at the end of reporting period. 58A – Eligible subordinated loans In accordance with PDCOB 11.7.3R and PDCOB 11.7.8R, pensions dashboard service firms should enter the firm’s eligible subordinated loans. A subordinated loan/debt cannot be included as part of the firm’s capital resources to meet the firm’s core capital resources requirement unless it meets the conditions set out in PDCOB 11.7.8R. 59A – Personal assets not needed to meet non-business liabilities In accordance with PDCOB 11.7.3R and PDCOB 11.7.6R, pensions dashboard service firms that are either sole traders or partnerships may use personal assets as eligible capital unless: i) these assets are being used to meet liabilities relating to other non-FCA activities (including personal and other business activities); or ii) the firm holds client money or other client assets in relation to regulated activities other than regulated pensions dashboard activity. Refer to PDCOB 11.7.6R. 60A – Less intangible assets In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter the firm’s intangible assets for deduction. 61A – Less interim net losses

FCA 2023/XX Page 78 of 87 In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter the firm’s interim losses, where they have not already been incorporated into the firm's capital or current accounts, for deduction. 62A – less excess of drawings over profits for a sole trader or partnership In accordance with PDCOB 11.7.3R and PDCOB 11.7.5R, pensions dashboard service firms should enter any excess capital removed from the firm over and above any profit made by the firm for deduction. 63A – Total capital resources In accordance with PDCOB 11.7, pensions dashboard service firms should calculate their total capital resources as at the firm’s end date of the reporting period by using the following formula: item 57A (capital of a sole trader or partnership) + item 58A (eligible subordinated loans) + item 59A (personal assets not needed to meet non-business liabilities) - item 60A (intangible assets) - item 61A (interim net losses) - item 62A (excess of drawings over profits for a sole trader or partnership). SECTION F: CAPITAL ADEQUACY POSITION 64A – Capital resources surplus/(deficit) In accordance with PDCOB 11.3.1R, pensions dashboard services firms must at all times maintain capital resources equal to or in excess of their core capital resources requirement. Pensions dashboard service firms that are incorporated businesses, excluding Limited Liability Partnerships, should calculate this by taking item 56A (total capital resources) less item 47B (core capital resources requirement). Pensions dashboard service firms that are unincorporated businesses and Limited Liability Partnerships should calculate this by taking item 63A (total capital resources) less item 47B (core capital resources requirement).

FCA 2023/XX Page 79 of 87 Annex G Amendments to the Dispute Resolution: Complaints sourcebook (DISP) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Treating complainants fairly … 1 Annex 1R Complaints return form …

FCA 2023/XX Part A-1, DISP 1 Annex 1R For Firms Receiving Less Than 500 Complaints in the Reporting Period Table 1 – Complaints Opened When Fewer Than 500 Total Opened … Decumulation & Pensions Product / Service Total Advising, Selling and Arranging Information, Sums/ Charges or Product Performance General Admin / Customer Service Arrears Related Other A D H L M N 78 Workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 79 Non-workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 80 Trust based pensions (e.g. Occupational and DB) 81 Pensions packaged multi products 224 Pensions dashboard services 82 Other pensions - Please provide details below 82x … Table 3 - Contextualisation Metrics When Fewer Than 500 Total Opened Complaints … Product / Service Grouping Provision (At Reporting Period End Date) Intermediation (Within the Reporting Period)

FCA 2023/XX Page 81 of 87 A B 164 Total banking and credit cards Number of accounts 173 Total home finance Number of balances outstanding Number of sales 190 Total insurance & pure protection Number of policies in force Number of policies sold 203 Total decumulation & pensions Number of policies in force/service users Number of policies in force/service users 218 Total investments Number of client accounts Number of sales or equivalent transactions … Part A-2, DISP 1 Annex 1R For Firms Receiving More Than 500 Complaints in the Reporting Period Table 4 - Complaints Opened When Greater Than or Equal to 500 Opened Complaints …

FCA 2023/XX Page 82 of 87 Decumulation & Pensions Total Advising, Selling and Arranging Information, Sums / Charges or Product Performance General Admin / Customer Service Arrears Related Other Claims Product / Service Unsuitable Advice Unclear Guidance / Arrangement Disputes over Sums / Charges Product Performance / Features Product Disclosure Information Errors / Not Following Instructions Delays / Timescales Other General Admin / Customer Service Number of Complaints in Columns B to N Which are Claims Related A B C E F G I J K M N O 78 Workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 79 Non-workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 80 Trust based pensions (e.g. Occupational and DB) 81 Pensions packaged multi products 224 Pensions dashboard services

FCA 2023/XX Page 83 of 87 … Table 5 - Complaints Closed, Upheld and Redress When Greater Than or Equal to 500 Opened Complaints … Decumulation & Pensions Product / Service Complaints Closed Within 3 Days Complaints Closed > 3 days but Within 8 Weeks Complaints Closed > 8 Weeks Total Complaints Closed Total Complaints Upheld Total Redress Paid for Upheld Complaints (Single Units) Total Redress Paid for Complaints Not Upheld (Single Units) Total Redress Paid (Single Units) A B C D E F G H 133 Workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 134 Non-workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 135 Trust based pensions (e.g. Occupational and DB) 136 Pensions packaged multi products 225 Pensions dashboard services … Table 6 - Contextualisation Metrics Greater Than or Equal to 500 Opened Complaints … Decumulation & Pensions

FCA 2023/XX Page 84 of 87 Product / Service Provision (At Reporting Period End Date) Number of Policies in Force/Service Users Intermediation (Within the Reporting Period) Number of Policies Sold/Service Users A B 193 Workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 194 Non-workplace personal pensions (e.g. SIPPs, SHPs, PPPs) 195 Trust based pensions (e.g. Occupational and DB) 196 Pensions packaged multi products 226 Pensions dashboard services 197 Other pensions … Decumulation & Pensions Contextualised Product / Service Provision (At Reporting Period End Date) Number of Policies in Force/Service Users Intermediation (Within the Reporting Period) Number of Policies Sold/Service Users A B 204 Number of complaints opened per 1000 policies in force/service users 205 Number of complaints opened per 1000 policies sold/service users …

FCA 2023/XX … 2 Jurisdiction of the Financial Ombudsman Service … 2.5 To which activities does the Voluntary Jurisdiction apply? 2.5.1 R The Ombudsman can consider a complaint under the Voluntary Jurisdiction if: … (2) it relates to an act or omission by a VJ participant in carrying on one or more of the following activities: (a) an activity (other than auction regulation bidding, and administering a benchmark, meeting of repayment claims, and managing dormant asset funds (including the investment of such funds) and regulated pensions dashboard activity) carried on after 28 April 1988 which: … … (c) activities, other than regulated claims management activities, activities ancillary to regulated claims management activities, meeting of repayment claims, and managing dormant asset funds (including the investment of such funds) and regulated pensions dashboard activity, which (at 1 August 2022 [date TBC]) would be covered by the Compulsory Jurisdiction, if they were carried on from an establishment in the United Kingdom (these activities are listed in DISP 2 Annex 1G). … … … 2.7 Is the complainant eligible? … Eligible complainants … 2.7.6 R …

FCA 2023/XX Page 86 of 87 (18) the complainant is a customer of the respondent in relation to regulated pensions dashboard activity. … 2 Annex 1G Regulated Activities for the Voluntary Jurisdiction at 1 August 2022 [date TBC] … The activities which were covered by the Compulsory Jurisdiction (1 August 2022 [date TBC]) were: … The activities which (at 1 August 2022 [date TBC]) were regulated activities were, in accordance with section 22 of the Act (Regulated Activities), any of the following activities specified in Part II and Parts 3A and 3B of the Regulated Activities Order (with the addition of auction regulation bidding and administering a benchmark): … (48) regulated pensions dashboard activity (article [XX]); … … 4 Standard terms … 4.2 Standard terms … Application of DISP 1 to DISP 3 4.2.3 R The following rules and guidance apply to VJ participants as part of the standard terms, except where the context requires otherwise: … (2) … (d) DISP 2.7.6(14B); and (e) DISP 2.7.6(18); and

FCA 2023/XX Page 87 of 87 …

CP22/25 Appendix 2 Financial Conduct Authority Proposed regulatory framework for pensions dashboard service firms Appendix 2 Draft Forms

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 1 Authorisation application form Pensions Dashboard Service (PDS) Full name of applicant firm Important information to read before completing this form The guidance notes that accompany this form will help you complete the questions and explain why the information is being requested. Purpose of this form This form collects information that is specific to the type of business the applicant firm is applying for. You must answer every question. If a question does not apply to the applicant firm, please write ‘Not Applicable’. Contents of this form Schedule of supporting documents 1 Application contact details 2 Firm details 3 Scope of permission and fees 4 Pensions Dashboard Service Conduct of Business 5 Financial resources 6 Disclosure of significant events 7 Systems and controls 8 Compliance arrangements 9 Personnel information 10 Owners and influencers 11 Supporting documents 12 Paying the application fee 13 Declaration

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 2 Schedule of supporting document During the course of the application, firms will be required to supply additional documents. Please see a comprehensive list below: All firms • Regulatory business plan • Policy for meeting the needs of customers in vulnerable circumstances • Complaints handling policies comprising the below: o Complaints handling procedures o Complaints root cause identification procedure o Example Management Information (MI) for complaints root cause analysis and correction • Compliance monitoring procedures comprising the below: o Compliance monitoring programme o Example MI to monitor ongoing compliance with FCA rules • Financial projections comprising the below: o Opening balance sheet o Forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading post-authorisation o Monthly cash flow forecast for the first 12, 24 and 36 months of trading post-authorisation o Monthly profit and loss forecast for the first 12, 24 and 36 months of trading post-authorisation • Latest annual accounts (if already trading) • Up-to-date management accounts (if already trading and year-end date for most recent annual accounts is greater than 12 months) • Companies House form (SH01) (if applicable and firm has already capitalised) • Details of source of funding (if firm is not a limited company, sole trader or partnership) • Details of subordinated loans (if applicable) • Details of other external funding (if applicable) • Risk management policies and procedures • Business continuity plan (BCP) • Detailed IT controls form • Evidence of the applicant firm’s registration with the Information Commissioner’s Office • Staff organisation structure chart (if applicable) • Controller forms • Controller and close link structure chart (if applicable) Sole Traders only • Statement of personal assets and liabilities • Statement of business assets and liabilities Partnerships (including limited partnerships and limited liability partnerships) only • Copy of partnership agreement deeds (if applicable) • Copy of limited liability partnership agreement deeds (if applicable) • Statement of personal assets and liabilities (one per partner) • Statement of business assets and liabilities • Members’ capital agreement (if applicable)

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 3 1 Application contact details We need this information in case we need to contact you when assessing this application. Contact for this application 1.1 Please enter the contact details of the person we will get in touch with about this application This must be someone directly employed by the firm and not a professional adviser. Title First names Last name Email address Address Postcode Country Mobile number Phone number Pre-application case A pre-application meeting is not compulsory, and we only recommend one if you believe that the meeting would significantly help you get specific support not ordinarily available to you from our website, Handbook, and other guidance materials. Innovate and Innovation Hub 1.2 Please specify if you have received support from the Innovation Hub

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 4 Timings for this application 1.3 Is there a date by which you would like this application approved? No YesEnter date required and explain why below / / We cannot guarantee to determine your application by a specific date, but we will try to take into account any timings above when assessing your application(s). We will attempt to process your application as quickly as possible. If you wish your application to be granted by a specific date, we will try to do so. If we cannot, we will contact you with the reason why.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 5 2 Firm details We need to know general information about the applicant firm so we can process this application as efficiently as possible. We also need the applicant firm's details for the Financial Services Register, which is our public record of authorised firms: https://register.fca.org.uk/ Firm details 2.1 Is the firm authorised by the FCA or PRA? No YesGive Firm Reference Number (FRN) below FRN Firm name About the legal status of the applicant firm 2.2 What type of firm is the applicant firm? Sole trader Continue to Question 2.8 Public limited company Private limited company Unincorporated association Partnership (other than limited partnership or limited liability partnership) Limited partnership Limited liability partnership Other  you must detail below the legal status of the applicant firm 2.3 Date of incorporation or formation (dd/mm/yyyy) / / 2.4 Where was the applicant firm incorporated or formed? England/ Wales Scotland Northern Ireland Outside the UKGive details below 2.5 Does the applicant firm have a registered number eg Companies House number? NoContinue to Question 2.8 YesGive details below

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 6 2.6 You must confirm that all details given in this section match companies house records Yes NoGive details below Financial year end 2.7 Date of the applicant firm's financial year end (dd/mm) / Firm Address Details 2.8 Principal place of business of applicant firm Principal place of business address Postcode Phone number Email address 2.9 Registered Office Address (if applicable) Please tick this box if the registered office address is the same as the principal place of business Registered Office business address Postcode Phone number 2.10 Head Office Address Please tick this box if the head office address is the same as the principal place of business Please tick this box if the head office address is the same as the registered office Head Office business address Postcode

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 7 Phone number 2.11 Does the applicant firm have a website address? No YesGive address below Being developedGive address (if known) and launch date below Complaint Contact 2.12 Complaint contact person's details for the Financial Services Register Tick here if the complaint contact details are the same as the application contact details Title First names Last name Job title Mobile number Email address Please tick this box if the complaints address is the same as the principal place of business Please tick this box if the complaints address is the same as the registered office Address Postcode Phone number 2.13 Please confirm that the person named above has been informed and has agreed that their details will be displayed on the Financial Services Register as a contact for complaints Yes, the named person has agreed to their details being displayed on the FS Register

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 8 2.14 Details of financial auditor / reporting accountant Firm Name Title First names Last name Job title Mobile number Email address Address Postcode Phone number 2.15 Details of professional adviser (if applicable) Firm Name Title First names Last name Job title Mobile number Email address Address Postcode Phone number 2.16 Please tick this box if the applicant firm wants us to copy all correspondence to the professional adviser 2.17 Please tick this box if the applicant firm plans to use this professional adviser following authorisation

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 9 2.18 Locum Details Please tick this box if the applicant firm is dependent on a single key person Firms dependent on a single key person are expected to appoint a locum, please provide the details of the applicant firm’s locum arrangement below Firm name of locum FRN of locum Title First names Last name Job title Mobile number Email address Address Postcode Phone number Trading names For more information about the Company, Limited Liability partnership and Business Names (Sensitive Words and Expressions) Regulations 2014, see http://www.legislation.gov.uk/uksi/2014/3140/contents/made 2.19 Does the applicant firm intend to use any trading names as well as the name given on the front of this form? NoContinue to Section 3 YesGive details below Name

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 10

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 11 3 Scope of permission and fees If we grant the applicant firm authorisation, we will issue a Scope of Permission Notice. This sets out: • the regulated activities the applicant firm is authorised to carry on • the customer types • any limitations • any requirements 3.1 Does the applicant firm meet the Money and Pensions Service’s (MaPS) connection, security and technical standards in order to connect to MaPS’ digital architecture? Yes No 3.2 The applicant firm should make sure that it applies for adequate permission to conduct the regulated activities for the business it wishes to carry on. Please consult the Perimeter Guidance Manual (PERG) before completing this section. Specific guidance concerning the regulated activities is in PERG 2.7. Please note that the selections below are limited to the customer type retail and the following activities only: • operating and making a pensions dashboard service available • making arrangements with a view to transactions in investments limited to the provision of post-view services If your firm wishes to undertake other regulated activities, you should also complete the relevant forms for those activities. View a full list of all regulated activities, definitions and exemptions in PERG. Pensions Dashboard Service operating and making a pensions dashboard service available. Making arrangements with a view to transactions in investments If the applicant firm intends to provide post-view services, it is likely that it will need the making arrangements permission below. Please tick to confirm that the applicant firm would like to apply for this permission making arrangements with a view to transactions limited to the provision of post-view services If the applicant firm intends to provide a post-view service(s) and considers that the making arrangements permission is not required to do so, please provide a thorough description of the applicant firm’s rationale for this view.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 12 Agreeing to carry on a regulated activity Under the permissions regime, ‘agreeing to carry on a regulated activity’ is a regulated activity in its own right. As a matter of course, an applicant firm will carry on this regulated activity (which is limited to agreeing to carry on only the other regulated activities specified in its Scope of Permission Notice). 3.3 You must confirm that the applicant firm requests permission to carry on this activity. Yes History of the applicant firm 3.4 Has the applicant firm ever been regulated by us or any other regulator before making this application? No YesGive details below Name of regulator Address of regulator Applicant firm’s identification number with that regulator (FRN if previously regulated by us) 3.5 Has the applicant firm ever been refused - or had revoked - any license, membership, authorisation, registration or permission granted by a financial services regulator or government body in the UK or overseas? No Yes 3.6 Has the applicant firm ever decided not to proceed, after making an application to a regulatory body for: • a licence? • authorisation? • registration? • notification? • membership? • other permission granted by a regulatory body? No Yes 3.7 Has the applicant firm ever used a trading name which it has since ceased to use or which it will cease to use prior to authorisation? No Yes Please provide details of the trading name(s) previously used

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 13 Explanations 3.8 If the answer to any of Questions 3.5 to 3.7 is Yes, please give a full explanation of the events in question on a separate sheet of paper. Make sure this includes: • the question number the event refers to • the date of the event • any amounts involved • the outcome • an explanation of the circumstances Please indicate how many separate sheets of paper you have used Number of additional sheets Fees and levies The permission we grant the applicant firm will allocate it to one or more fee blocks. FEES 4 Annex 1A of the FCA Handbook has detailed notes on the fee blocks and tariff bases. FCA fees Fee Block A.24 – Pensions Dashboard Service The Financial Ombudsman Service (FOS) General Levy Businesses that are covered by the FOS must pay a general levy to fund its operating costs and to deal with the forecast volume of complaints about relevant business activity. It is payable by all firms authorised or registered by the FCA and we raise and collect it on behalf of the FOS. The general levy payable by a PDS is a flat fee of £65. Declaration of ongoing FCA fees liability 3.9 You must confirm that the applicant firm understands that it is liable and remains liable to pay fees until such time as the FCA cancels its permission. This is irrespective of whether it is trading, or even if it has notified us of intention to cease trading or submitted an application to cancel. Yes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 14 4 Pensions Dashboard Service Conduct of Business We need to know about the business the applicant firm intends to carry on so we can assess the scope of the authorisation it will need, the adequacy of its resources and its suitability. Background 4.1 You must attach a regulatory business plan. This must be tailored to the applicant firm’s business and consider the matters described in the Threshold Conditions Handbook under COND 2.7 (Business Model), otherwise it may lead to delays in the authorisation process. The business plan should include: • the background to the business • the background and experience of all the persons performing senior management functions and how this will help them with their role – this should include employment background. • any long-term strategy and expansion plans for the business • details of governance framework and personnel • details of key operational matters • analysis of key business and regulatory risks • financial projections for 3 years • details of websites, promotions and communications to be used by the applicant firm • the types of post-view services the applicant firm will be selling, including identifying areas it may specialise in • details of all charges payable by customers for post-view services • details on when these charges are levied and collected from customers Please confirm that you have attached a business plan with the application Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 15 Sourcing customers 4.2 How will the applicant firm source its customers? Method of sourcing customers Approximate % sourced by this method Advertising (including websites, television, radio, magazines, leaflet drops, post, billboards etc) Third Parties Lead Generators Word of Mouth/Personal Recommendations Other Total 100% Other Give details below of the method(s) the applicant firm intend(s) to use and the approximate % of customers intended to be sourced by this method. All business activities 4.3 Does the applicant firm, or any entity of the group of which the applicant firm is a member (if applicable), carry on or intend to carry on any unregulated business activities? No YesGive details below Total unregulated activities £ % of total revenue Description of the unregulated business the applicant firm will be conducting 4.4 Does the applicant firm intend to offer post-view services? NoContinue to Question 4.7 Yes Give full detail regarding these services; your analysis as to whether other permissions are required to provide them (including legal and/or compliance advice if received); an attestation that the applicant firm has considered whether other permissions are needed; confirm that the applicant firm has carried out user testing. You must provide a summary of the

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 16 research and, where relevant, how the services were adapted post-testing as a result of the research findings. 4.5 Does the applicant firm intend to generate income from post-view services? NoContinue to Question 4.6 Yes Give full details regarding these services, your analysis as to whether other permissions are required to provide them (including legal and/or compliance advice if received) and indicate the percentage of total firm revenue to be generated from provision of these activities. 4.6 How will the applicant firm be remunerated for post-view services? Please give precise details regarding the applicant firm’s remuneration structure (eg fixed fees, percentage-based fees, commissions or any other structure). Include both monies received from the customer and from other firms. Please also explain how these fees are communicated to its customers. 4.7 Is the applicant firm currently taking over the business of any other firm or are there any plans for the applicant firm to do so? (Or, if the firm is already trading, has the applicant firm acquired the business of any other firms in the last 5 years?) No YesGive full details of the other firm

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 17 4.8 How many customers does the applicant firm expect to have in relation to its regulated activities? At authorisation 12 months after authorisation 24 months after authorisation 36 months after authorisation Business Risks 4.9 You must attach the applicant firm’s risk management policy. This should set out the key business risks the applicant firm has identified and how it intends to manage those risks. You must include: • the range of various scenarios tested (for example seasonal changes in demands for products and services) • what sensitivity analysis of those various scenarios was undertaken • the outcome of each scenario tested and analysed • the measures / contingency plans the applicant firm has put in place to mitigate the risks identified eg cyber security risks • how the applicant firm considered the impact to the firm if key members of staff left the business • how conflicts of interest are identified, recorded, monitored and mitigated. Data export 4.10 You must provide a step-by-step description of data export capabilities (if any) below. You should pay particular attention to how you have considered consumer understanding in obtaining the customers’ agreement to data export. Attaching screenshots is recommended.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 18 Outsourcing to third parties 4.11 What functions (if any) will the applicant firm outsource? You must include details of the parties to whom the functions will be outsourced and how the applicant firm will monitor and control the outsourced functions. Dashboard services made available by third parties 4.12 You must provide details of the applicant firm’s arrangements with third parties to make its dashboard services available to the third parties’ customers, members or employees. You must include the names of the parties with whom these arrangements will be established, including the relevant URLs of the third party dashboard(s). 4.13 You must outline the oversight arrangements in place to ensure dashboards presented by third parties do not compromise consumer protections and meet all regulatory standards, including being unalterable. 4.14 You must explain how it will be made clear to consumers using a dashboard presented by a third party who the regulated entity is. 4.15 You must tick below to confirm your understanding that the applicant firm must notify the FCA of new arrangements with third parties, as well as changes and terminations to arrangements with third parties

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 19 The Consumer Duty & Fair Treatment of Customers The Consumer Duty comprises: • A new Consumer Principle that requires firms to act to deliver good outcomes for retail customers. • Cross-cutting rules providing greater clarity on our expectations under the new Principle and helping firms interpret the four outcomes. • Rules relating to the four outcomes we want to see under the Consumer Duty. These represent key elements of the firm-consumer relationship which are instrumental in helping to drive good outcomes for customers. These outcomes relate to: • products and services • price and value • consumer understanding • consumer support Our rules require firms to consider the needs, characteristics and objectives of their customers – including those with characteristics of vulnerability – and how they behave, at every stage of the customer journey. As well as acting to deliver good customer outcomes, firms will need to understand and evidence whether those outcomes are being met. We have issued further guidance to firms on how they should comply with their obligations under the new Consumer Duty as set out in Principle 12 and PRIN 2A (https://www.fca.org.uk/firms/consumer-duty). 4.16 The Consumer Duty, and/or, where this doesn’t apply, the fair treatment of customers, must be a key consideration for all firms. Please tell us how the Duty and/or the fair treatment of customers has been considered in the development of the applicant firm’s business plan? 4.17 How will the applicant firm’s senior management ensure that the Duty and/or the fair treatment of customers is embedded in the culture of the applicant firm and that it can demonstrate that it is treating customers fairly and consistently delivering good outcomes to retail customers?

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 20 4.18 What has the applicant firm’s senior management identified as the key risks to the fair treatment of customers and/or the delivery of outcomes consistent with the Duty, and what controls are in place to mitigate these risks effectively? 4.19 You must attach the applicant firm’s policy for meeting the needs of consumers in vulnerable circumstances. Attached 4.20 You must attach a copy of the applicant firm’s complaints handling procedures. Attached 4.21 You must attach a copy of the document setting out the management controls in place to identify and correct root causes of complaints. Attached 4.22 You must attach an example of the management information (MI) produced in relation to complaints handling, root cause analysis and correction. Attached 4.23 You must attach an example of the MI the firm’s senior management or governing body uses to monitor and direct the firm’s compliance with the complaints rules. Attached Financial promotions 4.24 Does the applicant firm intend to display financial promotions on its dashboard? No YesPlease provide full details regarding the nature of the financial promotions including whether these will be the applicant firm’s financial promotions or those of third parties. 4.25 How will the applicant firm ensure that financial promotions comply with the relevant requirements?

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 21 4.26 Does the applicant firm intend to approve any financial promotions in accordance with section 21 of the Financial Services and Markets Act 2000 on behalf of unauthorised persons? No Yes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 22 5 Financial resources All authorised firms must meet certain financial resources requirements. We need to be satisfied that the applicant firm will meet these requirements from the date it is authorised. 5.1 All applicant firms must provide the following: An opening balance sheet demonstrating how the applicant firm will meet its financial resources requirement at the date of authorisation Attached A forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading as an authorised firm Attached A monthly cash flow forecast for the first 12, 24 and 36 months of trading as an authorised firm Attached A monthly profit and loss forecast for the first 12, 24 and 36 months of trading. As a minimum, the profit and loss forecast must disclose the following on a monthly basis: • a gross income, analysed between regulated and un-regulated activities • business expenditure, relevant annual expenditure, analysis of the major overheads expenditure; and • profit before taxation Attached Is the applicant firm currently trading? NoGo to next question YesYou must attach the applicant firm’s most recent annual accounts. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. Attached Provide below the date the firm commenced trading (dd/mm/yyyy) / / Is the applicant firm part of a group? NoGo to next question YesYou must attach the most recent consolidated group accounts

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 23 5.2 You must state the amounts of the different sources of the applicant firm’s capital. Please tick all that apply. Please tick Source Amount (£) Fully paid-up ordinary shares Share premium account Preference shares (allowable if not redeemable within two years) (Audited) reserves * (Verified) interim net profits * Revaluation reserves Subordinated loan(s) Members’ capital agreement Members’ reserves Total

• Audit may not be required if exempt under the Companies Act 1985

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 24 5.3 What type of firm is the applicant firm? Limited company You must attach a Companies House form (SH01) Attached Applicant firm not yet capitalised Sole trader Statement of personal assets and liabilities Attached Statement of business assets and liabilities Attached Partnership Statement of personal assets and liabilities (one per partner) Attached Statement of business assets and liabilities Partnership agreement deeds Attached Attached Limited liability partnership Members’ capital agreement Limited liability partnership agreement deeds Attached Attached Other You must attach details of the applicant firm’s source of funding Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 25 Subordinated loans 5.4 Does the applicant firm have any subordinated loans? NoContinue to Question 5.6 YesYou must give details below of any subordinated loans. If there is more than one subordinated loan, please use a separate sheet of paper. If you have used separate sheets of paper, please indicate how many below. Number of additional sheets Name of loan provider Amount (£) Date of agreement Nature of loan Repayment terms, including number of instalments and final payment date Interest payable % 5.5 You must attach any relevant subordinated loan agreement(s) Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 26 Other funding 5.6 Does the firm have other external funding? NoContinue to Question 5.7 YesYou must give details of other external funding If the applicant firm has external funding but has not drawn down on the external funding, you must still answer the questions below. If there is more than one other source of external funding, please use a separate sheet of paper. If you have used separate sheets of paper, please indicate how many below. Number of additional sheets Name of funding provider(s) Amount (£) Date of agreement Nature of funding Repayment terms, including number of instalments and final payment date Interest payable % Core capital resource requirement 5.7 What is the applicant firm’s core capital resource requirement? Where a firm has a Part 4A permission to carry on the regulated PDS activity, its core capital requirement is £40,000 Where a PDS also has Part 4A permission to carry on other regulated activities, the capital resources requirement is the higher of: (1) the core capital resources requirement for the PDS activity, and (2) a capital resources requirement (however described) applied to the firm by any other rule or requirement

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 27 5.8 Has a review been conducted within the last 12 months of the adequacy of assets available to ensure that customers receive, when needed, the benefits and services they have purchased? No If one has not been conducted within the last 12 months, you must state below when the review will be completed and submitted to us. Without this document, your application cannot be deemed to be complete. Yes Attached 5.9 You must confirm that the applicant firm will meet and will continue to meet its capital resource requirement on an ongoing basis and have projections available to prove so. Yes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 28 6 Disclosure of significant events These questions are about your firm. You should disclose all information, even if you are in doubt about it. If we need further information, your case officer will be in touch. If you wish to send us more information, please reply to the email you receive after you submit your application form, and include all relevant information. Significant events include but are not limited to: Material litigation, written complaints made by customers, bankruptcy, winding up petition, creditors voluntary agreement, any financial obligations arising from regulated activities, being subject of a receiving or administration order. For further information see our guidance on disclosure. 6.1 Has the applicant firm previously traded? NoContinue to Section 7 YesContinue to Question 6.2 6.2 Please provide a list of all previous firm names Previous Name(s) Effective from date (dd/mm/yyyy) 6.3 Has the applicant firm ever been presented with a petition for bankruptcy, a petition for compulsory winding up or creditors' voluntary arrangements? No Yes 6.4 Has the applicant firm ever had a receiver or administrator appointed, failed to satisfy a debt adjudged due, or come to a compromise or similar arrangement over a debt with any of its creditors? No Yes 6.5 Has the applicant firm ever been the subject of a corporate restructure because of any form of insolvency or otherwise? No Yes 6.6 Has the applicant firm ever been the subject of any criminal investigations or proceedings? In answering this question, firms are not required to disclose details of any specific individuals who were subject to historic (as opposed to ongoing) criminal investigations or historic criminal proceedings. No Yes 6.7 Has the applicant firm been the subject of any civil investigations or proceedings or arbitration in the last five years? No Yes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 29 6.8 Does the applicant firm have any unsatisfied judgments, debts or awards outstanding against it? No Yes 6.9 Has the applicant firm entered into any material settlements in the last five years, whether or not on an ex￾gratia basis? No Yes 6.10 Has the applicant firm ever been convicted of fraud or other dishonesty? No Yes 6.11 Has the applicant firm ever been convicted of an offence under legislation (whether in the United Kingdom or not) relating to any of the following: • companies • building societies • industrial and provident societies • credit unions • friendly societies • insurance • banking • mortgages • other financial services • insolvency • consumer credit • consumer protection • compensation claims No Yes 6.12 Has the applicant firm had any material written complaints made against it by its customers or former customers in the last five years which it has accepted, rejected or which are awaiting determination, or have been upheld – by an ombudsman or a complaints scheme? No Yes 6.13 Has the applicant firm ever been: • criticised • censured • investigated • disciplined • suspended • expelled • fined • been subject to any other disciplinary intervention action by any regulator or government body in the UK or overseas? No Yes 6.14 Has the applicant firm ever been found guilty of carrying on any unauthorised regulated activities or been investigated for the possible carrying on of unauthorised regulated activities? No Yes 6.15 Is the applicant firm currently involved in any proceedings, investigations or other events referred to in any of the questions above that are pending or not yet determined? No Yes 6.16 Are there any other significant events relating to the applicant firm which we have not asked about in Questions 6.3 to 6.15 that have happened – or are taking place – that

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 30 are relevant to the applicant firm's application for authorisation? No Yes Explanations 6.17 If the answer to any of Questions 6.3 to 6.16 is Yes, please give a full explanation of the events in question on a separate sheet of paper. Make sure this includes: • the question number the event refers to • the date of the event • any amounts involved • the outcome • an explanation of the circumstances Please indicate how many separate sheets of paper you have used Number of additional sheets

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 31 7 Systems and controls We must be satisfied that the applicant firm has appropriate systems and controls to meet its regulatory obligations. IT systems 7.1 Will the applicant firm be using only commercial off-the-shelf computer products / packages eg Word, Sage accounting software? We note that cyber security might be provided by third parties. If you are using both off-the-shelf and bespoke IT systems, you must list the off-the-shelf systems in the boxes provided and provide a brief description below of your bespoke systems. Yes Give the names of the packages below System Type System Name Operational Date Business transaction recording system Accounting system Other IT systems, eg Word, Excel You must attach a copy of the detailed IT controls form; the form can be accessed using the following link: https://www.fca.org.uk/publication/forms/detailed-it-controls-form.xlsm Detailed IT controls form attached Business continuity and disaster recovery 7.2 All firms are required to have business continuity and disaster recovery plans. The purpose of a business continuity and disaster recovery plan is to ensure the applicant firm is able to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly reviewed, updated and tested to ensure their effectiveness. Examples of business interruption might include loss or failure of internal or external resources such as people, systems or other assets, loss or corruption of information and external events such as vandalism or adverse weather. For more information refer to the Guidance Notes. You must tick below to confirm that you have attached the following documents: Business continuity plan (BCP) Agreements and/or terms of reference agreed with any third-party providing compliance or other services to the applicant firm Outsourcing arrangements for disaster recovery setting out the outsourced providers duties and responsibilities

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 32 Regulatory returns – Reg Data All regulated firms must supply regular regulatory returns by electronic means that the FCA makes available. You will need access to a personal computer with an internet connection and will be required to register to be able to submit returns. 7.3 You must confirm that the applicant firm will complete and submit regulatory returns. Yes 7.4 You must confirm that the applicant firm will complete and submit event driven notifications, as required. Yes 7.5 Does the applicant firm agree tknno submit to us, at regular and stated intervals, financial information that can be used to help supervise and assess the firm on an ongoing basis as specified in the FCA Handbook? Yes 7.6 Does the applicant firm agree to submit this information using RegData in a timely manner? Yes Data protection Firms are required to comply with data protection regulations. 7.7 You must confirm that the applicant firm has effective documented processes and procedures in place to make sure it complies with all relevant data protections regulations applicable to the firm Yes 7.8 You must confirm that the applicant firm has in place systems and controls to make sure that it acquires and processes customer data in accordance with all relevant data protection regulations applicable to the firm Yes 7.9 You must confirm that the applicant firm has in place systems and controls to make sure that it will regularly monitor and review its compliance with data protection regulations and take action to address findings Yes 7.10 You must provide the applicant firm’s Information Commissioner’s Office (ICO) registration number ICO Registration Number 7.11 You must attach a screenshot of the firm’s ICO registration details as displayed on the ICO register Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 33 8 Compliance arrangements We need to make sure the applicant firm has the appropriate compliance arrangements in place to meet its regulatory obligations. Compliance procedures You are not required to send compliance procedures with this application, but the applicant firm must be able to produce a copy at any time while we are assessing the application or in the future. These compliance procedures must set out how the firm will comply with all rules applicable to the applicant firm for the activities it proposes to carry on and has applied for in this application. 8.1 You must confirm that the applicant firm has documented compliance procedures in place. Yes Compliance monitoring programme The applicant firm must establish, maintain and carry out a programme of actions to check that it complies and continues to comply with its compliance procedures. This is called a compliance monitoring programme, which must be sent with this application. The compliance monitoring programme must be relevant to the regulated activities the applicant firm wishes to carry on and to its business, so the compliance monitoring programme must be tailored to the applicant firm’s business. A compliance monitoring programme must describe the actions the individual responsible for compliance oversight and their staff will take to ensure that the applicant firm complies with our rules and guidance at all times, in particular: • what checks will take place • how often the checks will take place, as appropriate to the procedure being checked. This might be daily, weekly, monthly, quarterly, annually or another frequency specified by us • who will carry out the checks, such as the Compliance Officer • what records of the checks will be kept confirming they have taken place 8.2 You must attach a copy of your compliance monitoring programme document Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 34 9 Personnel information We must be satisfied that the applicant firm has staff with adequate knowledge, skills and experience at all levels to meet and continue to meet threshold condition 4 (appropriate resources) and threshold condition 5 (suitability) 9.1 Is the applicant firm a sole trader? No Yes Senior Managers & Certification Regime (SM&CR) The applicant firm will not necessarily need to have all these senior management functions listed in the tables below. You must indicate the country where the person will primarily be based if this is anywhere other than the UK. 9.2 Will the applicant firm be a PDS-only firm? These are firms that have no permissions other than: operating and making a pensions dashboard available and the limited version of the making arrangements permission. NoContinue to Question 9.4 YesContinue to Question 9.3 9.3 Limited Scope firms for the SM&CR Please provide the name of the individual who will perform the SMF29 role in the table below Function Description of Senior Management Function Name of individual(s) SMF29 Limited Scope function 9.4 Will the applicant firm be an Enhanced firm for the purposes of SM&CR? Refer to our guidance on SM&CR which sets out whether the applicant firm would be an Enhanced firm: https://www.fca.org.uk/publication/policy/guide￾for-fca-solo-regulated-firms.pdf NoContinue to Question 9.5 YesContinue to Question 9.6 9.5 Core firms for the SM&CR Function Description of Senior Management Function Name of individual(s) SMF1 Chief Executive SMF3 Executive Director

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 35 SMF27 Partner SMF9 Chair SMF16 Compliance Oversight SMF17 Money Laundering Reporting Officer 9.6 Enhanced firms for the SM&CR Function Description of Senior Management Function Name of individual(s) SMF1 Chief Executive SMF3 Executive Director SMF7 Group Entity Senior Manager SMF9 Chair SMF10 Chair of the Risk Committee SMF11 Chair of the Audit Committee SMF12 Chair of the Remuneration Committee SMF13 Chair of the Nominations Committee SMF14 Senior Independent Director SMF27 Partner SMF16 Compliance Oversight SMF17 Money Laundering Reporting Officer SMF18 Other Overall Responsibility SMF2 Chief Finance Function SMF4 Chief Risk Function SMF5 Head of Internal Audit SMF24 Chief Operations Function

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 36 9.7 You must submit a ‘Form A – Application to perform controlled functions including senior management functions’ for the persons who will be performing the senior management functions listed above. The Form A is available in the Handbook. You must also provide a Statement of Responsibilities with each Form A and attach it to your application in Connect. The Statement of Responsibility can be found in the Handbook. Please complete one with each Form A and attach it to your application in Connect. For more information on the Statement of Responsibilities, the firm should consult SUP 10C.11 and SYSC 24-26. How many Form As are being sent with this application? Staff organisational structure chart The applicant firm must show that it has an effective management structure and clear reporting lines to senior managers. 9.8 Is the applicant firm a sole trader or a sole director of a limited company with no employees? Yes You must provide the details below of the person empowered to stand in temporarily to act on behalf of the firm if the sole trader or the sole director becomes incapacitated. NoYou must provide a staff organisational structure chart, clearly indicating senior management, decision makers, headcount of the internal management and control bodies on a separate sheet of paper. Attached

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 37 10 Owners and influencers 10.1 How many controllers do you have? NoneContinue to Question 10.5 Controller 1 Name Legal status of controller Percentage of control % Controller 2 Name Legal status of controller Percentage of control % Controller 3 Name Legal status of controller Percentage of control % Controller 4 Name Legal status of controller Percentage of control %

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 38 Controller 5 Name Legal status of controller Percentage of control % Please indicate how many separate sheets of paper you have used Number of additional sheets 10.2 Are any of the controllers corporate controllers and applying for a controlled function? No YesYou must provide details below including name of controller, percentage of shareholding and any other relevant information 10.3 Do the controllers intend to change (increase or reduce) their level of control in the foreseeable future? No YesGive details below

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 39 Controller forms 10.4 Applicant firms must submit with this application the appropriate Controller Forms for each of its controllers. These forms can be found by following the link below. Applicant firms that have controller(s) that are either already known to us or are authorised by us may use the shorter Standard notification form. Applicant firms that have: 1 a corporate controller(s) must submit a Corporate controller form 2 a partnership controller(s) must submit a Partnership controller form 3 an individual controller(s) must submit an Individual controller form 4 a fund manager controller(s) must submit a Fund manager controller form 5 a trust controller(s) must submit a Trust controller form for each of the controller(s) See link: https://www.fca.org.uk/firms/authorisation/how-to-apply/financial￾services/controller-forms Controller forms attached Close links 10.5 Does the applicant firm have close links other than the controllers stated above? NoContinue to Section 11 Yes 10.6 You must attach a structure chart to show the nature of the relationship between the applicant firm and each close link (please include the business type of the close link). Structure chart attached 10.7 Are you aware of any information to suggest that any close link is likely to prevent our effective supervision of the applicant firm? No YesGive details below

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 40 11 Supporting documents 11.1 Attach and list below any other documents you have provided. 11.2 Provide any details on supporting documents if necessary. Other information 11.3 Is there anything else you would like to tell us or should tell us about this application? No YesGive details below

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 41

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 42 12 Paying the application fee Payment method Payment is by credit or debit card when you apply via our Connect system. The application fee is not refundable. Application fee 12.1 You must confirm you have paid the fee for your application. Operating and making a pensions dashboard service available Category 4 Please refer to FEES 3 Annex 1AR for the details of the amount chargeable for each category - https://www.handbook.fca.org.uk/handbook/FEES/3/Annex1AR.html

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 43 13 Declaration It is a criminal offence, knowingly or recklessly, to give the FCA information that is materially false or misleading or deceptive (see sections 398 and 400 FSMA). Even if you believe or know that information has been provided to the FCA before or is in the public domain, you must disclose it clearly and fully in this form and as part of this application. If there is any doubt about the relevance of information, it should be included. There will be a delay in processing the application if information is inaccurate or incomplete. You must notify the FCA immediately if there is a change to the information in this form and/or if inaccurate information has been provided (insofar as the FCA are reasonably likely to consider the information material). The candidate authorises the FCA to make such enquiries and seek such further information as it thinks appropriate to identify and verify information that it considers relevant to the assessment of this application. I/We confirm that the information provided in this application is accurate and complete to the best of my/our knowledge. I/We will notify the appropriate regulator immediately if there is a material change to the information provided. I/We agree that the FCA may, in the course of processing this application, undertake a Police National Computer (PNC) check in respect of any or all of the persons to whom this application relates. Where the signatory to this application has provided an address and/or email address in connection with the applicant firm’s business, the signatory agrees on behalf of the applicant firm that the FCA may use such address and email address as the ‘proper address for service’ at which to give the applicant firm a ‘relevant document’ as those terms are defined in Financial Services and Markets Act 2000 (Service of Notice) Regulations (SI 2001/1420). I/We have attached the relevant documents where requested or where marked as 'send later' I/we have them fully ready and available on request and I/we have taken all reasonable steps to ensure they are correct. I/We confirm that where I/We have certified that documents are ready they have been prepared to an appropriate standard and are available for immediate inspection by the FCA. I/We understand that the FCA may require the applicant firm firm to provide further information or documents at any time. I/We confirm that I/we are authorised to sign this form on behalf of the firm and/or controller(s) and (where applicable) to give each of the confirmations on behalf of the applicant firm set out in this declaration. The FCA and the Bank of England process personal data in line with the requirements of the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018. For further information about the way we use the personal data collected in this form, please read the privacy notices available on the FCA’s website at: https://www.fca.org.uk/data-protection and the Bank of England’s website at: https://www.bankofengland.co.uk/prudential￾regulation/authorisations

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 44 In addition to other regulatory responsibilities, firms and approved persons have a responsibility to disclose to the FCA matters of which it would reasonably expect to be notified. Failure to notify the appropriate regulator of such information may lead to the FCA taking disciplinary or other action against the firm and/or individuals. Review and Submission The ability to submit this form is given to an appropriate user or users by the firm’s principal compliance contact. ☐ Tick here to confirm that the person submitting this form on behalf of the firm and (if applicable) the individual named below – have read and understood the declaration. ☐ I can confirm that a permanent copy of this application, signed by myself and the signatories, will be retained for an appropriate period, for inspection at the FCA /PRA’s request. Who must sign the declaration? The person or persons signing this application must have legal authority to act as a signatory on behalf of the applicant firm. This can be, for example, the owner of a sole trader business, or a director or a partner. There can be one or two required signatures depending on the number of directors / partners in the applicant firm. Person 1 Name of signatory Signature Date (dd/mm/yyyy) / / Person 2 Name of signatory Signature Date (dd/mm/yyyy) / /

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 1 Authorisation application form Pensions Dashboard Service (PDS) - Notes Please read these notes carefully. They will help you to fill in the Pensions Dashboard Service authorisation application form correctly. When completing the application forms you will need to refer to the Handbook: www.handbook.fca.org.uk/. If after reading these notes you need more help please: • check the FCA website • consult The Handbook: www.handbook.fca.org.uk/ • call the FCA’s Supervision Hub on 0300 500 0597 • email the FCA’s Supervision Hub: Firm.Queries@fca.org.uk Terms in these notes These notes use the following terms: • 'we', ‘us’, 'our' or FCA refers to the Financial Conduct Authority • 'the applicant firm' refers to the firm applying for authorisation • 'you' refers to the person(s) signing the form on behalf of the applicant firm • ‘FSMA’ refers to the Financial Services and Markets Act 2000 Important information At the point of authorisation, we expect the applicant firm to be ready, willing and organised to start business. Once authorised the applicant firm is required to pay regulatory fees even if it is not trading. Firms must also notify us immediately if any of their static data changes. Contents of this form The FCA Handbooks The Threshold Conditions 1 Application contact details 2 Firm details 3 Scope of Permission and Fees 4 Pension Dashboard Service Conduct of Business 5 Financial Resources 6 Disclosure of Significant Events 7 Systems and Controls 8 Compliance arrangements 9 Personnel Information 10Owners and Influencers 11Supporting Documents 12Paying the Application fee 13Declaration

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 2 The FCA Handbooks Introduction The FCA Handbooks set out our legislative powers and other provisions made under powers given to us by FSMA. The Handbooks are available online. The Handbooks are extensive documents, but you will only need to refer regularly to the specific parts that will affect your business. In addition to the Handbooks, there are also Handbook guides and Regulatory guides. Handbook guides are guides to the Handbook as a whole and are aimed at particular types of firms. They will point you in the direction of relevant material. The Handbooks are divided into Blocks and each of these is subdivided into modules. Additionally, the Handbook contains a Glossary of all the definitions used in the Handbooks. The full handbook can be found at www.handbook.fca.org.uk/

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 3 The Threshold Conditions Throughout the application pack, you will see references to the Threshold Conditions (COND). These are the minimum requirements that a firm must satisfy to be and remain authorised. When we consider the applicant firm's application, we will assess whether the firm is ready, willing and organised to satisfy, and continue to satisfy, the Threshold Conditions. The Threshold Conditions are set out in full in COND 2 of the Handbooks at: www.handbook.fca.org.uk/handbook/COND/2/

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 4 1 Application contact details Contact for this application 1.1 Please enter the contact details of the person we will get in touch with about this application This must be someone based in the UK and in the direct employment of the applicant firm. The firm may wish to provide the contact details of a second individual if the main contact will not be available for a long period of time. 1.2 Please specify if you have received support from the Innovation Hub No additional notes Timings for this application 1.3 Is there a date by which you would like this application approved? Please note the following timeframes for authorisation: Authorisations have 6 months to come to a decision regarding an application once it is deemed to be complete. If the application is not complete authorisations have up to 12 months to come to a decision.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 5 2 Firm details Firm details 2.1 Is the firm authorised by the FCA or PRA? You must notify us if the applicant firm is currently authorised by the FCA or the PRA. About the legal status of the applicant firm 2.2 What type of firm is the applicant firm? The applicant firm must fall into one of the categories listed to apply for authorisation. The firm must tick the appropriate box to state the firm’s legal status. 2.3 Date of incorporation or formation (dd/mm/yyyy) This does not apply to sole traders. 2.4 Where was the applicant firm incorporated or formed? This does not apply to sole traders. 2.5 Does the applicant firm have a registered number eg Companies House number? No additional notes 2.6 You must confirm that all details given in this section match companies house records No additional notes Financial year end 2.7 Date of the applicant firm's financial year end (dd/mm) Once authorised, this is the date that will be used by the FCA to determine the applicant firm's deadlines for reporting. If the applicant firm is a limited company the date you enter here must match that in the Companies House Registration. Firm Address Details 2.8 Principal place of business of applicant firm Once authorised, this address will appear on the firm's public entry on the Financial Services Register. Please note that for this purpose the principal place of business means the main place where work is performed or business is carried on. 2.9 Registered Office Address (if applicable) This will not be displayed if you are a sole trader. This address must be in the UK.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 6 2.10 Head Office Address This will not be displayed if you are a sole trader. This address must be in the UK. 2.11 Does the applicant firm have a website address? We may look at this when processing the application. If the applicant firm is developing a website, please provide the name and an approximate launch date. Complaint Contact 2.12 Complaint contact person's details for the Financial Services Register No additional notes 2.13 Please confirm that the person named above has been informed and has agreed that their details will be displayed on the Financial Services Register as a contact for complaints No additional notes 2.14 Details of financial auditor / reporting accountant If the applicant is not legally required to have a financial auditor / reporting accountant, this section can be left blank. Any applicant firm which falls within the table in SUP 3.1.2R is required to have a financial auditor. The table also sets out which sections of SUP will be applicable to the applicant firm. You can find the table at: www.handbook.fca.org.uk/handbook/SUP/3/ Financial auditors can act as a source of information for us in our ongoing supervision of firms. They will report, where required, on the financial resources of the firm, the accuracy of its reports to us and a firm's compliance with particular rules and requirements – for example, the client asset rules. If this section applies to you, SUP 3 and, in particular, SUP 3.3 – Appointment of Auditors - will give you guidance on appointing auditors. Please note in certain limited circumstances, we may ask you to verify information that you have submitted or need to submit as part of the application. As part of the authorisation process, we can require you to provide a report (on any aspect) by a financial auditor, reporting accountant, actuary or other qualified person approved by us. If this is needed during the process, we will discuss it with you at the earliest opportunity 2.15 Details of professional adviser (if applicable) Some applicant firms seek professional help in completing the application (eg from a compliance consultant or lawyer). Questions 2.15 to 2.17 ask if the applicant firm has had such help, and if so, requests details of its adviser. 2.16 Please tick this box if the applicant wants us to copy all correspondence to the professional adviser Please note that while we will copy correspondence to the applicant firm's professional advisers, we will always deal directly with the applicant firm when processing the application.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 7 2.17 Please tick this box if the applicant plans to use this professional adviser following authorisation The applicant firm may decide to use a professional adviser to help them with regulatory returns or ongoing compliance matters. However, the applicant firm is responsible for ensuring all answers are completed fully and honestly. 2.18 Locum Details Please tick this box if the applicant is dependent on a single key person. If your firm is solely dependent on one individual to run the business, you will need to have arrangements in place with another firm who has the same permissions as yourself, to help your customers on a temporary basis due to unforeseen circumstances that might befall the individual. Trading names 2.19 Does the applicant firm intend to use any trading names as well as the name given on the front of this form? If the firm is authorised, it is important that the FCA is informed of all trading names. This will assist the FCA in the supervision of the firm to be able to track the firm's financial promotions activity ie adverts. It may also help us in the handling of any complaints against the firm. More information about the Company, Limited Liability partnership and Business Names (Sensitive Words and Expressions) Regulations 2014 can be found at: http://www.legislation.gov.uk/uksi/2014/3140/contents/made

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 8 3 Scope of Permission and Fees 3.1 Background When applying for authorisation, the applicant firm is responsible for ensuring that the regulated activities and the corresponding client and investment types requested adequately cover the business the applicant firm intends to carry on. If the applicant firm is authorised, the FCA will issue the firm with a Scope of Permission Notice. The permission notice lists the regulated activities the applicant firm will be authorised to carry on. It may also contain what we refer to as 'requirements' and 'limitations'. In broad terms, limitations are restrictions placed on individual regulated activities and requirements will be placed on the firm’s entire scope of permission requiring it to take or not to take specified actions. Getting the applicant firm's scope of permission right at the outset is fundamental. If the applicant firm carries on a regulated activity that is not set out in its permission notice it could be in breach of the Financial Services and Markets Act 2000 (FSMA) and subject to enforcement action. Wording of the Scope of Permission Notice The Scope of Permission Notice will follow the wording in the Perimeter Guidance PERG 2 (Annex 2). You can find this at: https://www.handbook.fca.org.uk/handbook/PERG/2/?view=chapter Requested permission You will need to look at the list of regulated activities and decide which are relevant to the applicant. You can find a full description of each regulated activity in PERG 2.7 at: https://www.handbook.fca.org.uk/handbook/PERG/2/7.html You may also find it useful to look at the FCA glossary: https://www.handbook.fca.org.uk/handbook/glossary/ Don’t be put off by the language. We need to use formal language to mirror how the activities are described in the Regulated Activities Order (Specified Activities). The Scope of Permission Notice is a legal document that sets out the scope of your permission for regulatory purposes. Does the applicant firm meet the Money and Pensions Service’s (MaPS) connection, security and technical standards in order to connect to the MaPS’ digital architecture? MaPS has developed standards, specifications and technical requirements for all components and participants in the ecosystem. These standards include Data, Technical, Design and Reporting standards. MaPS has also provided a Code of Connection, that encompasses Security, Service, and Operational standards. The standards are technical and operational and are critical to the effective operation of dashboards. So, meeting MaPS standards is an explicit requirement of our rules. If the applicant firm has not built its business to

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 9 meet these requirements it is likely it will be asked to withdraw its application until it has fully considered and met these standards. 3.2 The applicant should ensure that it applies for permission to conduct the appropriate regulated activities for the business it wishes to carry on. Please consult the Perimeter Guidance Manual (PERG) before completing this section. Specific guidance concerning the regulated activities is in PERG 2.7. Pensions Dashboard Service Making arrangements with a view to transactions in investments Limitation Where the applicant firm intends to offer a post-view service(s) which requires the making arrangements permission it will be accompanied by a limitation. If the applicant firm considers that it requires the making arrangements permission without this limitation for another part of its business model, it will need to complete the relevant forms. Agreeing to carry on a regulated activity 3.3 You must confirm that the applicant firm requests permission to carry on this activity. Under the permission regime, ‘Agreeing to carry on a regulated activity’ is a regulated activity in its own right. As a matter of course, an applicant firm will carry on this regulated activity (which is limited to agreeing to carry on only the other regulated activities specified in its Scope of Permission Notice). History of the applicant firm 3.4 Has the applicant firm ever been regulated by us or any other regulator before making this application? No additional notes 3.5 Has the applicant firm ever been refused - or had revoked - any license, membership, authorisation, registration or permission granted by a financial services regulator or government body in the UK or overseas? No additional notes 3.6 Has the applicant firm ever decided not to proceed, after making an application to a regulatory body No additional notes 3.7 Has the applicant firm ever used a trading name which it has since ceased to use or which it will cease to use prior to authorisation? No additional notes Explanations 3.8 If the answer to any of Questions 3.5 to 3.7 is Yes, please give a full explanation of the events in question on a separate sheet of paper. No additional notes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 10 Fees & Levies Firms fall into fee blocks according to their permissions. The rules about which activities fall into which fee blocks are in FEES 4 Annex 1A https://www.handbook.fca.org.uk/handbook/FEES/4/Annex1A.html The rules about calculating fees in a firm’s first and second year of authorisation are in FEES 4.2.7 https://www.handbook.fca.org.uk/handbook/FEES/4/2.html All authorised firms pay minimum fees towards the annual regulatory costs. Larger firms will pay a variable fee in proportion to the size of its tariff data. You can estimate your regulatory fees and levies using our fee calculator at https://www.fca.org.uk/firms/calculate-your-annual-fee/fee-calculator Guidance notes for calculating the tariff data are available at https://www.fca.org.uk/firms/fees/report-fee-tariff-data. Links to the relevant parts of the Handbook can be found in the notes below. Please contact the FCA’s Supervision Hub on 0300 500 0597 if you require further clarification for this section. FCA fees After authorisation, the applicant will be liable to pay periodic fees to the FCA. We will use the figures the firm provides in this section to calculate its fee for its first year of trading following authorisation. Where possible the firm should endeavour to use true and accurate information when making its projections. Fee Block A.24 - Pensions Dashboard Service The Financial Ombudsman Service (FOS) General Levy Businesses that are covered by the Financial Ombudsman Service are required to pay a general levy to fund its operating costs and to deal with the forecast volume of complaints about relevant business activity. It is payable by all firms authorised or registered by the FCA and it is raised and collected by the FCA on behalf of the Financial Ombudsman Service. The general levy is based on the amount of regulated business done with consumers eligible to refer their complaint to the Financial Ombudsman Service. Declaration of ongoing FCA fees liability 3.9 You must confirm that the applicant firm understands that it is liable and remains liable to pay fees until such time as the FCA cancels its permission. This is irrespective of whether it is trading, or even if it has notified us of intention to cease trading or submitted an application to cancel. The rules in FEES 4.2.9 and FEES 4.3.13-14 describe the fee obligations of firms who are cancelling their permissions.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 11 4 Pensions Dashboard Service Conduct of Business Background 4.1 You must attach a regulatory business plan. This must be tailored to the applicant firm’s business and consider the matters described in the Threshold Conditions Handbook under COND 2.7 (Business Model), otherwise it may lead to delays in the authorisation process. We need to know about the business the applicant firm intends to carry on so we can ensure it is authorised for the correct regulated activities, investment types and client types, and to assess the adequacy of its resources. We see the regulatory business plan as an important regulatory tool for the applicant firm and us in measuring the applicant firm's business risk and control over any regulatory concerns. You can find further information about this in: https://www.handbook.fca.org.uk/handbook/SYSC/3/2.html (for firms which are not common platform firms) and SYSC 4 − 10 (for common platform firms). Bearing in mind the threshold conditions, we need to be satisfied that the applicant firm can: • identify all regulated activities and any unregulated activities it intends to carry on • identify all the likely business and regulatory risk factors • explain how it will monitor and control these risks • take into account any intended future developments Please remember that the applicant firm's regulatory business plan is an important part of the overall application and integral to our decision-making process. It is important that the regulatory business plan is tailored to the applicant firm’s activities. The amount of detail submitted should be proportionate to the nature of the business the applicant firm intends to carry on. For example, a small firm seeking to carry on a business with a risk you perceive as low, should have a smaller and less complex business plan than a business plan for a complex high-risk firm. The level of detail should also be appropriate to the risks to the applicant firm's clients. You can find further information about our requirements and expectations for business plans at: https://www.handbook.fca.org.uk/handbook/COND/2/4.html Sourcing customers 4.2 How will the applicant source its customers? If you selected ‘Other’, please give details below of the channel(s) the applicant intends to use and the approximate percentages

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 12 To assess this application fully, we need as much insight as possible into how the applicant intends to carry on business. All business activities 4.3 Does the applicant firm, or any entity of the group of which the applicant is a part, carry on or intend to carry on any unregulated business activities? Please provide the revenue generated, or projected to be generated, by unregulated activities and the proportion this makes up of the applicant firm’s total revenue. 4.4 Does the applicant firm intend to offer post-view services? No additional notes 4.5 Does the applicant firm intend to generate income from post-view services? By post-view services we mean services provided after a customer has viewed their pensions information and which relate to pensions and retirement planning (please see PDCOB 10 for further information). You must consider whether your firm needs to apply for other permissions in order to carry out any of these post-view services. In particular, the applicant should consider whether any of these services constitute providing advice. 4.6 How will the applicant firm be remunerated for post-view services? No additional notes 4.7 Is the applicant currently taking over the business of any other firm or are there any plans for the applicant to do so? Please refer to our Change in Control webpages for more information 4.8 How many customers does the applicant expect to have in relation to its regulated activities? No additional notes Business Risks 4.9 You must attach the applicant firm’s risk management policy. This should set out the key business risks the applicant firm has identified and how it intends to manage those risks. Here are some examples that should be considered, depending on the nature of the applicant firm’s business: External risks: The applicant firm should: • identify competitors and assess their reaction to the applicant firm's presence in the market, if applicable • consider critical economic factors which should then be analysed and assessed. For example, it may be useful to explore the effect on the applicant firm's business if there were large-scale local redundancies, a recession in the economy, low interest rates or limited demand for its products/services. Internal risks: The applicant firm should: • undertake a sensitivity analysis of various scenarios and the possible outcomes (this could be a reduction in business or an equally large increase in business – for example, towards the end of a tax year)

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 13 • consider how the applicant firm would manage if it lost key staff • prepare and maintain a contingency plan that deals with the applicant firm's identified key risks Data export 4.10 You must provide a step-by-step description of data export capabilities below. Providing screenshots of the data export journey will enable us to assess the journey from the perspective of the customer. Outsourcing to third parties 4.11 What functions (if any) will the applicant outsource? Outsourcing is the act of one firm contracting with another to provide services that might otherwise be performed by in-house employees. You must include details of the parties that the functions will be outsourced to and how the applicant will monitor and control the outsourced functions. Dashboard services made available by third parties 4.12 You must provide details of the applicant firm’s arrangements with third parties to make its dashboard services available to the third parties' customers, members or employees. No additional notes 4.13 You must outline the oversight arrangements in place to ensure dashboards presented by third parties do not compromise consumer protections and meet all regulatory standards, including being unalterable. No additional notes 4.14 You must explain how it will be made clear to consumers using a dashboard presented by a third party who the regulated entity is. It is important that consumers know with whom they are interacting when using dashboard services made available by a third party. This information helps consumers to make informed decisions about whether to use those dashboard services and how to interact with the PDS firm. 4.15 You must tick below to confirm your understanding that the applicant firm must notify the FCA of new arrangements with third parties, as well as changes and terminations to arrangements with third parties. No additional notes The Consumer Duty & Fair Treatment of Customers 4.16 The Consumer Duty, and/or, where this doesn’t apply, the fair treatment of customers, must be a key consideration for all firms. Please tell us how the Duty and/or the fair treatment of customers has been considered in the development of the applicant firm’s business plan? No additional notes.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 14 4.17 How will the applicant firm’s senior management ensure that the Duty and/or the fair treatment of customers is embedded in the culture of the applicant firm and that it can demonstrate that it is treating customers fairly and consistently delivering good outcomes to retail customers? No additional notes. 4.18 What has the applicant firm’s senior management identified as the key risks to the fair treatment of customers and/or the delivery of outcomes consistent with the Duty, and what action has been taken to mitigate these risks? No additional notes. 4.19 You must attach the applicant firm’s policy for meeting the needs of customers in vulnerable circumstances. No additional notes. 4.20 You must attach a copy of the applicant firm’s complaints handling procedures. No additional notes. 4.21 You must attach a copy of the document setting out the management controls in place to identify and correct root causes of complaints. No additional notes. 4.22 You must attach an example of the management information (MI) produced in relation to complaints handling, root cause analysis and correction. No additional notes. 4.23 You must attach an example of the MI the firm’s senior management or governing body uses to monitor and direct the applicant firm’s compliance with the complaints rules. No additional notes. Financial promotions 4.24 Does the applicant firm intend to display financial promotions on its dashboard? No additional notes. 4.25 How will the applicant firm ensure that financial promotions comply with the relevant requirements? No additional notes. 4.26 Does the applicant firm intend to approve any financial promotions in accordance with section 21 of the Financial Services and Markets Act 2000 on behalf of unauthorised persons? No additional notes.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 15 5 Financial Resources 5.1 All applicant firms must provide the following: An opening balance sheet to demonstrate how the applicant firm will meet its financial resources requirement at the date of authorisation This is a balance sheet prepared as at the start of your trading as an authorised firm. A forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading as an authorised firm This is a balance sheet showing the financial position of the applicant as it is forecasted to be after 12, 24 and 36 months of trading. A month by month cash flow forecast for the first 12, 24 and 36 months of trading as an authorised firm The cashflow statement shows how a firm is paying for its operations and future growth, by detailing the ‘flow’ of cash into and out of the firm. The cashflow statement is normally similar to the profit and loss statement but shows the actual financial position of a firm at any time. So if a firm starts with share value of £10,000 then this is the starting figure. Include this in your profit and loss to take it forward and for every month you will have income and expenses deducted, showing you the actual financial position of the company at any time. A month by month profit and loss forecast for the first 12, 24 and 36 months of trading. As a minimum, the profit and loss forecast must disclose the following on a monthly basis: • a gross income, analysed between regulated and un-regulated activities • business expenditure, relevant annual expenditure, analysis of the major overheads expenditure; and • profit before taxation A profit and loss account shows the firm’s income and expenditure for a set period. You must send us 36 forecast profit and loss accounts, one for each of the first 36 months of trading as an authorised firm. Is the applicant currently trading? If the applicant firm is already trading, it must submit its most recent annual accounts as submitted to Companies House. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. 5.2 You must state the amounts of the different sources of the applicant firm’s capital. No additional notes. 5.3 What type of firm is the applicant firm? Depending on the answer you gave earlier in the form about the legal status of the firm depends on the questions you will be asked on financial resources.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 16 Public Limited Company or Private Limited Company We need to know the sources of the capital in the applicant firm and how these amounts are made up. Capital is the money or assets in your business. The different types are described briefly below. • Fully paid-up ordinary shares: These are ordinary shares that the applicant firm has been paid for in full. Ordinary shares are the most common type of share. They carry full voting and dividend rights and their owners are the owners of the company. • Share premium account: This is a reserve of money set up in the applicant firm's accounts to account for the issue of new shares above their par value. ie if you issue some shares at £1 each, and you keep some back which you then sell at £1.50 each, you put the extra 50p into the share premium account. • Preference shares: These are shares that pay a fixed dividend. Holders of preference shares receive their dividend before holders of ordinary shares. For our defined term, please see the Handbook Glossary entry from preference share at: https://www.handbook.fca.org.uk/handbook/glossary/G1587.html • Audited reserves: These are past earnings that the applicant firm has retained, as verified by its auditors. For firms not required to appoint an auditor, under the Companies Act 2006, for their accounts, these will be unaudited. • Verified interim net profits: These are the net profits made after the applicant firm's last annual financial statement, as verified by its auditor. For firms not required to appoint an auditor, under the Companies Act 2006, these will be interim profits which have not been verified by an auditor. • Revaluation reserves: These are reserves kept to allow for the depreciation of any assets. • Subordinated loans: These are loans that rank below other unsubordinated debt in the queue for repayment should the applicant firm be wound up. They can only count as part of its capital if they satisfy the conditions laid out in the relevant parts of the Handbook. Where assets are included in the applicant firm's financial resources and they are subject to depreciation, please take this into account when calculating the value of those assets. Partnerships and sole traders • Only include your share of any assets and liabilities that are jointly owned by another party, such as your wife/husband. • Current market value (not the price paid or nominal value) of quoted investments – only include readily realisable securities, unit trusts and other packaged products. • Where applicable current market value (eg property) should be estimated. • Guarantees – include the maximum liability of a personal guarantee given to a third party. Limited Liability Partnership You must tell us how the capital in the partnership is sourced. Capital is the money or property or other assets owned in by the business. The different types of sources are described below:

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 17 • Member's capital agreement. This is the legal agreement between the members of the LLP which should show the make-up and value of the capital. • Members' reserves. These are the past earnings of the applicant firm that have been retained by it on its balance sheet. • Subordinated loan. These are loans that rank below other unsubordinated debt in the queue for repayment if the applicant firm is wound up. They can only count as part of your capital if they satisfy the conditions laid down in our Handbook rules. Where assets are included in the applicant firm's financial resources and they are subject to depreciation, please take this into account when calculating the value of those assets. Other applicant firms You must tell us how the capital in the applicant firm is sourced. Capital is the money, property or other assets in your business. Subordinated loans 5.4 Does the applicant firm have any subordinated loans? You will only be asked this question if your legal status is Public Limited Company, Private Limited Company or Limited Liability Partnership and you were asked about subordinated loans at the start of this Financial Resources Section. A subordinated loan is a loan that ranks below other unsubordinated debt in the queue for repayment should the applicant firm be wound up. 5.5 You must attach any relevant subordinated loan agreement(s) Other funding 5.6 Does the firm have other external funding? Examples of external finance would include a bank overdraft or a business loan. Core capital resource requirement 5.7 What is the applicant firm’s core capital resource requirement? There is a set core capital requirement for PDS firms. However, if the firm carries out or intends to carry out other regulated activities the highest of the two capital requirements will apply. 5.8 Has a review been conducted within the last 12 months of the adequacy of assets available to ensure that customers receive, when needed, the benefits and services they have purchased? No additional notes 5.9 You must confirm that the firm will meet and will continue to meet its capital resource requirement on an ongoing basis and have projections available to prove so. No additional notes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 18 6 Disclosure of significant events Disclosure Significant events include, but are not limited to: • any material litigation in the last five years before the date of the application • any material written complaints made by clients or former clients in the last five years accepted by the applicant firm or those upheld or awaiting determination by an ombudsman • any bankruptcy, winding-up petition or creditors' voluntary arrangement • any failure to satisfy a judgement debt under a court order in the UK and elsewhere in the last ten years • any outstanding financial obligations arising from regulated activities the applicant firm carried on in the past, including any outstanding fees to the Financial Services Authority, Financial Conduct Authority or the Prudential Regulation Authority or any other regulator • whether the applicant firm has been the subject of a receiving or administration order Although we may consider that a matter is relevant to its assessment of a firm, we will consider each matter in relation to the regulated activity the applicant firm has applied for. If necessary, you should discuss relevant matters with us before submitting this application. This will allow us to consider fully how significant the matter is and how it affects the applicant firm's ability to satisfy, and continue to satisfy, the threshold conditions. More information on disclosing significant events can be found in COND 1.3.3 G, on our website at: https://www.handbook.fca.org.uk/handbook/COND/1/3.html There is also further guidance on our website at: https://www.handbook.fca.org.uk/handbook/COND You must answer all the questions in the Disclosure of significant events appendix. If you answer yes to any of the questions you must provide a full explanation of the event on a separate sheet(s) of paper. You must then attach this to your application. Any explanations you give must include the question number that the event refers to, the date of the event, any amounts of money involved, the outcome and a full and clear explanation of the circumstances.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 19 7 Systems and Controls IT systems 7.1 Will the applicant firm be using only commercial off-the-shelf computer products / packages eg Word, Sage accounting software? An off-the-shelf package is a simple 'one size fits all' package rather than a system that is tailor made specifically for the business. Business transaction reporting We appreciate that different types of firms will have different transactions and ways of recording those transactions, so please be as clear as possible in your explanation. An example of business transaction reporting could be the systems the applicant firm has in place, or will have in place, for recording a client's individual transaction details on their file eg keeping know your customer details up to date. Accounting system Examples of off-the-shelf accounting packages are SAGE, Quickbooks pro. Other IT systems, eg Word, Excel No additional notes. You must provide a brief description of your proposed bespoke systems (this must include details of your IT systems, business transaction recording system and accounting system). You must also attach a copy of the detailed IT controls form. The form can be accessed using the following link: https://www.fca.org.uk/publication/forms/detailed-it-controls￾form.xlsm No additional notes. Business continuity and disaster recovery 7.2 All firms are required to have business continuity and disaster recovery plans. We expect the applicant firm to have a disaster recovery plan in place which is appropriate given the size and nature of its business. This should ensure that it can continue to function and meet its regulatory obligations if there is an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness. The plan should include an assessment of the disruptions to which the firm is particularly susceptible (and the likely timescale of those disruptions). These might include: • loss or failure of internal and external resources such as people (either through illness or leaving the firm), systems and other assets; • the loss or corruption of information (eg computer breakdown and loss of customer files); and • external events (such as vandalism, terrorism and adverse weather).

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 20 It should cover ways in which both the likelihood and impact of a disruption can be reduced, eg by succession planning and contingency arrangements. It should show the strategy for: • maintaining continuity of operations • communicating to the staff • regularly testing the adequacy and effectiveness of this strategy. The questions listed below should help you with this: • What arrangements do you have in place to reduce the impact of a short, medium or long-term disruption to the following: o people, systems and other assets o the recovery priorities for the firm's operations o communication arrangements for internal and external concerned parties (eg the FCA and/or the PRA, clients and the press) • How would the applicant firm set in motion its disaster recovery and business continuity plans? • Does it have any processes in place to check and validate the integrity of information affected by the disruption? • How will the applicant firm review, test and update its disaster recovery plan operations? For further guidance see: www.handbook.fca.org.uk/handbook/SYSC/. Regulatory returns – Reg Data All regulated firms must supply regular regulatory returns by electronic means made available by the FCA. To complete returns you must have access to a personal computer with an internet connection. You will be required to register to be able to submit returns. 7.3 You must confirm that the applicant firm has the ability to complete and submit regulatory returns. For further details please see our website. 7.4 You must confirm that the applicant firm will complete and submit event driven notifications, as required. No additional notes. 7.5 Does the applicant firm agree to submit to us, at regular and stated intervals, financial information that can be used to help supervise and assess the firm on an ongoing basis as specified in the FCA Handbook? No additional notes. 7.6 Do you agree to submit this information using RegData in a timely manner? No additional notes. Data protection 7.7 You must confirm that the applicant firm has effective documented processes and procedures in place to make sure it complies with all relevant data protection regulations applicable to the firm. No additional notes.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 21 7.8 You must confirm that the applicant firm has in place systems and controls to make sure that it acquires and processes customer data in accordance with all relevant data protection regulations applicable to the firm. No additional notes. 7.9 You must confirm that the applicant firm has in place systems and controls to make sure that it will regularly monitor and review its compliance with data protection regulations and take action to address findings. No additional notes 7.10 Please provide the applicant firm’s Information Commissioner’s Office (ICO) registration number. No additional notes 7.11 You must attach a screenshot of the firm’s ICO registration details as displayed on the ICO register. No additional notes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 22 8 Compliance arrangements Compliance procedures 8.1 You must confirm that the applicant has documented compliance procedures in place. When assessing this application, we need to be satisfied the applicant firm has the appropriate compliance arrangements in place to meet its regulatory obligations, both when we authorise it and on an ongoing basis. You should not send the compliance procedures to us when submitting this application. However, they must be ready for inspection at any time. They will also need to be in place so that you can prepare the Compliance Monitoring Programme. Set out below are the areas for which we would expect you to have adequate compliance procedures, depending on the activities that you propose to carry out: (a) the scope of the applicant firm's business (b) complaints handling (c) financial crime (d) skills, knowledge and expertise (e) business continuity (f) communication with clients (g) record keeping (h) notifications to the FCA (i) reporting requirements (j) compliance with conduct business rules in COBS (k) sales of products and services (l) conflicts of interest (m) reliance on others (n) exclusion of liability (o) protecting customers' interests As well as the subjects above, your compliance manual may need to cover the subjects below depending on your type of business. (a) charges and commission (b) claims handling (d) general provisions related to distance marketing (e) financial promotions (f) Systems and controls in relation to financial crime and money laundering There may be other compliance procedures and policies, which the applicant firm will need to include in its compliance manual depending on the type of

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 23 business it intends to carry on. If you are unsure whether you need to include anything else, please take professional advice. Remember that this manual should be designed so it is specifically tailored to the business, and is easy to use as well as easy to amend and to keep up-to￾date. If you are in any doubt about what you need to put into the compliance manual you should seek professional advice. Common platform firms should, in particular, consider carefully the obligations in SYSC 6.1 (https://www.handbook.fca.org.uk/handbook/SYSC/6/1/.html). Compliance monitoring programme 8.2 You must attach a copy of your compliance monitoring programme document This will need to be included as part of your application. The compliance monitoring programme must be relevant to, and tailored to reflect, the applicant firm's proposed business. Each applicant firm's compliance monitoring programme will therefore be unique to itself. A compliance monitoring programme must describe the actions that the holder of the compliance oversight function and their staff will take to ensure that the applicant firm complies with our rules and guidance at all times. In particular, it must describe: • what checks will take place • how often the checks will take place, as appropriate to the procedure being checked – this might be daily, weekly, monthly, quarterly, annually or another period specified by us • who will carry out the checks – this is the role of the person who will make the checks, such as the Compliance Officer, Training and Competence Officer or Money Laundering Reporting Officer • what records of the checks will be kept to confirm they have taken place

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 24 9 Personnel information Applicant firms must be able to demonstrate that they have employees of adequate quality, skills and experience at all levels. We will also consider the extent to which the members of the governing body have experience in the financial services industry. It is the responsibility of the firm to ensure that no person performs a senior management function until the applicant firm has been authorised by us and we have approved the person to perform senior management function(s). If granted, approval is effective from the date of authorisation. What is an approved person? An approved person is a person who is approved by us to perform a senior management function for an authorised firm or an appointed representative. To be approved and continued to be approved to perform a senior management function, a person must: • meet, and maintain, our criteria for approval (the 'fit and proper test'); and then • perform their senior management function(s) in line with the FCA Handbook, and FCA’s Code of Conduct (COCON). What is a senior management function? A senior management function is a function relating to the carrying on of a regulated activity by the firm which is specified in the table of FCA senior management functions. Some senior management functions are required for every firm; others will depend on the nature of your business. Senior management functions have their own unique identification number. You can find a full list of all the senior management functions and an explanation of each one at: www.handbook.fca.org.uk/handbook/SUP/10C/ You should review the description of each senior management function and identify those that apply to the applicant firm. 9.1 Is the applicant firm a sole trader? No additional notes 9.2 Will the applicant firm be a PDS-only firm? No additional notes Senior Managers & Certification Regime 9.3 Limited Scope firms for the SM&CR No additional notes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 25 9.4 Will the applicant firm be an Enhanced firm for the purposes of SM&CR No additional notes 9.5 Core firms for the SM&CR No additional notes 9.6 Enhanced firms for the SM&CR No additional notes 9.7 The applicant must submit a ‘Form A – Application to perform controlled functions including senior management functions’ for the persons who will be performing the senior management functions have listed above. The Form A is available in the Handbook. No additional notes Staff organisational structure chart 9.8 Is the applicant firm a sole trader or a sole director of a limited company with no employees? No additional notes

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 26 10 Owners and Influencers 10.1 How many controllers do you have? This information will help us understand who owns the applicant firm and has control or influence over its business. Our approval is required before a person can become a controller of an authorised firm. The controllers of the applicant firm will include the ultimate beneficial owners, who may be individuals or firms with an indirect shareholding in the applicant firm – for example, through their controlling interest in a parent of the applicant firm. You must complete the information we ask for in the spaces provided or provide a structure chart so we can determine who the applicant firm's controllers are. The controller(s) will then need to complete the appropriate Appendix providing their own details. This is a requirement of the Act (Part XII Control over authorised persons). Chapter 11 of the Supervision Manual (SUP) in the Handbook gives further information about controllers. In particular, SUP 11.3 sets out the information which a controller or proposed controller must provide to us before becoming a controller. You can use this link to access it: https://www.handbook.fca.org.uk/handbook/SUP/11/ For these purposes, a controller is, broadly speaking, an individual or firm that: (1) holds 20% or more of the shares in the applicant firm or its parent (2) is able to exercise significant influence over the management of the applicant firm through a controlling interest in the applicant firm or its parent (3) is entitled to control or exercise control of 20% or more of the voting power in the applicant firm or its parent (4) is able to exercise significant influence over the management of the applicant firm through their voting power in it or its parent Controllers of Partnerships (1) Partnership applicants should note that some (or sometimes all) individual partners may be controllers of the partnership. Usually this will depend on the number of partners and the terms of the partnership agreement, especially regarding voting power or significant influence. For example, in a 5-person partnership where each partner has equal voting power, each partner will have 20% of the voting power and so will be a controller. (2) In a 5-person partnership where two senior partners each have 40% of the voting power (and the same level of significant influence) and the remaining 20% is equally split between the other 3 partners (meaning that each of them has less than 20% of the voting power and significant influence), only the 2 senior partners would be deemed controllers. (3) In a ten-person partnership where each partner has equal voting power, each partner will have 10% of the voting power and will not be deemed a controller.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 27 (4) In an eleven-person partnership where all have equal voting power it might appear that none of the partners will be a controller (as no individual partner will have 20% or more of the voting power). However, one of the partners can still exercise significant influence - if the partnership agreement required significant decisions to be taken unanimously by the partners, a dissenting partner could exercise significant influence over the firm's management despite having less than 20% of the voting power. Applicant firms should have this is mind when considering whether a partner with less than 20% voting power could exercise significant influence over the firm's management. Please remember that this information will probably be set out in your partnership agreement. 10.2 Are any of the controllers corporate controllers and applying for a controlled function? No additional notes 10.3 Do the controllers intend to change (increase or reduce) their level of control in the foreseeable future? No additional notes Controller forms 10.4 Applicant firms must submit with this application the appropriate Controller Forms for each of its controllers. You do not need to submit an individual controller form for any individual controller who has also submitted a Form A to hold a Controlled function with the applicant firm. Definitions of the following terms can be found in the Handbook Glossary:- https://www.handbook.fca.org.uk/handbook/glossary/ • Controller • Control • Control function • Shares • Voting power • Aggregation of shares and acting in concert guidance • Parent undertaking • Firm • Regulatory body

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 28 Close links 10.5 Does the applicant firm have close links other than the controllers stated above? You must notify us about any other firms or individuals that an applicant firm may have close links with – whether directly, or through a parent or a subsidiary – so we can be sure that we can supervise you effectively. You will find below: • a diagram (1) which sets out the types of relationships between firms and individuals that we consider to be close links • a flowchart (2) which will help you in deciding if you have close links (1) Firm A (Parent) Applicant firm Firm B (Subsidiary) (a) Firm A is the parent of the applicant firm (d) Firm B is a subsidiary of firm A, the parent of the applicant firm d a Applicant firm Firm C (Parent) Firm D (Subsidiary) (b) Firm D is a subsidiary of the applicant firm (c) Firm C is the parent of a subsidiary, Firm D. Firm D is a subsidiary of the applicant firm Firm E (Controller of the applicant firm) Applicant firm (Controller of Firm F) Firm F 20% or more e 20% or more f b c (e) Firm E owns or controls 20% or more of the voting power or capital of the Applicant firm (i.e. is a controller of applicant firm; and/or (f) the applicant firm owns or controls 20% or more of the voting power or capital of firm F

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 29 (2) The firm that controls 20% or more of the voting rights in the applicant firm is a close link Does the applicant firm own or control 20% or more of the voting rights or capital in another firm? The firm that the applicant firm owns or controls 20% or more of the voting rights is a close link Does the applicant firm have a subsidiary? Does the applicant firm have a parent? The subsidiary is classed as a close link The parent is classed as a close link Does the applicant firms parent have any other subsidiaries apart from the applicant firm? These subsidiaries are classed as a close link Does the subsidiary have a different parent to the applicant firm’s parent? The Parent of the subsidiary is classed as a close link Yes Start here Yes If you have answered ‘no’ to all these questions then broadly speaking you do not have close links. Does another person or firm own or control 20% or more of the voting rights or capital in the applicant firm? Yes No Yes No

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 30 For further guidance on close links please see: • SUP 11: https://www.handbook.fca.org.uk/handbook/SUP/11/ • Handbook Glossary: https://www.handbook.fca.org.uk/handbook/glossary/ 10.6 You must attach a structure chart to show the nature of the relationship between the applicant firm and each close link (please include the business type of the close link). The structure chart should show clearly: (i) the close link(s)'s name(s) (ii) the close link(s)'s address(es) (iii) the category of each close link – a, b, c, d, e or f (please see diagram (1) above) (iv) the details of any regulatory body that regulates each close link. Please include the address, telephone number, email address and a contact name at the regulator. (If a close link is regulated by us, please provide the firm’s reference number wherever possible) Please note you will need to complete the appropriate Controller Appendix (please see Question 1.3 of this appendix) for any close links falling into category e (please see diagram (1)). 10.7 Are you aware of any information to suggest that any close link is likely to prevent our effective supervision of the applicant firm? Possible examples of the kind of issues that might impinge on our effective supervision include anything that might: • affect your ability to provide adequate information to us at any time • hinder the flow of information from the applicant firm or the applicant firm's close link(s) to us at any time • prevent us from being able to assess the overall financial position of the applicant firm or your close link(s) at any time Please consider in particular if such issues may arise because the close link is subject to the laws of a state outside the EEA. A list of EEA member states is provided at the beginning of this section.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 31 11 Supporting documents 11.1 Attach and list below any other documents you have provided. You must attach any other documents you have referenced that you consider to be relevant to your application. 11.2 Provide any details on supporting documents if necessary. No additional notes. Other information 11.3 If there is anything else you would like to tell us about this application please give details below. No additional notes.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 32 12 Paying the Application fee No additional notes.

FCA ⚫ Application for Authorisation ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 33 13 Declaration Declaration The signature boxes are for you to use when you print out the application for your records. A permanent copy of the application should be signed and retained by the firm.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 1 Variation of Permission (VoP) application form Pensions Dashboard Service (PDS) Firm Reference Number Firm Name Important information to read before completing this form The notes that accompany this form will help you complete the questions and explain why the information is being requested. Purpose of this form This form collects information that is specific to the type of business the applicant firm is applying for. You must answer every question. If a question does not apply to the applicant firm, please write 'Not Applicable'. Contents of this form Schedule of supporting documents 1 Application contact details 2 Scope of permission and fees 3 PDS Conduct of Business 4 Financial resources 5 Systems and controls 6 Compliance arrangements 7 Threshold Conditions 8 Supporting documents 9 Paying the application fee 10Declaration

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 2 Schedule of supporting documents During the course of the application, firms will be required to supply additional documents. Please see a comprehensive list below: All firms • Regulatory business plan • Policy for meeting the needs of customers in vulnerable circumstances • Complaints handling policies comprising the below: o Complaints handling procedures o Complaints root cause identification procedure o Example Management Information (MI) for complaints root cause analysis and correction • Compliance monitoring procedures comprising the below: o Compliance monitoring programme o Example MI to monitor ongoing compliance with FCA rules • Financial projections comprising the below: o Opening balance sheet o Forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading post-authorisation o Monthly cash flow forecast for first 12, 24 and 36 months of trading post-authorisation o Monthly profit and loss forecast for first 12, 24 and 36 months of trading post-authorisation • Latest annual accounts (if already trading) • Up-to-date management accounts (if already trading and year-end date for most recent annual accounts is greater than 12 months) • Details of subordinated loans (if applicable) • Details of other external funding (if applicable) • Risk management policies and procedures • Business continuity plan (BCP) • Detailed IT controls form • Evidence of the firm’s registration with the Information Commissioner’s Office • Staff organisation structure chart (if applicable)

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 3 1 Application contact details We need this information in case we need to contact you when assessing this application. Contact for this application 1.1 Please enter the contact details of the person we will get in touch with about this application This must be someone directly employed by the firm and not a professional adviser. Title First names Last name Email address Timings for this application 1.2 Is there a date by which you would like this application approved? No YesEnter date required and explain why below / / We cannot guarantee to determine your application by a specific date, but we will try to take into account any timings above when assessing your application(s). We will attempt to process your application as quickly as possible. If you wish your application to be granted by a specific date, we will try to do so. If we cannot, we will contact you with the reason why.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 4 Reason for Variation 1.3 We need to know why your firm is applying to change its scope of permission. You should give us as much information as possible including: • how this change will affect your firm and the long-term strategy for your business • any new operational, legal, market risks that you have identified and will consider • details on any outsourcing

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 5 2 Scope of permission and fees If we grant the applicant firm authorisation, we will issue a Scope of Permission Notice. This sets out: • the regulated activities the applicant firm is authorised to carry on • the client types • any limitations • any requirements 2.1 Does the applicant firm meet the Money and Pensions Service’s (MaPS) connection, security and technical standards in order to connect to the MaPS’ digital architecture? Yes No 2.2 The applicant firm should make sure that it applies for permission to conduct the appropriate regulated activities for the business it wishes to carry on. Please consult the Perimeter Guidance Manual (PERG) before completing this section. Specific guidance concerning the regulated activities is in PERG 2.7. Please note that the selections below are limited to customer type retail and the following activities only: • operating and making a pensions dashboard service available • making arrangements with a view to transactions in investments limited to the provision of post-view services If your firm wishes to undertake other regulated activities, you should also complete the relevant forms for those activities. View a full list of all regulated activities, definitions and exemptions in PERG. Pensions Dashboard Service operating and making a pensions dashboard service available Making arrangements with a view to transactions in investments If the applicant firm intends to provide post-view services, it is likely that it will need the making arrangements permission below. Please tick to confirm that the applicant firm would like to apply for this permission making arrangements with a view to transactions in investments limited to the provision of post-view services If the applicant firm intends to provide a post-view service(s) and considers that the making arrangements permission is not required to do so, please provide a thorough description of the applicant firm’s rationale for this view.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 6 Fees and levies Changing your firm’s permission can generate an application fee and vary your firm’s periodic fee. FEES 4 Annex 1A of the FCA Handbook has detailed notes on the fee blocks and tariff bases. FCA fees Fee Block A.24 - Pensions Dashboard Service Declaration of ongoing FCA fees liability 2.3 You must confirm that the applicant firm understands that it is liable and remains liable to pay fees until such time as the FCA cancels its permission. This is irrespective of whether it is trading, or even if it has notified us of intention to cease trading or submitted an application to cancel. Yes Money Laundering Regulations 2017 2.4 If the variation of permission is granted will the applicant firm become, or continue to be, subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and supervised by the FCA? Yes No

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 7 3 Pensions Dashboard Service Conduct of Business We need to know about the business the applicant firm intends to carry on so we can assess the scope of the authorisation it will need, the adequacy of its resources and its suitability. Background 3.1 You must attach a regulatory business plan. This must be tailored to the applicant firm’s business and consider the matters described in the Threshold Conditions Handbook under COND 2.7 – Business Model, otherwise it may lead to delays in the authorisation process. The business plan should include: • the background to the business • the background and experience of all the persons performing senior management functions and how this will help them with their role – this should include employment background. • any long-term strategy and expansion plans for the business • details of governance framework and personnel • details of key operational matters • analysis of key business and regulatory risks • financial projections for 3 years • details of websites, promotions and communications to be used by the applicant firm • the types of post-view services the applicant firm will be selling, including identifying areas it may specialise in • details of all charges payable by customers for post-view services • details on when these charges are levied and collected from customers Please confirm that you have attached a business plan with the application Attached

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 8 Sourcing customers 3.2 How will the applicant firm source its customers? Method of sourcing customers Approximate % sourced by this method Advertising (including websites, television, radio, magazines, leaflet drops, post, billboards etc) Third Parties Lead Generators Word of Mouth/Personal Recommendations Other Total 100% Other Give details below of the method(s) the applicant firm intend(s) to use and the approximate % of customers intended to be sourced by this method. All business activities 3.3 Does the applicant firm, or any entity of the group of which the applicant firm is a member (if applicable), carry on or intend to carry on any unregulated business activities? No YesGive details below Total unregulated activities £ % of total revenue Description of the unregulated business the applicant firm will be conducting.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 9 3.4 Does the applicant firm intend to offer post-view services? NoContinue to Question 3.7 Yes Give full detail regarding these services; your analysis as to whether other permissions are required to provide them (including legal and/or compliance advice if received); an attestation that the applicant firm has considered whether other permissions are needed; confirm that the applicant firm has carried out user testing. You must provide a summary of the research and, where relevant, how the services were adapted post-testing as a result of the research findings. 3.5 Does the applicant firm intend to generate income from post-view services services? No Continue to question 3.6 YesGive full details regarding these services, your analysis as to whether other permissions are required to provide them (including legal and/or compliance advice if received) and indicate the percentage of total firm revenue to be generated from provision of these activities 3.6 How will the applicant firm be remunerated for post-view services? Please give precise details regarding the applicant firm’s remuneration structure (e.g. fixed fees, percentage-based fees, commissions or any other structure). Include both monies received from the customer and from other firms. Please also explain how these fees are communicated to its customers. 3.7 Is the applicant firm currently taking over the business of any other firm or are there any plans for the applicant firm to do so? (Or, if the firm is already trading, has the applicant firm acquired the business of any other firms in the last 5 years?) No YesGive full details of the other firm

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 10 3.8 How many customers does the applicant firm expect to have in relation to its regulated activities? At authorisation 12 months after authorisation 24 months after authorisation 36 months after authorisation Business Risks 3.9 You must attach the applicant firm’s risk management policy. This should set out the key business risks the applicant firm has identified and how it intends to manage those risks. You must include: • the range of various scenarios tested (for example seasonal changes in demands for products and services) • what sensitivity analysis of those various scenarios was undertaken • the outcome of each scenario tested and analysed • the measures / contingency plans the applicant firm has put in place to mitigate the risks identified e.g. Cyber security risks • how the applicant firm considered the impact to it if key members of staff left the business • how conflicts of interest are identified, recorded, monitored and mitigated

Data export 3.10 You must provide below a step-by-step description of data export capabilities (if any) below. You should pay particular attention to how you have considered consumer understanding in obtaining the customer’s agreement to data export. Attaching screenshots is recommended.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 11 Outsourcing to third parties 3.11 What functions (if any) will the applicant firm outsource? You must include details of the parties to whom the functions will be outsourced and how the applicant firm will monitor and control the outsourced functions. Dashboard services made available by third parties 3.12 You must provide details of the applicant firm’s arrangements with third parties to make the firm’s dashboard services available to the third parties’ customers, members or employees. You must include the names of the parties with whom these arrangements will be established, including the relevant URLs of the third party dashboard(s). 3.13 You must outline the oversight arrangements in place to ensure dashboards presented by third parties do not compromise consumer protections and meet all regulatory standards, including being unalterable. 3.14 You must explain how it will be made clear to consumers using a dashboard presented by a third party who the regulated entity is.

3.15 You must tick below to confirm your understanding that the applicant firm must notify the FCA of new arrangements with third parties, as well as changes and terminations to arrangements with third parties.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 12 The Consumer Duty & Fair Treatment of Customers The Consumer Duty comprises: • A new Consumer Principle that requires firms to act to deliver good outcomes for retail customers. • Cross-cutting rules providing greater clarity on our expectations under the new Principle and helping firms interpret the four outcomes. • Rules relating to the four outcomes we want to see under the Consumer Duty. These represent key elements of the firm-consumer relationship which are instrumental in helping to drive good outcomes for customers. These outcomes relate to: • products and services • price and value • consumer understanding • consumer support Our rules require firms to consider the needs, characteristics and objectives of their customers – including those with characteristics of vulnerability – and how they behave, at every stage of the customer journey. As well as acting to deliver good customer outcomes, firms will need to understand and evidence whether those outcomes are being met. We have issued further guidance to firms on how they should comply with their obligations under the new Consumer Duty as set out in Principle 12 and PRIN 2A (https://www.fca.org.uk/firms/consumer-duty). 3.16 The Consumer Duty, and/or, where this doesn’t apply, the fair treatment of customers, must be a key consideration for all firms. Please tell us how the Duty and/or the fair treatment of customers has been considered in the development of the applicant firm’s business plan? 3.17 How will the applicant firm’s senior management ensure that the Duty and/or the fair treatment of customers is embedded in the culture of the applicant firm and that it can demonstrate that it is treating customers fairly and consistently delivering good outcomes to retail customers?

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 13 3.18 What has the applicant firm’s senior management identified as the key risks to the fair treatment of customers and/or the delivery of outcomes consistent with the Duty, and what action has been taken to mitigate these risks effectively? 3.19 You must attach the applicant firm’s policy for meeting the needs of customers in vulnerable circumstances. Attached 3.20 You must attach a copy of the applicant firm’s complaints handling procedures. Attached 3.21 You must attach a copy of the document setting out the management controls in place to identify and correct root causes of complaints. Attached 3.22 You must attach an example of the management information (MI) produced in relation to complaints handling, root cause analysis and correction. Attached 3.23 You must attach an example of the MI the firm’s senior management or governing body uses to monitor and direct the firm’s compliance with the complaints rules. Attached Financial promotions 3.24 Does the applicant firm intend to display financial promotions on its dashboard? No YesPlease provide full details regarding the nature of the financial promotions including whether these will be the applicant firm’s financial promotions or those of third parties.

3.25 How will the applicant firm ensure that financial promotions comply with the relevant requirements?

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 14 3.26 Does the applicant firm intend to approve any financial promotions in accordance with section 21 of the Financial Services and Markets Act 2000 on behalf of unauthorised persons? No Yes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 15 4 Financial resources All authorised firms must meet certain financial resources requirements. We need to be satisfied that the applicant firm will meet these requirements from the date it is authorised. 4.1 All applicant firms must provide the following: An opening balance sheet demonstrating how the applicant firm will meet its financial resources requirement at the date of approval of the variation of permission Attached A forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading following approval of the variation of permission Attached A monthly cash flow forecast for the first 12, 24 and 36months of trading following approval of the variation of permission Attached A monthly profit and loss forecast for the first 12, 24 and 36 months of trading following approval of the variation of permission. As a minimum, the profit and loss forecast must disclose the following on a monthly basis: • a gross income, analysed between regulated and un-regulated activities • business expenditure, relevant annual expenditure, analysis of the major overheads expenditure • profit before taxation Attached You must attach the applicant firm’s most recent annual accounts. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. Attached Is the applicant firm currently trading? NoGo to next question Yes You must attach the applicant firm’s most recent annual accounts. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. Attached Provide below the date the firm commenced trading (dd/mm/yyyy) / / Is the applicant firm part of a group? NoGo to next question YesYou must attach the most recent consolidated group accounts

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 16 Subordinated loans 4.2 Does the applicant firm have any subordinated loans? NoContinue to Question 5.3 YesYou must give details below of any subordinated loans If there is more than one subordinated loan please use a separate sheet of paper. If you have used separate sheets of paper please indicate how many below. Number of additional sheets Name of loan provider Amount (£) Date of agreement Nature of loan Repayment terms, including number of instalments and final payment date Interest payable % 4.3 You must attach any relevant subordinated loan agreement(s) Attached

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 17 Other funding 4.4 Does the firm have other external funding? NoContinue to Question 5.5 YesYou must give details of other external funding If the applicant firm has external funding but has not drawn down on the external funding, you must still answer the questions below. If there is more than one other source of external funding please use a separate sheet of paper. If you have used separate sheets of paper please indicate how many below. Number of additional sheets Name of funding provider(s) Amount (£) Date of agreement Nature of funding Repayment terms, including number of instalments and final payment date Interest payable %

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 18 Core capital resource requirement 4.5 What is the applicant firm’s core capital resources requirement? Where a firm has a Part 4A permission to carry on one the regulated PDS activity, its core capital requirement is £40,000. Where a PDS also has Part 4A permission to carry on other regulated activities, the capital resources requirement is the higher of: (1) the core capital resources requirement for the PDS activity (2) a capital resources requirement (however described) applied to the firm by any other rule or requirement 4.6 Has a review been conducted within the last 12 months of the adequacy of assets available to ensure that customers receive, when needed, the benefits and services they have purchased? No If one has not been conducted within the last 12 months, you must state below when the review will be completed and submitted to us. Without this document, your application cannot be deemed to be Complete. Yes Attached 4.7 You must confirm that the applicant firm will meet and will continue to meet its capital resource requirement on an ongoing basis and have projections available to prove so. Yes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 19 5 Systems and controls We must be satisfied that the applicant firm has appropriate systems and controls to meet its regulatory obligations. IT systems 5.1 Will the applicant firm be using only commercial off-the-shelf computer products / packages eg Word, Sage accounting software? We note that cyber security might be provided by third parties. If you are using both off-the-shelf and bespoke IT systems, you must list the off-the-shelf systems in the boxes provided and provide a brief description below of your bespoke systems. Yes Give the names of the packages below System Type System Name Operational Date Business transaction recording system Accounting system Other IT systems, eg Word, Excel You must also attach a copy of the detailed IT controls form, the form can be accessed using the following link: https://www.fca.org.uk/publication/forms/detailed-it-controls-form.xlsm Detailed IT controls form attached Business continuity and disaster recovery 5.2 All firms are required to have business continuity and disaster recovery plans. The purpose of a business continuity and disaster recovery plan is to ensure the applicant firm is able to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly reviewed, updated and tested to ensure their effectiveness. Examples of business interruption might include loss or failure of internal or external resources such as people, systems or other assets, loss or corruption of information and external events such as vandalism or adverse weather. For more information refer to the Guidance Notes. You must tick below to confirm that the applicant firm has attached the following documents: Business continuity plan (BCP) Agreements and/or terms of reference agreed with any third-party providing compliance or other services to the applicant firm Outsourcing arrangements for disaster recovery setting out the outsourced providers duties and responsibilities

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 20 Data protection Firms are required to comply with data protection regulations. 5.3 You must confirm that your firm has effective documented processes and procedures in place to make sure it complies with all relevant data protections regulations applicable to the firm Yes 5.4 You must confirm that your firm has in place systems and controls to make sure that it acquires and processes customer data in accordance with all relevant data protection regulations applicable to the firm Yes 5.5 You must confirm that your firm has in place systems and controls to make sure that it will regularly monitor and review its compliance with data protection regulations and take action to address findings Yes 5.6 You must provide the applicant firm’s Information Commissioner’s Office (ICO) registration number ICO Registration Number 5.7 You must attach a screenshot of the firm’s ICO registration details as displayed on the ICO register Attached

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 21 6 Compliance arrangements We need to make sure the applicant firm has the appropriate compliance arrangements in place to meet its regulatory obligations. Compliance procedures You are not required to send compliance procedures with this application, but the applicant firm must be able to produce a copy at any time while we are assessing the application or in the future. These compliance procedures must set out how the firm will comply with all rules applicable to the applicant firm for the activities it proposes to carry on and has applied for in this application. 6.1 You must confirm that the applicant firm has documented compliance procedures in place. Yes Compliance monitoring programme The applicant firm must establish, maintain and carry out a programme of actions to check that it complies and continues to comply with its compliance procedures. This is called a compliance monitoring programme, which must be sent with this application. The compliance monitoring programme must be relevant to the regulated activities the applicant firm wishes to carry on and to its business, so the compliance monitoring programme must be tailored to the applicant firm’s business. A compliance monitoring programme must describe the actions the individual responsible for compliance oversight and their staff will take to ensure that the applicant firm complies with our rules and guidance at all times, in particular: • what checks will take place • how often the checks will take place, as appropriate to the procedure being checked. This might be daily, weekly, monthly, quarterly, annually or another frequency specified by us • who will carry out the checks, such as the Compliance Officer • what records of the checks will be kept confirming they have taken place 6.2 You must attach a copy of your compliance monitoring programme document Attached

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 22 7 Threshold Conditions We need to know whether the firm will continue to satisfy the threshold conditions following the variation of permission The threshold conditions are the minimum conditions a firm is required to satisfy, and continue to satisfy, to be given and retain Part 4A Permission. The firm must satisfy us that these conditions will continue to be met if the application is granted. You may be asked to provide documentary evidence in support of your answers, either during the application process or at a alter point. Locations of Offices 7.1 Confirm either of the following: • If you are a body corporate, that your firm’s Head Office (and also if you have a Registered Office, your Registered Office) is located within the United Kingdom; or • If you are not a body corporate and Head Office is in the United Kingdom, that you carry on business in the United Kingdom NoGive details below Yes Effective Supervision 7.2 As a result of this application, will there be any impact on the appropriate regulator’s ability to effectively supervise the firm? YesGive details below No 7.3 Are you aware of any information to suggest that any close link is likely to prevent our effective supervision of the applicant firm? YesGive details below No 7.4 You must provide a structure chart to show the nature of the relationship between the applicant firm and each close link (please include the business type of the close link) Attached

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 23 Appropriate resources Prudential Category 7.5 What is your current prudential category? 7.6 Will the firm’s prudential category change as a result of this application? No Yes 7.7 What will be the firm’s new capital resources requirement? 7.8 Is the firm currently able to meet this new capital requirement? Yes NoGive details below Suitability Business Model 7.9 You must confirm that the firm has a suitable business plan available that reflects the firm’s current business and proposed changes? Yes Compliance A firm must establish, maintain and carry out a Compliance Monitoring Programme of actions to check it complies and continues to comply with regulations. 7.10 Do you have in place a Compliance Manual and a Compliance Monitoring Programme that reflects the firm's current business and the proposed change in business, if applicable, for which you are applying? YesContinue to next question NoGive details below Conduct of Business Requirements – Conduct of Business (COBS) Sourcebook 7.11 Is the firm ready, willing and organised to comply with the relevant provisions in COBS, and, if applicable to this application, does the firm have in place the relevant customer disclosure documentation for the permission you are applying for?

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 24 YesContinue to next question NoGive details below Systems and Controls (SYSC) Requirements 7.12 Does the firm continue to meet the SYSC requirements? YesContinue to next question NoGive details below We may contact you for more detailed information to support your application, especially if you are applying to significantly change your firm's current business.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 25 8 Supporting documents 8.1 Please attach and list below any other documents you have provided. 8.2 Please provide any details on supporting documents if necessary. Other information 8.3 Is there anything else you would like to tell us or should tell us about this application? No YesGive details below

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 26 9 Paying the application fee Payment method Payment is by credit or debit card when you apply via our Connect system. The application fee is not refundable. Application fee 9.1 You must confirm you have enclosed the fee for your application. Operating and making a pensions dashboard service available - Category 4 Please refer to FEES 3 Annex 1AR for the details of the amount chargeable for each category - https://www.handbook.fca.org.uk/handbook/FEES/3/Annex1AR.html

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 27 10 Declaration It is a criminal offence, knowingly or recklessly, to give the FCA information that is materially false or misleading or deceptive (see sections 398 and 400 FSMA). Even if you believe or know that information has been provided to the FCA before or is in the public domain, you must disclose it clearly and fully in this form and as part of this application. . If there is any doubt about the relevance of information, it should be included. There will be a delay in processing the application if information is inaccurate or incomplete. You must notify the FCA immediately if there is a change to the information in this form and/or if inaccurate information has been provided (insofar as the FCA are reasonably likely to consider the information material). The candidate authorises the FCA to make such enquiries and seek such further information as it thinks appropriate to identify and verify information that it considers relevant to the assessment of this application. I/We confirm that the information provided in this application is accurate and complete to the best of my/our knowledge. I/We will notify the appropriate regulator immediately if there is a material change to the information provided. I/We authorise the appropriate regulator to make such enquiries and seek such further information as it thinks appropriate to identify and verify information that it considers relevant to the assessment of this application. These checks may include credit reference checks or information pertaining to fitness and propriety. I/We are aware that the results of these enquiries may be disclosed to the firm/employer/applicant firm. I/We agree that the FCA may, in the course of processing this application, undertake a Police National Computer (PNC) check in respect of any or all of the persons to whom this application relates. Where the signatory to this application has provided an address and/or email address in connection with the applicant firm’s business, the signatory agrees on behalf of the applicant firm that the FCA may use such address and email address as the ‘proper address for service’ at which to give the applicant firm a ‘relevant document’ as those terms are defined in Financial Services and Markets Act 2000 (Service of Notice) Regulations (SI 2001/1420). I/We confirm that where I/We have certified that documents are ready they have been prepared to an appropriate standard and are available for immediate inspection by the appropriate regulator. I/We understand that the FCA may require the applicant firm to provide further information or documents at any time. I/We confirm that I/we are authorised to sign this form on behalf of the firm and/or controller(s) and (where applicable) to give each of the confirmations on behalf of the applicant firm set out in this declaration. The FCA and the Bank of England process personal data in line with the requirements of the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018. For further information about the way we use

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 28 the personal data collected in this form, please read the privacy notices available on the FCA’s website at: https://www.fca.org.uk/data-protection and the Bank of England’s website at: https://www.bankofengland.co.uk/prudential-regulation/authorisations In addition to other regulatory responsibilities, firms and approved persons have a responsibility to disclose to the FCA matters of which it would reasonably expect to be notified. Failure to notify the FCA of such information may lead to the appropriate regulator taking disciplinary or other action against the firm and/or individuals. Review and Submission The ability to submit this form is given to an appropriate user or users by the firm’s principal compliance contact. Tick here to confirm that the person submitting this form on behalf of the firm and (if applicable) the individual named below – have read and understood the declaration. I can confirm that a permanent copy of this application, signed by myself and the signatories, will be retained for an appropriate period, for inspection at the FCA /PRA’s request. Who must sign the declaration? The person or persons signing this application must have legal authority to act as a signatory on behalf of the applicant firm. This can be, for example, the owner of a sole trader business, or a director or a partner. There can be one or two required signatures depending on the number of directors / partners in the applicant firm. Person 1 Name of signatory Signature Date (dd/mm/yyyy) / /

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service ⚫ Release 1 ⚫ December 2022 page 29 Person 2 Name of signatory Signature Date (dd/mm/yyyy) / /

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 1 Variation of Permission (VoP) application form Pensions Dashboard Service (PDS) - Notes Please read these notes carefully. They will help you fill in the Pensions Dashboard Service VoP application form correctly. When completing the form, you will need to refer to the Handbook: www.handbook.fca.org.uk/. If after reading these notes you need more help please: • check the FCA website • consult the Handbook: www.handbook.fca.org.uk/ • call us on 0300 500 0597 • email: Firm.Queries@fca.org.uk Terms in these notes In these notes: • 'we', ‘us’, 'our' and ‘the FCA’ refers to the Financial Conduct Authority • 'the applicant firm' refers to the firm applying for authorisation • 'you' refers the person(s) signing the form on behalf of the applicant firm • ‘FSMA’ refers to the Financial Services and Markets Act 2000 Important information At the point of authorisation, we expect the applicant firm to be ready, willing and organised to start business. Once authorised, the applicant firm is required to pay regulatory fees even if it is not trading. Firms must also notify us immediately if any of their static data changes. Contents of this form The FCA Handbooks The Threshold Conditions 1 Application contact details 2 Scope of permission and fees 3 PDS Conduct of Business 4 Financial resources 5 Systems and controls 6 Compliance arrangements 7 Threshold Conditions 8 Supporting documents 9 Paying the application fee 10Declaration

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 2 The FCA Handbooks Introduction The FCA Handbooks set out our legislative powers and other provisions made under powers given to us by FSMA. The Handbooks are available online. The Handbooks are extensive documents, but you will only need to refer regularly to the specific parts that will affect your business. In addition to the Handbooks, there are also Handbook guides and Regulatory guides. Handbook guides are guides to the Handbook as a whole and are aimed at particular types of firms. They will point you in the direction of relevant material. The Handbooks are divided into Blocks and each of these is subdivided into modules. Additionally, the Handbook contains a Glossary of all the definitions used in the Handbooks. The full handbook can be found at www.handbook.fca.org.uk/

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 The Threshold Conditions Throughout the application pack, you will see references to the Threshold Conditions (COND). These are the minimum requirements that a firm must satisfy to become and remain authorised. When we consider the applicant firm's application we will assess whether the firm is ready, willing and organised to satisfy, and continue to satisfy, the Threshold Conditions. The Threshold Conditions are set out in full in COND 2 of the Handbook at: www.handbook.fca.org.uk/handbook/COND/2/

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 4 1 Application contact details Contact for this application 1.1 Please enter the contact details of the person we will get in touch with about this application. This must be someone based in the UK and in the direct employment of the applicant firm. The firm may wish to provide the contact details of a second individual if the main contact will not be available for a long period of time. Timings for this application 1.2 Is there a date by which you would like this application approved? Please note the following timeframes for authorisation: Authorisations have 6 months to come to a decision regarding an application once it is deemed to be complete. If the application is not complete, authorisations have up to 12 months to come to a decision. Reason for Variation 1.3 We need to know why your firm is applying to change its scope of permission. No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 5 2 Scope of permission and fees Background When applying for authorisation, the applicant firm is responsible for ensuring that the regulated activities and the corresponding client and investment types requested adequately cover the business the applicant firm intends to carry on. If the applicant firm is authorised, the FCA will issue the firm with a Scope of Permission Notice. The permission notice lists the regulated activities the applicant firm will be authorised to carry on. It will also contain what we refer to as 'requirements' and 'limitations'. In broad terms, limitations are restrictions placed on individual regulated activities and requirements will be placed on the firm’s entire scope of permission requiring it to take or not to take specified actions. Getting the applicant firm's scope of permission right at the outset is fundamental. If the applicant firm carries on a regulated activity that is not set out in its permission notice it could be in breach of the Financial Services and Markets Act 2000 (FSMA) and subject to enforcement action. Wording of the Scope of Permission Notice The Scope of Permission Notice will follow the wording in the Perimeter Guidance PERG 2 (Annex 2). You can find this at: https://www.handbook.fca.org.uk/handbook/PERG/2 Requested permission You will need to look at the list of regulated activities and decide which are relevant to the applicant firm. You can find a full description of each regulated activity in PERG 2.7 at: https://www.handbook.fca.org.uk/handbook/PERG/2/7 You may also find it useful to look at the FCA glossary: https://www.handbook.fca.org.uk/handbook/glossary/ Don’t be put off by the language. We need to use formal language to mirror how the activities are described in the Regulated Activities Order (Specified Activities). The Scope of Permission Notice is a legal document that sets out the scope of your permission for regulatory purposes. 2.1 Does the applicant firm meet the Money and Pensions Service’s (MaPS) connection, security and technical standards in order to connect to the MaPS’ digital architecture? MaPS has developed standards, specifications and technical requirements for all components and participants in the ecosystem. These standards include Data, Technical, Design and Reporting standards. MaPS has also provided a Code of Connection, that encompasses Security, Service, and Operational standards. The standards are technical and operational and are critical to the effective operation of dashboards. So, meeting MaPS standards is an explicit

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 requirement of our rules. If the applicant firm has not built its business to meet these requirements it is likely it will be asked to withdraw its application until it has fully considered and met these standards. 2.2 The applicant firm should make sure that it applies for permission to conduct the appropriate regulated activities for the business it wishes to carry on. Please consult the Perimeter Guidance Manual (PERG) before completing this section. Specific guidance concerning the regulated activities is in PERG 2.7. Pensions Dashboard Service Making arrangements with a view to transactions in investments Limitation Where the applicant firm intends to offer a post-view service(s) which requires the making arrangements permission it will be accompanied by a limitation. If the applicant firm considers that it requires the making arrangements permission without this limitation for another part of its business model, it will need to complete the relevant forms. Fees & Levies Firms fall into fee blocks according to their permissions. The rules about which activities fall into which fee blocks are in FEES 4 Annex 1A https://www.handbook.fca.org.uk/handbook/FEES/4/Annex1A.html The rules about calculating fees in a firm’s first and second year of authorisation are in FEES 4.2.7 https://www.handbook.fca.org.uk/handbook/FEES/4/2.html All authorised firms pay minimum fees towards the annual regulatory costs. Larger firms will pay a variable fee in proportion to the size of its tariff data. You can estimate your regulatory fees and levies using our fee calculator at https://www.fca.org.uk/firms/calculate-your-annual-fee/fee-calculator Guidance notes for calculating the tariff data are available at https://www.fca.org.uk/firms/fees/report-fee-tariff-data. Links to the relevant parts of the Handbook can be found in the notes below. Please contact the FCA’s Supervision Hub on 0300 500 0597 if you require further clarification for this section.

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 FCA fees After authorisation, the applicant firm will be liable to pay periodic fees to the FCA. We will use the figures the firm provides in this section to calculate its fee for its first year of trading following authorisation. Where possible the firm should endeavour to use true and accurate information when making its projections. Fee Block A.24 - Pensions Dashboard Service The Ombudsman Services General Levy Businesses that are covered by the Financial Ombudsman Service are required to pay a general levy to fund its operating costs and to deal with the forecast volume of complaints about relevant business activity. It is payable by all firms authorised or registered by the FCA and it is raised and collected by the FCA on behalf of the Financial Ombudsman Service. The general levy is based on the amount of regulated business done with consumers eligible to refer their complaint to the Financial Ombudsman Service. Declaration of ongoing FCA fees liability 2.3 You must confirm that the applicant firm understands that it is liable and remains liable to pay fees until such time as the FCA cancels its permission. This is irrespective of whether it is trading, or even if it has notified us of intention to cease trading or submitted an application to cancel. The rules in FEES 4.2.9 and FEES 4.3.13-14 describe the fee obligations of firms who are cancelling their permissions. Money Laundering Regulations 2017 2.4 If the variation of permission is granted will the applicant firm become, or continue to be, subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and supervised by the FCA? No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 8 3 Pensions Dashboard Service Conduct of Business Background 3.1 You must attach a regulatory business plan. This must be tailored to the applicant firm’s business and consider the matters described in the Threshold Conditions Handbook under COND 2.7 – Business Model, otherwise it may lead to delays in the authorisation process. We need to know about the business the applicant firm intends to carry on so we can ensure it is authorised for the correct regulated activities, investment types and client types and to assess the adequacy of its resources. We see the regulatory business plan as an important regulatory tool for the applicant firm and us in measuring the applicant firm's business risk and control over any regulatory concerns. You can find further information about this in: https://www.handbook.fca.org.uk/handbook/SYSC/3/2.html (for firms which are not common platform firms) and SYSC 4 - 10 (for common platform firms). Bearing in mind the threshold conditions, we need to be satisfied that the applicant firm can: • identify all regulated activities and any unregulated activities it intends to carry on • identify all the likely business and regulatory risk factors • explain how it will monitor and control these risks • take into account any intended future developments Please remember that the applicant firm's regulatory business plan is an important part of the overall application and integral to our decision-making process. It is important that the regulatory business plan is tailored to the applicant firm’s activities. The amount of detail submitted should be proportionate to the nature of the business the applicant firm intends to carry on. For example, a small firm seeking to carry on a business with a risk you perceive as low, should have a smaller and less complex business plan than a business plan for a complex high-risk firm. The level of detail should also be appropriate to the risks to the applicant firm's clients. You can find further information about our requirements and expectations for business plans at: https://www.handbook.fca.org.uk/handbook/COND/2/4.html Sourcing customers 3.2 How will the applicant firm source its customers? If you selected ‘Other’, please give details below of the channel(s) the applicant firm intends to use and the approximate percentages.

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 To assess this application fully, we need as much insight as possible into how the applicant firm intends to carry on business. All business activities 3.3 Does the applicant firm, or any entity of the group of which the applicant firm is a part, carry on or intend to carry on any unregulated business activities? Please provide the revenue generated, or projected to be generated, by unregulated activities and the proportion this makes up of the applicant firm’s total revenue. 3.4 Does the applicant firm intend to offer post-view services? No additional notes 3.5 Does the applicant firm intend to generate income from post-view services? By post-view services we mean any revenue generating activities that arise off the back of the PDS activity. You must consider whether your firm needs to apply for other permissions in order to carry out any of these post-view services. In particular, the applicant firm should consider whether any of these services constitute providing advice. 3.6 How will the applicant firm be remunerated for post-view services? No additional notes 3.7 Is the applicant firm currently taking over the business of any other firm or are there any plans for the applicant firm to do so? Please refer to our Change in Control webpages for more information. 3.8 How many customers does the applicant firm expect to have in relation to its regulated activities? No additional notes Business Risks 3.9 You must attach the applicant firm’s risk management policy. This should set out the key business risks the applicant firm has identified and how it intends to manage those risks. Here are some examples that should be considered, depending on the nature of the applicant firm’s business: External risks: The applicant firm should: • identify competitors and assess their reaction to the applicant firm's presence in the market, if applicable • consider critical economic factors which should then be analysed and assessed. For example, it may be useful to explore the effect on the applicant firm's business if there were large-scale local redundancies. Internal risks: The applicant firm should: • undertake a sensitivity analysis of various scenarios and the possible outcomes (this could be a reduction in business or an equally large increase in business – for example, towards the end of a tax year) • consider how the applicant firm would manage if it lost key staff

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 • prepare and maintain a contingency plan that deals with the applicant firm's identified key risks Data export 3.10 You must provide a step-by-step description of data export capabilities below. Providing screenshots of the data export journey will enable us to assess the journey from the perspective of the customer. Outsourcing to third parties 3.11 What functions (if any) will the applicant firm outsource? Outsourcing is the act of one firm contracting with another to provide services that might otherwise be performed by in-house employees. You must include details of the parties that the functions will be outsourced to and how the applicant firm will monitor and control the outsourced functions. Dashboard services made available by third parties 3.12 You must provide details of the applicant firm’s arrangements with third parties to make its dashboard services available to the third parties’ customers, members or employees. No additional notes 3.13 You must outline the oversight arrangements in place to ensure dashboards presented by third parties do not compromise consumer protections and meet all regulatory standards, including being unalterable. No additional notes 3.14 You must explain how it will be made clear to consumers using a dashboard presented by a third party who the regulated entity is It is important that consumers know with whom they are interacting when using dashboard services made available by a third party. This information helps consumers to make informed decisions about whether to use those dashboard services and how to interact with the PDS firm. 3.15 You must tick below to confirm your understanding that the applicant firm must notify the FCA of new arrangements with third parties, as well as changes and terminations to arrangements with third parties No additional notes The Consumer Duty & Fair Treatment of Customers 3.16 The Consumer Duty, and/or, where this doesn’t apply, the fair treatment of customers, must be a key consideration for all firms. Please tell us how the Duty and/or the fair treatment of customers has been considered in the development of the applicant firm’s business plan? No additional notes.

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 3.17 How will the applicant firm’s senior management ensure that the Duty and/or the fair treatment of customers is embedded in the culture of the applicant firm and that it can demonstrate that it is treating customers fairly and consistently delivering good outcomes to retail customers? No additional notes. 3.18 What has the applicant firm’s senior management identified as the key risks to the fair treatment of customers and/or the delivery of outcomes consistent with the Duty, and what action has been taken to mitigate these risks? No additional notes. 3.19 You must attach the applicant firm’s policy for meeting the needs of customers in vulnerable circumstances. No additional notes. 3.20 You must attach a copy of the applicant firm’s complaints handling procedures. No additional notes. 3.21 You must attach a copy of the document setting out the management controls in place to identify and correct root causes of complaints. No additional notes. 3.22 You must attach an example of the management information (MI) produced in relation to complaints handling, root cause analysis and correction. No additional notes. 3.23 You must attach an example of the MI the applicant firm’s senior management or governing body uses to monitor and direct the applicant firm’s compliance with the complaints rules. No additional notes. Financial promotions 3.24 Does the applicant firm intend to display financial promotions on its dashboard? If the firm answers ‘yes’ please explain how it will ensure financial promotions, whether their own or of a third party, will comply with the relevant rules. 3.25 How will the applicant firm ensure that financial promotions comply with the relevant requirements? No additional notes 3.26 Does the applicant firm intend to approve any financial promotions in accordance with section 21 of the Financial Services and Markets Act 2000 on behalf of unauthorised persons? No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 12 4 Financial Resources 4.1 All applicant firms must provide the following: An opening balance sheet to demonstrate how the applicant firm will meet its financial resources requirement at the date of authorisation This is a balance sheet prepared as at the start of your trading as an authorised firm. A forecast closing balance sheet at the end of the first 12, 24 and 36 months of trading as an authorised firm This is a balance sheet showing the financial position of the applicant firm as it is forecasted to be after 12 months of trading. A month-by-month cash flow forecast for the first 12, 24 and 36 months of trading as an authorised firm The cashflow statement shows how a firm is paying for its operations and future growth, by detailing the ‘flow’ of cash into and out of the firm. The cashflow statement is normally similar to the profit and loss statement but shows the actual financial position of a firm at any time. So, if a firm starts with share value of £10,000 then this is the starting figure. Include this in your profit and loss to take it forward and for every month you will have income and expenses deducted, showing you the actual financial position of the company at any time. A month-by-month profit and loss forecast for the first 12, 24 and 36 months of trading. As a minimum, the profit and loss forecast must disclose the following on a monthly basis: • a gross income, analysed between regulated and un-regulated activities • business expenditure, relevant annual expenditure, analysis of the major overheads expenditure; and • profit before taxation A profit and loss account shows the firm’s income and expenditure for a set period. You must send us 36 forecast profit and loss accounts, one for each of the first 36 months of trading as an authorised firm. You must attach the applicant firm’s most recent annual accounts. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. It must submit its most recent annual accounts as submitted to Companies House. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts.

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 Is the applicant firm currently trading? If the applicant firm is already trading, it must submit its most recent annual accounts as submitted to Companies House. If the year-end date for its most recent annual accounts is greater than 12 months, the firm must also submit up-to-date management accounts. Is the applicant firm part of a group? If the applicant firm is part of a group, it must attach the most recent consolidated group accounts. Subordinated loans 4.2 Does the applicant firm have any subordinated loans? You will only be asked this question if your legal status is Public Limited Company, Private Limited Company or Limited Liability Partnership and you were asked about subordinate loans at the start of this Financial Resources Section. A subordinated loan is a loan that ranks below other unsubordinated debt in the queue for repayment should the applicant firm be wound up. 4.3 You must attach any relevant subordinated loan agreement(s) Other funding 4.4 Does the applicant firm have other external funding? Examples of external finance would include a bank overdraft or a business loan. Core capital resources requirement 4.5 What is the applicant firm’s core capital resources requirement? There is a set core capital requirement for PDS firms. The highest of the PDS requirement and the firm’s existing resource requirement will apply. Please clarify which of the two this will be for your firm. 4.6 Has a review been conducted within the last 12 months of the adequacy of assets available to ensure that customers receive, when needed, the benefits and services they have purchased? Without this document, your application cannot be deemed to be Complete. 4.7 You must confirm that the applicant firm will meet and continue to meet its capital resource requirement on an ongoing basis and have projections available to prove so. No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 14 5 Systems and controls IT systems 5.1 Will the applicant firm be using only commercial off-the-shelf computer products / packages eg Word, Sage accounting software? An off-the-shelf package is a simple 'one size fits all' package rather than a system that is tailor made specifically for the business. Business transaction reporting We appreciate that different types of firms will have different transactions and ways of recording those transactions, so please be as clear as possible in your explanation. An example of business transaction reporting could be the systems the applicant firm has in place, or will have in place, for recording a client's individual transaction details on their file eg keeping know your customer details up to date. Accounting system Examples of off-the-shelf accounting packages are SAGE, Quickbooks pro. Other IT systems, eg Word, Excel No additional notes. You must provide a brief description of your proposed bespoke systems (this must include details of your IT systems, business transaction recording system and accounting system). You must also attach a copy of the detailed IT controls form. The form can be accessed using the following link: https://www.fca.org.uk/publication/forms/detailed-it-controls￾form.xlsm No additional notes Business continuity and disaster recovery 5.2 All firms are required to have business continuity and disaster recovery plans We expect the applicant firm to have a disaster recovery plan in place which is appropriate given the size and nature of its business. This should ensure that it can continue to function and meet its regulatory obligations if there is an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness. The plan should include an assessment of the disruptions to which the firm is particularly susceptible (and the likely timescale of those disruptions). These might include:

5 Systems and Controls FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 • loss or failure of internal and external resources such as people (either through illness or leaving the firm), systems and other assets • the loss or corruption of information (eg computer breakdown and loss of customer files) • external events (such as vandalism, terrorism and adverse weather). It should cover ways in which both the likelihood and impact of a disruption can be reduced, eg by succession planning and contingency arrangements. It should show the strategy for: • maintaining continuity of operations • communicating to the staff • regularly testing the adequacy and effectiveness of this strategy The questions listed below should help you with this: • What arrangements do you have in place to reduce the impact of a short, medium or long-term disruption to the following: o people, systems and other assets or the recovery priorities for the firm's operations o communication arrangements for internal and external concerned parties (eg the FCA and/or the PRA, clients and the press) • How would the applicant firm set in motion its disaster recovery and business continuity plans? • Does it have any processes in place to check and validate the integrity of information affected by the disruption? • How will the applicant firm review, test and update its disaster recovery plan operations? • For further guidance see: www.handbook.fca.org.uk/handbook/SYSC/. Data protection 5.3 You must confirm that the applicant firm has effective documented processes and procedures in place to make sure it complies with all relevant data protections regulations applicable to the firm. No additional notes 5.4 You must confirm that the applicant firm has in place systems and controls to make sure that it acquires and processes customer data in accordance with all relevant data protection regulations applicable to the firm. No additional notes 5.5 You must confirm that the applicant firm has in place systems and controls to make sure that it will regularly monitor and review its compliance with data protection regulations and take action to address findings. No additional notes 5.6 You must provide the applicant firm’s Information Commissioner’s Office (ICO) registration number. No additional notes 5.7 You must attach a screenshot of the firm’s ICO registration details as displayed on the ICO register No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 16 6 Compliance arrangements Compliance procedures 6.1 You must confirm that the applicant firm has documented compliance procedures in place. When assessing this application, we need to be satisfied the applicant firm has the appropriate compliance arrangements in place to meet its regulatory obligations, both when we authorise it and on an ongoing basis. You should not send the compliance procedures to us when submitting this application. However, they must be ready for inspection at any time. They will also need to be in place so that you can prepare the Compliance Monitoring Programme. Set out below are the areas for which we would expect you to have adequate compliance procedures, depending on the activities that you propose to carry out: (a) the scope of the applicant firm's business (b) complaints handling (c) financial crime (d) skills, knowledge and expertise (e) business continuity (f) communication with clients (g) record keeping (h) notifications to the FCA (i) reporting requirements (j) compliance with conduct business rules in FPCOBS (k) sales of products and services (l) conflicts of interest (m) reliance on others (n) exclusion of liability (o) protecting customers' interests As well as the subjects above, your compliance manual may need to cover the subjects below depending on your type of business. (a) charges and commission (b) claims handling (d) general provisions related to distance marketing (e) financial promotions (f) Systems and controls in relation to financial crime and money laundering There may be other compliance procedures and policies, which the applicant firm will need to include in its compliance manual depending on the type of

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 business it intends to carry on. If you are unsure whether you need to include anything else, please take professional advice. Remember that this manual should be designed so it is specifically tailored to the business and is easy to use as well as easy to amend and to keep up-to￾date. If you are in any doubt about what you need to put into the compliance manual, you should seek professional advice. Common platform firms should consider carefully the obligations in SYSC 6.1 (https://www.handbook.fca.org.uk/handbook/SYSC/6/1/.html ). Compliance monitoring programme 6.2 You must attach a copy of your compliance monitoring programme document This will need to be included as part of your application. The compliance monitoring programme must be relevant to, and tailored to reflect, the applicant firm's proposed business. Each applicant firm's compliance monitoring programme will therefore be unique to itself. A compliance monitoring programme must describe the actions that the holder of the compliance oversight function and their staff will take to make sure that the applicant firm complies with our rules and guidance at all times. In particular, it must describe: • what checks will take place • how often the checks will take place, as appropriate to the procedure being checked – this might be daily, weekly, monthly, quarterly, annually or another period specified by us, • who will carry out the checks – this is the role of the person who will make the checks, such as the Compliance Officer, Training and Competence Officer or Money Laundering Reporting Officer • what records of the checks will be kept to confirm they have taken place

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 18 7 Threshold Conditions We need to know whether the firm will continue to satisfy the threshold conditions following the variation of permission The threshold conditions are the minimum conditions a firm is required to satisfy, and continue to satisfy, to be given and retain Part 4A Permission. The firm must satisfy us that these conditions will continue to be met if the application is granted. You may be asked to provide documentary evidence in support of your answers, either during the application process or at a alter point. Locations of Offices 7.1 Confirm either of the following: • If you are a body corporate, that your firm’s Head Office (and also if you have a Registered Office, your Registered Office) is located within the United Kingdom; or • If you are not a body corporate and Head Office is in the United Kingdom, that you carry on business in the United Kingdom No additional notes. Effective Supervision 7.2 As a result of this application, will there be any impact on the appropriate regulator’s ability to effectively supervise the firm? No additional notes. 7.3 Are you aware of any information to suggest that any close link is likely to prevent our effective supervision of the applicant firm? No additional notes. 7.4 You must provide a structure chart to show the nature of the relationship between the applicant firm and each close link (please include the business type of the close link) No additional notes. Appropriate resources Prudential Category 7.5 What is your current prudential category? No additional notes. 7.6 Will the firm’s prudential category change as a result of this application? No additional notes. 7.7 What will be the firm’s new capital resources requirement? No additional notes. 7.8 Is the firm currently able to meet this new capital requirement? No additional notes. Suitability Business Model

FCA ⚫ Variation of Permission Pensions Dashboard Services notes ⚫ Release 1 ⚫ December 2022 7.9 You must confirm that the firm has a suitable business plan available that reflects the firm’s current business and proposed changes? No additional notes. Compliance 7.10 Do you have in place a Compliance Manual and a Compliance Monitoring Programme that reflects the firm's current business and the proposed change in business, if applicable, for which you are applying? No additional notes. Conduct of Business Requirements – Conduct of Business (COBS) Sourcebook 7.11 Is the firm ready, willing and organised to comply with the relevant provisions in COBS, and, if applicable to this application, does the firm have in place the relevant customer disclosure documentation for the permission you are applying for? No additional notes. Systems and Controls (SYSC) Requirements 7.12 Does the firm continue to meet the SYSC requirements? No additional notes.

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 20 8 Supporting documents 8.1 Please attach and list below any other documents you have provided. You must attach any other documents you have included that you consider to be relevant to your application. 8.2 Please provide any details on supporting documents if necessary. No additional notes Other information 8.3 Is there anything else you would like to tell us or should tell us about this application? No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 21 9 Paying the application fee No additional notes

FCA ⚫ Variation of Permission ⚫ Pensions Dashboard Service notes ⚫ Release 1 ⚫ December 2022 page 22 10 Declaration Declaration The signature boxes are for you to use when you print out the application for your records. A permanent copy of the application should be signed and retained by the firm.

© Financial Conduct Authority 2022 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 007934