PS24/15: Regulatory framework for pensions dashboard service firms

Policy Statement PS24/15 Regulatory framework for pensions dashboard service firms November 2024

This relates to Consultation Papers 22/25 and 24/4 which are available on our website at www.fca.org.uk/ publications Email: cp24-4@fca.org.uk Sign up for our news and publications alerts See all our latest press releases, consultations and speeches.

3 Contents Chapter 1 Summary Page 4 Chapter 2 The core framework Page 14 Chapter 3 Conduct Standards – consumer protection Page 24 Chapter 4 Conduct standards – enabling engagement Page 43 Chapter 5 FCA processes Page 62 Annex 1 List of non-confidential respondents Page 70 Annex 2 Abbreviations used in this paper Page 72 Appendix 1 Made rules (legal instrument)

4 Chapter 1 Summary 1.1 Pensions dashboards will allow consumers to find their pensions and view basic information about them in one secure place. The Government asked the Money and Pensions Service (MaPS) to develop and operate the public (non-commercial) Pensions Dashboard Service. The Government also enabled private sector entities to offer a Pensions Dashboard Service (PDS). The Government set certain parameters for these dashboards, including that they should be non-transactional and that they must meet standards set by the Pensions Dashboards Programme (PDP). PDP is the part of MaPS that is responsible for delivering the central digital architecture that will make pensions dashboards work. 1.2 Earlier this year, the Government changed the law to bring the new activity of operating a PDS within the FCA’s regulatory remit (our regulatory perimeter). This legislative change means that a firm wishing to operate a PDS must: • be or become FCA authorised • get our permission to undertake the new regulated activity • meet our requirements for firms undertaking this activity 1.3 We first consulted on proposed requirements for firms operating a PDS (PDS firms) in December 2022 CP22/25: Proposed regulatory framework for pensions dashboard service firms (CP22/25). After Parliament approved the legislation to introduce the new regulated activity (February 2024), we published a further consultation in CP24/4: Further consultation on the regulatory framework for pensions dashboard service firms. This consultation contained further and revised proposals prompted by the drafting of the regulated activity and feedback to CP22/25. 1.4 In this Policy Statement (PS) we summarise the feedback to these consultations and our response to it. 1.5 The Minister for Pensions recently announced that the PDP will prioritise the launch of the MoneyHelper dashboard service (the non-commercial dashboard provided by MaPS), before turning to the work of connecting private sector dashboard services (sometimes referred to as commercial dashboards). This means that the launch of private sector dashboards is still some way into the future. We are finalising our rules now to give interested parties some certainty over the initial FCA requirements. 1.6 Our rules set appropriate expectations for the initial launch of private sector PDS. But we recognise the potential for PDS to evolve over time. There are both FCA and Government initiatives and workstreams in various stages of development that could change the future landscape in which dashboards operate in future, for example open finance, the Government’s small pots initiative and the Advice Guidance Boundary Review (AGBR). These present potential opportunities for alternative uses of data. Where changes occur, we may need to revisit the regulatory framework for PDS firms to explore how it might interact, support and appropriately protect in those

5 new landscapes. For example, as we signal in Chapter 4, we are open to reviewing our limitations on whether and how ‘view data’ might be exported in future in the context of the AGBR. In each case, the opportunities and risks would have to be carefully explored. Who this affects 1.7 This PS primarily affects firms interested in operating a PDS and who will need to get the new regulatory permission to do so. This could include firms that are currently FCA authorised for other activities, as well as those that are not currently FCA authorised and/or organisations such as Master Trusts that are regulated by other bodies. 1.8 This PS will also interest: • bodies that want to help their customers, members or other consumers, to find and use a PDS, for example, employers and charities • pension providers, trustees and administrators who will be supplying information to dashboard services for their pension savers to view • individual consumers and bodies representing the interests of consumers 1.9 Other stakeholders who may be interested in our regulatory framework for PDS firms may include individuals and firms providing advice, guidance and information on pensions and retirement planning. The wider context of this policy statement 1.10 As illustrated in Diagram 1 below, the ecosystem to which pensions dashboards will connect, will enable a consumer to use a PDS to find and view pensions information. How the ‘find’ process will work and the information a user will be able to ‘view’ is set out in: • Government regulations: The Pensions Dashboards Regulations 2022 came into force in December 2022. • Binding standards: PDP published drafts of most of its standards in November 2022 (some of which were updated in Summer 2024) and consulted on Design Standards in December 2022. The PDP continues to revise and refresh the standards before asking the Secretary of State to approve them. We refer to these standards collectively as the PDP’s standards, as they are published by the PDP on behalf of MaPS.

6 Diagram 1: Sources of obligations across the ecosystem dashboard provider dashboard provider dashboard provider MaPS dashboard pensions information flows find request and response to dashboard find request response – register with consent and authorisation server pension scheme pension provider Key: FCA remit Subject to: • The Pension Dashboards Regulations 2022 • PDP standards dashboard governance register identity service consent and authorisation pension finder service pension provider pension scheme state pensions integrated service provider

7 1.11 Throughout this paper, we will use diagram 2 as a key to demonstrate where: • our rules apply in parallel to the Government Regulations and PDP standards • only our rules (and, where applicable, existing data protection legislation) apply Diagram 2: the obligations that apply in three different environments How it links to our objectives Consumer protection 1.12 The Government committed to bring operators of private sector PDSs into our remit to ensure an appropriate degree of consumer protection. 1.13 Central to our framework of rules is the expectation PDS firms will act fairly, honestly and professionally in consumers’ best interests and deliver good consumer outcomes consistent with the Consumer Duty. Our rules: • emphasise that the services that PDS firms offer must be fit for purpose and help consumers make effective choices and act in their own interests • aim to deliver against our strategic commitments that firms put consumers’ needs first and enable consumers to help themselves Outside the PDS Existing regulation and legislation, as applicable. Wider PDS: beyond view data FCA Rules for PDS firms Core PDS: find and view • Pensions Dashboards Regulations 2022 • PDP Standards • FCA Rules for PDS firms

8 Competition 1.14 Our framework of rules delivers against our operational objective of promoting effective competition in the interest of consumers. Pensions dashboards have the potential to increase effective competition in adjacent markets, specifically among pension providers. Access to information on dashboards may trigger increased consumer engagement. This could drive effective competition and innovation by increasing pressure on providers and advisers to ensure their products and services offer value for money and meet consumers’ needs and demands. Secondary international competitiveness and growth objective 1.15 Our framework of rules is designed to allow firms to compete, primarily based on how effectively they innovate to provide post-view services (PVS), as well as the quality (and, where applicable, the cost) of those services. In turn, these forces may contribute to the ability of firms that operate PDS to drive sustainable economic growth and facilitate the international competitiveness of the UK economy. Some industry participants have indicated they expect their PDS to be a loss leader, but to still be important in supporting their customers’ needs. Where use of pensions dashboards leads to greater pensions engagement, PDS also have the potential to increase effective competition in adjacent markets, specifically among pension providers and firms offering advice, guidance and, in time, any alternative support that the Advice Guidance Boundary Review (AGBR) might make permissible. 1.16 Addressing the consultation responses and revising our rules to make sure firms are aware of the considerable design choice and flexibility they offer, shows our commitment to ensuring our rules are proportionate. What we are changing 1.17 Pensions dashboards will have the potential to reconnect savers with an estimated £31.1 billion in lost pension pots, and to improve consumers’ ability to engage with pensions which, in turn, may lead to better retirement outcomes. 1.18 However, the fact that consumers will have easy digital access to this information could also make users vulnerable to harms – such as becoming the target of scams, data misuse or pressure selling. Consumers also face a risk of poor outcomes if they make uninformed, irreversible pension decisions based on dashboard data alone without seeking further information, guidance or advice. 1.19 PDS firms may also have commercial incentives to exploit an imbalance in knowledge and information, consumer trust and consumer biases. 1.20 Against this backdrop, our final framework of rules has broadly 2 categories: • The high standards we expect of all FCA regulated financial services firms. Firms that are already FCA authorised will be familiar with these expectations and how they apply in other parts of their business (Chapters 2 and 5). These bring PDS

9 firms in scope of our Principles for Businesses (including the Consumer Duty), Perimeter Guidance, Systems and Controls, complaint handling rules and Fees Manual. • Requirements that are specific to firms operating a PDS that are intended to balance risks and opportunities: – Measures that are principally designed to protect PDS users from harm – ‘consumer protection’ (Chapter 3). These include disclosure requirements, marketing restrictions, scam prevention measures and prudential requirements. – Measures that primarily support users to understand and engage with their pensions dashboard ‘view data’ – ‘enabling engagement’ (Chapter 4). Our choice architecture rules, requiring PDS firms to present next step choices and exit communications to consumers, are designed to a) put the consumer in control of the steps they take in and beyond their dashboard journey, b) understand the difference between the digital environments they are navigating and c) take appropriate care when viewing content outside the regulated dashboard. Our rules on PVSs enable PDS firms to offer its customers additional information, education and guidance which meet the needs of its target market. Each PDS firm’s PVS will be in addition to the routes to MoneyHelper guidance and regulated investment advisers that the choice architecture provides. Outcome we are seeking 1.21 We want PDS to be platforms where consumers can confidently and positively engage with their pensions and be safely supported in retirement planning. 1.22 If consumers lose confidence in dashboards, due to firms not acting in consumers’ best interests, we risk losing the opportunities dashboards offer and the ability to build on this in the future. So, it is important that our framework has adequate safeguards to limit these risks from the start. 1.23 However, if our standards are too stringent, we may prevent desirable innovation that helps consumers and deter reputable firms from entering the market. In turn, this could limit opportunities for consumers to meaningfully engage with their pensions. 1.24 We consider our framework of rules is proportionate for the first iteration of dashboards. But we also see the potential for dashboards to develop into, or contribute to, something more sophisticated over time. We also recognise there are cross-cutting regulatory developments in train across both the FCA and Government that could change the landscape in which pensions dashboard services operate. 1.25 In that context we need to explore the important and complex question of whether, how and in what circumstances dashboard data might enable consumers to access mass-market support outside the dashboard. We intend to use the AGBR to start that conversation.

10 Measuring success 1.26 To assess the extent to which private sector dashboards are delivering on the Government’s expectation that they will extend the reach of dashboards and reunite consumers with lost pots, we will monitor a) the number of dashboards that are authorised; b) the number of users per dashboard; and c) the number of lost pots (according to the Pensions Policy Institute’s biennial survey). 1.27 Early indicators that our framework is working as intended and driving the desired outcomes include multiple firms progressing through the gateway and gaining the permission, as well as permission being denied to firms that cannot meet our expectations. 1.28 The extent to which firms are developing innovative PVSs that meet target markets’ needs will be evidenced when firms submit their applications for authorisation and the new permission. After a suitable period of operation, we will gather data from firms to understand whether consumers are using these services. We will also look to other sources such as the Financial Lives Survey to understand the extent to which the launch of dashboards is changing consumers’ knowledge and engagement around pensions. 1.29 After a suitable period of operation, we may also gather data from firms about consumers’ next steps when presented with the choice architecture. This would offer insight into whether consumers go on to pursue advice or guidance after using the dashboard. 1.30 As part of the FCA’s Rule Review Framework, we are providing an additional way for stakeholders to give evidence where they feel that our rules are not achieving their intended outcomes, as set out above, once implemented. You can do this using our online stakeholder feedback form. Summary of feedback and our response 1.31 We received 33 formal responses to CP22/25 and 23 responses to CP24/4. These came from a broad range of respondents, including consumer groups, industry representatives, pension providers, Master Trusts and fintech companies. We are grateful to all respondents for their valuable feedback. 1.32 In this paper we do not include or address the feedback we received about matters outside our remit. For example, decisions taken and requirements introduced by the Government and PDP, the design and operation of components of MaPS’ digital architecture and the timing and content of MaPS standards. We shared the appropriate elements of this feedback with the relevant delivery partners. 1.33 Most respondents to our Consultation Papers understood the aims and rationale for our proposals. The vast majority supported our proposal to apply key existing elements of the FCA Handbook to firms operating a PDS. So, as discussed in Chapters 2 and 3, our final rules adopt those consultation proposals largely unchanged. 1.34 Our proposed conduct standards for PDS firms attracted more mixed responses (discussed in Chapters 4 and 5). Consumer representatives were broadly supportive

11 of the measures we proposed, but some industry respondents suggested that certain elements of our proposals were too prescriptive and/or too restrictive. 1.35 Operating a PDS is an entirely new activity and establishing consumer confidence and trust in the service is critical to the success and longevity of the initiative. The core expectations set within the rules are however calibrated to the potential risks that PDS firms present to our strategic objective that markets function well. We recognise the need for balance, and we have redrafted some of the rules to ensure firms are better able to see the considerable design choice and flexibility they offer. The Consumer Duty obligations will help ensure that the way the firm implements our rules delivers good outcomes for consumers. 1.36 Many industry respondents, particularly those that wish to become PDS operators, considered our proposed Pensions Dashboard Code of Business Sourcebook (PDCOB) rules to be too restrictive. They claim that dashboards will be of limited use to consumers in the absence of: • transaction capability • ability to export data outside the PDS 1.37 The Government has committed that dashboards will not be transactional. But, we consider that PDS firms which operate in these parameters can deliver considerable benefits for consumers: • reuniting consumers with lost or forgotten pension pots • removing the difficulties and frustrations of finding information about each pension • enabling consumers to see the basic information without which it is difficult to engage further 1.38 We also consider that PDS firms have scope to add value to dashboard users’ experience by offering PVS. These services (which cannot be an offer to sell or a personal recommendation to transact) could span the spectrum of information, education and guidance and could be delivered in a range of ways, including for example factsheets, explainer videos or simple calculators. PDS firms must carefully consider what PVS are necessary to fulfil Consumer Duty obligations to their dashboard target market and will be required to show this at the gateway alongside evidence of user testing. Providing such PVS in a non-transactional space could overcome two known barriers to engagement: lack of pensions knowledge and risk aversion (where fear of making a mistake inhibits engagement). 1.39 Our final rules adopt the PDCOB proposals in CP22/25 as modified by CP22/24, with some amendments to clarify our intent where respondents had interpreted our requirements as more restrictive or prescriptive than we intended them to be. For example, we have revised our rules on exit communications to address the misapprehension that they required a detailed description of regulatory environments. 1.40 Both consultations included a Cost Benefit Analysis (CBA). The CBAs adopted a largely narrative approach to reflect that:

12 • operating a PDS is a new activity and no firm is currently offering this service • our rules offer firms design discretion 1.41 We received only minor comments on our CBA and they reflected whether the respondents considered our proposed rules appropriate. Chapters 2 to 5 of this paper address the respondents’ views on our proposals. The changes to our final rules discussed in this Policy Statement do not materially affect our assessment of costs. 1.42 PDS firms will incur other costs not accounted for in either CBA. This is because they are the initial and ongoing costs that arise from complying with obligations in the Department for Work and Pensions’ (DWP) regulations, PDP’s standards and other relevant legal requirements, such as the UK General Data Protection Regulations (GDPR) – i.e., requirements that are not the FCA’s responsibility. The Government published its Regulatory Impact Assessment in October 2022. Equality and diversity considerations 1.43 We recognise that not all consumers will benefit from pensions dashboards equally. Digitally-excluded consumers will not be able to access a PDS without support and those who have started to access 1 or more of their pensions, most of whom will be 55 or over, will not see all of their pensions on dashboards. These are not consequences of the finalised FCA rules but rather of the Government’s wider policy initiative. There are currently alternative avenues for individuals, including those with protected characteristics and characteristics of vulnerability, to request information about their pensions directly from their providers. 1.44 We do not consider that our framework for PDS firms negatively impacts any of the groups with protected characteristics under the Equality Act 2010. Our rules will operate alongside the Consumer Duty, which requires firms to consider the wide range of needs within their target market, including those with characteristics of vulnerability. Further information is available in our guidance for firms on the fair treatment of vulnerable customers (FG21/1) and the guidance for firms on the Consumer Duty (FG22/5). Environmental, social & governance considerations 1.45 In developing this Policy Statement, we have considered the environmental, social and governance (ESG) implications of our proposals. We have also considered our duty under ss.1B(5) and 3B(c) of the Financial Services and Markets Act 2000 (FSMA) to have regard to contributing towards the Secretary of State achieving compliance with the net-zero emissions target under section 1 of the Climate Change Act 2008 and environmental targets [under s. 5 of the Environment Act 2021]. Overall, we do not consider that the framework for PDS firms is relevant to contributing to those targets.

13 The Consumer Duty 1.46 The Consumer Duty requires firms to act to deliver good outcomes for retail customers. As dashboard users will be retail customers, all PDS firms will need to comply with requirements under the Duty. 1.47 The Duty requires firms to act in good faith, to avoid causing foreseeable harm and to enable and support retail customers to pursue their financial objectives. 1.48 All PDS firms will also have to comply with the rules for the 4 outcomes we want to see under the Duty. These represent key elements of the firm-customer relationship which are vital in helping to drive good outcomes for customers. The outcomes apply to products and services, price and value, consumer understanding and consumer support. PDS firms should familiarise themselves with our expectations of firms under the Duty. Where applicable, our final rules contain guidance provisions to remind PDS firms of this and, where relevant, we discuss the interaction between our rules and the Duty throughout this Policy Statement. Next steps 1.49 Although we are finalising our rules, we are not yet opening the gateway to receive applications for authorisation and variation of permission. We will open the gateway only when it is possible for a firm to show that it is ready, willing and organised to undertake the new activity of operating a PDS. This means we will open the gateway when the Government and PDP have produced all the information necessary for a firm to design and build a PDS. 1.50 We will give industry adequate advance notice of the gateway opening, accompanied by the finalised application forms. For reference in the interim, firms can continue to consult the draft forms that were appended to CP22/25. However, those forms are illustrative only and are not definitive.

14 Chapter 2 The core framework 2.1 The FCA Handbook sets out rules and guidance we have made under powers given to us by the Financial Services and Markets Act 2000 (FSMA). The Handbook is divided into blocks and then sourcebooks which we refer to in this consultation with acronyms (for example, ‘PRIN’ and ‘SYSC’). For more information on the Handbook, please see our Handbook Readers Guide. 2.2 This chapter summarises feedback we received about how we proposed to apply and revise existing sourcebooks for firms operating pensions dashboard services (PDS). These proposed core elements help firms determine whether they need the new permission and, for those that do, explain how the minimum high standards we expect of all FCA regulated firms will apply to them. 2.3 It summarises feedback on our proposals for the Perimeter Guidance, high-level standards (including the application Senior Managers and Certification Regime) and dispute resolution (complaints and redress). It also sets out our response to the feedback and confirms our final rules, as set out in the instrument. Perimeter guidance sourcebook 2.4 In February 2024, the Government amended legislation to bring the activity of operating a PDS into FCA regulation: Article 89BA of the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 defines this new regulated activity as ‘operating a pensions dashboard service which connects to the Money and Pensions Service (MaPS) dashboards digital architecture’. 2.5 This means that firms wanting to carry out the activity of ‘operating a pensions dashboard service’ must be or must become FCA authorised, get the regulatory Outside the PDS Wider PDS: beyond view data Core PDS: find and view

15 permission to carry out this specific activity and adhere to the FCA Handbook requirements that apply to firms that operate a PDS (PDS firms). 2.6 In CP24/4, we consulted on Perimeter Guidance (PERG) to help firms understand the scope of the new activity and the circumstances in which a party will need our authorisation (or a variation of permission, where applicable). The perimeter guidance we proposed was designed to provide guidance particularly where a firm intends to use services from other parties to develop or operate part of the PDS. It set out that a party will be carrying out the regulated activity of operating a PDS if they have control over the dashboard service provided to consumers. Feedback received 2.7 Respondents who commented on this proposal welcomed the guidance, noting it was clear and sufficient for its intended purpose. Our response Our final rules adopt the perimeter guidance largely unchanged from the consultation draft. We are satisfied from the responses to CP24/4 that the guidance clarifies the scope of the regulated activity (and consequently the application of our rules for firms performing the regulated activity). Particularly as many of the respondents that welcomed the guidance in CP24/4 had, in their earlier responses to CP22/25 sought clarity on whether, how and to whom certain proposals would apply, in outsourcing and third-party dashboard arrangements (see Chapter 3). We are confirming this guidance as final to help ensure an effective and efficient authorisations assessment process when the gateway opens. This will ensure that fewer applications are rejected, withdrawn, refused or delayed for want of further information or legal advice to establish if any of the parties involved should be authorised. High-level standards block 2.8 Some of the high-level standards in the FCA Handbook apply to all FCA regulated firms. So, the Principles for Businesses (PRIN), Threshold Conditions (COND) and General Provisions (GEN) will apply to all PDS firms. 2.9 There are other high-level standards where the application of the sourcebook depends on the activities a firm carries out and any other permissions it holds: Senior Management Arrangements, Systems and Controls 2.10 In CP22/25 we proposed that the application of the Systems and Controls sourcebook (SYSC) to a PDS firm will depend on the activities that firm carries out and the permissions it holds. SYSC 23 explains the SM&CR regime, defines which firms the

16 SM&CR regime applies to, defines the different kinds of SM&CR firms, and signposts the relevant Handbook provisions for each type of SM&CR firm. 2.11 We proposed that: • A firm which only holds the permission to carry on the PDS activity (and, where applicable, the permission for agreeing to carry on the PDS activity and the proposed limited version of the making arrangements permission that would apply in relation to the post-view services (PVS)) will be classed as a Limited Scope firm under the Senior Managers and Certification Regime (SM&CR) (see Chapter 3). • A firm that is currently a Limited Scope firm and varies its permission to add the new permission to offer PDSs will become a Core SM&CR firm. If a firm is already a Core or Enhanced SM&CR firm because of the other regulated activities it performs, the addition of the permission to operate a PDS will not change its current classification. We proposed that these firms should follow the appropriate application of SYSC for Core or Enhanced firms. For example, we proposed that a firm that is an insurer and holds the PDS permission will continue to follow SYSC as it applies to insurers. 2.12 In addition, we proposed a new rule in SYSC 4 for all PDS firms. SYSC 4.1.5AR will require these PDS firms to establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information. We proposed that PDS firms must keep records of their systems and procedures to document compliance with this requirement. For more information on our approach to supervision, including reporting and recordkeeping requirements, see Chapter 5. 2.13 We also proposed that PDS firms should notify us immediately in the event of an incident which may compromise the security, integrity and confidentiality of any personal or pensions information held by the PDS firm. Further details are in Chapter 5 of this Policy Statement. 2.14 In CP22/25, we asked: Question: Do you agree with the way in which we propose to apply the Senior Management Arrangements, Systems and Controls (SYSC) sourcebook to pensions dashboard service (PDS) firms? Feedback received 2.15 Respondents to this question supported our proposals, but 2 sought clarity on whether, how and to whom SYSC would apply where a firm uses services from other parties to develop or operate part of the PDS. Our response Our final rules apply SYSC to PDS firms as in the consultation drafts. We consider that adding PERG 12A to our Perimeter Guidance will enable PDS firms (including those who use services from other parties to develop or operate part of the PDS) to clearly identify their status under SYSC and determine their responsibilities accordingly.

17 The rules and guidance in SYSC describe what we expect from firms that comply with Principle 3 (‘A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems’). It is appropriate that PDS firms should be subject to those same expectations. Those in charge of the firm should take responsibility for how it carries on its business. This includes conducting its affairs responsibly and acting in a way that enables us to monitor its business properly. Our requirement that PDS firms establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, is separate from any requirements placed on PDS firms by PDP’s security standards (within the code of connection). SYSC 4.1.5AR relates to a PDS firm’s systems, while PDP’s standards place requirements on interfaces to the ecosystem and data moving within the ecosystem. Senior Managers & Certification Regime 2.16 In CP22/25, we proposed that the following elements of the Senior Managers & Certification Regime (SM&CR) will apply to the Limited Scope PDS-only firms that have no other regulatory permissions. • The Senior Managers Regime – these rules relate to individuals in certain senior roles (Senior Managers). • Certification Regime – these rules apply to an individual whose job meets the definition of being a ‘Certification Function’. • Conduct Rules – these high-level standards of behaviour set out in the Code of Conduct Sourcebook (COCON) will apply to almost all employees in a PDS firm, except for ancillary staff. Additional Conduct Rules apply to Senior Managers. 2.17 We also proposed: • to require Limited Scope PDS-only firms to allocate the Limited Scope Function (SMF29) to a Senior Manager • that the relevant Certification Functions for firms which only hold the PDS permission would be a) the significant management function; and b) Manager of certification employees - anyone who supervises or manages a certification employee (directly or indirectly), but who is not a Senior Manager • that PDS firms (including Limited Scope PDS firms) will need to ensure that anyone performing a Senior Manager Function (SMF) or a ‘Certification Function’ is fit and proper to do so (assessed on an ongoing basis and at least once a year). 2.18 We explained that COCON will apply to all PDS firms. These apply to all other authorised firms subject to the SM&CR. These are rules that relate to the conduct of certain persons working in firms. Full details are in COCON 1.1. 2.19 In CP22/25, we asked:

18 Question: Do you agree with our proposal to apply the Senior Managers and Certification Regime (SM&CR) to PDS firms? Question: Do you agree with our proposals to treat PDS only firms (firms that have no other regulatory permissions) as Limited Scope firms? Question: Are there any provisions within Senior Managers and Certification Regime (SM&CR), including the Fit and Proper test for Employees and Senior Personnel (FIT) and Code of Conduct (COCON), that apply to most firms but should not apply to PDS firms? Feedback received 2.20 Almost all respondents to these questions supported our proposals, agreeing that PDS firms should be regulated to the same high standards as other FCA regulated firms and activities. 2.21 Two respondents sought clarity on whether, how and to whom SM&CR would apply where a firm uses services from other parties to develop or operate part of the PDS – they argued that the SM&CR should not extend to those other parties. 2.22 One respondent argued that the SMF29 function is not sufficient for a Limited Scope PDS-only firm and that we should require PDS firms to allocate the Compliance Oversight Function (SMF16) to a Senior Manager. Our response Our final rules adopt the SM&CR approach we proposed in CP22/25. Each firm is responsible for determining which SM&CR category it falls into, based on the rules. It is important that they make sure they are correctly categorised, as their category determines how the SM&CR applies. We consider that PERG 12A will better enable PDS firms to clearly identify the obligations that apply to them under SM&CR. The requirements of the SM&CR span multiple sourcebooks: SYSC 23.3 lists the rules that apply and where they can be found in the Handbook. Firms should consult these rules and relevant guides. Limited scope firms are exempt from some requirements and will typically have fewer Senior Management Functions. More information is in section 6 of the SM&CR Guide for solo-regulated firms. In the case of a Limited Scope PDS-only firm, the holder of the SMF29 function is responsible for: • ensuring that significant business responsibilities are clearly and appropriately divided among the directors and Senior Managers of the firm • overseeing the putting in place and maintenance of systems and controls

19 It is the responsibility of the SMF29 to ensure there is a person(s) responsible for overseeing compliance with FCA rules. Our rules do not require, however, that the person(s) be approved by the FCA to hold that function. We consider this approach proportionate for a Limited Scope PDS-only firm that is operating a non-transactional service. We cannot predict how many applicants for the new permission will be Limited Scope PDS-only firms. Of the CP24/4 respondents who indicated an interest in becoming a PDS, all but one were already FCA regulated for one or more other FCA regulated activity and so would become or remain either Core or Enhanced firms if their application for the new permission is successful. Firms may choose to be categorised in the Enhanced or Core regime (‘opt up’), even if they are not categorised in that regime under our rules. A firm does not need any particular reason to opt up. But we might see this where, for example, a Core firm is a subsidiary of an Enhanced firm and they want the SM&CR to apply consistently across both entities. Opting up will result in a firm being subject to the requirements of the higher category; the firm cannot be selective about which requirements will apply. For instance, a Core firm that has opted up to Enhanced would be treated in the same way as a firm that is classified as Enhanced under the rules. The Fit and Proper test for Employees and Senior Personnel (FIT) sourcebook sets out the factors that firms should look at when assessing Senior Management Functions (SMFs) and Certification Staff as fit and proper. This includes factors like a person’s honesty, integrity and reputation, their competence and capability and their financial soundness. Firms can extend similar fitness and propriety assessments to individuals who are outside the Certification Regime on a voluntary basis. The COCON chapter of our Handbook aims to create and maintain high standards of individual behaviour in regulated firms, and individual accountability and awareness of conduct issues. PDS firms will need to train individuals who are subject to the Conduct Rules on how the rules apply to them. A PDS firm must notify us if it takes disciplinary action against someone subject to Conduct Rules if the reason for the disciplinary action also amounts to a Conduct Rule breach (see COCON 4). Fees manual 2.23 In CP22/25, we set out our proposals for recovering the costs of introducing the new regulated activity and supervising PDS firms through application fees and periodic (annual) fees. • Application fee: We proposed a category 5 application fee for PDS firms (£5,000 at the time CP22/25 was published) to cover both the costs of processing their applications and a fair and proportionate contribution to the recovery of our project costs.

20 • Periodic (annual) fees: We proposed to create a new fee block (A.24 at the time CP22/25 was published) for PDS firms and a flat-rate fee of £10,000 to cover our average supervisory costs per firm. 2.24 We asked: Question: Do you agree with our proposed approach to fees for PDS firms? Feedback received 2.25 All respondents to this question supported our proposed approach to fees and did not consider it a disproportionate barrier to entry. 2.26 One respondent suggested that an income-driven tariff measure could be adopted where a PDS firm charges dashboard users to use post-view services (see Chapter 4). 2.27 One trade association asked whether we expect the proposed fees to be adequate to cover the additional cost of regulating PDS firms. Our response: Our final rules adopt the approach to fees that we proposed in CP22/25. PDS firms will be required to pay the relevant category 5 fee at the date on which the firm submits its authorisation application. At the time of consultation, category 5 had a £5,000 fee. In July 2024, this fee increased to £5,440. The fees in most periodic fee blocks are graded according to the size of the feepayers, using a metric known as a tariff measure. The most common tariff measure is the firm’s income from regulated activities. This makes the largest firms pay the highest fees. The FSMA fee blocks are defined in FEES 4 Annex 1A and the current fee rates are in FEES 4 Annex 2A. The DWP regulations do not allow PDS firms to charge customers to use the core dashboard, and we don’t yet know whether firms will charge for post-view services and, if so, whether that income would be a sustainable tariff measure for this new fee block. So, at this initial stage, we do not consider income an appropriate tariff measure to scale the periodic fees for the new fee block, now A.25. We will, however, keep the flat-rate fee approach and level under review as the market develops. Dispute Resolution 2.28 In CP22/25, we proposed to apply our Dispute Resolution: Complaints sourcebook (DISP) to PDS firms. DISP covers how firms should handle complaints and how the Financial Ombudsman Service (the Financial Ombudsman) considers complaints.

21 2.29 We proposed to bring PDS firms carrying on business in the UK within the Financial Ombudsman’s compulsory jurisdiction (CJ). We also jointly consulted with the Financial Ombudsman on amendments to the voluntary jurisdiction (VJ) rules, guidance and standard terms to make clear that activities relating to pensions dashboards are not covered by the VJ. 2.30 We proposed to enable the Financial Ombudsman to have the power to make any of the below awards (as appropriate) if a complaint is upheld against a PDS firm: • a money award against the respondent • an interest award against the respondent • a costs award against the respondent • a direction to the respondent 2.31 In CP22/25, we asked: Question: Do you agree with our proposals to apply our complaint handling rules and guidance in the Dispute Resolution: Complaints Sourcebook (DISP), including the compulsory jurisdiction of the Financial Ombudsman Service, to PDS firms? Question: Do you agree with the Financial Ombudsman Service’s proposals to exclude activities relating to pensions dashboard services from the voluntary jurisdiction? Question: Do you agree with our approach to redress? Feedback received 2.32 Most respondents agreed that PDS firms should have a responsibility to handle complaints about its acts and omissions, and that dashboard users should have recourse to the Financial Ombudsman under the CJ (but not the VJ). 2.33 However, a small number of respondents appeared unclear about what types of complaints would be in scope of this proposal. They noted that a consumer’s complaint might not relate to the actions of the PDS firm, but might be about the data provided by a pension scheme or provider, or the consumer’s experience of the ID verification service, for example. For the same reason, other respondents noted that it would be difficult for the consumer to identify to who they should complain to. 2.34 One respondent suggested that we clarify what a PDS firm should do when it receives a complaint that’s not about the PDS. Our response Our final rules adopt the approach to redress we proposed in CP22/25. DISP will apply to PDS firms, requiring them to handle complaints about their acts and omissions in their capacity as PDS firms. PDS users will also

22 have recourse to the Financial Ombudsman under the CJ (but not the VJ) if the PDS firm does not address their complaint satisfactorily or in the specified timeframe. DISP applies separately and in addition to Regulation 11 of the Pensions Dashboards Regulations 2022. This requires PDS firms to provide a link to the central complaints process, which will be hosted and operated by MaPS. The central complaints process will help consumers identify who it is likely they should complain to in the first instance, recognising that it may be difficult for the consumer to identify this independently. The PDP will provide more information about the central complaints process in due course. Further, DISP 1.7 will require PDS firms to forward complaints to the responsible party, if they consider another firm is solely or jointly responsible for the matter being complained about. Complaints reporting 2.35 We proposed minor amendments to DISP 1 Annex 1R to require PDS firms to submit complaints data to us. 2.36 In CP22/25, we asked: Question: Do you agree with our complaints reporting proposals for PDS firms? Feedback received 2.37 One respondent sought clarity as to which type of complaints should be reported, another suggested it would be difficult for PDS firms to separately identify complaints against the PDS firm from complaints that might concern the actions of others in the ecosystem. Our response Our final rules adopt our complaints reporting proposals in CP22/25. They require firms to periodically report to the FCA the volume of complaints received and closed which concern the firm’s PDS business. Funding the Financial Ombudsman 2.38 The Financial Ombudsman is currently funded through a combination of a general levy on firms in the compulsory jurisdiction, a levy on participants in the voluntary jurisdiction (where applicable) and a fee per case. 2.39 We charge and collect the general levy on behalf of the Financial Ombudsman. We allocate the levy between our industry blocks, based on the Financial Ombudsman’s projections of where its caseload will come from in the year ahead.

23 2.40 To ensure that PDS firms contribute appropriately to the funding of the Financial Ombudsman via the general levy, in CP22/25 we proposed to add a new industry funding block for PDS firms to FEES 5 Annex 1R. We proposed that the tariff base should be a fixed fee of £65. 2.41 In CP22/25, we asked: Question: Do you agree with our approach to the Financial Ombudsman Service’s fees and levy? Feedback received 2.42 All respondents to this question agreed our approach to the Financial Ombudsman’s fees and levy appears reasonable. A very small number of respondents suggested we should keep our approach under review. Our response Our final rules adopt the approach we consulted on in CP22/25. We will, however, keep the fixed-fee approach and level under review as the market develops.

24 Chapter 3 Conduct Standards – consumer protection 3.1 In CP22/25, we proposed to introduce a new sourcebook to the FCA Handbook. This contains rules that exclusively apply to firms operating a pensions dashboard service (PDS). The content of Pensions Dashboards: Conduct of Business sourcebook (PDCOB) falls into 2 broad categories: • measures that are principally designed to protect PDS users from harm – consumer protection. • measures that primarily support users to understand and engage with their pensions dashboard ‘view data’ – enabling engagement. 3.2 This chapter summarises feedback on the ‘consumer protection’ PDCOB proposals and our response. It also confirms our final rules, as set out in the PDCOB sourcebook of the instrument. General conduct of business rules Our proposals 3.3 In common with our regulatory approach to other financial services markets, in CP22/25 we proposed that PDS firms: • must act honestly, fairly and professionally in line with the best interests of their customers • cannot seek to exclude or restrict any duty or liability to a customer, unless the duty or liability arises other than under our regulatory system and it is reasonable to do so Outside the PDS Wider PDS: beyond view data Core PDS: find and view

25 • cannot accept payments or non-monetary benefits which would conflict with the firm’s duty to act in the customer’s best interests • cannot charge customers (or enter agreements where a charge is, or may become, payable) for data export and post-view services unless the customer has actively opted-in 3.4 In CP22/25, we asked: Question: Do you agree with our proposals on general conduct of business rules? Feedback received 3.5 Most respondents that commented on this question agreed with our proposals. Two industry respondents suggested that our data export and post-view services proposals (see Chapter 4 of this PS) which they consider too restrictive, prevent PDS firms from acting in dashboard users’ best interests. Our response Having considered feedback, we intend to proceed with the general conduct of business rules as consulted on in CP22/25. These requirements set important overarching principles that PDS firms should operate within. Our final general conduct of business rules are in PDCOB 2-4 of the instrument. We discuss data export and post-view services in Chapter 4 of this Policy Statement. However, our general conduct requirements, including the requirement to act in a customer’s best interests, are set against the backdrop of the Government’s commitment that pensions dashboards will not be able to offer any functionality which enables transactions, such as consolidating pension pots or transferring pensions. Disclosures and warnings Our proposals 3.6 In CP22/25, we proposed that PDS firms must display certain disclosures, warnings and explanations to its dashboard users. The proposals, as modified in the draft rules in CP24/4, require firms to communicate information about: • the firm and its dashboard service: so that the user can identify the person authorised as the PDS firm, the nature of the service the PDS firm can provide, and whether a charge may be applicable for any element of that service • ‘view data’: so that a user is aware of the limitations of ‘view data’

26 • decision-making: so that the consumer is discouraged from making decisions based on ‘view data’ alone 3.7 These proposals complement but are distinct from the obligations in the Pension Dashboard Programme’s (PDP) Design Standards concerning the presentation of ‘view data’. ‘View data’ is prescribed by the Pensions Dashboards Regulations 2022 and includes administrative data, signposting information, values (accrued and projected) and contextual data. 3.8 In CP22/25 we asked: Question: Do you agree with our proposals on disclosures, signposts and warnings? Question: We want disclosures, signposts and warnings to be displayed at the most important moment for consumers. Do you have any evidence as to when PDS firms should communicate these disclosures, signposts and warnings? Feedback received 3.9 Both industry and consumer group respondents broadly agreed that disclosures and warnings within the consumer journey were necessary to support users’ understanding and expectations of the dashboard service and the information it provides. 3.10 There was also broad agreement in allowing firms flexibility to determine how to deliver this information in the most engaging way and that communications should be informed by firms’ obligations under the Consumer Duty, with user testing and adapting where appropriate. 3.11 Eight industry respondents expressed concern that requiring too many warnings to be displayed too frequently would put the consumer at risk of information overload. They argued that this could cause consumers to ignore the disclosures, which would undermine their effectiveness, or create a cumbersome or poor user experience. Alternatives that were suggested included providing disclosures once at the beginning of the consumer journey, with targeted warnings at relevant points and giving greater prominence to warnings they considered more important. 3.12 Three respondents suggested our proposals on the volume, frequency and timing of disclosures and warnings should be informed by user testing to ensure these are effective and at the right points in the consumer journey. One respondent suggested PDS firms should be required to user test all warnings to ensure consumers understand them and avoid information overload. 3.13 A small number of respondents urged us to work closely with PDP on a single set of requirements to ensure that the FCA rules and PDP Design Standards do not duplicate, contradict or omit important disclosure requirements. One respondent suggested our rules should refer to the Design Standards or use the same wording to avoid confusion.

27 3.14 Six respondents made suggestions about the format, design and presentation of the disclosures and warnings, including that they: • should be informed by research or proven methodologies to make sure they are communicated effectively and consistently • should be available as a text-only option so consumers can view this with low data on a device or without any sound • shouldn’t be presented as ‘Terms and Conditions’ style warnings but as educational material or instructions. 3.15 Three industry respondents were concerned that the warnings might cause the consumer not to trust or see the data as valuable and that this may discourage them from engaging further with the data. One of the three suggested that instead of dissuading consumers from making decisions based on view data alone, a user should be encouraged to seek advice first. 3.16 On the other hand, some respondents called for us to add further warnings and disclosures: • About the firm and its dashboard service: One respondent suggested PDS firms should give a clearer explanation of the difference between a PDS and other kinds of pension services, dashboards or pension finder services. They argued that without this, consumers may not understand what this new service is or realise that it’s the same service as MoneyHelper’s dashboard provided by a private sector firm. • About ‘view data’: a small number of respondents suggested additional warnings be included: – about the limitations of defined benefit entitlements that may be inferred from view data – that the estimated retirement income is not guaranteed or intended to be a tailored or accurate estimate – about the effect of inflation and loss of purchasing power over time – making users aware that data supplied by the pensions scheme could be wrong and so ‘cannot be relied upon’ • About decision-making and further sources of information and support: One respondent suggested strengthening our warning dissuading consumers from making decisions based on dashboard data alone by instead telling users that they ‘must not’ make decisions based on limited dashboard data. 3.17 In this paper we do not address respondents’ comments concerning PDP’s design standards or the Pensions Dashboards Regulations 2022, as they are outside the scope of our framework. We notified PDP and The Department for Work and Pensions (DWP) about these comments. Our response Having considered the feedback on both CP22/25 and CP24/4, we remain of the view that it is necessary for PDS firms to display certain disclosures and warnings to the user, in order to:

28 • manage their expectations of the PDS, • make them aware of the limitations of the data provided about their pensions and • ensure informed decision-making The Government acknowledged in its 2022 consultation, that ‘for initial dashboards at least, the information provided will be high-level, and certainly insufficient for decision-making around transactions’. So, we continue to consider it appropriate to: • Require firms to display a warning that consumers should not make financial decisions based on dashboard data alone. This warning should be given each time a customer is provided with view services, PVS and when data is being exported to the consumer. • Enable consumers to identify where and how they can access impartial guidance from MoneyHelper and find a regulated financial adviser that can offer a holistic personal recommendation. Our choice architecture rules (see Chapter 4) fulfil this aim and supersede the signposting requirement we previously consulted on. Our final rules (set out in PDCOBS 5) require disclosures at the ‘view data’ stage to communicate that: • Values are supplied for illustrative purposes. Actual values could be higher or lower. • Assumptions have been used to estimate projected values. The projected values are not guaranteed.  Actual values at retirement may be influenced by changes in investment performance, contributions made and the date the saver decides to take their pension. • All values are shown before tax. • The saver can contact their pension provider or scheme admin for more up-to-date pension values, and any further details. • Some pensions may not be displayed on a dashboard. For example, if the saver has started taking their benefits. Our rules setting out when these warnings and disclosures should be displayed are necessary to moderate consumers’ expectations and most effectively communicate limitations or risks at relevant points in the consumer journey. PDS firms can determine the most appropriate time to provide the warnings and disclosures, so long as they are provided by the points set out in the rules. Our rules also give firms discretion to determine the most effective and engaging way to present these disclosures and warnings, according to the style and design of their PDS and the needs of their target market. Having considered feedback on the number and frequency of the disclosures PDS firms must display, we remain of the view that our final requirements are proportionate. Our final disclosure and warning rules are intended to complement and supplement the obligations in PDP’s Design Standards. An initial draft of PDP’s Design Standards was published in November 2022 and set out a)

29 how a PDS firm must structure the display of view data to the user and b) the requirements relating to this display to ensure it is engaging, clear, accessible and inclusive. We will continue to work closely with PDP as it develops the next iteration of Design Standards to ensure compatibility of our approaches. We consider user testing of our requirements by the FCA would have limited value as our rules give PDS firms flexibility to determine the language, design, format and mechanism for delivering these communications. This means PDS firms can develop and test their communications in line with the needs of their target markets, within the parameters set by PDCOB 4 and Consumer Duty obligations: • PDCOB 4 - the general rules that apply to all PDS communications: – the fair, clear and not misleading rule – additional requirements including comprehensibility, prominence and notification of changes – additional requirements for content to be balanced with appropriate warnings • Consumer Duty obligations: we want PDS firms’ communications to meet the information needs of the target market, including those of any customers with characteristics of vulnerability. The Duty’s consumer understanding outcome requires firms to communicate with consumers in a way that is likely to be understood and equips them to make effective, timely and properly informed decisions. To show they have acted to deliver this outcome, PDS firms need to monitor, test and adapt their communications, where appropriate. We consider our PDCOB requirements alongside the Consumer Duty are sufficient to ensure effective communication of disclosures and warning. We do not think the rules need to be more specific in terms of the language, design, format and location of communications. When multiple parties contribute to bringing a dashboard service to market Our proposals 3.18 In CP22/25 we proposed additional rules and guidance that would apply when PDS firms: • outsource certain elements of a PDS to another entity • enter third-party dashboard arrangements 3.19 These proposals were designed to prevent regulatory arbitrage and to make sure that the consumer is no less protected if more than 1 party is involved in the dashboard that they use.

30 3.20 In CP22/25 we asked: Question: Do you agree with our approach to outsourcing? Question: Do you agree with our proposals relating to where third parties make dashboard services available? Feedback received 3.21 Stakeholder responses showed that many respondents misunderstood the concepts of outsourcing and third-party access arrangements as we set them out, and the difference between them. We clarified these concepts in CP 24/4. 3.22 Of those who understood the differences we intended to draw out, most agreed that PDS firms should take full responsibility for any arrangements outsourced to another party. Some respondents, including 1 consumer group, observed that enabling outsourcing arrangements would support PDS firms to take advantage of third-party technologies and expertise. 3.23 One trade association thought we had proposed new, bespoke and prescriptive outsourcing requirements. Based on this understanding, they cautioned that prescription could limit legitimate business models from emerging. 3.24 Some industry respondents contested our third-party access proposals – specifically our proposal to restrict data export and PVS to the PDS firm only. They argued that without these facilities, third-party access arrangements would not be viable alternatives for firms that cannot afford or resource the full regulated activity. 3.25 By contrast, consumer groups agreed that it is important that consumers are clearly and appropriately protected when using third-party services, especially where the third￾party is not FCA regulated. Our response The difference between outsourcing and third-party access arrangements ’Outsourcing’ is a term used to describe an arrangement of any form between a firm and a service provider by which that service provider performs a process, a service or an activity which would otherwise be undertaken by the firm itself. By contrast, ‘third-party dashboard arrangement’ is a new, dashboard-specific concept. It covers the scenario where a PDS operated by a PDS firm is made available exclusively to the employees, members or customers of a third-party (that does not hold the permission to operate a PDS). CP24/4 (paragraphs 3.8 to 3.15) gave an illustrative high-level example of each.

31 Outsourcing Third-party dashboard arrangement Firm A outsources the digital software that will connect to the Money and Pensions Service (MaPS) digital architecture to another party – Firm B. Firm B builds the digital software for this on behalf of Firm A and in line with Firm A’s instructions. Firm B can make further amends or technical support but only on instruction of Firm A. Firm A builds a PDS and connects to the MaPS digital architecture. Firm A has the FCA permission to operate a PDS (which means it showed at the authorisations gateway that it has control of the entire PDS). Firm A then enters an arrangement with Firm B to give Firm B’s members exclusive access to a PDS provided by Firm A. It is clear to Firm B’s members that the PDS is provided and operated by Firm A. CP24/4 explained that in both scenarios, it is unlikely Firm B is operating the dashboard if it does not: • have any authority over the PDS and cannot alter, edit or adapt the service, other than when acting under the instruction of the regulated PDS firm • have any responsibility for compliance with any of the requirements under the Pensions Dashboards Regulations 2022, PDP standards and the FCA Handbook rules and guidance • have the capability, under contract terms for example, to carry out activities or services to support the PDS, unless commissioned or instructed by the PDS firm to carry this out on their behalf PERG 12A explains that a party will be carrying out the regulated activity of operating a PDS if they have control over the dashboard service provided to consumers, which means that they: • accept responsibility for the PDS • have authority and discretion over how the dashboard service is run or managed Most CP24/4 respondents confirmed that the perimeter guidance proposals were sufficient and clear. We are satisfied that it has eliminated confusion between the concepts of outsourcing and third-party dashboard arrangements. As explained in Chapter 2, our final rules adopt the perimeter guidance we consulted on. Outsourcing CP22/25 did not propose new dashboard-only outsourcing rules. Rather, we proposed that PDS firms should be brought in scope of the outsourcing rules and guidance that already exist in the FCA Handbook, and which apply to other FCA authorised firms performing other regulated activities. We explained that, because of this approach, the

32 PDS firm will remain responsible for the compliance of its outsourced operations so should: • have sufficient oversight arrangements in place to be satisfied that all aspects of the outsourced function comply with the relevant regulatory requirements • take responsibility for managing risk arising from those outsourcing arrangements We do not consider this approach prevents credible business models emerging. We accept that some firms that wish to become PDS firms may need to outsource certain elements of the PDS. And we recognise that outsourcing these elements can bring cost savings, catalyse innovation and, in some cases, provide greater resilience than firms’ own technology infrastructure. Our rules allow for this while ensuring the PDS firm remains responsible for all elements of the service. So, our final rules contain guidance (PDCOB 10) that reminds PDS firms of their obligations under SYSC 8 and SYSC 13, where relevant. PDCOB 10 also signposts PDS firms to the guidance we produced for firms outsourcing to the ‘cloud’ and other third-party IT services. Third-party access arrangements The Government brought the activity of operating a pensions dashboard service within the FCA’s regulatory remit. Parliament gave effect to this decision by amending the Regulated Activities Order (RAO). Certain parties that do not wish to, or do not have the resource or expertise to, get the permission to undertake the new activity may nevertheless want to make exclusively available to their members, employees or customers a PDS operated by a firm that does have the permission. Third-party dashboard arrangements allow for this. These third-party dashboard access providers will not have been subject to the scrutiny of our gateway assessment and will not be bound by our regulatory framework for PDS firms. As such, it would not be appropriate for them to offer the same functions and services as PDS firms. So, as per our CP22/25 proposals, our final rules (PDCOBS 9) contain specific requirements which ensure: • the PDS accessed by third-party members/customers remains fully operated and controlled by the PDS firm, and not the third-party. • The third-party dashboard access provider cannot edit or alter the PDS. • The PDS firm retains full responsibility for compliance with all regulatory requirements. • It is clear to the consumer who is operating the PDS, as well as who the third-party dashboard access provider is. This can be achieved, for example, by using text, logos and/or company colours. These requirements will ensure that the consumer experience is designed by the PDS firm, who is subject to and remains accountable under our rules and reduces the potential of consumer risk through a third-party dashboard access provider.

33 Our final rules require the PDS firm to make sure there is an enforceable written agreement in place between the firm and the third-party dashboard access provider, before the platform is offered to a consumer. Our rules set out the 5 key issues the agreement needs to address but does not prescribe the wording. PDS firms must make sure that any third-party dashboard arrangements they enter into comply with data protection legislation, including GDPR.    Marketing Our proposals 3.26 In CP22/25, we consulted on proposals to: • Limit what marketing is permissible within the PDS. We proposed that the only type of marketing that would be permissible within PDSs are financial promotions for FCA regulated investment advice that comply with our financial promotion rules in Chapter 4 of our Conduct of Business Sourcebook (COBS 4). • Prevent PDS firms from allowing other parties to place advertising on or around its PDS. Our proposals did not permit PDS firms to display on its PDS webpages anything other than financial promotions for regulated advice, signposts to their PVS and anything required or permitted by DWP’s regulations, DWP’s standards on state pension information, PDP’s standards and our rules. • Make sure pensions dashboards users do not unwillingly become the target of unsolicited marketing for products and services. We proposed that PDS firms must get the user’s active and unfettered consent a) before adding them to their marketing database; and b) to accept non-essential cookies and other tracking technologies. 3.27 Our proposals aim to prevent consumers: • being exposed to advertisements for scams or for inappropriate investments • mistakenly assuming the advertised products or services are endorsed by the PDS or recommendations tailored to the consumer’s own dashboard data 3.28 We did not propose any rules or restrictions on the promotion of a PDS. 3.29 In CP22/25 we asked: Question: Do you agree with our proposals on marketing? Question: Do you agree with our proposals on cookies and similar tracking technologies?

34 Feedback received Marketing within a PDS 3.30 Most respondents recognised the potential ‘halo’ effect that could apply in the user’s pensions dashboard journey. So, they agreed that some advertising restrictions were needed to prevent consumers being subject to the potential harms associated with marketing on a PDS, such as those set out in CP22/25. 3.31 Consumer groups supported our proposals, noting that without them, dashboard users could be led into unsuitable pension decisions. One consumer group observed that consumers may be more receptive to the promotion of products on a PDS through mistakenly thinking they are endorsed by the Government. 3.32 Five industry and trade representative respondents argued we would limit consumer engagement with pensions planning by restricting marketing this way. Concerns raised included: • that our approach may create the impression that anything other than MoneyHelper guidance and regulated advice would be a harmful next step for the consumer • consumers are used to differentiating between online advertising and website content 3.33 Some of these respondents called for our rules to permit the promotion and/or signposting of tools, modellers and regulated services or products that exist outside the PDS but which they consider would benefit consumers to better engage with pensions planning. Marketing triggered by using a PDS 3.34 Three industry respondents argued that existing legislation, specifically UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR), gives sufficient personal data controls and so it is unnecessary for us to specify: • how PDS firms must collect marketing consent • that PDS firms must make it as easy for consumers to opt for essential cookies only, as to opt for any other cookies option. 3.35 One respondent claimed our proposals would create additional work for firms that currently have different processes to comply with the requirements under existing legislation. One warned that changes to data protection legislation in the future could result in conflicting requirements with our rules. However, 2 respondents thought our proposals were consistent with existing requirements. 3.36 One industry respondent suggested we go further and impose a ban on non-essential cookies to achieve the aim of generating trust in dashboards and limiting cross-site tracking. 3.37 Another respondent was concerned that our proposals only allowed PDS firms to collect marketing consent. This could be problematic for companies owned by a parent firm with different legal entities. It may also lead to confusion by consumers in managing different marketing preferences.

35 Promotion of a PDS 3.38 One respondent was concerned that firms may ‘prime’ a consumer for a transaction by placing a link to the PDS part-way through a transactional journey. They suggested we should prevent PDS firms from promoting pension products at the same time as they promote a dashboards service. Our response Having considered feedback, our final rules broadly adopt the proposals we consulted on in CP22/25. We address feedback below. Marketing within a PDS The feedback did not persuade us that we should permit marketing of products or services other than regulated investment advice within a PDS. As we outlined in CP22/25: • the presence of marketing within a PDS might create the impression or expectation that a consumer should act or transact after finding and viewing their pensions • consumers might wrongly assume that any products promoted to them in this space are a tailored recommendation • pursuing the advertised products without advice or guidance could lead to consumers investing in products that do not meet their needs and/or giving up important benefits and features on their existing pensions We are not persuaded that consumers being used to online advertising in other environments will mitigate these risks within a PDS. In fact, research published by PDP in 2021 identified “a general wariness” and “some scepticism towards a potential hidden sales agenda behind a pensions dashboard service”. We disagree that allowing promotions for investment advice will discourage consumers from considering any other steps. The choice architecture rules (see Chapter 4 and PDCOB 8) will make sure that dashboard users understand the immediate next steps they can pursue, including PVS if the PDS firm offers them. Advertising regulated investment advice (in a manner that complies with PDCOB 6) does not give primacy to this option, rather it provides an additional way consumers can identify a provider of this advice. Marketing triggered by using a PDS PDP research identified that consumers are concerned that using dashboards will make them a target for unwanted marketing. So, ensuring consumers have the option to limit their ‘footprint’ is important in building consumer trust and confidence in dashboards. It is each PDS firm’s legal responsibility to familiarise themselves with, and adhere to, the applicable requirements in the Privacy and Electronic Communications Regulations (PECR) on the use of cookies or similar tracking technologies. These include the requirement under Regulation 6 to:

36 • say what cookies will be set • explain what the cookies will do • get consent to store cookies on devices (‘consent’ as defined under GDPR) In implementing these requirements, we anticipate that most firms will have regard to the guidance on the use of cookies and similar technologies produced by the Information Commissioner’s Office (ICO) and will be aware that adherence with these requirements has been an area of particular scrutiny by the ICO over the last year. We agree with feedback that it is unnecessary to duplicate PECR requirements in our rules. Instead, we signpost the obligations under PECR so that these are not overlooked (PDCOB 7.2) and require firms to keep a record of the text and presentation of consent options for cookies or tracking technologies (PDCOB 16.6). Promoting a PDS The RAO amendment did not bring the activity of operating a PDS within the scope of section 21 of the Financial Services and Markets Act 2000 (FSMA) (Restrictions on Financial Promotion). This means that PDS firms are not subject to our COBS 4 financial promotion rules when publicising their dashboard service. Further, we do not consider that knowing dashboards exist and where to find them presents any foreseeable harm to consumers. We note the concern that when and where the PDS is promoted could have a potential priming effect. However, we consider this risk is appropriately mitigated: • when promoting their dashboards, PDS firms must comply with our PDCOB 4 requirement for communications to be fair, clear and not misleading and relevant Consumer Duty obligations • if a PDS firm also promotes other products or services alongside promotions for its dashboard services, it will need to ensure it adheres to any applicable COBS 4 requirements in the advertisement • the dashboard user will receive the relevant warnings about making decisions based on dashboard data alone (PDCOB 5) • the choice architecture (see Chapter 4) will make sure the consumer is made aware of other options they can pursue Additional scam prevention measures Our proposals 3.39 We recognise that consumers who use a dashboard service may become a target for scams. Our desire to minimise the risk that users fall victim to a pensions, investment or personal data scam has informed our thinking in many of the policy areas discussed in this Policy Statement. See, for example, our discussion of marketing and data export.

37 3.40 Additionally, in CP22/25 we proposed certain measures exclusively to address the heightened scams risk. These included proposals requiring firms to: • signpost to our ScamSmart campaign in consumer copies of exported data • suggest that consumers should use the FCA register to check the legitimacy of parties requesting that they share their screen or grant remote access to (or control of) devices, as scammers sometimes use this approach • immediately notify the FCA if they become aware of a scam relating to their pensions dashboard, such as a clone dashboard or investment scam 3.41 In CP22.25, we asked: Question: Do you agree with our proposals to protect dashboard users from scams? Feedback received 3.42 Most respondents, including both consumer and industry representatives, agreed pensions dashboards bring the potential for new scam activity. Most therefore welcomed our scam prevention proposals and considered them proportionate and necessary. 3.43 One respondent felt our proposals placed too much emphasis on the danger of data sharing. 3.44 A few respondents queried the effectiveness of some of the measures proposed: • Three suggested we should make sure legitimate dashboards are easily identifiable by consumers and distinguishable from ‘clone’ dashboards. • One respondent queried whether ScamSmart is sufficiently within the public’s awareness to be effective in mitigating scam risks. • Another suggested we should change, from guidance to a rule, the proposal in 5.3.4G that PDS firms should remind users to keep their data safe, think carefully about who sees it and alert them to common scams. 3.45 Two respondents (separately) suggested delivery partners of pensions dashboards (DWP, PDP, The Pensions Regulator (TPR), MaPS and FCA) should work collaboratively to: • Evaluate scam risks after the launch of dashboards to review the effectiveness of scam measures. • Coordinate a response with relevant partners where the FCA receives a scam notification from a PDS firm, given the potential reputational impact on dashboards as a whole. 3.46 One respondent misinterpreted our proposal that firms should notify the FCA of a potential scam, believing it required firms to investigate before notifying us. Based on this misunderstanding they suggested our notification proposal should be made immediate.

38 Our response Our final rules broadly mirror the draft rules we consulted on. However, we have made revisions in light of the feedback. These requirements complement wider scam protections built into the central digital architecture, PDP’s Standards, the Pensions Dashboards Regulations 2022, and protections in the wider pensions landscape, such as The Conditions for Transfers Regulations 2021, which aims to minimise the risk of consumers transferring their pensions into a scam scheme. Pensions and investment scams The scale of harm that dashboard users could experience from pensions scams could be significant. So, we consider our rules are proportionate and strike the right balance to empower consumers to identify and avoid scams which in turn will make them feel more confident in using pensions dashboards. In response to feedback that warnings should be proportionate and minimise information overload, we have revised our rules so that PDS firms can tailor their scam communications to the most relevant risks at the time. We have removed guidance: • Asking PDS firms to make users aware of the types of scams that could occur in relation to a PDS. We consider this isn’t needed in addition to other scam warnings and it is unlikely a clone or fake dashboard would include this warning. • Giving suggested examples to illustrate the risks of allowing remote access, so PDS firms will use the most up to date and/or relevant examples. We agree that the warnings in draft 5.3.4G(1) and (2) are important. It is now a rule rather than guidance that PDS firms display them to users. Data scams The Pensions Dashboard Programme will only connect FCA authorised PDS firms to the central architecture. Nevertheless, we recognise the potential for scammers to set up fake dashboards (which are not connected to the PDP ecosystem) solely as a means of asking consumers to input personal data. Purporting to operate a PDS would be a breach of the general prohibition under s19 of the Financial Services and Markets Act which states that no person may carry on a regulated activity in the United Kingdom, or purport to do so, unless authorised or exempt. Breach of the general prohibition is a criminal offence. The notification requirement we consulted on (requiring a firm to notify us immediately if it becomes aware of a scam relating to its pensions dashboard platform) will help us identify if and what action we can take. This could include adding the firm’s name to the FCA Warning List so consumers can identify that this is a firm to avoid. The notification

39 form will allow firms to include details about any action it has taken - for example initiating an investigation - but this should not be interpreted as a firm needing to take any action before notifying us. We will continue to work closely with delivery partners in advance of the launch of dashboards to ensure scam risks and information on how to avoid these are communicated to the public. Prudential requirements Our proposals 3.47 In addition to the requirement under Principle 4 and COND 2.4 to have adequate financial resources, in CP22/25 we proposed that all PDS firms will need to comply with a: • general solvency requirement • core capital resources requirement 3.48 We also proposed that PDS firms must hold £40,000 additional core capital resources. Firms must hold resources that are sufficient to meet this core capital requirement. Capital resources may include, for example, share capital, capital other than share capital, reserves, interim net profits, revaluation reserves and certain qualifying subordinated debt. 3.49 Where a firm carries out other regulated activities in addition to the PDS activity, we proposed that the firm will have to comply with whichever is the higher core capital resources requirement. 3.50 We did not propose a standalone liquidity requirement but sought industry views as to whether we should and, if so, how it should be calculated. 3.51 Our proposals did not mandate Professional Indemnity Insurance (PII) owing to the unique characteristics of this emerging market. However, we encouraged PDS firms to consider purchasing PII and cyber insurance cover as part of a comprehensive risk management strategy. Allowing some flexibility in risk management strategies at this early stage will contribute to the healthy development of the PDS market, while our other prudential requirements provide a solid foundation for consumer protection. 3.52 We asked: Question: Do you agree with our proposed prudential requirements for PDS firms? Question: Do you have any suggestions for how we might develop the capital resources requirement going forward, in particular to calibrate it to PDS firms as the market develops?

40 Question: Do you think there should be a liquidity requirement for PDS firms going forward and, if so, how this might be calculated? Feedback received 3.53 Our proposed core capital resources requirement attracted mixed responses, ranging from: • one industry respondent who suggested that the risk presented by PDS firms did not justify the imposition of a capital resources requirement • three industry respondents who considered our proposed level of capital resources appropriate because a higher level could deter small, innovative firms from entering the market • three respondents who suggested that £40,000 might be too low, noting that small firms may not be well capitalised and there is potential for the ICO to fine the firm for data breaches 3.54 All respondents who commented on our proposal not to mandate PII cover, agreed with the proposal. 3.55 Most respondents to these questions agreed we should keep our approach under review as the sector develops. Four industry respondents suggested ways in which we might better calibrate the capital resources requirement in future to the nature and scale of PDS firms’ businesses. These suggestions included: • scaling according to the volume of users, volume of data exported and saved by the PDS firm, or the number and nature of post-view services the PDS firm offers • excluding PDS firms from the core capital requirements • placing restrictions on the post-view services that firms with low capital resources can offer 3.56 No respondents supported the introduction of a liquidity requirement at this stage. Our response Not all respondents realised our proposed core capital resources requirement would apply in addition to our proposed general solvency requirement. Our general solvency proposal would require PDS firms to maintain overall financial resources which are adequate to ensure there is no significant risk that the firm cannot meet its liabilities as they fall due. As part of our ongoing supervision, we may provide firms with individual capital guidance, individual liquidity guidance, or both, in line with SUP 9.3. This guidance is tailored to each firm’s specific circumstances and risk profile. It outlines the amount or quality of capital or liquidity that we believe a firm needs to hold to meet its general solvency requirement. This approach allows for flexible, risk-based supervision while ensuring firms maintain adequate financial resources. Firms will be expected to document how they meet the general solvency requirement. If we are

41 unable to agree with a firm on the level of capital or liquidity that it needs to hold to meet the general solvency requirement, we may instead use our powers to impose these on the firm by requirement. It was against this backdrop that we proposed an additional core capital resources requirement to act as a buffer above the basic solvency resources requirement. In adopting this approach in PDCOB, we followed the approach to our other prudential regimes, such as for insurance mediation (MIPRU 4), debt management firms (CONC 10) and claims management companies (CMCOB 7). Having considered the feedback, and noting that PDS firms will not hold client money in their capacity as a PDS firm, we consider our original proposal of both a general solvency requirement and a £40,000 core capital requirement remains a reasonable and proportionate starting point for ensuring that a firm has adequate financial resources: • for contingencies, such as if software or systems need upgrading or otherwise repairing • to exit the market in an orderly fashion, including safely disposing of any personal or pensions data it holds • to meet the potential costs arising from any harms caused • to maintain overall financial resilience appropriate to their business model and risk profile    So, our final rules adopt the prudential standards that we proposed in CP22/25. As all respondents who commented on our approach to PII agreed that we should encourage firms to consider obtaining PII and/or Cyber Insurance, we have added to PDCOB a guidance provision to this effect. We will keep this approach under review as the market develops. Wind-down procedures 3.57 In CP22/25, we proposed that PDS firms must prepare a wind-down plan to facilitate an orderly wind-down of the business (ie, to end its regulated activities and cancel its permission) and to minimise detriment (such as disruption or reputational damage, to the firm’s customers, counterparties or the wider market). 3.58 We asked: Question: Do you agree with our proposed approach to wind-down procedures for PDS firms? Feedback received 3.59 All respondents who answered this question were broadly supportive of our proposed approach to wind-down procedures.

42 3.60 One industry respondent observed that in the event of a wind-down (whether a strategic exit or the result of an unexpected crisis or insolvency), PDS firms must ensure that any retained customer data is deleted in a secure manner. So, the respondent suggested that a PDS firm must have adequate resources (human and financial) to do so. Our response Our final rules adopt the approach to wind-down procedures we proposed in CP22/25. A wind-down plan is important for PDS firms to assess if they have adequate resources to wind down in an orderly manner, especially under challenging circumstances. Our Wind-down Planning Guide (WDPG), provides guidance to help firms develop effective wind-down plans. As we explained in CP22/25, we consider that PDS firms should consider the sensitivity of the data they hold and appropriate measures and protections for handling sensitive data on wind-down. They will also need to consider any relevant requirements in PDP’s standards or in legislation, such as UK GDPR. The Information Commissioner’s Office (ICO) has published guidance on deleting personal data. We may ask to see a firm’s wind-down plan as part of the authorisation application or ongoing supervision. These plans should be living documents, regularly reviewed and updated to reflect changes in the firm’s business, market conditions or regulatory requirements.

43 Chapter 4 Conduct standards – enabling engagement 4.1 In this chapter we summarise the feedback to the CP22/25 and CP24/4 proposals which concern only those parts of the consumer’s experience that are beyond the core ‘find and view’ function that is subject to DWP's Pensions Dashboards Regulations 2022 and Pensions Dashboards Programme (PDP) standards, but which take place within the dashboard itself. These Pensions Dashboards Code of Business Sourcebook (PDCOB) proposals were designed to enable and encourage pensions dashboards service firms (PDS firms) to facilitate continued engagement in pensions and retirement: • Presentation of user-choices and disclosures at the point of exit (choice architecture and exit communications): no matter which PDS a consumer chooses, they should be able to easily identify and go to the immediate next step choices available to them. Those that: – are available within the PDS e.g. post-view services and – exist outside the PDS e.g. guidance from MoneyHelper, financial advice from a regulated adviser, the PDS firm’s non-dashboard webpages, etc. Where the customer selects an option that takes them outside the dashboard, the PDS must disclose certain information to make sure the consumer is aware they are going to a different environment. We introduced this concept in CP24/4 following feedback to CP22/25 that sought greater clarity as to when the user’s dashboard journey ends. • Post-view services (PVS): these are non-transactional services within the PDS, accessed via the choice architecture, that help users better understand and engage with their found pensions. Services that are offered to a consumer outside the dashboard (after a user has exited the dashboard) are not PVS for the purposes of our rules. • Data export: the process by which a customer can consent within the PDS to their view data being extracted or ‘exported’ from the PDP ecosystem, to either the PDS firm (for use with permitted PVSs) or to themselves. 4.2 This chapter summarises the feedback on our choice architecture and exit communications, post-view services and data export proposals. We respond to the issues raised and indicate whether and how they have affected our final rules.

44 Choice architecture and exit communications Our proposals 4.3 In CP22/24 we proposed that, from the point at which a user views their pensions data and each time they have accessed a) their pensions ‘view data’ b) any PVS (see paragraphs 4.14 to 4.24 of this Policy Statement) and c) exported data to themself (see paragraphs 4.28 to 4.46), the PDS firm should present a choice architecture to the consumer that enables them to identify and select their immediate next step. 4.4 We also proposed that where a user selects from that architecture a choice that would take them outside the PDS, the PDS firm must communicate certain information to them. 4.5 As we explained in CP24/4, these proposals were a direct response to CP22/25 feedback which sought greater clarity on the point at which a consumer’s dashboard journey ends. 4.6 In our CP24/4 consultation we asked: Question: Do you agree with our proposals to require PDS firms to introduce a choices architecture to put the consumer in control of deciding initial next steps? If not, what problems can you foresee with these proposals? And how might they be addressed? Question: Do you agree with our proposals concerning exit communications? If not, please explain why. Outside the PDS Wider PDS: beyond view data Core PDS: find and view

45 Feedback received 4.7 Most of the respondents to these questions agreed that our choice architecture proposals would do one or more of the following: • put the consumer in control of their dashboard journey enabling them to make informed decisions to decide the next steps that are appropriate for their information needs at the time. • allow the consumer to identify and select sources of further information, guidance and advice. • ensure a clear and consistent mechanism for deciding next steps across all dashboards. 4.8 Seven industry respondents were concerned that: • the number of ‘choices’ might confuse users and increase the length and complexity of the user journey, which could discourage engagement • displaying the choices with ‘equal prominence’ would create a poor user experience, give undue and distracting prominence to actions for which consumers would have less demand. • it would be difficult to present the choices compliantly on small screen devices 4.9 One respondent asked whether the choice (in our choices architecture requirements) to ‘take no further action’ could direct the user to a third-party’s own webpage, rather than the PDS firm’s webpage, as part of a third-party dashboard arrangement. 4.10 Half of all respondents that commented on our exit communication proposals considered our proposals reasonable. They recognised their potential to prevent harms that could arise if the user is unaware when they have left the PDS. They also agreed it was proportionate to give PDS firms flexibility to determine the design, format, language and delivery of the exit communications. 4.11 Over half the respondents representing industry were concerned that our proposals may deter consumers from continuing with pensions engagement beyond the dashboard. Their key concerns were that the exit communications: • would be unnecessarily worrying or might scare users from engaging further with their pensions • could confuse users and lengthen the consumer journey, particularly in addition to the choice architecture requirements, leading to a poor user experience and users disengaging 4.12 Many respondents misinterpreted our proposals as requiring a detailed explanation of the regulatory protections that apply inside the PDS and how they compare with the regulatory protections (or lack thereof) at their destination. They considered this unnecessary as users are unlikely to understand or appreciate the nuances of different regulatory environments. 4.13 Three industry respondents considered the choices architecture and/or exit communication proposals were unnecessary because, in their view, PDS firms’ obligations under the Consumer Duty would deliver the same outcomes.

46 Our response Having considered respondent feedback on our choice architecture proposals, we have retained the core requirements but made revisions that: • clarify the flexibility firms have in presenting the choices • remove 2 of the choices that are already required to be displayed on a dashboard under the Pensions Dashboards Regulations 2022 We consider our final rules give firms sufficient flexibility to more effectively achieve the aims of our choices architecture requirements to: • put the consumer in control of deciding their initial next steps so they can navigate the dashboard on an informed basis • limit the potential a consumer pursues a course of action, without understanding all available options, or be led into a particular action through design or omission. Clarifying flexibility in presenting choices Some respondents interpreted the requirement to display the choices ‘impartially and with equal prominence’ more strictly than we had intended. To address this, and give more clarity to PDS firms, our rules now focus on the outcome we want to achieve, in line with a PDS firms’ Consumer Duty obligations on communicating information: • The PDS firm does not bias the consumer’s choice by giving greater prominence to any particular option. • A user is: – able to easily identify and understand all the options available to them – make an informed choice about next steps based on this understanding If the above outcomes are met, our rules allow firms the freedom to determine: • where on the screen choices are presented • whether to present choices on the same screen as ‘view data’, or as a subsequent screen or pop-up, for example • whether to use layering, logical grouping or a drop-down functionality to present the choices, as long as the choices are grouped in common themes so users can still easily find and understand all the choices. The presentation of the choices should make it clear to consumers where they can find the next steps they can choose to take. They should not be presented in a way that may be overlooked by a consumer – for example, labelling the choices as ‘additional information’. Our revised rules are sufficiently clear that we no longer need to specify that PDS firms must continue to meet the choice architecture requirements even where a consumer can scroll or navigate around the presentation of choices.

47 Removal of choices already required under the Pensions Dashboards Regulations 2022 (2022 regulations) Having considered feedback that the number of choices may confuse users and lengthen or add complexity to the consumer journey, we are not mandating the following: Choice offered to user Where the PDS firm must redirect the consumer if they select the choice offered Raise a question or complaint about the service or relating to the view data  Redirect to the central complaints process for the Money and Pensions Service which is a service to help users understand:  • what help is available if things go wrong and   • their available routes to redress  Review, revoke or amend consents originally granted at the Consent and Authorisation Service Redirect to the PDP Consent and Authorisation service to manage consents  PDS firms must still provide a link to both the above in their PDS in line with their obligations under regulations 12(2) and 8(4)(c) of the Pension Dashboards Regulations 2022. PDS firms may, if they wish, present these 2 options within the choice architecture, but the effect of this change is that there is no obligation to do so. In addition, firms are reminded of their obligations under the Dispute Resolution: Complaints Sourcebook (DISP) to provide and make available a complaints mechanism. See Chapter 2. So, our final rules require PDS firms to offer users the following core set of next step choices: • take no further action and be redirected to the PDS firm’s wider digital environment outside of the PDS • get further information, support and impartial guidance from MoneyHelper • find an adviser (one regulated by the FCA with permission to make personal recommendations about pensions and investments) Additionally, if the PDS firm offers PVS and/or the facility for the user to get a copy of their view data, the PDS firm must actively offer these as choices for the consumer in addition to the core choices listed above. The choice architecture should be presented to the consumer after: • viewing their pensions data • engaging in PVS (where offered) • exporting a copy of their data to themselves (where offered) Clarifying flexibility in interpreting presentation of exit communications Having considered feedback on our exit requirement proposals, we are retaining the core exit communication requirements. But we are making some revisions to clarify the flexibility firms have in presentation.

48 Where a consumer selects a choice that directs them to leave the PDS, our final rules require a PDS firm to communicate to the user: • that they are leaving the pensions dashboard service • that their pensions dashboard data will not leave with them • where they are being redirected to • that what they see after leaving the PDS is not tailored to them based on their dashboard pensions data We want users to be presented with the exit communications whenever they exit the PDS. Our final rules now clarify that PDS firms are required to display the exit communications in PDCOB 8.4.1R to a user whenever a link within the PDS directs the user to leave the PDS. This could include a link in: • their pensions ‘view data’ detailing how to contact the pension administrator or provider of the found pension • a financial promotion for regulated investment advice that is permitted to be included within the PDS In the above circumstances, a PDS firm is not required to provide an explanation of where the consumer is being redirected if this is clear to the user from the context in which the link was presented. PDS firms have flexibility to determine the language, presentation and mechanism of communications, as long as they communicate the above outcomes to the user when exiting the PDS. To address any misinterpretation that our proposals required a detailed explanation of the regulatory protections inside the PDS, compared to those of the exit destination, we have removed reference to this in the exit communication requirements. In response to feedback that communications across the PDS be proportionate and not overload the consumer, PDS firms are not required to include a warning that discourages users from making financial decisions based on view data alone in their exit communications. We consider it sufficient that this warning is required to be presented in other key stages of the user’s dashboard journey. Clarification in the context of third-party dashboard arrangements: direction when user elects to take no further action We have considered feedback about whether the choice to ‘take no further action’ could direct the user to a third-party dashboard access provider’s own webpage, rather than the PDS firm’s webpage, as part of a third-party dashboard arrangement. We do not consider this would create any additional risks to consumers and would make a third-party dashboard arrangement more commercially viable, allowing more dashboards to be available to consumers. So, we have amended our rules to allow this, where a PDS firm has agreed to this as part of a third￾party dashboard arrangement and contract terms. This would only allow redirection of a user to a third-party dashboard access provider's website instead of to the PDS firm’s website. It would not give the third-party

49 dashboard access provider any other rights or permissions over the dashboard or dashboard data. Post-view services Our proposals 4.14 In CP22/25, we proposed to permit PDS firms to offer services within the PDS that can support users to engage further with their found pensions and retirement planning. We did not prescribe what these ‘post-view services’ should be as we did not want to inhibit firms’ innovation. We did, however, propose some parameters ie, that PVS must: • support customers in understanding their pensions • relate to pensions and retirement planning • be operated by the PDS firm • not lead a consumer into a product or transaction • be user tested 4.15 We proposed that PVS could be populated with dashboard data (where consent for data export is given) and/or data that is ‘self-asserted’ by the user. We also proposed firms could firms could charge for these services, where they are satisfied this is compatible with providing fair value to customers under the Consumer Duty. Data retention 4.16 We proposed limitations on the use and retention of the data that is input to a PVS (exported or self-asserted) or generated for the user by a PVS. We proposed that PDS firms: • Must not share consumer information, (view data, self-asserted data and the outcome of PVSs) with any entities beyond the PDS firm. • Can only store the data for 30 days. This applies to both a user’s dashboard data and self-asserted data. 4.17 In CP22/25 we asked: Question: Do you agree that our proposals on post-view services achieve an appropriate balance between allowing scope for innovation and protecting consumers? Feedback received 4.18 On the whole, consumer groups and industry respondents agreed that dashboard users should be able to access services that support better understanding and engagement in pension planning.

50 4.19 While respondents generally agreed there should be protections in place for PVS users, 11 industry respondents argued our proposals were too restrictive. They contested our articulation of PVS as services provided by PDS firms within the dashboard, arguing that: • our approach would limit the support that is accessible to PDS users • the prohibition on transactions would create unnecessary friction and impede consumers’ ability to engage in pensions planning • our approach would prevent consumers from benefitting from consolidation of small pots. 4.20 Their responses revealed an expectation or recommendation that PVS could and should be services outside the dashboard, but which use (exported) dashboard data. Some respondents wanted to limit these services to those offered by PDS firms in their wider digital estate. Others suggested these services could be offered by any pension scheme or provider. This would extend the range of PVS available for users and avoid the cost of adding separate services to the PDS. 4.21 Alternatively, some respondents suggested that PDS firms should be allowed to include signposts, within or alongside the dashboard, to existing support services and engagement tools outside the dashboard. 4.22 One respondent was concerned that restricting PVS to ‘pensions or retirement planning’ may limit firms being able to provide useful services on wider financial or budget planning. They asked for examples to help clarify what types of services could be included. 4.23 Of the 6 respondents that commented on our data retention proposals, the majority opposed our proposal that PDS firms should delete users’ data (particularly self￾asserted data) after 30-days. They suggested that many users may need more than 30 days to reflect on the information they have seen and/or to get further information to self-assert. They claimed that consumers would therefore need to frequently re-enter their data to fully and/or frequently experience the PVS. They were concerned the consumer would find this frustrating and stop using PVS. 4.24 Two suggested users should be able to choose how long to store their data, with possible choices ranging from 30 days up to a year. One respondent thought there should be an express rule reminding firms they cannot store consumers data without consent. Our response Having considered feedback to both consultations, we are taking forward the approach we consulted on in CP22/25, subject to certain minor changes and clarifications. The nature of post-view services Our rules on PVS have regard to the Government’s public commitment that PDS would not have transactional capability (such as consolidation or transferring pensions), to: • protect consumers from making irreversible pension decisions based only on the limited information that dashboards will provide

51 (administrator/provider name and contact details, accrued value and projected retirement income) • instil trust and confidence in PDS from the outset For this reason, our first iteration of rules for PDS firms do not allow for transactions to be promoted or initiated within the PDS. Consequently, PVS cannot be transactional (PDCOB 12.3.1R(3)). A post-view service is a defined term in our Handbook, introduced specifically in the context of our rules for PDS firms. PVS are unique to dashboards and should be: • designed for the target market of the firm’s PDS (under the Consumer Duty products and services outcome in PRIN 2A.3) • accessed only by PDS users via the choice architecture within the dashboard (PDCOB 8.2.7R). PVS should not be conflated with other services that a consumer might find or choose to use after exiting the dashboard. Some CP22/25 respondents queried whether it would be permissible for PDS firms to present their PDS so that a user can see and access links to the firm’s non-dashboard products and services alongside and during their dashboard journey. We consider this would: • undermine the purpose of the dashboard, the stated objective of the choice architecture, and our overall framework of PDCOB rules which embody an appropriate degree of friction in the PDS consumer journey to mitigate the risk of consumer harms - this would likely be incompatible with the Consumer Duty requirement to act in good faith under PRIN 2A.2.1R and the requirement to design and deliver consumer support that includes appropriate friction in consumer journeys to mitigate the risk of harm and give customers sufficient opportunity to understand and assess their options, including any risks (PRIN 2A.6.2R(3)) • likely confuse or mislead the customer over the spaces they are navigating – potentially in breach of the Consumer Duty requirements to enable and support retail customers to pursue their financial objectives (PRIN 2A.2.14R) and avoid causing foreseeable harm (PRIN 2A.2.8 R) Our rules allow a PDS firm to give access to their PDS via their existing webpages or apps. However, once a consumer has entered the PDS, a PDS firm is not permitted to display or make available to the dashboard user any other webpage or app, until the consumer has left the PDS. Our rules now clarify this at PDCOB 3.3.1R. Our rules on PVS offer PDS firms a unique opportunity to meet the consumer in a moment of consumer-initiated engagement and present to them a range of information, education and guidance services (as an alternative or precursor to impartial guidance or regulated investment advice) that enable a consumer to address the most immediate questions that seeing their ‘view data’ might trigger. Research has consistently shown that many people: • have low confidence in their knowledge about pensions, consider

52 pensions to be confusing, or both. • recognise that pensions are important and consequently are concerned about making decisions or taking actions that might put them at risk. So, PVS that enable consumers to build their knowledge without fear of making a ’mistake’ could better empower consumers to engage beyond the dashboard on a better-informed basis, should they wish to. Examples of PVS could include: • providing information that enables a consumer to develop a high￾level understanding of defined benefit, defined contribution and state pensions, and the difference between them • enabling the consumer to understand how their estimated retirement income compares with the income they might need or want in retirement • explanations of the concepts of transfer or consolidation, and what a consumer should consider before determining whether these might be suitable in their circumstances • explore what might happen if the consumer were to change their retirement age, or to change their pension contribution levels We are not suggesting that these are the services that all firms must offer, or that these are the only acceptable forms of PVS. They are illustrative examples that we consider could bring value to the consumer’s dashboard experience. Our final rules require that PVS must relate to pensions or retirement planning. The initial objective of pensions dashboards is to empower, enable and increase pensions engagement, rather than engagement in wider financial services. So, PDS firms should only offer PVS that support a user to: • understand the pensions they have found (and the data provided about them) • consider or plan for the income they will need in retirement When considering whether and which PVS to offer, a PDS firm will need to consider their obligations under the Consumer Duty obligations, including that they: • should consider how they can act to deliver good outcomes for customers (Principle 12) • must make sure that the design of the product or service meets the needs, characteristics, and objectives of customers in the identified target market (the products and services outcome in PRIN 2A.3) • must make sure communications meet the information needs of customers, are likely to be understood by customers, and equip customers to make effective, timely and properly informed decisions (the consumer understanding outcome in PRIN 2A.5) • are required to design and deliver support that meets the needs of consumers, that enables them to realise the benefits of the service and to pursue their financial objectives so they can act in their own interests (consumer support outcome in PRIN 2A.6)

53 The volume and nature of PVS that it offers will be one of the main ways that a PDS firm can distinguish itself from other private sector PDSs and the MoneyHelper dashboard. So, we consider PVS to be an integral part of a firm’s commercial business model and would expect firms to present details of these with their application for authorisation or variation of permission. Our rules do not prescribe the design and format of PVS. Conceivable examples could include factsheets, explainer videos, animations, interactive tools and calculators. But it will be for firms to determine the most effective way to engage their target market’s interest and understanding. PDCOB 12.6.1R requires that user testing should be conducted to ensure that the nature of the PVS is capable of being easily understood, easily used and not likely to mislead or confuse. We recognise that there will be costs to firms to develop and offer such services. The extent of those costs will vary according to the nature of the service, and whether they are designed from scratch, or their design is borrowed from services the firm already offers to its general web users (modified for compliance with PDCOB rules for PVS). Our rules permit PDS firms to charge for PVS so long as the charges are compatible with the fair value outcome under the Consumer Duty. However, if the firm offers the same service significantly cheaper or free of charge outside the pensions dashboard platform, a firm must inform the customer of that fact in good time before providing the service. In developing PVS, PDS firms should take care not to stray into other regulated activities for which they do not have permission and/or breach existing requirements from other sections of the FCA Handbook. PERG provides guidance on the perimeter and the circumstances in which permission is required to carry out activities. And our Innovation Pathways service can help PDS firms to understand how regulation will apply to their proposed PVS, ahead of applying for the PDS permission. In turn, this could better enable applicants to submit a robust and thorough application for either authorisation or a change of permission. Data retention Our final rules apply separately from and in addition to a firm’s obligations under: • data protection legislation, such as UK GDPR and the Data Protection Act 2018 • regulation 9(3) of the Pensions Dashboards Regulations 2022 which prohibits PDS firms from storing view data for purposes other than displaying it the user in a single session Our final rules on data retention include some minor changes in response to feedback. Self-asserted data In light of feedback, we are not specifying a data retention period for self-asserted data in our rules. Firms must instead adopt the retention

54 period they consider appropriate to meet their obligations under the data protection legislation. Exported view data Where a PDS firm offers the option of setting-up user accounts, it will be able to issue new view requests for each of the user’s found pensions, each time the user logs into the account. This would enable the consumer to retrieve the latest available view data, without undertaking the find process again. In these cases, there is no need for a firm to retain the customer’s view data between visits. However, where a PDS firm offers only ‘guest user’ access, or a customer chooses to proceed as guest rather than logging in, a period of retention for view data that is exported for use in a PVS would allow the delivery of PVS over the course of more than one visit. We remain of the view that 30 days is an appropriate retention period. There might already be a considerable elapse of time between the date on which the ‘view data’ values were calculated and the date on which they were viewed by the customer. The longer this data can be retained for use with PVS, the more likely it is that more recent and accurate data would be available from the dashboard. The more out of date the retained data becomes, the less helpful the PVS will be for the consumer. So, we have clarified that where review data is retained, it can only be retained for 30 days from the date on which the consumer consented to the PDS firm storing the data. Feedback suggesting PDS firms must get consent to store a user’s data highlighted an omission in our rules. This was always our policy intent and is now reflected in our final rules. Where a user has agreed to export data to a PDS firm, the firm must get a user’s express consent to store the view data for the permitted 30-day storage period. We have also revised our rules to make it clear that PDS firms can share exported view data with a firm they have outsourced elements of a PVS to, but only to the extent this is necessary for that purpose. The PDS firm would retain regulatory responsibility, and must have appropriate oversight arrangements in place, as required under outsourcing rules in SYSC 8. Sharing and using ‘view data’: data export and delegated access 4.25 Regulation 9(3) of the Pensions Dashboards Regulations 2022 prohibits the PDS from storing a user’s view data, except in the form of temporary caching for the sole purpose of displaying the view data to the user, in a single view session. 4.26 The Government also concluded that the right to data portability under UK GDPR (which allows individuals to get and reuse their personal data for their own purposes across

55 different services) is not created when a consumer uses the dashboard to find and view their pensions. 4.27 So, it falls to the FCA to determine whether and in what circumstances a user’s view data can be exported and used. Data export Our proposals 4.28 ‘Data export’ is the term we use to describe the process by which a customer’s view data is extracted or ‘exported’ from the PDP ecosystem, in limited circumstances for specific purposes. 4.29 In CP22/24, as in CP22/25, we proposed that PDS firms could take one of three approaches to data export: • not to offer data export • offer consumers the option to export data to themselves • offer the consumer two options: export to self and export to the PDS firm for use with PVS 4.30 In light of feedback to CP22/25, the CP24/4 proposals did not include the option we consulted on in CP22/25: • to also permit export of view data to the PDS firm (or a firm in the same group as the PDS firm) with regulatory permission to give investment advice (a connected person) • that permitted PVS could include investment advice provided by the PDS firm or a ‘connected person’, so long as they have the permission to give investment advice 4.31 We asked in CP22/25: Question: Do you agree with our proposal that data should only be exported to either the customer, the PDS firm, or a firm in the same group as the PDS firm with permission to give investment advice? 4.32 We asked in CP24/4: Question: Do you agree that permitting data export to PDS firms (with the investment advice permission) for investment advice purposes creates an unfair competitive advantage in relation to advice? Question: Do you agree that our proposal (to remove the option of data export to the PDS firm, or connected person, for investment advice) is appropriate? If not, what would be a more appropriate and competitively fair approach for the FCA to adopt?

56 Feedback received 4.33 Almost all respondents to these questions agreed that PDS firms should have the option a) not to offer data export; and b) to allow consumers to export view data to themselves. 4.34 Most respondents agreed that the consumer should be able to export data to the PDS firm. However, a significant proportion of industry respondents argued that PDS firms should not be the only permitted industry recipients of exported view data. Some argued that the consumer should be able to export view data directly to any FCA regulated party: • some on the basis that this would give the consumer easy access to a wider range of services than the PDS firm’s PVS; • others to remove any incentive for legitimate parties to ask the consumer to download their view data and share with the requester by less secure means – legitimising behaviour that a scammer might also adopt 4.35 They argued their suggested alternative would be appropriate because the recipient would be FCA regulated in some way. A very small number of respondents suggested that occupational pension schemes, particularly Master Trusts, should also be permitted recipients of view data. They argued this was necessary to ensure that consumers could just as easily access services offered by TPR regulated schemes as PDS firms. In their view, our proposal gives an advantage to FCA regulated pension providers that become PDS firms. 4.36 One respondent suggested there should be a separate regulatory permission for firms that want to receive exported view data. 4.37 Most respondents to CP24/4 agreed that allowing data export to PDS firms (or connected persons) for investment advice would create a competitive advantage. Only a small number claimed the advantage was justified. Some industry respondents, however, were concerned that the revised data export proposals may create barriers to, or discourage consumers from, taking regulated financial advice. They noted that this would be incompatible with the objectives of the Advice Guidance Boundary Review (AGBR). Our response Our final rules adopt the data export proposals in CP22/25 as modified by CP24/4. Initially, and subject to consumer consent, view data can only be exported to the consumer or to the PDS firms for use in PVS (including where the PDS firm has outsourced the operation of the PVS to another party). We consider these rules appropriately ensure that, for the initial launch of dashboards: • consumers will remain in control of how their personal and pensions data is processed • exported data is only used to support consumers in retirement planning

57 We understand that many respondents would prefer we permit data to be exported to other parties beyond the PDS firm, but we do not consider the alternatives suggested to be appropriate: • The wider population of FCA regulated firms – while such firms would be subject to our high-level standards and the Consumer Duty, it does not necessarily follow that all FCA regulated firms would be appropriate recipients of the customer’s view data. Being FCA regulated does not necessarily make the firm capable of supporting the consumer on the next step of their pensions engagement journey, and respondents provided no clearly defined or consistent use cases where this might be the case. • Introducing a regulatory permission for the receipt of exported view data – the Treasury is responsible for amending legislation to bring new activities within our remit. If the Treasury made exporting view data a regulated activity, any party that wants to receive ‘view data’ would have to be/become authorised and go through a gateway assessment to get the new permission. We consider it highly unlikely that firms would be willing to undertake those steps purely to enable them to receive ‘view data’ which is inherently limited in nature. • The Pensions Regulator (TPR) regulated schemes – these schemes are outside our regulatory reach. While the FCA and TPR work in tandem to address risks and harms in the pensions and retirement income sector, we have distinct statutory remits as set by Parliament. It was a government decision to make operating a PDS an FCA regulated activity. The trustees or managers of TPR regulated schemes can apply for authorisation and permission to become PDS firms, but we recognise they may not have the resources and expertise to do that. It remains possible for the trustees and managers of TPR regulated schemes to make a PDS accessible to their scheme members, either by signposting to the MoneyHelper dashboard, or by entering third-party dashboard arrangements with a PDS firm (see Chapter 3 and PDCOB 9). While our rules do not permit data export to the third-party dashboard access provider, whether to offer export to the PDS firm for PVS is a matter for the third-party dashboard access provider (in this case the TPR regulated scheme) and the PDS firm to contractually agree. Those PVS would not be transactional. We are open to considering whether and how view data might be safely exported in future, to a clearly defined population, for a specific use case. The opportunities and risks would have to be carefully explored, as well as compatibility with data protection legislation. We will begin to consider these questions in our next publication on AGBR. We note some respondents’ comments that our intent can be easily circumnavigated if the consumer chooses (independently or with encouragement) to share the data they exported to themselves, with a party to whom they could not export data directly from the dashboard. We recognise that this leaves the consumer open to approach from scammers. But this risk exists no matter how narrowly or broadly the

58 permitted recipients of exported data are defined. It is for this reason that we consider the protections in PDCOB 11.4 to be so important. We cannot prohibit consumers from sharing their own copies of their data with other people – but we can make sure they know the risks of doing so, and how to mitigate them. Delegated Access While our final rules do not permit the export of view data to the PDS firm, connected persons, or indeed any other firm for the purpose of investment advice, our final rules do not stop dashboard users seeking financial advice. Rather, when delegated access is available, a consumer who wishes to share their data with an adviser/advice firm will be able to do so via this secure mechanism. Delegated access is a function managed via the Central Digital Architecture (CDA) through which customers can grant access for a MoneyHelper (MaPS) guidance specialist or an FCA authorised person with the relevant permissions to advise on pensions (investments and/or transfers) to see the customer’s view data on a dashboard. See p.109 of DWP’s consultation on the draft Pensions Dashboards Regulations for more information on delegated access. The delegated access process is yet to be delivered. So, we have omitted from our final rules any of our previous proposals that interact with the delegated access function. For example, how delegated access should be presented as an option in the choice architecture. We will revise our rules accordingly when the relevant detail is available from PDP. Where appropriate, we may need to conduct a short, focused consultation for those rules. We do not consider that our final rules discourage dashboard users from taking regulated financial advice. PDCOB 6.3 allows the promotion of regulated investment advice, and PDCOB 8.2 requires that the choice architecture must enable the consumer to access a directory of regulated advisers. Consumers can also use dashboard data, which alone is not a sufficient basis for giving holistic advice, to inform advisers of their found pensions, making the fact find process more efficient. But not every dashboard user will want, need or be able to afford holistic advice. By contrast, many users could benefit from information, education and guidance offered by PDS firms as PVS which ought to address many users’ information, education and guidance needs. Rules for data export Our proposals 4.38 In CP22/25, we consulted on rules how PDS firms can process customers’ dashboard data, when they offer permitted forms of data export.

59 4.39 For both export to the consumer and export to the firm, we proposed that the PDS firm must: • Get a user’s agreement before exporting view data. When getting the agreement, the PDS firm must not: – use defaults (such as pre ticked boxes) – bundle this with other agreements – make data export a pre-condition of using a dashboard. • Provide the consumer with appropriate information to help them make an informed decision: – communicated in a fair, clear and not misleading way – include the name of the data controller who will be processing the data and the purpose for which the data is being processed. • Transmit the data securely 4.40 We proposed that PDS firms should keep records of how they get users’ agreement to data export, including the content of messages. Export to the consumer 4.41 Additionally, we proposed that the customer’s copy of the data must: • be useful to the consumer and easy to read • make the consumer aware of scam risks when looking at their data or considering sharing it with a third party • limit scammers’ ability to initiate irreversible transactions if they intercept the customer’s copy by omitting or obscuring part of the customer’s pensions reference Export to the PDS firm for use in post-view services 4.42 We proposed that view data cannot be exported for the immediate purpose of initiating a transaction, or populating an application form. 4.43 In CP22/25, we asked: Question: Do you agree that the requirements we propose to place around how data is exported and processed ensure an appropriate degree of consumer protection? Feedback received 4.44 There was broad agreement that, as far as appropriate, we should ensure that export of data does not put the consumer and their data at risk. 4.45 Five industry respondents, however, opposed our proposal that the customer’s full pensions reference should not be exported. They argued that our proposal was

60 unnecessary (given that such a precaution is not deemed necessary for annual benefit statements), would frustrate the consumer onward journey and reduce the utility of the data for advisers with whom the consumer might share it. Most interpreted our guidance that a firm might include only the last 4 characters of the pension reference as a prescribed rule. 4.46 A small number of respondents asked for further clarity on our expectation that the data exported to consumers be clear and easy to read, asking if: • a comma separated value (CSV) file would be a permissible format • the exported copy should adhere to the display methodologies in the PDP’s Design Standards Our response Our final rules take forward the requirements we proposed in CP22/25 around how data is exported and processed in CP22/25. We have made minor drafting revisions to give greater clarity in areas where respondents’ comments indicated the original drafting had not been properly understood. Exporting the pensions reference We remain of the view that the full customer pension reference should not be included in the consumer’s copy of the exported data. This makes sure that, in a similar way to the redaction of certain payment card details from retail sales receipts: • should the consumer’s copy of the data fall into the wrong hands, a bad actor would struggle to initiate a transaction • the consumer can still cross reference with any other records they might hold. Unlike an annual benefit statement, which contains detailed information about a single pension, the consumer’s exported data will contain data about all the consumer’s found pensions - pensions that the consumer, and in many cases, their employers, have contributed to across their entire working lives. We have modified our guidance in PDCOB 11.3.6G to make clear that the firm may choose how many and which digits to omit or obscure. PDS firms must keep a record of their chosen approach and rationale. We have revised PDCOB 11.3 to make clear that this limitation on exporting the pensions reference applies only to the consumer's copy of the exported data. Content, format and manner of data export to the customer Our rules (PDCOB 11.4.3R) require the firm to make sure the export is in a format which is accessible to a member of the general population. In satisfying this rule, PDS firms should consider:

61 • whether the format of the data export meets any accessibility obligations such as under the Equality Act 2010 • their obligations under the consumer understanding outcome of the Consumer Duty (PRIN 2A.5) Our rules do not prescribe the format of the consumer copy, but the copy that the consumer receives should be recognisably a copy of what the consumer saw on screen. The presentation of that data shouldn’t be so different from the screen display as to mislead or confuse the understanding the customer reached from the on-screen version. The exported information must: • include the customer’s view data and any display explanations and contextual information which is required by PDCOB 5 and other legislation, such as the Pensions Dashboards Regulations 2022 (PDCOB 11.4.5R) • be accompanied by certain important messages (PDCOB 11.4.6R)

62 Chapter 5 FCA processes 5.1 This chapter provides an update on the authorisations gateway. It also summarises the feedback we received on our proposed approach to Supervision and Enforcement and Authorisation in line with our Supervision manual (SUP), Enforcement Guide (EG) and Decision Procedure and Penalties Manual (DEPP). We also respond to the issues raised. Authorisations 5.2 Firms which are not currently FCA authorised and intend to operate a pensions dashboard service (PDS) must apply to us for new firm authorisation (NFA). Firms which are already authorised and intend to operate PDSs in addition to their existing activities must submit a variation of permission (VoP) application. 5.3 We outlined our proposed approach to authorising PDS firms in Chapter 8 of CP22/25. We explained that the NFA and VoP application forms are important because the information given, and documents submitted with it, are the basis on which we assess whether the firm is ready, willing and able to conduct the relevant regulated activity. 5.4 When applying, all firms must show how they meet the minimum standards as set out in the Financial Services and Markets Act 2000 (FSMA) (known as the Threshold Conditions), both at the time of authorisation and ongoing. All FCA regulated firms must meet the Threshold Conditions to be able to undertake the regulated activities they intend to carry out. 5.5 We are likely to ask firms for additional/more detailed information and/or documents as part of our gateway assessment. It is important that firms provide all the information we request in good time to help avoid delays in assessing the application. Outside the PDS Wider PDS: beyond view data Core PDS: find and view

63 5.6 Where an application for FCA permissions is complete, we will usually assess it within 6 months. If an application isn’t complete, it could take up to 12 months, so firms should allow time for this. We give further information on our authorisation process at How to apply for authorisation or registration. 5.7 Applications for NFA or VoP and supporting documentation can be submitted at any time after we open the authorisations gateway. But we expect firms to only apply for the new permission when they can show that they are ready, willing and organised to undertake the activity of operating a PDS in line with our regulatory standards. 5.8 We expect firms to show this through a well-developed technology infrastructure and business plan, which should give us detailed information about the business, in particular: • the activities the firm proposes to carry out • the key regulatory, operational and other risks involved • how the firm will mitigate these risks • how it will comply with its various regulatory obligations on an ongoing basis 5.9 Advice on how to put together a regulatory business plan is on our Authorisation webpages and includes a sample business plan. 5.10 A firm is unlikely to be able to show it is ready and organised to operate a PDS if it is not also ready and capable of meeting the requirements under the Pensions Dashboards Regulations 2022 and Pensions Dashboard Programme (PDP) standards. 5.11 So, although we are finalising our rules for PDS firms, we are not yet opening the gateway to receive applications for authorisation and variation of permission. We will not open the gateway until it is possible for a firm to show that it is ready, willing and organised. This means we will not open the gateway until the Government and PDP have produced all the information necessary for a firm to design and build a PDS. 5.12 We will provide industry with adequate advance notice of the gateway opening, accompanied by the finalised application forms. Draft forms were appended to CP22/25 for illustrative purposes. Firms may still find it helpful to consult these, but they are not definitive versions of the forms and sections could be added, deleted or revised before they are finalised. Supervision 5.13 Once authorised, the senior managers of firms are responsible for making sure their firms act in line with our principles and rules that set out the minimum standards of conduct. Firms are responsible for conducting their business in a proper and responsible way, and to comply with the spirit – not just the letter – of our rules and guidance. 5.14 We supervise to make sure firms and individuals comply with our rules. Our Supervision Manual (SUP) describes the operation of our supervisory function, as well as requirements on firms relating to the supervisory function.

64 5.15 In CP22/25, we proposed to apply the relevant sections of SUP to all firms with the PDS permission and require PDS firms to: • notify us of significant changes in their business • report to us key data on a regular basis • keep adequate records to show compliance with the regulatory system 5.16 We asked: Question: Do you agree with our proposed application of existing Supervision Manual (SUP) rules? Feedback received 5.17 All respondents who answered this question were broadly supportive of our proposed application of existing SUP rules to PDS firms. Our response Our final rules adopt the application of existing SUP rules as proposed in CP22/25. Firms should familiarise themselves with the detail of SUP and the provisions that apply according to the regulated activities they undertake. We give further information about how and why we supervise in our approach to supervision. Notification requirements 5.18 In CP22/25 we proposed to apply to PDS firms all the SUP 15 notification requirements that apply to almost all FCA regulated firms. Specifically, PDS firms must notify us when there is a significant change in their business, including but not limited to: • matters having a serious regulatory impact (SUP 15.3.1R) • a significant breach of a rule (SUP 15.3.11R) • a significant event involving fraud (SUP 15.3.17R) • anything relating to the firm of which the FCA would reasonably expect notice, such as a significant failure in systems or controls (SUP 15.3.8G and Principle 11). 5.19 We also proposed additional PDS-specific notifications for all firms that hold the permission to undertake the new PDS activity. Specifically, the PDS firm must notify us of any: • incident which may compromise the security, integrity and confidentiality of any personal pensions information held in the firm’s PDS capacity (SYSC 4.1.5CR) • changes to its third-party arrangements • material changes to its post-view services (PVS) • scam it becomes aware of that relates to its dashboard

65 5.20 We asked: Question: Do you agree with our proposed approach to notification requirements? Feedback received 5.21 Most respondents to this question supported our proposed notification requirements. 5.22 One industry respondent asked whether our proposals require automated reports rather than governance/escalation route via regulatory liaison. 5.23 Only one respondent opposed one of our notification requirements: material changes to PVS. They argued that PDS firms should have full control over their innovation process and digital journeys, without FCA oversight. 5.24 A small number of respondents asked for further explanation of what would constitute a ‘material change’ that warrants notification. Our response Our final rules adopt the approach to notification requirements we proposed in CP22/25. Method of notification The method of submitting SUP 15 notifications is the same for PDS firms as other FCA regulated firms. SUP 15.3 contains guidance which explains that: • A firm making a notification in line with SUP 15.3.1 R should consider SUP 15.7.2 G and notify the FCA by telephone if appropriate. • A notification under Principle 11 may be given orally, although the FCA may request written confirmation of a matter. • A firm is responsible for making sure that matters are properly and clearly communicated to the FCA. • A firm should provide a written notification if a matter either is complex or may require the FCA to take action. • A firm should also have regard to Principle 11 and the guidance in SUP 15.7.2 G. • PDCOB 15 explains that the notifications required under PDCOB 15.1- 15.4 must be provided in writing using the relevant form that will be available on Connect (our secure online system). Nature and purpose of notifications The event-driven notifications target specific harms in the new market and will support our supervisory work. The change notifications are not requests for approval – the onus is on the firm to ensure that any change complies with our rules, including the Principles for Businesses, and the Consumer Duty obligations. Rather, the change notifications will help us understand the development of this new market and facilitate fully

66 informed supervision. Consequently, supervisors may ask the firm to supply further information, including sharing any relevant records that the firm is required to keep complying with its regulatory obligations. Our draft and now final rules include guidance that a material change to PVS includes, but is not limited to, alteration of a PVS in such a way which affects the customer’s experience of the PVS. Regulatory reporting requirements 5.25 In CP22/25, we proposed to apply a small number of existing regulatory reporting obligations to PDS firms. Specifically, PDS firms must submit: • annual controllers report (SUP 16.4) • annual close links reports (SUP 16.5) • annual reports and accounts (SUP 16. 7A) • verification that firm’s details are accurate and up to date (SUP 16.10) • a regulatory return to demonstrate compliance with Principle 4 and prudential requirements (SUP 16.12) • information about its Directory persons (SUP 16.26) 5.26 We asked: Question: Do you agree with our proposed approach to regulatory reporting? Feedback received 5.27 Respondents to this question were broadly supportive of our proposed approach. Our response Our final rules adopt the approach to regulatory reporting we proposed in CP22/25. The reports required under SUP 16 help us to monitor firms’ compliance with Principles governing relationships between firms and their customers, with Principle 4, which requires firms to maintain adequate financial resources, and with other requirements and standards under the regulatory system. The reporting requirements under SUP 16 are separate from any requirements placed on PDS firms by PDP’s reporting standards which will enable MaPS in monitoring the effectiveness and overall health of the pensions dashboard ecosystem.

67 Record-keeping requirements 5.28 All FCA regulated firms are required to keep orderly records of their business and internal organisation to enable us to monitor their compliance with regulatory requirements and obligations to customers (SYSC 9). Additionally, in CP22/25 we proposed that all PDS firms must keep a record of: • their dashboard service customer journey for 6 years - the record must be updated when there is a material change to the journey • the number of customers – using the dashboard service – using a PVS – using all PVS (where the firm offers more than one PVS) – exporting their data to a) self, b) the firm and c) a connected person (where the PDS firm offers these options) • the total number of times: – a PVS is used – all PVSs are used (where the firm offers more than one PVS) – data is exported to a) self and b) the firm (where the firm offers these options) 5.29 We proposed that where a PDS firm has entered third-party arrangements, the PDS firm must keep a separate record for each third-party dashboard provider and arrangement. 5.30 We asked: Question: Do you agree with our record-keeping proposals? Feedback received 5.31 Respondents to this question broadly agreed with our proposals. 5.32 One trade association asked for guidance on what would constitute a substantive or material changes to the consumer journey that should be recorded. 5.33 One consumer organisation suggested that records of equality and diversity data should also be kept, to support assessments of the impact of digital exclusion on particular groups. Our response We are taking forward the record-keeping requirements we proposed in CP22/25. We recognise there will be some changes to the customer journey which are minor. For example, updating the firm’s contact details or a formatting change. There will also be more substantive or material changes, such as

68 adding or removing marketing from a dashboard service. PDCOB 16.2.3R explains that a material change is anything that could affect the way a customer may understand the services offered on the pensions dashboard platform, or the way in which a customer is able to use the services. A PDS firm is not required to gather equality data as part of the ’view’ process. Further, a PDS firm will not receive any of the customer’s ‘find’ data. So, it would not be possible to introduce the additional requirements suggested by the consumer group. None of our final record-keeping rules require the PDS firm to capture any customer’s personal data. We may look to turn these record-keeping requirements into regulatory reporting requirements in future as the market develops. Enforcement 5.34 In CP22/25 we explained that FSMA sets out our enforcement powers. We proposed to apply to PDS firms our: • Enforcement Guide (EG) (which sets out our approach to enforcement and how we use our powers of investigation, gather information and investigate) • Decision Procedure and Penalties Manual (DEPP) to PDS firms 5.35 This proposal would ensure we adopt the same approach to PDS firms as other regulated firms when carrying out enforcement investigations, using sanctions and decision-making. 5.36 We asked: Question: Do you have any comments on our proposal to apply the same approach to enforcement investigations and actions to PDS firms as we do to other regulated firms, as set out in our Enforcement Guide (EG)? Question: Do you have any comments on our proposal to follow the same procedures for decision-making and imposing penalties in relation to PDS firms and individuals set out in our Decision Procedure and Penalties Manual (DEPP)? Feedback received 5.37 Most respondents to these questions supported our proposal to apply the same enforcement approach and procedures to PDS as to other FCA regulated firms. 5.38 Two respondents flagged concern that these powers would not extend to any steps or activity that the customer pursues outside the dashboard.

69 Our response As proposed in CP22/25, our final rules confirm that our Enforcement Guide and Decision Procedure and Penalties Manual (DEPP) would apply to PDS firms. We recognise respondents’ concerns about the actions a consumer might take after visiting a dashboard (with or without the encouragement of other parties). The introduction of the new regulated activity empowers us to make rules governing the conduct of PDS firms. But we cannot make rules for every consumer experience after their interaction with the firm. We can, however, make rules that ensure that a consumer is well-informed and aware of any risks that might attach to their actions outside the dashboard.

70 Annex 1 List of non-confidential respondents We are obliged to include a list of the names of respondents to our two consultations who have consented to the publication of their name. That list is as follows for Consultation Paper 22/25: Proposed regulatory framework for pensions dashboard service firms: Abaka Association of British Insurers Aegon AgeWage AJ Bell Association of Pension Lawyers Aviva Bravura Solutions Ltd BT Pension Scheme Management Fidelity International Financial Services Consumer Panel Iress Laverock Financial Consulting Legal and General Moneyhub National Pension Trust Nest Corporation Pensions Administration Standards Association Pensions Management Institute People’s Partnership Phoenix Group Pensions and Lifetime Savings Association Royal London Sackers and Partners LLP

71 Scottish Widows Smart Pension The Money Charity The Society of Pension Professionals The Investing and Saving Alliance Which? Willis Towers Watson The list is as follows for Consultation Paper 24/4: The regulatory framework for pensions dashboard service firms: further consultation Association of British Insurers Aegon AJ Bell Aviva Bravura Solutions Ltd Equisoft Financial Services Consumer Panel FCA Practitioner Panel Ferret Information Systems Hargreaves Lansdown Legal and General The Money and Pensions Service MoneyHub Phoenix Group Personal Investment Management and Financial Advice Association Pensions and Lifetime Savings Association Sackers and Partners LLP Scottish Widows Society of Pension Professionals People’s Partnership The Investing and Saving Alliance

72 Annex 2 Abbreviations used in this paper Abbreviation Description AGBR Advice Guidance Boundary Review CBA Cost Benefit Analysis CDA Central Digital Architecture COBS Conduct of Business sourcebook COCON Code of Conduct sourcebook CONC Consumer Credit sourcebook COND Threshold Conditions sourcebook CJ Compulsory Jurisdiction (of the Financial Ombudsman Service) CP Consultation paper CP22/25 CP22/25: Proposed regulatory framework for pensions dashboard service firms CP24/4 CP24/4: Further consultation on the regulatory framework for pensions dashboard service firms DB Defined benefit pension DC Defined contribution pension DEPP Decision Procedure and Penalties Manual DISP Disputes Resolution: Complaints sourcebook DWP Department for Work and Pensions EG Enforcement Guide ESG Environmental, social and governance FCA Financial Conduct Authority FEES Fees Manual

73 Abbreviation Description FIT Fit and Proper test for Employees and Senior Personnel sourcebooks FSMA Financial Services and Markets Act 2000 GEN General Provisions sourcebook ICO Information Commissioner’s Office LRRA Legislative and Regulatory Reform Act 2006 MaPS Money and Pensions Service MIPRU Prudential sourcebook for Mortgage and Home Finance Firms, and Insurance Intermediaries PDCOB Pensions Dashboard Conduct of Business sourcebook PDP Pensions Dashboards Programme PDS Pensions dashboard service PECR Privacy and Electronic Communications Regulations PERG Perimeter Guidance Manual PII Professional Indemnity Insurance PRIN Principles for Business sourcebook PS Policy Statement PVS Post-view services RAO Regulated Activities Order SM&RC Senior Mangers and Certification Regime SMF Senior Manager Function SYSC Senior Management Arrangements, Systems and Controls SYSC sourcebook TPR The Pensions Regulator UK GDPR UK General Data Protection Regulation

74 Abbreviation Description VJ Voluntary Jurisdiction (of the Financial Ombudsman Service) VOP Variation of permission WDPG Wind-down Planning Guide All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 020 7066 6087 Sign up for our news and publications alerts

Appendix 1 Made rules (legal instrument)

FCA 2024/42 FOS 2024/4 PENSIONS DASHBOARD SERVICE INSTRUMENT 2024 Powers exercised by the Financial Conduct Authority A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 137A (The FCA’s general rules); (2) section 137T (General supplementary powers); (3) section 139A (Power of the FCA to give guidance); and (4) section 226 (Compulsory jurisdiction). B. The rule-making provisions listed above are specified for the purposes of section 138G(2) (Rule-making instruments) of the Act. C. The FCA consents to and approves the rules and guidance and standard terms made and amended and fixed and varied by the Financial Ombudsman Service Limited, as set out at paragraph D below. Powers exercised by the Financial Ombudsman Service Limited D. The Financial Ombudsman Service Limited makes and amends the rules and guidance for the Voluntary Jurisdiction and fixes and varies the standard terms for Voluntary Jurisdiction participants, as set out in Annex G to this instrument, and incorporates the changes to the Glossary of definitions as set out in Annex A to this instrument, in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 227 (Voluntary jurisdiction); (2) paragraph 8 (Information, advice and guidance) of Schedule 17; (3) paragraph 18 (Terms of reference to the scheme) of Schedule 17; and (4) paragraph 20 (Voluntary jurisdiction rules: procedure) of Schedule 17.

E. The making and amendment of the rules and guidance and the fixing and varying of the standard terms by the Financial Ombudsman Service Limited, as set out at paragraph D above, is subject to the consent and approval of the Financial Conduct Authority. Commencement F. This instrument comes into force on 30 November 2024. Amendments to the Handbook G. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2) below.

FCA 2024/42 FOS 2024/4 Page 2 of 106 (1) (2) Glossary of definitions Annex A Principles for Businesses sourcebook (PRIN) Annex B Senior Management Arrangements, Systems and Controls sourcebook (SYSC) Annex C Fees manual (FEES) Annex D Supervision manual (SUP) Annex F Dispute Resolution: Complaints sourcebook (DISP) Annex G Amendments to material outside the Handbook H. The Perimeter Guidance manual (PERG) is amended in accordance with Annex H to this instrument. Making the Pensions Dashboards: Conduct of Business sourcebook (PDCOB) I. The FCA makes the rules and gives the guidance in accordance with Annex E to this instrument. J. The Pensions Dashboards: Conduct of Business sourcebook (PDCOB) is added to the Business Standards block within the Handbook, immediately after the Funeral Plan: Conduct of Business sourcebook (FPCOB). Notes K. In the Annexes to this instrument, the notes (indicated by “Note:” and “Editor’s note:”) are included for the convenience of readers but do not form part of the legislative text. Citation L. This instrument may be cited as the Pensions Dashboard Service Instrument 2024. By order of the Board of the Financial Conduct Authority 31 October 2024 By order of the Board of the Financial Ombudsman Service Limited 4 November 2024

FCA 2024/42 FOS 2024/4 Page 3 of 106 Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. Insert the following new definitions in the appropriate alphabetical position. The text is not underlined. Dashboard Regulations the Pensions Dashboards Regulations 2022 (SI 2022/1220). data export (in PDCOB) the service by which a customer’s pensions dashboard view data is transferred outside the MaPS pensions dashboards ecosystem. data export to the firm (in PDCOB) data export to a firm in accordance with PDCOB 11.2.1R(2). PDCOB the Pensions Dashboards: Conduct of Business sourcebook. pensions dashboard platform (a) view services; and (b) (where applicable) permitted dashboard services. permitted dashboard service (a) data export; and (b) post-view services. post-view services services, other than data export, that: (a) can only be accessed by a customer within a qualifying pensions dashboard service and only when the customer selects the choice in accordance with the first column of the table in PDCOB 8.2.8R; (b) do not take the customer outside of the qualifying pensions dashboard service; (c) can only be provided by a firm with the permission to carry on regulated pensions dashboard activity; and (d) meet the requirements of PDCOB 12.3.1R(1). regulated pensions dashboard activity the regulated activity in article 89BA of the Regulated Activities Order.

FCA 2024/42 FOS 2024/4 Page 4 of 106 third-party dashboard access provider a person that: (a) does not have permission to carry on regulated pensions dashboard activity; and (b) under an arrangement with a firm that does have permission to carry on regulated pensions dashboard activity, makes available to a customer a pensions dashboard platform, for which the firm is responsible. third-party dashboard arrangement an arrangement: (a) entered into by a firm with permission to carry on regulated pensions dashboard activity; and (b) under which a person, that does not have permission to carry on regulated pensions dashboard activity, makes a pensions dashboard platform, for which the firm is responsible, available to a customer. view services services providing the display of pensions dashboard view data by a firm carrying on regulated pensions dashboard activity. Amend the following definitions as shown. core capital resources requirement … (2) for a firm with a Part 4A permission to carry on funeral plan distribution to which FPCOB 15 applies and that does not also carry on any other regulated funeral plan activity, the requirement specified in FPCOB 15.6.1R; or (3) for a firm with a Part 4A permission to carry on any other regulated funeral plan activity to which FPCOB 15 applies, the requirement specified in FPCOB 15.5.1R.; (4) for a firm with a Part 4A permission to carry on regulated pensions dashboard activity to which PDCOB applies, the requirement specified in PDCOB 13.5.1R; or (5) for a firm to which PDCOB applies that also has a Part 4A permission to carry on other regulated activities, the requirement specified in PDCOB 13.6.1R. customer … (B) in the FCA Handbook: (1) (except in relation to SYSC 19F.2, ICOBS, retail premium finance, a credit-related regulated activity,

FCA 2024/42 FOS 2024/4 Page 5 of 106 regulated claims management activity, regulated funeral plan activity, regulated pensions dashboard activity, MCOB 3A, an MCD credit agreement, CASS 5, PRIN in relation to MiFID or equivalent third country business, DISP 1.1.10-BR, PROD 1.4 and PROD 4) and in relation to payment services and issuing electronic money (where not a regulated activity) a client who is not an eligible counterparty for the relevant purposes. … (9) … (10) (in relation to regulated pensions dashboard activity) a pensions dashboard user or a potential pensions dashboard user. customer’s best interests rule (1) … (1A) (in relation to regulated pensions dashboard activity) PDCOB 2.1.1R. … fair, clear and not misleading rule … (2) … (2A) (in relation to regulated pensions dashboard activity) PDCOB 4.2.1R. … general solvency requirement (1) (in relation to regulated funeral plan activity) the requirement specified in FPCOB 15.2.1R. (2) (in relation to regulated pensions dashboard activity) the requirement specified in PDCOB 13.2.1R. individual capital guidance (1) (other than in (2) and (3)) guidance given to a firm about the amount and quality of capital resources that the appropriate regulator thinks the firm should hold at all times under the overall financial adequacy rule as it applies on a solo level or a consolidated level. (2) …

FCA 2024/42 FOS 2024/4 Page 6 of 106 (3) (in PDCOB 13) guidance given to a firm about the amount and quality of capital resources that the FCA thinks the firm should hold at all times under PDCOB 13.2.1R (General solvency requirement). individual liquidity guidance … (2) … (3) (in PDCOB 13) guidance given to a firm about the amount, quality and funding profile of liquidity resources that the FCA thinks the firm should hold at all times under PDCOB 13.2.1R (General solvency requirement). pensions dashboard find data (1) (in COBS 19.11) data which enables pensions dashboard matching the pensions dashboard matching process to take place, comprising: … (c) any other data elements that the Money and Pensions Service may add as part of the services that it provides. (2) (in PDCOB) (a) data which enables the pensions dashboard matching process to take place, comprising: (i) pensions dashboard verified identity attributes; (ii) pensions dashboard self-asserted data elements; and (iii) any other data elements that the Money and Pensions Service may add as part of the services that it provides; or (b) ‘find data’ as defined in Schedule 1 of the Dashboard Regulations, as applicable. pensions dashboard standards (1) (in COBS 19.11) standards, specifications or technical requirements published by the money and pensions service from time to time for the purpose of section 137FAA(4) of the Act comprising of the following matters in relation to any part of the MaPS pensions dashboards ecosystem: … (f) data.

FCA 2024/42 FOS 2024/4 Page 7 of 106 (2) (in PDCOB and PERG 12A) standards, specifications or technical requirements published by the money and pensions service from time to time for the purpose of section 137FAA(4) of the Act comprising the following matters in relation to any part of the MaPS pensions dashboards ecosystem: (a) connection and security; (b) technical; (c) service; (d) operational; (e) reporting; (f) data; and (g) design. pensions dashboard view data (1) (in COBS 19.11) the data comprising: … (d) contextual information. (2) (in PDCOB) the data comprising the information that must be displayed on a qualifying pensions dashboard service under Regulations 8, 9 and 10 of the Dashboard Regulations. regulated activity … (B) in the FCA Handbook: (in accordance with section 22 of the Act (Regulated activities)) the activities specified in Part II (Specified activities), Part 3A (Specified activities in relation to information) and Part 3B (Claims management activities in Great Britain) of the Regulated Activities Order, which are, in summary: … (tu) advice, investigation or representation in relation to a criminal injury claim (article 89L); and (tv) advice, investigation or representation in relation to an employment-related claim (article 89M); and (tw) regulated pensions dashboard activity (article 89BA);

FCA 2024/42 FOS 2024/4 Page 8 of 106 …

FCA 2024/42 FOS 2024/4 Page 9 of 106 Annex B Amendments to the Principles for Businesses sourcebook (PRIN) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Rules about application … 3.2 What? 3.2.1A R PRIN (other than Principle 12 and PRIN 2A) applies with respect to the carrying on of: … (3) ancillary activities in relation to designated investment business, home finance activity, regulated funeral plan activity, credit￾related regulated activity, insurance distribution activity, regulated pensions dashboard activity and accepting deposits; and … … 3.4 General Clients and the Principles 3.4.-1 R PRIN 3.4.1R, PRIN 3.4.2R and PRIN 1 Annex 1 do not apply with respect to: … (4) … (4A) regulated pensions dashboard activity; or … …

FCA 2024/42 FOS 2024/4 Page 10 of 106 Annex C Amendments to the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Application and purpose … 1 Annex 1 Detailed application of SYSC … Part 2 Application of the common platform requirements (SYSC 4 to 10) … What? … 2.10 R The provisions on record-keeping in SYSC 9 and articles 21 and 72 of the MiFID Org Regulation apply as set out in SYSC 1 Annex 1.2.8R and SYSC 1 Annex 1.2.8AR, except that they only apply to the carrying on of ancillary activities that are performed in relation to: … (4) credit-related regulated activity.; and (5) regulated pensions dashboard activity. … Part 3 Tables summarising the application of the common platform requirements to different types of firm … Table A: Application of the common platform requirements in SYSC 4 to SYSC 10 Provision SYSC 4 COLUMN A Application to a common COLUMN A+ Application to a UCITS COLUMN A++ Application to a full-scope UK COLUMN B Application to all other firms

FCA 2024/42 FOS 2024/4 Page 11 of 106 platform firm other than to a UCITS investment firm management company AIFM of an authorised AIF apart from insurers, UK ISPVs, managing agents, the Society, full￾scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 4.1.5R … … … … SYSC 4.1.5AR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity SYSC 4.1.5BR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity SYSC 4.1.5CR Not applicable Not applicable Not applicable Applies as a rule only to a firm carrying on regulated pensions dashboard activity … … Provision COLUMN A COLUMN A+ COLUMN A++ COLUMN B

FCA 2024/42 FOS 2024/4 Page 12 of 106 SYSC 6 Application to a common platform firm other than to a UCITS investment firm Application to a UCITS management company Application to a full-scope UK AIFM of an authorised AIF Application to all other firms apart from insurers, UK ISPVs, managing agents, the Society, full￾scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 6.3.9R Rule For firms carrying on a credit-related regulated activity or regulated claims management activity, or operating an electronic system in relation to lending, applies only where the Money Laundering Regulations apply to the firm. Rule does not apply to a firm with a limited permission for entering into a regulated credit agreement as lender. Rule

FCA 2024/42 FOS 2024/4 Page 13 of 106 does not apply to a firm for which a professional body listed in Schedule 1 to the Money Laundering Regulations, and not the FCA, acts as the supervisory authority for the purposes of those regulations. (FCA Handbook only). Rule does not apply to a firm carrying on regulated pensions dashboard activity. … … 3 Systems and controls … 3.2 Areas covered by systems and controls … Investment strategy and investment decision making 3.2.23 G … Operators of pensions dashboard services: security, integrity and confidentiality 3.2.24 R A firm carrying on regulated pensions dashboard activity must comply with the requirements set out in SYSC 4.1.5AR, SYSC 4.1.5BR and SYSC 4.1.5CR as if those rules applied to firms to which SYSC 3 applies.

FCA 2024/42 FOS 2024/4 Page 14 of 106 … 4 General organisational requirements 4.1 General requirements … Mechanisms and procedures for a firm … 4.1.5 R … Operators of pensions dashboard services: security, integrity and confidentiality 4.1.5A R A firm carrying on regulated pensions dashboard activity must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of any personal or pensions information held by the firm, taking into the account the nature of the information in question. 4.1.5B R A firm carrying on regulated pensions dashboard activity must keep appropriate records to demonstrate compliance with SYSC 4.1.5AR. 4.1.5C R (1) If there is an incident which may compromise the security, integrity or confidentiality of any personal or pensions information held by the firm, the firm must immediately notify the FCA using the relevant form in Connect. (2) A notification under (1) must contain: (a) a description of the incident; (b) the time of the incident (where known); and (c) a description of the steps the firm is taking since being made aware of the incident (where applicable). … 23 Senior managers and certification regime: Introduction and classification … 23.2 Definitions and types of firms … 23.2.3 G Broadly speaking, firms covered by the senior managers and certification regime that are regulated by the FCA are divided into three categories:

FCA 2024/42 FOS 2024/4 Page 15 of 106 … (3) Firms whose business is limited to certain types. These are called “limited scope SMCR firms”. A large number of firms will be in this category. The main examples are: … (f) a firm that only has permission for benchmark activities and has the benefit of a waiver treating it as a limited scope SMCR firm as described in SYSC 23 Annex 1 6.12R (Benchmark firms: Waiver applying limited scope status); and (g) a firm that only has permission for funeral plan distribution.; and (h) a firm that only has permission for regulated pensions dashboard activity and, if applicable, making arrangements with a view to transactions in investments, which has a limitation to activities that are post-view services as permitted under PDCOB 12. … 23 Annex 1 Definition of SMCR firm and different types of SMCR firms … Part Six: Definition of limited scope SMCR firm … Benchmark firms: Opting to be a core or enhanced scope firm … 6.27 G … Pensions dashboard service 6.28 R A firm is a limited scope SMCR firm if it meets the following conditions: (1) it has permission to carry on regulated pensions dashboard activity; and (2) either: (i) it does not have permission to carry on any other regulated activity; or

FCA 2024/42 FOS 2024/4 Page 16 of 106 (ii) it does not have permission to carry on any other regulated activity except for: (a) permission to carry on making arrangements with a view to transactions in investments which has a limitation to activities which are post-view services as permitted under PDCOB 12; and/or (b) permission for agreeing to carry on a regulated activity in respect of regulated pensions dashboard activity. 6.29 G The FCA considers that, if a firm offers post-view services as permitted under PDCOB 12, the firm may need permission to carry on the regulated activity of making arrangements with a view to transactions in investments which has a limitation to activities which are post-view services as permitted under PDCOB 12. In that scenario, the firm will be a limited scope SMCR firm if it meets the requirement in SYSC 23 Annex 1 6.28R. …

FCA 2024/42 FOS 2024/4 Page 17 of 106 Annex D Amendments to the Fees manual (FEES) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Application, Notification and Vetting Fees … 3 Annex 1R Authorisation fees payable … Part 2 – Pricing categories applicable to applications made in the following activity groupings in the A, B, C, CC and CMC fee blocks Activity grouping Description Applicable pricing category in FEES 3 Annex 1AR … A.23 Carrying out a funeral plan contract as provider and entering as provider into a funeral plan contract 6 A.24 Carrying on regulated pensions dashboard activity 5 … … 4 Periodic fees … 4.2 Obligation to pay periodic fees … Calculating all other fees in the second and subsequent years of authorisation where a full year of tariff data is not available … 4.2.7K R Where the measure is not cumulative (e.g. the number of traders for fee￾block A10), the firm must use the figure relating to the valuation date

FCA 2024/42 FOS 2024/4 Page 18 of 106 specified in FEES 4 Annex 1AR Part 5 (e.g. 31 December for A10). Table A sets out the reporting requirements for the key fee-blocks when full actual data is not available: Table A: calculating tariff data for second and subsequent years of authorisation when full trading figures are not available Fee-block Tariff base Calculation where trading data are not available … A.24 … A.25 Flat fee Not applicable … … 4 Annex 1AR FCA activity groups, tariff bases and valuation dates Part 1 This table shows how the FCA links the activities (for which a firm has permission or designation) to activity groups (fee-blocks). A firm can use the table to identify which fee￾blocks it falls into based on its permission or its other activities. Activity group Fee payer falls into the activity group if: … A.24 Access to cash - designated firms … A.25 Pensions dashboard firms Its permissions include carrying on regulated pensions dashboard activity. … …

FCA 2024/42 FOS 2024/4 Page 19 of 106 Part 3 This table indicates the tariff base for each fee-block set out in Part 1. The tariff base in this Part is the means by which the FCA measures the amount of business conducted by a firm for the purposes of calculating the annual periodic fees payable to the FCA by that firm. Activity group Tariff base … A.24 … A.25 Not applicable. … … Part 5 This table indicates the valuation date for each fee-block. A firm can calculate its tariff data in respect of fees payable to the FCA by applying the tariff bases set out in Part 3 with reference to the valuation dates shown in this table. Activity group Valuation date IN THIS TABLE, REFERENCES TO SPECIFIC DATES OR MONTHS ARE REFERENCES TO THE LATEST ONE OCCURRING BEFORE THE START OF THE PERIOD TO WHICH THE FEE APPLIES, UNLESS OTHERWISE SPECIFIED - E.G. FOR 2013/14 FEES (1 APRIL 2013 TO 31 MARCH 2014), A REFERENCE TO DECEMBER MEANS DECEMBER 2012. Where a firm’s tariff data is in a currency other than sterling, it should be converted into sterling at the exchange rate prevailing on the relevant valuation date. … A.24 … A.25 Not applicable. …

FCA 2024/42 FOS 2024/4 Page 20 of 106 4 Annex 2AR

FCA Fee rates for the period from 1 April 2024 to 31 March 2025 Part 1 This table shows the tariff rates applicable to each of the fee blocks set out in Part 1 of FEES 4 Annex 1AR. … Activity group Fee payable … A.24 … … A.25 Flat fee (£) £10, 000 … … 5 Financial Ombudsman Service Funding … 5 Annex 1R Annual General Levy Payable in Relation to the Compulsory Jurisdiction for 2024/25 … Compulsory jurisdiction – general levy Industry block Tariff base General levy payable by firm … 25. funeral plan intermediaries and funeral plan providers … … 26. firms carrying on regulated pensions dashboard activity Flat fee Levy of £65

FCA 2024/42 FOS 2024/4 Page 21 of 106 …

FCA 2024/42 FOS 2024/4 Page 22 of 106 Annex E Pensions Dashboards: Conduct of Business sourcebook (PDCOB) In this Annex, all of the text is new and is not underlined. 1 Application and purpose 1.1 Application 1.1.1 G (1) The Pensions Dashboards: Conduct of Business sourcebook (PDCOB) is the specialist sourcebook for firms carrying on regulated pensions dashboard activity. (2) PDCOB applies as described in the General Application provisions in PDCOB 1.3, unless modified in the manner described in the application provisions of a particular chapter, section or rule. (3) PERG 12A contains general guidance on when a firm will be carrying on regulated pensions dashboard activity. Where a firm enters an outsourcing arrangement with a third party, the third party will need to consider whether it is also carrying on regulated pensions dashboard activity taking into account the guidance in PERG 12A. 1.1.2 G Firms are reminded that they may require permissions to carry on regulated activities other than regulated pensions dashboard activity, in which case firms will need to comply with the conduct requirements in the FCA Handbook that are relevant to those activities in the usual way. 1.1.3 G Firms are also reminded that they may need to comply with other sourcebooks relating to conduct of business in the FCA Handbook (for example, COBS) where they also fall within the application provisions of those sourcebooks. 1.2 Purpose 1.2.1 G The purpose of PDCOB is to set out the detailed obligations that are specific to a firm carrying on regulated pensions dashboard activity and any related services carried on by that firm that are permitted under the rules in this sourcebook. PDCOB 17 refers to the other high-level obligations in the FCA Handbook that apply to such firms – for example, PRIN, SYSC and GEN. 1.3 General application Who? What? 1.3.1 R This sourcebook applies to a firm in relation to any of the following activities it carries on, offers or allows access to: (1) regulated pensions dashboard activity; (2) any post-view services;

FCA 2024/42 FOS 2024/4 Page 23 of 106 (3) data export; and (4) any other activity which could be carried out in a way that is connected to the qualifying pensions dashboard service, including: (a) any marketing relating to regulated pensions dashboard activity or post-view services; and (b) any communications relating to (1) to (3) above. 1.3.2 G For the purposes of PDCOB 1.3.1R(1), firms are reminded of the guidance in PERG 12A on when a firm will be carrying on regulated pensions dashboard activity and who will be considered to be the operator in relation to a particular qualifying pensions dashboard service where there is more than one party or firm involved. 1.3.3 R Where a firm involves a third-party dashboard arrangement in any part of the activities listed in PDCOB 1.3.1R, the rules in PDCOB 9 apply to the firm. Where? 1.3.4 R This sourcebook applies to all regulated pensions dashboard activity wherever in the world the customer accesses the pensions dashboard platform. 1.3.5 R A Gibraltar-based firm with permission for regulated pensions dashboard activity must comply with the provisions of PDCOB relating to regulated pensions dashboard activity. 2 General principles 2.1 The customer’s best interests rule 2.1.1 R A firm must act honestly, fairly and professionally in accordance with the best interests of its customer (the customer’s best interests rule). 2.2 Exclusion of liability 2.2.1 R A firm must not seek to exclude or restrict, or rely on any exclusion or restriction of any duty or liability it may have to a customer, unless: (1) it is reasonable for it to do so and it is consistent with the firm’s obligations under the customer’s best interests rule; and (2) the duty or liability arises other than under the regulatory system. 2.2.2 G The general law, including the CRA, also limits the scope for a firm to exclude or restrict any duty or liability to a customer. 2.3 Active election by a customer 2.3.1 R In this sourcebook, references to an active election by a customer must not be read to include an omission by a customer.

FCA 2024/42 FOS 2024/4 Page 24 of 106 2.3.2 G A failure by a customer to change a default option such as a pre-ticked box on a website is an example of an omission by a customer for the purposes of PDCOB 2.3.1R. 2.4 Inducements 2.4.1 R A firm must not pay or accept any fee or commission, or provide or receive any non-monetary benefit, unless the payment or acceptance of the fee or commission, or provision or receipt of the non-monetary benefit, would not impair compliance with the firm’s duty to act in accordance with the customer’s best interest rule. 2.4.2 G (1) Principle 8 requires a firm to manage conflicts of interest fairly, both between itself and its customers and between a customer and another customer. This principle extends to soliciting or accepting inducements where this would conflict with a firm’s duties to its customers. A firm that offers or accepts such inducements should consider whether doing so conflicts with its obligations under: (a) Principle 1 to act with integrity; (b) Principle 12 to act to deliver good outcomes for retail customers; or (c) the customer’s best interests rule. (2) An inducement is a benefit offered to a firm, or any person acting on its behalf, with a view to that firm, or that person, adopting a particular course of action. This can include, but is not limited to, cash, cash equivalents, commission, goods, hospitality or training programmes. (3) Firms should also refer to the rules on charging for the qualifying pensions dashboard service and post-view services (PDCOB 2.5 and PDCOB 12.4.1R to PDCOB 12.4.3R). 2.5 Restrictions on charging in relation to dashboard services 2.5.1 G Firms are reminded that the Dashboard Regulations require that view services must be provided without charge. Prohibition on charging other than for permitted dashboard services 2.5.2 R A firm must not impose a charge on a customer for any service other than for a permitted dashboard service. Prohibition on charging by other parties 2.5.3 R A firm must not permit any other person to charge in relation to any services on or from the firm’s pensions dashboard platform.

FCA 2024/42 FOS 2024/4 Page 25 of 106 Prohibition on providing a service for which a charge is payable without active election 2.5.4 R A firm must not impose a charge on a customer for a permitted dashboard service, or enter into an agreement with a customer under which a charge is, or may become, payable for a permitted dashboard service, unless the customer has actively elected to receive that service and pay that charge. 2.5.5 R A firm must not invite or induce a customer to receive services for which a charge will be, or may become, payable if the firm knows or has reasonable cause to suspect that the services are not permitted dashboard services or that an active election to be charged is unlikely to be made. Impact of auto-renewals on active election 2.5.6 R If, under the terms and conditions of a permitted dashboard service there is to be an automatic renewal of the agreement on substantially the same terms, it suffices for the purposes of PDCOB 2.5.4R if the customer actively elected to obtain the permitted dashboard service before entering into the initial agreement or a preceding renewal. 2.5.7 R An automatic renewal of the agreement is not to be regarded as being on substantially the same terms if, following the renewal, a charge, or a significant charge, will or may become payable for the permitted dashboard service for the first time (in which case, PDCOB 2.5.4R applies at the time of the renewal). Meaning of ‘charge’ 2.5.8 R For the purposes of this section, a charge includes any direct or indirect financial or non-financial consideration of any kind, whether payable to the firm or any other person. 2.5.9 G Firms are reminded that a similar prohibition on opt-out selling of add-on products is imposed by the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (www.legislation.gov.uk/uksi/2013/3134) in relation to additional payments under a contract where the main sale is not a financial service or product. 3 What is a firm permitted to do? 3.1 Permitted offers to customers 3.1.1 R A firm is only permitted to offer to customers: (1) view services; (2) data export in accordance with PDCOB 11; and (3) post-view services.

FCA 2024/42 FOS 2024/4 Page 26 of 106 3.1.2 G While a firm must provide view services as part of regulated pensions dashboard activity, data export and post-view services are optional activities that a firm may choose to provide. 3.2 Other permitted activities 3.2.1 R A firm is only permitted to undertake the following other activities: (1) communications in relation to PDCOB 3.1.1R(1) to (3) amounting only to: (a) information which the firm is required to display by law, including information under the Dashboard Regulations; and (b) communications which the firm is permitted or required to make under PDCOB or other rules; (2) the placement of advertisements as permitted under PDCOB 6.3 to PDCOB 6.4; (3) other marketing activities as permitted under PDCOB 7; (4) entry into a third-party dashboard arrangements in accordance with PDCOB 9; and (5) other activities necessary for the proper functioning of the activities in PDCOB 3.1.1R(1) and, where applicable, PDCOB 3.1.1R(2) and (3), including those required under PDCOB and other rules. 3.3 Activities not permitted 3.3.1 R A firm is not permitted, at any time before the customer has exited the pensions dashboard platform, to display or make visible to the customer any other commercial website or app or similar. 3.3.2 G For the avoidance of doubt, PDCOB 3.3.1R does not apply to website addresses or links to websites or apps. 4 Communications: general principles applying to all communications 4.1 Application 4.1.1 R This chapter applies with respect to a firm’s communications in relation to a pensions dashboard platform. 4.2 General principles applicable to all communications: the fair, clear and not misleading rule 4.2.1 R A firm must ensure that any communication it makes is fair, clear and not misleading.

FCA 2024/42 FOS 2024/4 Page 27 of 106 4.2.2 G A firm should consider whether the omission of any relevant fact could result in a communication being insufficiently clear or unfair, or could result in the communication being misleading. 4.2.3 G If a communication names the FCA, the PRA or both as the regulator of a firm or other provider and refers to matters not regulated by the FCA, the PRA or both, the firm should ensure that the communication makes clear that those matters are not regulated by the FCA, the PRA or both. 4.2.4 G Part 7 (Offences relating to financial services) of the Financial Services Act 2012 (www.legislation.gov.uk/ukpga/2012/21/contents) creates criminal offences relating to certain misleading statements and practices. 4.3 General principles applicable to communications: additional requirements including comprehensibility, prominence and notification of changes 4.3.1 R A firm must communicate information: (1) in the manner and form most likely to be comprehensible to a customer and in good time, having regard to their expected ability to comprehend information, including the abilities of customers with characteristics of vulnerability; (2) in English or in any other language agreed by the parties; (3) free of charge; and (4) prominently. 4.3.2 R The requirement to communicate to the customer prominently includes ensuring that the communication is visible and that the communication is accessible to customers without requiring them to expand a window or text box. 4.3.3 R A firm must notify a customer in good time about any material change to any information communicated to the customer which is relevant to a service that the firm is providing, or is proposing to provide, to that customer. 4.3.4 G (1) In determining what constitutes the provision of information ‘in good time’, a firm should take into account, having regard to the urgency of the situation, the customer’s need for sufficient time to read and understand the information before taking a decision. (2) A customer is likely to require more time to review information given on a complex or unfamiliar service, or a service a customer has no experience with, than a customer considering a simpler or more familiar service, or where the customer has relevant prior experience. 4.3.5 G The rules in this sourcebook regarding communications to customers do not prescribe the exact wording or formatting of the communications. To comply with the customer’s best interests rule, Principle 12 and the rules in relation to

FCA 2024/42 FOS 2024/4 Page 28 of 106 general communications in this sourcebook, a firm should consider the information needs of, and seek to make general communications appropriate and comprehensible for, a customer in their target market, including: (1) what a customer needs in order to understand the relevance of any information provided by the firm; (2) the point at which information will be most useful to the customer to enable them to make an informed decision; and (3) the firm’s obligations under PRIN 2A.5. 4.4 General principles applicable to communications: additional requirements for content to be balanced with appropriate warnings 4.4.1 R A firm must ensure that any communication it makes is balanced and contains appropriate risk warnings and, in particular: (1) does not emphasise any potential benefits that may be available to customers without also giving a fair and prominent indication of any relevant risks or downsides; (2) does not disguise, omit, diminish or obscure important items, statements or warnings; and (3) ensures that any comparisons or contrasts are meaningful and are presented in a fair, balanced way. 4.5 General principles applicable to communications: additional requirements in relation to the use of advertisements 4.5.1 R A firm must ensure that advertisements do not have the effect of impairing the quality of the firm’s communications. This includes not concealing or reducing their prominence or allowing for them to give a misleading impression. A firm must take into account the requirements in the FCA’s Handbook and the other requirements that a firm is subject to under law, including the Dashboard Regulations. 4.6 The reasonable steps defence to an action for damages 4.6.1 R If, in relation to a particular communication, a firm takes reasonable steps to ensure it complies with the fair, clear and not misleading rule, a contravention of that rule does not give rise to a right of action under section 138D of the Act. 5 Disclosure requirements 5.1 Purpose 5.1.1 G (1) This chapter requires firms to provide certain information and warnings to customers when they are using a pensions dashboard platform to enable them to understand the nature, limitations and risks relevant to

FCA 2024/42 FOS 2024/4 Page 29 of 106 the different stages of the pensions dashboard platform. This should manage customer expectations and support informed decision-making. (2) Save for the information set out in PDCOB 5.5.1R, firms can determine the specific point in time to provide the information and warnings which they would consider to be the most appropriate and effective, so long as it is provided by the points set out in the rules. 5.2 Form of messages 5.2.1 G The rules in this chapter do not prescribe the form in which the information and warnings should be communicated by firms to customers. Firms are able to: (1) choose the design, form, language and delivery of the information and warnings; and (2) determine the most effective and engaging way that they can convey the information and warnings to customers. 5.3 Information about a firm and its services and fees disclosure 5.3.1 R Before a customer is directed to the MaPS dashboards digital architecture to generate pensions dashboard find data, the firm must: (1) provide the customer with at least the following information: (a) the name and address of the firm, and the contact details necessary to enable a customer to communicate effectively with the firm; (b) appropriate information about the services offered by the firm, including regulated pensions dashboard activity and (if applicable) any data export and post-view services; (c) a statement that some pensions may not be displayed on a qualifying pensions dashboard service and at least 2 of the possible reasons; (d) a statement of the fact that the firm is authorised by the FCA; (e) if the firm has entered into a third-party dashboard arrangement, a statement of this fact, and the name of the third party that has given the customer access to the pensions dashboard platform; (f) information, or a link to a location containing information, about how a customer could register complaints about the firm with the firm and the Financial Ombudsman Service; and (g) any other information which the firm deems necessary so that the customer is reasonably able to understand the nature of the pensions dashboard platform that is being offered; and

FCA 2024/42 FOS 2024/4 Page 30 of 106 (2) inform the customer that: (a) the view services are free of charge; and (b) a fee may become payable for services other than view services, but only for those services which amount to permitted dashboard services. 5.3.2 R PDCOB 5.3.1R applies each time a customer is directed to the MaPS dashboards digital architecture. 5.3.3 G A firm disclosing details of its authorisation should refer to the appropriate forms of words set out in GEN 4 Annex 1R. 5.3.4 G For the purposes of the statement in PDCOB 5.3.1R(1)(c), examples of the reasons why a pension might not be shown on a qualifying pensions dashboard service include: (1) if a pension provider is not connected to the MaPS pensions dashboards ecosystem; or (2) if the customer is entitled to the present payment of the pension benefits. 5.3.5 G PDCOB 12.4 applies to a firm that imposes a fee in connection with any permitted dashboard service. 5.3.6 R Where a fee may become payable for a permitted dashboard service, the firm must inform the customer of the amount of the fee before the customer incurs a liability to pay the fee. 5.4 Disclosure warnings about the possibility of scams 5.4.1 R On each occasion that the customer uses the pensions dashboard platform, a firm must display the following: (1) a message warning the customer that if they are approached by a third party who asks for the customer’s data or asks to screen share, the customer should check who they are dealing with; (2) a message warning the customer about the risks of: (a) screen sharing with a third party; and (b) giving a third party access to the customer’s device, including remote access; (3) an explanation that a third party with control of the customer’s device can access and control more than what is visible on the screen, including one or more examples of what a third party can access remotely on a customer’s device; and

FCA 2024/42 FOS 2024/4 Page 31 of 106 (4) a reminder to the customer: (a) to think carefully about whether the third party needs to see the information on the screen; and (b) that pensions dashboard view data is sensitive, valuable and should be kept safe. 5.4.2 G Firms should consider warning customers to use the Financial Services Register to check whether a third party that claims to be authorised or exempt is who they say they are. 5.4.3 G Firms are reminded of the notification requirement relating to scams in PDCOB 15.2. 5.5 Disclosure information in relation to view data 5.5.1 R Immediately prior to the customer accessing their pensions dashboard view data, a firm must communicate to the customer the limitations of pensions dashboard view data, including that: (1) value data is supplied for illustrative purposes and the actual value could be higher or lower than those supplied; (2) the projected values are indicative of what a customer could receive, and are not guaranteed; (3) assumptions have been used to estimate the projected values; (4) projected values may change (increase or decrease) and may be influenced by changes in investment performance, contributions and the date the customer decides to take their pension; (5) more up-to-date figures and more details may be available from the pension provider or scheme administrator; (6) all figures are shown before tax; and (7) pensions dashboard view data may not be available in respect of some pensions. 5.5.2 G An example of where pensions dashboard view data may not be available is where the customer has started to draw their benefits. 5.5.3 G A firm should communicate the information in PDCOB 5.5.1R in a way which is fair, clear and not misleading. 5.6 Disclosure warnings about decision-making solely in reliance on view data and post-view services 5.6.1 R A firm must communicate a warning to a customer when that customer is to be provided with view services or post-view services stating that the customer

FCA 2024/42 FOS 2024/4 Page 32 of 106 should not make a financial decision based solely on the information displayed on the view services or (where applicable) post-view services. 5.6.2 R PDCOB 5.6.1R applies each time the customer is to be provided with view services or post-view services. 5.6.3 R Where a firm offers customers the option of collapsing, hiding or dismissing the warning in PDCOB 5.6.1R, it must only do so if the customer has taken positive action to allow that. 5.7 Other specific disclosures 5.7.1 G Firms are reminded that whether certain other specific disclosures must be made depends on how the firm chooses to operate its business. These disclosures include where the firm: (1) has entered into third-party dashboard arrangements (see PDCOB 9.6.1R); (2) provides data export to the customer (see PDCOB 11.4.1R, PDCOB 11.4.2R and PDCOB 11.4.6R); (3) provides data export to the firm (see PDCOB 11.5.1R); or (4) provides post-view services (see PDCOB 12.5.1R and PDCOB 12.5.2G). 6 Restrictions on advertising permitted on a pensions dashboard 6.1 Application 6.1.1 R (1) PDCOB 6.2 to PDCOB 6.4 apply to a firm that places advertisements on or around its pensions dashboard platform. (2) In this sourcebook, reference to the placement of advertisements encompasses the placement of advertisements for services by third parties as well as advertisements for the firm’s services. 6.2 Purpose 6.2.1 G The purpose of the rules in this chapter is to ensure that firms are only permitted to place certain types of advertisements on a pensions dashboard platform and only in a particular manner. 6.3 Restriction on types of advertisement 6.3.1 R A firm must not place advertisements on its pensions dashboard platform other than advertisements offering: (1) advising on investments (except pension transfers and pension opt-outs); and/or (2) post-view services.

FCA 2024/42 FOS 2024/4 Page 33 of 106 6.3.2 G Firms are reminded of the rule in PDCOB 8.4.4R which applies to any link contained within an advertisement that is placed on its pensions dashboard platform. 6.3.3 R Before a firm places an advertisement offering advising on investments (except pension transfers and pension opt-outs), the firm must check that the firm offering those services holds the relevant permission. 6.3.4 R A firm must ensure that an advertisement does not create the impression that the service is an appropriate service for the customer’s circumstances. 6.3.5 G Firms are reminded of the requirements under COBS 4 that apply to any financial promotions in relation to advising on investments (except pension transfers and pension opt-outs). 6.3.6 R Only a firm may place advertisements on or around its pensions dashboard platform, and must not permit any other person to have control over the placement of advertisements. 6.4 Restrictions on the manner in which advertisements are placed 6.4.1 R A firm must ensure that the placement and volume of advertisements on or around its pensions dashboard platform does not lead to any impairment in a customer’s ability to get the full benefit of the services available on the pensions dashboard platform. 6.4.2 G Firms are reminded of the need to ensure that their use of advertisements does not impair the quality of their communications, taking into account requirements in FCA rules (see PDCOB 4). 7 Restrictions on marketing: permitted tracking technology and use of customer information on a dashboard platform 7.1 Obligations on firms under general privacy laws 7.1.1 G Firms are reminded of the need to comply with data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). 7.2 Cookies 7.2.1 G A firm that wishes to use cookies, pixels, tags or similar technologies to track customers, is, in particular, reminded of the following requirements in the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR): (1) the requirement to obtain the customer’s consent for that technology to be used, unless the conditions in the PECR are satisfied.

FCA 2024/42 FOS 2024/4 Page 34 of 106 (2) that the acceptance of non-essential cookies should not be a pre￾condition of using any of the services on the pensions dashboard platform. 7.3 Obtaining a customer’s details for marketing purposes 7.3.1 R A firm must not: (1) add a customer’s details to its marketing database, unless the customer has actively elected to be added; or (2) undertake direct marketing to the customer, unless the customer has actively elected to receive direct marketing from the firm. 7.3.2 R Before requesting that a customer actively elects to receive direct marketing from the firm, the firm must tell the customer how and why their details will be processed. 7.3.3 R A firm must not require the customer to agree to direct marketing as a condition of using the pensions dashboard platform. 7.3.4 R A firm must not provide a customer’s details to another person for marketing purposes. 8 Choice architecture 8.1 Purpose 8.1.1 G (1) The purpose of the rules in this chapter in relation to the choice architecture is to enable customers to identify and understand the steps available and be in control of which steps they take in the qualifying pensions dashboard service. (2) The exit communications rules (at PDCOB 8.4) will ensure that customers are informed about when an action will take them outside of the qualifying pensions dashboard service. They are intended to assist customers to take appropriate care when viewing material outside of a qualifying pensions dashboard service. 8.2 Requirement to incorporate the choice architecture 8.2.1 R Subject to PDCOB 8.2.6R and PDCOB 8.2.9R, a firm must ensure that: (1) its pensions dashboard platform gives a customer choices: (a) in accordance with the first column of the table in PDCOB 8.2.4R; (b) which direct the customer in accordance with the second column in the table at PDCOB 8.2.4R; and

FCA 2024/42 FOS 2024/4 Page 35 of 106 (c) at the times described in PDCOB 8.3.1R; and (2) the customer can only progress beyond the times described in PDCOB 8.3.1R after they have made a selection from one of the choices set out in the first column of the table in PDCOB 8.2.4R or, where relevant, the first column of the table in PDCOB 8.2.5G, PDCOB 8.2.8R or PDCOB 8.2.11R. 8.2.2 R For the purposes of PDCOB, the provision of the choices as described in PDCOB 8.2.1R is referred to as the choice architecture. 8.2.3 G PDCOB 8.5 provides rules and guidance in relation to the presentation of the choice architecture. 8.2.4 R The choice architecture is set out in the following table. Choice offered to user Where to direct the user if they select the choice offered Does the direction take the user outside the pensions dashboard service? In all cases Take no further action Redirect to: (1) the firm’s wider digital environment outside of the qualifying pensions dashboard service from where the consumer can, if desired, take up other information, services and/or activities offered by the firm; or (2) the digital estate of a third￾party access dashboard provider, but only where a firm has agreed to this as part of the third-party dashboard arrangement that it has with that particular third-party access dashboard provider. Yes Obtain further information, support and impartial guidance from Money and Redirect to MoneyHelper. Yes

FCA 2024/42 FOS 2024/4 Page 36 of 106 Pensions Service MoneyHelper Find an adviser (that is regulated by the FCA and has permission to make personal recommendations) Redirect the customer to MoneyHelper to obtain impartial information about finding a financial adviser. Yes 8.2.5 G In addition to the choices set out in PDCOB 8.2.4R, a firm may offer the additional choices set out in the table below to a customer as part of the choice architecture: Choice offered to user Where to direct the user if they select the choice offered Does the direction take the user outside the pensions dashboard service? Raise a question or complaint about the service or the pensions dashboard view data, where relevant Redirect to the central complaints service for Money and Pensions Service. Yes Review, revoke or amend consents originally granted at the Consent and Authorisation Service. Redirect to the Pensions Dashboard Programme Consent and Authorisation service to manage consents. Yes 8.2.6 R Where a firm offers post-view services, the firm must, in addition to the requirements in PDCOB 8.2.1R, and PDCOB 8.2.9R where relevant, ensure that the choice architecture enables the customer to: (1) select the choice in accordance with the first column of the table in PDCOB 8.2.8R; and (2) be directed in accordance with the second column of the table in PDCOB 8.2.8R where that selection is made. 8.2.7 R A firm must ensure that a customer can only access post-view services by selecting the choice in accordance with the first column of the table in PDCOB 8.2.8R and that the choice is only offered as part of the choice architecture.

FCA 2024/42 FOS 2024/4 Page 37 of 106 8.2.8 R The additional choice to be offered as part of the choice architecture to a customer for the purposes of PDCOB 8.2.6R is set out in the following table. Choice offered to user Where to direct the user if they select the choice offered Does the direction take the user outside the pensions dashboard service? Explore and/or use a post-view service offered by the firm Continue to the firm’s post-view service. No 8.2.9 R Where a firm enables a customer to obtain a copy of their pensions dashboard view data through data export to the customer, the firm must, in addition to the requirements in PDCOB 8.2.1R, and PDCOB 8.2.6R where relevant, ensure that the customer: (1) is able to select the choice in accordance with the first column of the table in PDCOB 8.2.11R; and (2) is directed in accordance with the second column of the table in PDCOB 8.2.11R where that selection is made. 8.2.10 R A firm must ensure that a customer can only obtain a copy of their pensions dashboard view data through data export to themselves by selecting the choice in accordance with the first column of the table in PDCOB 8.2.11R and that the choice is only offered as part of the choice architecture. 8.2.11 R The additional choice to be offered as part of the choice architecture to a customer for the purposes of PDCOB 8.2.9R is set out in the following table. Choice offered to user Where to direct the consumer if they select the choice offered Does the direction take the user outside the pensions dashboard service? Obtain a copy of their pensions dashboard view data Customer taken through data export process to themselves. No 8.2.12 G A firm may offer a single choice for all post-view services or one choice for each post-view service that it offers. 8.2.13 G Where a customer elects to export their data to populate a post-view service, the firm should enable the customer to move to the relevant part of the

FCA 2024/42 FOS 2024/4 Page 38 of 106 qualifying pensions dashboard service, to ensure compliance with PDCOB 11.5. 8.2.14 G Firms are reminded of their obligations under DISP 1.3, in particular, to establish effective and transparent procedures for the reasonable and prompt handling of complaints. 8.3 Timing of the choice architecture 8.3.1 R A firm must ensure that it gives a customer the choices in accordance with PDCOB 8.2.1R, and PDCOB 8.2.5G, PDCOB 8.2.6R and PDCOB 8.2.9R where relevant, each time they have accessed any of the following: (1) pensions dashboard view data; (2) post view services; or (3) data export to the customer in accordance with PDCOB 11.2.1R(1). 8.4 Exit communications requirements 8.4.1 R Where a customer makes a choice from the choice architecture that would cause them to exit the qualifying pensions dashboard service, the firm must communicate to the customer: (1) that they are exiting the qualifying pensions dashboard service; (2) that their pensions dashboard view data will not be visible outside the qualifying pensions dashboard service; (3) where they are being directed to; and (4) that information seen by them after they have exited the qualifying pensions dashboard service will not be customised to them, or their pensions dashboard view data. 8.4.2 G Firms should determine the design, form, language and delivery of the exit communications in PDCOB 8.4.1R and are reminded of their obligations under Principle 12 and the retail customer outcome on consumer understanding in PRIN 2A.5. 8.4.3 G Firms are reminded of their obligations in PDCOB 4 in relation to communications. In particular, firms are reminded of the requirement that any communication it makes must be clear, fair and not misleading. 8.4.4 R Where a customer is provided with a link in circumstances other than those in PDCOB 8.4.1R that would cause them to exit the qualifying pensions dashboard service, a firm: (1) (subject to (2)) must comply with the exit communication requirements in PDCOB 8.4.1R(1), (2) and (4); and

FCA 2024/42 FOS 2024/4 Page 39 of 106 (2) must comply with the requirement in PDCOB 8.4.1R(3) unless it would be reasonable to conclude that it would be clear to a customer to where they are being directed, in which case, the firm may comply with that requirement if it wishes to do so. 8.4.5 G An example of where it would be clear to a customer to where they are being directed would be where a customer is provided with a link to the website of a particular pension scheme administrator in their pensions dashboard view data which would cause them to exit the qualifying pensions dashboard service, which makes it clear to the customer that they will be directed to that particular pension scheme administrator’s website. 8.4.6 G For the avoidance of doubt, PDCOB 8.4.4R applies where a firm places an advertisement on its pensions dashboard platform with a link to a website outside of the pensions dashboard service, which may or not be a website belonging to the firm. 8.5 Presentation of the choice architecture 8.5.1 R A firm must ensure that the choice architecture is designed such that the presentation of the choices is: (1) accessible to the customer from the point at which they access their pensions dashboard view data onwards; (2) impartial, so that the customer is able to easily identify all of the choices available to them; and (3) designed in a way that enables the customer to understand all the choices available to them and to make choices based on this understanding. 8.5.2 G A firm may choose the design, form, language and delivery for the presentation of the choices. 8.5.3 G The following are examples of factors which may be relevant to a firm when designing the choice architecture: (1) whether each choice should be presented in the same way (this does not necessarily mean that the choices must be presented together as a whole); and (2) the use of pop-ups, layering, or drop-down functionality to present the choices. The choices may be grouped in common themes, but a firm should ensure that all choices remain easy to locate and that certain choices are not hidden or obscured. 8.5.4 G Firms are reminded of their obligations under Principle 12 in relation to the consumer understanding outcome and communications to retail customers, in particular:

FCA 2024/42 FOS 2024/4 Page 40 of 106 (1) PRIN 2A.5.3R, which requires firms to support retail customer understanding and to communicate information to retail customers in a way which is clear, fair and not misleading; and (2) PRIN 2A.5.10R, which requires firms, where appropriate, to test and monitor communications to identify whether they are supporting good outcomes for retail customers and correct any deficiencies identified. 8.5.5 G Firms are reminded they must comply with the requirements of Principle 12 and PRIN 2A on product design and product testing. In particular, firms are reminded of the requirements in PRIN 2A.3.4R, PRIN 2A.3.9R and PRIN 2A.3.10R, and should assess whether the presentation of the choice architecture: (1) is designed to meet the needs, characteristics and objectives of the target market; (2) does not adversely affect groups of consumers in the target market including groups with characteristics of vulnerability; and (3) avoids causing foreseeable harm to the target market. 8.5.6 G Firms should make changes to improve their communications if common areas of consumer misunderstanding are identified through a firm’s testing or monitoring. 9 Third-party dashboard arrangements 9.1 Application 9.1.1 R This chapter applies to a firm that enters into a third-party dashboard arrangement. 9.1.2 G The third-party dashboard arrangement referred to in PDCOB 9.1.1R is an arrangement between parties with continuing effect and would not include, for example, placing a publicly available link to a firm’s pensions dashboard platform either with or without that firm’s permission. 9.2 Purpose 9.2.1 G The purpose of this chapter is to ensure that, where a firm enters into a third￾party dashboard arrangement, the arrangement does not, as far as is reasonably possible, create scope for consumer harm. This chapter imposes additional obligations upon a firm that enters into a third-party dashboard arrangement. 9.2.2 G A firm that enters into a third-party dashboard arrangement must continue to comply with all of the other rules in PDCOB. 9.3 Requirements for the arrangement

FCA 2024/42 FOS 2024/4 Page 41 of 106 9.3.1 R Before a third-party dashboard access provider is able to offer a firm’s pensions dashboard platform to a customer, the firm must ensure that there is an enforceable written agreement in place between the firm and the third-party dashboard access provider that: (1) allows the firm reasonable access to the third-party dashboard access provider’s operations as necessary to allow the firm to carry out proper monitoring; (2) requires the third-party dashboard access provider to represent and warrant that it will not: (a) modify, edit or alter the pensions dashboard platform; (b) charge or attempt to charge a customer for any services connected to the firm’s pensions dashboard platform; or (c) promote the firm’s pensions dashboard platform in a way that may breach any protections within the FCA’s regulatory framework or the general law; (3) requires the third-party dashboard access provider to take all reasonable steps to remedy a breach of the requirements in (2); (4) requires the third-party dashboard access provider to indemnify the firm (or, where applicable, a successor) against all losses suffered by the firm (or, where applicable, a successor) arising out of, or in connection with, a breach by the third-party dashboard access provider of any of the requirements set out in (2); and (5) permits the firm to terminate the third-party dashboard access provider’s access to the pensions dashboard platform immediately where the third-party dashboard access provider has breached, or has attempted to breach, one of the requirements in (2). 9.3.2 G PDCOB 9.3.1R does not prescribe the exact wording of the written agreement with the third-party dashboard access provider. 9.4 Responsibility for the actions of the third-party dashboard access provider 9.4.1 R The firm retains responsibility for compliance with the rules in PDCOB and any other relevant FCA rules in relation to the pensions dashboard platform. This includes responsibility for the actions of a third-party dashboard access provider in relation to the firm’s pensions dashboard platform. 9.4.2 R Prior to entering into a third-party dashboard arrangement and routinely thereafter, a firm must satisfy itself that the third-party dashboard access provider is a suitable and reputable entity through which to make its pensions dashboard platform available to customers. 9.5 Restrictions on changes to the pensions dashboard platform

FCA 2024/42 FOS 2024/4 Page 42 of 106 9.5.1 R A firm must ensure that the pensions dashboard platform is not capable of being altered, modified or edited by another person. 9.5.2 R A firm must ensure that, when a customer accesses the firm’s pensions dashboard platform under the third-party dashboard arrangement, no part of the third-party dashboard access provider website or other application or similar is visible alongside the pensions dashboard platform. 9.5.3 G Under PDCOB 12.2.1R, a firm is not permitted to allow any other person to offer post-view services. 9.6 Disclosures to the customer about third-party dashboard arrangements 9.6.1 R A firm must ensure that, where a customer accesses the pensions dashboard platform through a third-party dashboard arrangement, the first point of contact with a customer on a pensions dashboard platform contains a prominent message that: (1) the firm is authorised to carry on regulated pensions dashboard activity; (2) the firm is responsible for the pensions dashboard platform; (3) the third-party dashboard access provider has entered an arrangement with the firm to make the pensions dashboard platform available to customers; and (4) complaints about the pensions dashboard platform should be directed to the firm, not the third-party dashboard access provider. 9.7 Notifications to the FCA 9.7.1 G Firms are reminded of the notification requirements relating to third-party dashboard arrangements in PDCOB 15.3. 10 Outsourcing 10.1 Arrangements involving outsourcing 10.1.1 G Firms that outsource any service or activity relating to their qualifying pensions dashboard services should have particular regard to how they comply with SYSC 8 and SYSC 13, where relevant. [Note: The FCA has issued non-Handbook guidance for firms on outsourcing to the ‘cloud’ and other third-party IT services. See https://www.fca.org.uk/publication/finalised-guidance/fg16-5.pdf.] 11 Specific requirements where firms offer data export 11.1 Application

FCA 2024/42 FOS 2024/4 Page 43 of 106 11.1.1 R This chapter applies to a firm which chooses to offer or provide data export. 11.2 Permitted data export functionality 11.2.1 R A firm is not permitted to offer or provide data export, apart from: (1) data export to the customer; or (2) data export to itself. 11.2.2 R A firm must not permit another person to offer or provide data export from the firm’s pensions dashboard platform. 11.2.3 R A firm which chooses to offer data export to the firm must also offer data export to the customer. 11.2.4 G Data export will involve a firm processing personal data. Accordingly, firms processing such data are data controllers or data processors and are obliged to comply with data protection legislation and, in particular, to adhere to the data protection principles. 11.3 Restrictions on providing data export 11.3.1 R A firm must not provide data export to the customer or to itself unless the customer has actively elected to select that specific type of data export. 11.3.2 R A firm must not require the customer to agree to data export as a condition of using the qualifying pensions dashboard service. Restrictions on the content, format and manner of data export 11.3.3 R The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 11.3.4R. 11.3.4 R When providing data export to the customer, the firm must not export the customer’s full pension reference. 11.3.5 R Where a firm exports a partial pension reference in accordance with PDCOB 11.3.4R, it must make a record of the rationale for the approach taken. 11.3.6 G For the purposes of PDCOB 11.3.4R, a firm may choose how many and which digits to omit or obscure. 11.3.7 G A firm should transfer the pensions dashboard view data securely to the customer or itself (as applicable). Firms are reminded of their obligation to comply with the principle of integrity and confidentiality in article 5(1)(f) of the General data protection regulation. 11.4 Restrictions on providing data export to the customer Specific disclosures prior to the provision of data export to the customer

FCA 2024/42 FOS 2024/4 Page 44 of 106 11.4.1 R In good time before the customer elects to receive data export, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export. This information must include: (1) the name of the person who is the data controller; (2) the nature of the processing which will take place to export the data; and (3) the purpose for which the data will be processed. 11.4.2 R Before the customer agrees to data export, a firm must clearly and prominently display a warning to the customer about the risks of data export to the customer, including that: (1) their data is valuable; (2) it is important that they keep their data safe; and (3) if the data export is being facilitated by download, the customer should avoid downloading the data on a shared device. Restrictions on the content, format and manner of data export to the customer 11.4.3 R A firm must ensure that pensions dashboard view data exported to a customer is in a format which is accessible to a member of the general population. 11.4.4 G A firm should consider whether the format of data export engages any accessibility obligations, such as under the Equality Act 2010. 11.4.5 R The information exported by data export to the customer must include: (1) subject to PDCOB 11.3.4R, the customer’s pensions dashboard view data; and (2) any display explanations and contextual information which is required by PDCOB 5 and other legislation, such as the Dashboard Regulations. Specific disclosures when providing information by data export to the customer 11.4.6 R The information provided by data export to the customer must be prominently accompanied by: (1) the warning at PDCOB 5.5.1R(1); (2) a signpost to the ScamSmart campaign, such as a link to ScamSmart - Avoid investment and pension scams | FCA; (3) a message that the customer’s pensions dashboard view data is sensitive and valuable, and the customer should seek to keep their data safe;

FCA 2024/42 FOS 2024/4 Page 45 of 106 (4) a message that, if the customer is asked to share their data with a third party, the customer should think carefully about whether a third party needs to see the data, check whether the third party is who they say they are and, if they claim to be authorised or exempt, should use the Financial Services Register to check; and (5) signposts to impartial guidance available from MoneyHelper. 11.5 Data export to the firm Specific disclosures prior to the provision of data export to the firm 11.5.1 R In good time before the customer elects to data export to the firm, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export to the firm. This information must include: (1) the name of the persons who will be the data controllers both before and after the data is exported; (2) the nature of the processing which will take place to export the data and once the data is exported; and (3) the purpose for which the data will be processed both during data export to the firm and once the data has been exported. 11.5.2 R Once the data is exported to the firm, the firm must not share the data with any other entities. Restrictions on the content, format and manner of data export to the firm 11.5.3 R The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 11.3.4R. 11.5.4 G Depending on the nature of the post-view services which the firm is offering, a firm should consider whether it is appropriate to include any display explanations or contextual information required by PDCOB 5 and other legislation such as the Dashboard Regulations. 11.5.5 R Once the customer’s data has been exported to the firm, the firm must only process that data to deliver post-view services and to which the customer has consented. 11.6 Data retention Obligations on firms under general privacy laws 11.6.1 G Firms are reminded of the need to comply with data protection legislation, including in relation to pensions dashboard self-asserted data.

FCA 2024/42 FOS 2024/4 Page 46 of 106 11.6.2 R Without prejudice to the application of the GDPR where data has been obtained by the firm from data export, a firm: (1) must obtain a customer’s express consent to store that data; and (2) where consent is obtained, is permitted to store that data for 30 days from the date the customer consented in accordance with (1) above, after which period it must be deleted. 11.6.3 R A firm is not permitted to store data obtained from data export where: (1) the customer does not expressly consent; or (2) the customer elected to export the data to themselves only. 12 Post-view services 12.1 Purpose 12.1.1 G The purpose of the rules in this chapter is to place specific additional requirements on firms that offer post-view services. 12.2 Restrictions 12.2.1 R Save for the circumstances in PDCOB 6.3.1R and PDCOB 6.3.6R a firm must not permit any other person to offer any services or products to customers from the pensions dashboard platform. 12.2.2 G Firms are reminded that they must not offer or provide any services or products to customers from the pensions dashboard platform other than post￾view services and data export under PDCOB 11 (see PDCOB 3.1.1R). 12.3 Permitted post-view services 12.3.1 R A firm must only offer or provide post-view services that: (1) relate to pensions and retirement planning or are a type of service that supports customers in understanding their pensions and view data to enable them to better understand and consider their retirement planning; (2) have been user-tested in accordance with PDCOB 12.6.1R; (3) do not include: (a) an offer to sell (which includes sending an application form for a product); (b) an offer to arrange for the sale or purchase of; (c) selling; or

FCA 2024/42 FOS 2024/4 Page 47 of 106 (d) arranging for the sale or purchase of (which includes sending an application form for a product), an investment to or for a customer; and (4) do not include investment advice or advising on pension transfers and pension opt-outs. 12.3.2 G A firm is permitted to ask a customer to input data into the post-view service, such that post-view services can be provided, either by way of auto-populated data from the view services, pensions dashboard self-asserted data or a mixture of both. 12.3.3 G Firms are reminded that they may require permission to carry on regulated activities other than regulated pensions dashboard activity if any post-view services amount to regulated activities. 12.3.4 G Firms are reminded that when they provide post-view services, they must comply with their obligations in PRIN, including: (1) acting to deliver good outcomes for retail customers (Principle 12); (2) enabling and supporting retail customers to pursue their financial objectives (PRIN 2A.2.14R); and (3) designing and delivering support to retail customers such that it meets the needs of retail customers, including those with characteristics of vulnerability (PRIN 2A.6.2R). 12.3.5 G Pursuant to PDCOB 12.3.1R(4), a firm is not permitted to offer a post-view service which amounts to advising on pension transfers and pension opt-outs. This includes abridged advice. However, a firm is permitted to offer post-view services which support and engage customers with their safeguarded benefits. A firm should ensure that such support and engagement does not stray into the regulated activity of advising on pension transfers and pension opt-outs and should consider the guidance in PERG 2.7.16G. 12.3.6 G Firms should consider how assumptions about future investment returns and charges can influence customers’ decision-making on transferring or converting safeguarded benefits. Firms should ensure that such assumptions do not result in the firm advising on pension transfers and pension opt-outs. 12.4 Specific fees restrictions in relation to post-view services 12.4.1 R A firm must not require the customer to pay for, or to agree to pay for, any post-view service as a condition of accessing their pensions dashboard view data. 12.4.2 G Firms should also refer to the rules on charging in PDCOB 2.5.2R to PDCOB 2.5.8R.

FCA 2024/42 FOS 2024/4 Page 48 of 106 12.4.3 R If a firm is charging for a post-view service, and the firm offers the same service significantly cheaper or free of charge outside the pensions dashboard platform, a firm must inform the customer of that fact in good time before providing the post-view service. 12.4.4 G A firm which charges for a post-view service is reminded of its obligations under Principle 12. In particular, a firm which charges for a post-view service should be satisfied that their fair value obligations under PRIN 2A.4, the retail customer outcome on price and value, are met. 12.5 Disclosures to be provided to customers in relation to post-view services 12.5.1 R A firm must ensure that any offer for post-view services is accompanied by prominent information which: (1) explains the nature and purpose of the post-view service; (2) explains the limitations of the post-view service; (3) explains how customers can raise a query or complaint about the post￾view service; and (4) includes the messages required under PDCOB 5.5. 12.5.2 G In order to ensure that the nature of the post-view service is not misleading and is capable of being understood by customers, a firm should consider including information which: (1) ensures that customers do not perceive post-view services as giving them guarantees of what their pension(s) will be worth in retirement; (2) ensures that customers do not perceive post-view services as giving them personal recommendations; and (3) where relevant, explains the assumptions underpinning modellers, projections, calculations or similar. 12.6 User testing 12.6.1 R The user testing referred to in PDCOB 12.3.1R(2) must be designed to ensure that the nature of the post-view services is capable of being easily understood and easily used and is not likely to mislead or confuse customers. 12.6.2 R Where user testing identifies deficiencies in post-view services and/or how they are presented, or improvements which should be made, the firm must make changes to the post-view services to remedy such deficiencies or make such improvements. 12.6.3 G A firm should consider whether further user testing is necessary when a material change has been made to any post-view services which it provides.

FCA 2024/42 FOS 2024/4 Page 49 of 106 12.7 Use of data 12.7.1 R Save for the circumstances in PDCOB 12.7.2R, a firm must not share customers’ information, including the outcome of post-view services, with any other person. 12.7.2 R A firm may share customers’ information, including the outcome of post-view services, with a third party with which a firm has entered into an outsourcing arrangement concerning any service or activity in connection with its qualifying pensions dashboard service where necessary and to the extent necessary to provide a post-view service. 12.8 Access to the results of post-view services 12.8.1 R A firm must allow a customer to receive a copy of the results of the post-view service, where applicable, and where the firm is not restricted by the rules in relation to data export in PDCOB 11. 12.8.2 G A firm should transfer the results referred to in PDCOB 12.8.1R securely to the customer. Firms are reminded of their obligation to comply with the principle of integrity and confidentiality in article 5(1)(f) of the General data protection regulation. 12.9 Notifications to the FCA 12.9.1 G Firms are reminded of the notification requirements in relation to post-view services in PDCOB 15.4. 13 Prudential requirements 13.1 Application and purpose General application 13.1.1 R Subject to PDCOB 13.1.2R, this chapter applies to firms with a Part 4A permission for regulated pensions dashboard activity. 13.1.2 R This chapter does not apply to a PRA-authorised person. Purpose 13.1.3 G (1) The purpose of PDCOB 13 is to set out the detailed prudential obligations that apply to regulated pensions dashboard activity. (2) Adequate financial resources are necessary for the effective management of prudential risks. The rules in this chapter therefore impose requirements relating to the financial resources of a firm to which this chapter applies. (3) The rules concern the adequacy of the financial resources that a firm needs to hold in order to be able to meet its liabilities as they fall due

FCA 2024/42 FOS 2024/4 Page 50 of 106 (the general solvency requirement). These resources include both capital and liquidity resources. (4) The rules also place a core capital resources requirement on a firm to which this chapter applies. 13.2 General solvency requirement 13.2.1 R A firm must at all times maintain overall financial resources which are adequate, both as to amount and quality, to ensure that there is no significant risk that its liabilities cannot be met as they fall due. This includes capital resources and liquidity resources. 13.2.2 G The liabilities referred to in the general solvency requirement include: (1) a firm’s contingent and prospective liabilities; (2) liabilities that arise both in scenarios where the firm is a going concern and where the firm ceases to be a going concern; and (3) claims that could be made against a firm, which ought to be paid in accordance with fair treatment of customers, even if such claims could not be legally enforced. 13.2.3 G The liabilities referred to in the general solvency requirement exclude liabilities that might arise from transactions that a firm has not entered into and which it could avoid. This could include, for example, by taking realistic management actions such as ceasing to transact new business after a suitable period of time has elapsed. 13.2.4 G A firm should therefore make its assessment of adequate financial resources on realistic valuation bases of assets and liabilities, taking into account the actual amounts and timing of cash flows under realistic adverse projections. 13.2.5 G Risks may be addressed through holding capital to absorb losses that unexpectedly materialise. The ability to pay liabilities as they fall due also requires liquidity. Therefore, firms should consider both capital and liquidity needs in assessing the adequacy of their financial resources. A firm should also consider the quality of its financial resources such as the loss-absorbency of different types of capital and the time required to liquidate different types of assets. 13.2.6 G As part of its day-to-day supervision of a firm, the FCA may review whether the amount and quality of capital and liquidity resources that a firm holds to comply with its general solvency requirement is sufficient. 13.2.7 G Where necessary, the FCA may consider the use of its powers under section 166 of the Act (Reports by skilled persons) to assist with the review referred to in PDCOB 13.2.6G.

FCA 2024/42 FOS 2024/4 Page 51 of 106 13.2.8 G (1) Following such a review, the FCA may conclude that a firm should hold an additional amount or quality of capital or liquidity resources to comply with the general solvency requirement. (2) Where this is the case, the FCA will normally specify an amount or quality of capital or liquidity resources that the firm should hold by: (a) issuing individual capital guidance; (b) issuing individual liquidity guidance; or (c) imposing a requirement on the firm. (3) The amounts in (2) will typically represent the FCA’s assessment of the firm’s general solvency requirement. However, in some cases, it may be specified on a different basis (such as by reference to a specific component of the general solvency requirement or to a particular risk or harm). (4) The FCA may choose to conduct reviews of the sector of firms carrying on regulated pensions dashboard activity, or aspects of it. In such cases, the FCA may subsequently choose to issue guidance on a sectoral basis or to impose additional requirements on all, or only a subset of, the entities included within that review. The guidance or requirement may relate to: (a) additional amounts or quality of capital or liquidity resources that such firms must hold; or (b) other actions that such firms must undertake. 13.2.9 G The FCA will determine whether a requirement or guidance is more appropriate. Where the FCA chooses to issue guidance, this will normally explain how the FCA will approach supervising the general solvency requirement in relation to the firm. The FCA expects that the firm would normally confirm to the FCA that the firm will hold the amounts specified in that guidance going forward (and will therefore hold the relevant capital and or liquidity resources to comply with the general solvency requirement), unless the firm subsequently determines that higher amounts are required. 13.2.10 G Where the FCA considers that it is appropriate to apply a requirement in connection with the general solvency requirement, it may invite a firm to make a voluntary application under section 55L(5) of the Act to impose a requirement on the firm to hold the level of capital or liquidity resources that the FCA has assessed as being required by the firm in order to meet the general solvency requirement. 13.2.11 G Guidance on the general solvency requirement issued by the FCA will apply until the FCA issues revised guidance (or varies or removes the requirement relating to the general solvency requirement) in relation to the firm.

FCA 2024/42 FOS 2024/4 Page 52 of 106 13.2.12 G If a firm subsequently determines, as a result of its own assessment, that it needs to hold a higher level or quality of capital or liquidity resources to satisfy the general solvency requirement, it must hold that higher level. This is because the FCA’s assessment (or a requirement applied to the firm by the FCA) reflects an assessment carried out at that point in time and does not relieve the firm of its obligation to ensure that it is meeting the general solvency requirement at all times. 13.2.13 G A firm’s business model or operating model may undergo a significant change, with the result that the firm considers that the amount or quality of capital or liquidity resources specified in the guidance issued by, or the requirement applied by, the FCA exceeds the amount or quality of capital or liquidity resources that the firm requires to comply with the general solvency requirement. In this case, the firm: (1) should undertake its own assessment of the amount that the firm now requires to comply with the general solvency requirement or, where applicable, to address the risks in relation to which the requirement was imposed; and (2) having undertaken the determination in (1), may contact the FCA to request a review of the existing guidance or requirement. 13.2.14 G The FCA will not give individual capital guidance or individual liquidity guidance to the effect that the amount of capital advised in that guidance is lower than the amount of capital which a firm should hold to meet its core capital resources requirement. 13.3 Core capital resources requirement 13.3.1 R A firm must at all times maintain capital resources equal to or in excess of its core capital resources requirement. 13.4 Capital resources: relevant accounting principles 13.4.1 R A firm must recognise an asset or liability, and measure its amount, in accordance with the relevant accounting principles applicable to it for the purpose of preparing its annual financial statements. 13.5 Core capital resources requirement for regulated pensions dashboard activities 13.5.1 R Subject to PDCOB 13.6.1R, for a firm with a Part 4A permission to carry on regulated pensions dashboard activities, the core capital resources requirement is £40,000. 13.6 Core capital resources requirement for a firm carrying on other regulated activity

FCA 2024/42 FOS 2024/4 Page 53 of 106 13.6.1 R Where a firm to which this chapter applies also has a Part 4A permission to carry on other regulated activities, the capital resources requirement is the higher of: (1) the core capital resources requirement in PDCOB 13.5.1R; and (2) a capital resources requirement (however described) applied to the firm by any other rule or requirement. 13.7 Calculation of core capital resources The calculation of a firm’s core capital resources 13.7.1 R A firm must calculate its capital resources for the core capital resources requirement from the items that are eligible to contribute to a firm’s capital resources, as set out in items 1 to 6 in the table at PDCOB 13.7.3R. 13.7.2 R In arriving at its calculation of its capital resources for the core capital resources requirement, a firm must deduct the items set out in items 1 to 5 in the table at PDCOB 13.7.5R. 13.7.3 R The items that are eligible to contribute to the capital resources of a firm are set out in the following table. Item Additional explanation 1 Share capital This must be fully paid and may include: (1) ordinary share capital; or (2) preference share capital (excluding preference shares redeemable by shareholders within 2 years). 2 Capital other than share capital (for example, the capital of a sole trader, partnership or limited liability partnership) (1) The capital of a sole trader is the net balance on the firm’s capital account and current account. (2) The capital of a partnership is the capital made up of the partners’: (a) capital account, which is the account: (i) into which capital contributed by the partners is paid; and (ii) from which, under the terms of the partnership agreement, an amount representing capital may be withdrawn by a partner only if:

FCA 2024/42 FOS 2024/4 Page 54 of 106 (A) the person ceases to be a partner and an equal amount is transferred to another such account by their former partners or any person replacing them as their partner; or (B) the partnership is otherwise dissolved or wound up; and (b) current accounts according to the most recent financial statement. (3) For the purpose of calculating capital resources in respect of a defined benefit occupational pension scheme: (a) a firm must derecognise any defined benefit asset; and (b) a firm may substitute for a defined benefit liability the firm’s deficit reduction amount, provided that the election is applied consistently in respect of any one financial year. 3 Reserves (Note) (1) These are (subject to the Note) the audited accumulated profits retained by the firm (after deduction of tax, dividends and proprietors’ or partners’ drawings) and other reserves created by appropriations of share premiums and similar realised appropriations. Reserves also include gifts of capital, for example, from a parent undertaking. (2) For the purposes of calculating capital resources, a firm must make the following adjustments to its reserves, where appropriate: (a) A firm must deduct any unrealised gains or, where applicable, add back in any unrealised losses on debt instruments held, or formerly held, in the available￾for-sale financial assets category. (b) A firm must deduct any unrealised gains or, where applicable, add back in any unrealised losses on cash flow hedges of financial instruments measured at cost or amortised cost. (c) In respect of a defined benefit occupational pension scheme: (i) a firm must derecognise any defined benefit asset; and

FCA 2024/42 FOS 2024/4 Page 55 of 106 (ii) a firm may substitute for a defined benefit liability the firm’s reduction amount, provided that the election is applied consistently in respect of any one financial year. 4 Interim net profits (Note) If a firm seeks to include interim net profits in the calculation of its capital resources, the profits must (subject to the Note) be verified by the firm’s external auditor, net of tax, anticipated dividends or proprietors’ drawings and other appropriations. 5 Revaluation reserves Revaluation reserves include reserves arising from the revaluation of land and buildings, which include any net unrealised gains for the fair valuation of equities held in the available-for-sale financial assets category. 6 Subordinated loans/debt Subordinated loans/debt must be included in capital on the basis of the provisions in this chapter that apply to subordinated loans/debts. Note: Reserves and interim net profits Reserves must be audited and interim net profits, general and collective provisions must be verified by the firm’s external auditor unless the firm is exempt from the provisions of Part 16 of the Companies Act 2006 (section 477 (Small companies: conditions for exemption from audit)) relating to the audit of accounts. 13.7.4 G A firm should keep a record of, and be ready to explain to its supervisory contacts in the FCA the reasons for, any difference between the deficit reduction amount and any commitment the firm has made in any public document to provide funding in respect of a defined benefit occupational pension scheme. 13.7.5 R In arriving at its calculation of its capital resources for the core capital resources requirement, a firm must deduct the items set out in the following table:

FCA 2024/42 FOS 2024/4 Page 56 of 106 Item Additional explanation 1 Investments in own shares 2 Investments in subsidiaries (Note 1) 3 Intangible assets (Note 2) 4 Interim net losses (Note 3) 5 Excess of drawings over profits for a sole trader or a partnership (Note 3) Notes: 1. Investments in subsidiaries are the full balance sheet value. 2. Intangible assets are the full balance sheet value. 3. The interim net losses in row 4, and the excess of drawings in row 5, are in relation to the accounting period following the date as at which the capital resources are being computed. Personal assets 13.7.6 R In relation to a sole trader’s firm or a firm which is a partnership, the sole trader or a partner in the firm may use personal assets to meet the core capital resources requirement, to the extent necessary to make up any shortfall in meeting that requirement, unless: (1) those assets are needed to meet other liabilities arising from: (a) personal activities; or (b) another business activity not regulated by the FCA; or (2) the firm holds client money or other client assets in relation to regulated activities other than regulated pensions dashboard activity. 13.7.7 G A sole trader or a partner may use any personal assets, including property, to meet the capital requirements of this chapter, but only to the extent necessary to make up a shortfall. Subordinated loans 13.7.8 R A subordinated loan or debt must not form part of the capital resources for the core capital resources requirement of the firm unless it meets the following conditions: (1) (a) it has an original maturity of at least 5 years; or (b) it is subject to 5 years’ notice of repayment;

FCA 2024/42 FOS 2024/4 Page 57 of 106 (2) the claims of the subordinated creditors must rank behind those of all unsubordinated creditors; (3) the only events of default must be non-payment of any interest or principal under the debt agreement or the winding up of the firm; (4) the remedies available to the subordinated creditor in the event of non￾payment or other default in respect of the subordinated loan or debt must be limited to petitioning for the winding up of the firm or proving the debt and claiming in the liquidation of the firm; (5) the subordinated loan or debt must not become due and payable before its stated final maturity date, except on an event of default complying with (3); (6) the agreement and the debt are governed by the law of England and Wales, or of Scotland or of Northern Ireland; (7) to the fullest extent permitted under the rules of the relevant jurisdiction, creditors must waive their right to set off amounts they owe the firm against subordinated amounts owed to them by the firm; (8) the terms of the subordinated loan or debt must be set out in a written agreement that contains terms that provide for the conditions set out in this rule; and (9) the loan/debt must be unsecured and fully paid up. 13.7.9 R When calculating its capital resources, the firm must exclude any amount by which the aggregate amount of its subordinated loans or debts exceeds the amount calculated as follows: A - B where: A is equal to the sum of items 1 to 6 (inclusive) in the table of items in PDCOB 13.7.3R, which are eligible to contribute to a firm’s capital resources. B is equal to the sum of items 1 to 5 (inclusive) in the table of items in PDCOB 13.7.5R, which must be deducted in arriving at firm’s capital resources. 13.8 Systems, strategies, processes and reviews Purpose

FCA 2024/42 FOS 2024/4 Page 58 of 106 13.8.1 G In addition to adequate financial resources, adequate systems and controls are necessary for the effective management of prudential risks. This section therefore imposes requirements relating to such systems and controls. 13.8.2 G This section requires a firm to identify and assess: (1) risks to the firm being able to meet its liabilities as they fall due; (2) how the firm intends to mitigate these risks; and (3) the amount and nature of financial resources that the firm considers necessary to address any remaining risks. 13.8.3 G The FCA may review this assessment as part of its own assessment of the adequacy of a firm’s financial resources. Systems, strategies and processes 13.8.4 R A firm must use sound, effective and comprehensive systems, strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of financial resources that it considers adequate to cover: (1) the nature and level of the risks to which it is or might be exposed; and (2) the risk that the firm might not be able to meet its core capital resources requirement and general solvency requirement in the future. 13.8.5 G A firm should consider taking out professional indemnity insurance and insurance to cover the risk of cyber-attacks in relation to its regulated pensions dashboard activity. Documentation of risk assessments 13.8.6 G The FCA may review the written record of the assessment in PDCOB 13.8.4R as required under PDCOB 16.12.1R as part of its own assessment of the adequacy of a firm’s financial resources as part of its day-to-day supervision of firms. 13.9 Action for damages 13.9.1 R A contravention of the rules in PDCOB 13 does not give rise to a right of action by a private person under section 138D of the Act, and each of those rules is specified for the purposes of section 138D(3) of the Act as a provision that does not give rise to such a right of action. 14 Resolution requirements 14.1 Wind-down planning

FCA 2024/42 FOS 2024/4 Page 59 of 106 14.1.1 R A firm must prepare and keep up to date a wind-down plan. 14.1.2 G A firm should refer to the FCA’s Wind-down Planning Guide (WDPG) to develop an effective wind-down plan. 14.1.3 G Firms are reminded of the disclosure requirements under Principle 11. 15 Notifications 15.1 Notifications general provisions 15.1.1 G This chapter sets out the requirements imposed on firms to notify the FCA of certain issues. In addition to the requirements set out in this chapter, firms must also comply with the notification requirement contained in SYSC 3.2.24R or SYSC 4.1.5CR, as applicable. 15.1.2 G Firms are reminded that PDCOB also imposes requirements to notify customers of certain matters. Those requirements are set out elsewhere in PDCOB. 15.2 Specific notification requirement: scams 15.2.1 R If a firm becomes aware of a scam relating to its pensions dashboard platform, the firm must immediately notify the FCA in writing using the relevant form in Connect. 15.2.2 R A notification under PDCOB 15.2.1R must contain: (1) a description of the scam; and (2) a description of the steps the firm is taking since being made aware of the scam. 15.2.3 G For the purposes of PDCOB 15.2.1R, a scam relating to a firm’s pensions dashboard platform might include the existence of a clone or fake dashboard, or an investment scam. 15.3 Specific notification requirement: third party dashboard arrangements 15.3.1 R If a firm enters into a new third-party dashboard arrangement or terminates an existing third-party dashboard arrangement, or if any of the details set out in PDCOB 15.3.2R(2) change in relation to an existing third-party dashboard arrangement, a firm must notify the FCA in writing using the relevant form in Connect within 30 days of the change coming into effect. 15.3.2 R A notification under PDCOB 15.3.1R must contain the following details: (1) the change the firm is notifying the FCA about (ie, entering into a new third-party dashboard arrangement, terminating an existing third-party dashboard arrangement or changing any of the details set out in PDCOB 15.3.2R(2));

FCA 2024/42 FOS 2024/4 Page 60 of 106 (2) the third-party access provider’s; (a) registered name; (b) trading name(s); (c) registered company number; (d) registered office; (e) principal place of business; (f) head office; (g) website address; (h) Firm Reference Number; and (i) named contact and their contact details; and (3) the uniform resource locators (URLs) through which customers can access the pensions dashboard platform. 15.3.3 G Where appropriate, the details provided in accordance with PDCOB 15.3.2R should be provided as registered with Companies House. 15.4 Specific notification requirement: post-view services 15.4.1 R If a firm adds, removes or makes any material changes to its post-view services, a firm must notify the FCA in writing using the relevant form in Connect within 30 days of the change coming into effect. 15.4.2 R A notification under PDCOB 15.4.1R must include: (1) the change the firm is notifying the FCA about (ie, adding a post-view service, removing a post-view service or a material change to a post￾view service); (2) the details of the post-view service (ie, a description of the new or removed post-view service, or a description of material changes to the post-view service where this is a relevant field) and a statement as to whether these changes are informed by user testing or complaints where this is a relevant field; (3) an attestation that the firm has considered whether it needs to vary its permissions as a result of the change; (4) where a firm has concluded that it does not need to vary its permission, an attestation of that fact; and (5) where a firm has concluded that it does need to vary its permission, an attestation of that fact and that it has attained the necessary

FCA 2024/42 FOS 2024/4 Page 61 of 106 variation of permission, as well as the date of the variation of permission. 15.4.3 G A material change to post-view services includes, but is not limited to, alteration of a post-view service that impacts the customer’s experience of the post-view service. 16 Record keeping 16.1 General record-keeping provisions 16.1.1 G Firms will need to decide what records they need to keep in line with the high-level record-keeping requirements elsewhere in the FCA Handbook, including in the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) (see SYSC 4.1.5B and SYSC 9.1.1R) and in SYSC 3, eg, SYSC 3.2.24R, for insurers, as well as for their own business needs. 16.1.2 R In order to deal with requests for information from the FCA, as well as queries and complaints from customers, firms must keep sufficient evidence and must make and maintain adequate records of how they have complied with the requirements in PDCOB, including evidence of the specific requirements set out in PDCOB 16.2 to PDCOB 16.12. 16.1.3 R In complying with the record-keeping rules in this chapter, a firm must not retain the personal data of customers, save as necessary in order to show compliance with the rules – for example, where the record is of correspondence with an individual arising out of a complaint or enquiry. 16.1.4 G A firm may seek to comply with the record-keeping rules in this chapter by keeping a visual record, such as screenshots, of the relevant stages of the pensions dashboard platform and screenshots of where the advertising is placed on the platform and how the advertisements are presented. Duration of record retention 16.1.5 R A firm must retain each record referred to in this sourcebook for at least 6 years. 16.2 Specific record-keeping requirements: the customer journey 16.2.1 R A firm must make and keep a record of the information customers were presented with at each stage of the pensions dashboard platform and how the information was presented. 16.2.2 R Each time there is a material change to the information described in PDCOB 16.2.1R, the firm must keep a record of that updated information and the dates when each version could be accessed by a customer. 16.2.3 R A material change is anything that could have an impact on the way a customer may understand the services offered on the pensions dashboard

FCA 2024/42 FOS 2024/4 Page 62 of 106 platform, or the way in which a customer is able to use the services, which includes (but is not limited to): (1) adding or removing advertising or changing its method of marketing; and (2) adding or removing functionality. 16.3 Specific record-keeping requirements: customer volumes 16.3.1 R A firm must make and keep a record of: (1) the number of customers using their pensions dashboard platform; (2) the number of customers using their post-view services; (3) the number of customers using each of their post-view services; (4) the total number of times their post-view services are used; (5) the total number of times each of their post-view services are used; and (6) in relation to data export: (a) the number of customers deciding to export their data in accordance with PDCOB 11; (b) the number of customers using data export to the firm; and (c) the total number of times that data export has been used. 16.4 Specific record-keeping requirements: warning and signposting 16.4.1 R A firm must make and keep a record of each version of the warning and signposting information provided to customers to comply with PDCOB 5 and the dates that each version was available to a customer. 16.5 Specific record-keeping requirements: advertisements 16.5.1 R (1) A firm must make and keep a record of the advertisements which it places on the pensions dashboard platform, and how those advertisements are placed, including the size, prominence and positioning of the advertisements. (2) A firm must make and keep a record of the steps it has taken to comply with PDCOB 6.3.4R. (3) A firm must make and keep a record of the remuneration it receives for placing advertisements.

FCA 2024/42 FOS 2024/4 Page 63 of 106 (4) A firm must make and keep a record of the checks which it has conducted to comply with PDCOB 6.3.3R. 16.6 Specific record-keeping requirements: consents 16.6.1 R A firm must make and keep a record of the text and presentation of consent options: (1) for cookies or similar tracking technologies; and (2) for direct marketing purposes. 16.7 Specific record-keeping requirements: choice architecture 16.7.1 R A firm must make and maintain a record of: (1) all versions or iterations of the choice architecture, including the language and format used and the dates each version or iteration was made available to customers; (2) how many customers select each of the choices presented to them by the firm; and (3) each version of the exit communications presented to customers. 16.8 Specific record-keeping requirements: third party dashboard arrangements 16.8.1 R A firm must make and keep a record of any third-party dashboard arrangement into which it enters, including the contractual terms of agreements entered into, and of any changes to such arrangements. 16.9 Specific record-keeping requirements: data export 16.9.1 R A firm must make and keep a record of: (1) the information presented to the customer prior to their data export election; (2) where data export to the customer is used, the warnings and messages displayed to customers in accordance with PDCOB 11.4.1R, PDCOB 11.4.2R and PDCOB 11.4.6R; (3) where data export to the firm is used, the warnings and messages displayed to customers in accordance with PDCOB 11.5.1R. (4) the text and presentation of consent options for data export storage in accordance with PDCOB 11.6.2R by a firm; and (5) the consent of the customer. 16.10 Specific record-keeping requirements: data protection impact assessments

FCA 2024/42 FOS 2024/4 Page 64 of 106 16.10.1 R Where a firm completes, or updates, a data protection impact assessment in relation to its pensions dashboard platform, it must keep a record of that assessment. 16.10.2 R Where a firm decides not to complete a data protection impact assessment in relation to its pensions dashboard platform, it must make a record of its reasons for not completing the assessment and retain that record. 16.11 Specific record-keeping requirements: post-view services 16.11.1 R A firm must keep a record of: (1) the information which it provides to customers to comply with PDCOB 12.5.1R; (2) the post-view services offered and the dates when they were available; (3) the purpose of the post-view services offered; and (4) details of changes to any post-view services included where post-view services are added or removed. 16.11.2 R A firm must make an adequate record of the user testing it has conducted to comply with PDCOB 12.3.1R(2), including a record of what, if anything, was changed as a result of the testing. 16.12 Specific record-keeping requirements: prudential requirements 16.12.1 R A firm must make a written record of the assessments required under PDCOB 13.8.4R. In particular, it must make a written record of: (1) the major sources of risk identified in accordance with PDCOB 13.8.4R; and (2) how it intends to deal with those risks. 16.12.2 R A firm must retain the records of its assessments referred to in PDCOB 16.12.1R for at least 3 years. 17 Application of other parts of the Handbook 17.1 Application of other parts of the Handbook 17.1.1 G This chapter applies to firms carrying out regulated pensions dashboard activity. It is intended to draw a firm’s attention to the application of other key parts of the FCA Handbook, as set out in the table at PDCOB 17.1.2G. 17.1.2 G The application of other parts of the Handbook and of Regulatory Guides is set out in the following table.

FCA 2024/42 FOS 2024/4 Page 65 of 106 Module Relevance to firms carrying on regulated pensions dashboard activity Principles for Businesses sourcebook (PRIN) PRIN sets out high-level requirements imposed by the FCA. It provides a general statement of regulatory requirements. The Principles apply to all firms. Senior Management Arrangements, Systems and Controls sourcebook (SYSC) SYSC 1, SYSC 4 to SYSC 10, SYSC 18, SYSC 21 to SYSC 24 and SYSC 27 apply to firms carrying out regulated pensions dashboard activity. Insurers carrying out regulated pensions dashboard activity will be subject to the provisions of SYSC applicable to insurers when carrying out that activity. Code of Conduct sourcebook (COCON) This contains rules and guidance that are directly applicable to a firm’s SMF managers, certification employees and other conduct rules staff. It also contains guidance for firms on giving their staff training about COCON and general factors to which the FCA will have regard when assessing compliance with the COCON rules. Threshold Conditions sourcebook (COND) In order to become authorised under the Act, all firms must meet the threshold conditions. The threshold conditions must be met on a continuing basis by firms. Failure to meet one of the conditions is sufficient grounds for the exercise by the FCA of its powers. Fit and Proper test for Employees and Senior Personnel sourcebook (FIT) The purpose of FIT is to set out and describe the criteria that a firm should consider when assessing the fitness and propriety of a person: (1) in respect of whom an application is being made for approval to undertake a controlled function under the senior managers regime; (2) who has already been approved; (3) who is a certification employee; or (4) whom a firm is considering appointing to be a certification employee. FIT also sets out and describes criteria that the FCA will consider when assessing the fitness and propriety of a candidate for a controlled function position and that it may consider when assessing the

FCA 2024/42 FOS 2024/4 Page 66 of 106 continuing fitness and propriety of approved persons. Training and Competence sourcebook (TC) TC sets out rules and guidance regarding the competence of a firm’s employees, continuing professional development and associated record￾keeping requirements. General Provisions sourcebook (GEN) GEN contains rules and guidance on general matters, including interpreting the FCA Handbook, statutory status disclosure, the FCA’s logo and insurance against financial penalties. Fees manual (FEES) FEES sets out the fees applying to firms. Conduct of Business sourcebook (COBS) COBS sets out rules and guidance regarding conduct of business in relation to investment services, such as investment advice. Supervision manual (SUP) SUP sets out the relationship between the FCA and firms. As a general rule, SUP contains material that is of continuing relevance after authorisation. Decision, Procedure and Penalties manual (DEPP) DEPP sets out: (1) the FCA’s decision-making procedure for giving statutory notices. These are warning notices, decision notices and supervisory notices (DEPP 1.2 to DEPP 5); and (2) the FCA’s policy with respect to the imposition and amount of penalties under the Act (see DEPP 6). Dispute Resolution: Complaints sourcebook (DISP) DISP sets out rules and guidance in relation to treating complainants fairly and the Financial Ombudsman Service. The Enforcement Guide (EG) EG describes the FCA’s approach to exercising the main enforcement powers given to it by the Act and by other legislation. Financial Crime Guide (FCG): A firm’s guide to countering financial crime risks and Financial Crime Thematic Reviews (FCTR) FCG and FCTR provide guidance on steps that a firm can take to reduce the risk that it might be used to further financial crime.

FCA 2024/42 FOS 2024/4 Page 67 of 106 The Perimeter Guidance manual (PERG) PERG gives guidance about the circumstances in which authorisation is required, or exempt person status is available, including guidance on the activities which are regulated under the Act and the exclusions which are available. The Unfair Contract Terms and Consumer Notices Regulatory Guide (UNFCOG) UNFCOG explains the FCA’s policy on how it will use its powers under the Consumer Rights Act 2015 in relation to unfair terms and consumer notices. The Wind-Down Planning Guide (WDPG) WDPG gives guidance about how to develop an effective wind-down plan. Sch 1 Right of action for damages Sch 1.1 G The table below sets out the rules in PDCOB the contravention of which by an authorised person may be actionable under section 138D of the Act (Actions for damages) by a person who suffers loss as a result of the contravention. Sch 1.2 G If a ‘Yes’ appears in the column headed ‘For private person?’ the rule may be actionable by a private person under section 138D of the Act (or, in certain circumstances, that person’s fiduciary or representative; see article 6(2) and (3)(c) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256)). A ‘Yes’ in the column headed ‘Removed’ indicates that the FCA has removed the right of action under section 138D(2) of the Act. Where this is the case, a reference to the rule in which it is removed is also given. Sch 1.3 G The column headed ‘For other person?’ indicates whether the rule may be actionable by a person other than a private person (or their fiduciary or representative) under article 6(2) and (3) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256). Where this is the case, an indication of the type of person by whom the rule may be actionable is given. Rights of action under section 138D Chapter Section / Annex Paragraph For private person? Removed? For other person? The fair, clear and not misleading rule in PDCOB 4.2.1R Yes In part (Note) No Any rule in PDCOB which prohibits an authorised person from seeking to make Yes No Yes

FCA 2024/42 FOS 2024/4 Page 68 of 106 provisions excluding or restricting any duty or liability The prudential rules for firms carrying on regulated pensions dashboard activity in PDCOB 13 No Yes (see PDCOB 13.9.1R) No All other rules in PDCOB Yes No No Note: PDCOB 4.6.1R provides that if, in relation to a particular communication, a firm takes reasonable steps to ensure it complies with the fair, clear and not misleading rule, a contravention of that rule does not give rise to a right of action under section 138D of the Act.

FCA 2024/42 FOS 2024/4 Page 69 of 106 Annex F Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. 10C FCA senior managers regime for approved persons in SMCR firms … 10C Annex 1 What functions apply to what type of firm … Part Seven: Functions applying to limited scope firms 10C Annex 1 7.1 R Limited scope SMCR firms are divided into the following categories for the purposes of SUP 10C Annex 1: … (9) a firm that comes within SYSC 23 Annex 1 6.11R (claims management) that is not a Class 1 firm as defined in CMCOB 7.2.5R(1).; and (10) a firm falling within SYSC 23 Annex 1 6.28R (Pensions dashboard service). … 10C Annex 1 7.3 R (1) The table in SUP 10C Annex 1 7.4R sets out which FCA controlled functions apply to a limited scope SMCR firm covered by SUP 10C Annex 1 7.1R(1), (2), (2A), (3), (4), (4A), (8), or (9) or (10). … 10C Annex 1 7.4 R Table: Controlled functions applying to limited scope SMCR firms except sole traders and authorised professional firms … Part 2 (Claims management and, funeral plan and pensions dashboard firms) (1) (2) (3) (4) (5) (6)

FCA 2024/42 FOS 2024/4 Page 70 of 106 Brief description of functions Function number Class 1 claims management firms Other claims management firms Funeral plan firms Pensions dashboard firms Required functions Compliance oversight function SMF 16 √ x Limited scope function SMF 29 √ √ √ √ Notes to the table Note (1): The categories of firm in the column headings of this table are to be interpreted in accordance with the classification of firms at SUP 10C Annex 1 7.1R. Therefore: … (7) column four of Part 2 of the table (Other Claims management firms) refers to SUP 10C Annex 1 7.1R(9); and (8) column five of Part 2 of the table (Funeral plan firms) refers to SUP 10C Annex 1 7.1R(2A).; and (9) column six of Part 2 of the table (Pensions dashboard firms) refers to SUP 10C Annex 1 7.1R(10). … … 16 Reporting requirements … 16.12 Integrated Regulatory Reporting … Purpose 16.12.2 G (1) Principle 4 requires firms to maintain adequate financial resources. The prudential sourcebooks, which are contained in the Prudential Standards block in the Handbook, for firms engaged in regulated funeral plan activity (FPCOB), and for firms engaged in regulated pensions dashboard activity (PDCOB), set out the FCA’s detailed capital adequacy requirements. By submitting regular data, firms

FCA 2024/42 FOS 2024/4 Page 71 of 106 enable the FCA to monitor their compliance with Principle 4 and their prudential requirements. … Reporting requirement 16.12.3 R (1) Any firm permitted to carry on any of the activities within each of the RAGs set out in column (1) of the table in SUP 16.12.4R must: (a) … (ii) unless (iii) applies, where a firm is required to submit completed data items for more than one RAG, that firm must only submit the data item of the same name and purpose in respect of the lowest numbered RAG applicable to it, RAG 1 being the lowest and RAG 12 13 the highest; … … … … 16.12.4 R Table of applicable rules containing data items, frequency and submission periods (1) (2) (3) (4) RAG number Regulated Activities Provisions containing: applicable data items reporting frequency/ period due date … RAG 12 … … … … RAG 13 regulated pensions dashboard activity SUP 16.12.29E SUP 16.12.29E SUP 16.12.29E … Regulated Activity Group 12 …

FCA 2024/42 FOS 2024/4 Page 72 of 106 16.12.2 9C R … Regulated Activity Group 13 16.12.2 9D R SUP 16.12.29ER does not apply to a local authority. 16.12.2 9E R The applicable data items, reporting frequencies and submission deadlines referred to in SUP 16.12.4R are set out in the table below. Reporting frequencies are calculated from a firm’s accounting reference date, unless indicated otherwise. The due dates are the last day of the periods given in the table below following the relevant reporting frequency period. Description of data item Data item (Note) Frequency Submission deadline Balance sheet Section A FIN075 Half yearly 30 business days after the half year end Profit and loss account Section B FIN075 Half yearly 30 business days after the half year end Audited accounts Section C FIN075 Half yearly 30 business days after the half year end Core capital resources requirement Section D FIN075 Half yearly 30 business days after the half year end Capital resources Section E FIN075 Half yearly 30 business days after the half year end Capital adequacy position Section F FIN075 Half yearly 30 business days after the half year end Note: When submitting the completed data item required, a firm must use the format of the data item set out in SUP 16 Annex 57R. Guidance notes for the completion of the data items are set out in SUP 16 Annex 58G. …

FCA 2024/42 FOS 2024/4 Page 73 of 106 After SUP 16 Annex 56R (Branch Data and Closures Report), insert the following new annexes: SUP 16 Annex 57R (Pensions Dashboard Service Firms – Half-Yearly Prudential Return) and SUP 16 Annex 58G (Guidance notes for the Pensions Dashboard Service Firms – Half￾Yearly Prudential Return). The text is all new and is not underlined. 16 Annex 57R Pensions Dashboard Service Firms – Half-Yearly Prudential Return This annex consists only of one or more forms. The forms can be found below: [Editor’s note: insert link to Pensions Dashboard Service Firms – Half-Yearly Prudential Return (FIN075)] Regulatory return for Pensions Dashboard Service (PDS) firms PDS FIRMS - PRUDENTIAL - HALF-YEARLY RETURN Completion guidance Part One, Part Two and Part Three must be completed. Memos (1) and (2) must be completed, where applicable, by all pensions dashboard service firms subject to the Pensions Dashboards: Conduct of Business sourcebook (PDCOB). Monetary answers must be given in Sterling. Column Row Item A B C PART ONE: FINANCIAL STATEMENT INFORMATION SECTION A: BALANCE SHEET (as at end date of reporting period) FIXED ASSETS

FCA 2024/42 FOS 2024/4 Page 74 of 106 1 Intangible assets 2 Tangible assets 3 Investments 4 TOTAL FIXED ASSETS CURRENT ASSETS 5 Stocks (or inventories) 6 Debtors (see Memo (1)) 7 Investments held as current assets (see Memo (2)) 8 Cash at bank and in hand 9 Other assets 10 TOTAL CURRENT ASSETS CURRENT LIABILITIES (amounts falling due within one year) 11 Bank loans and overdrafts 12 Other liabilities falling due within one year 13 TOTAL CURRENT LIABILITIES

FCA 2024/42 FOS 2024/4 Page 75 of 106 14 Net current assets 15 Total assets less current liabilities 16 Other liabilities falling due after more than one year 17 Provisions for liabilities and charges 18 Net assets 19 Guarantees provided by firm CAPITAL AND RESERVES Capital account (incorporated businesses excluding limited liability partnerships) 20 Ordinary share capital 21 Preference share capital 22 Share premium account 23 Profit and loss account (retained earnings) 24 Other reserves 25 TOTAL CAPITAL AND RESERVES

FCA 2024/42 FOS 2024/4 Page 76 of 106 Capital account (unincorporated businesses and limited liability partnerships) 26 Sole trader / Partners' capital account / Members' capital 27 Other reserves 28 TOTAL CAPITAL AND RESERVES Memo (1) 29 Total amount falling due within one year from directors, fellow group undertakings or undertakings in which the firm has a participating interest where included in debtors. Memo (2) 30 Value of shares in group undertakings where such investments are held as current assets. SECTION B: PROFIT AND LOSS ACCOUNT (for the period corresponding to the reporting period) REVENUE (Income accrued during the reporting period)

FCA 2024/42 FOS 2024/4 Page 77 of 106 31 Revenue from all regulated qualifying pensions dashboard services activities 32 Revenue from all FCA regulated activities (including regulated qualifying pensions dashboard services activities) 33 Revenue from all non-FCA regulated activities 34 TOTAL REVENUE EXPENDITURE (Expenditure incurred during the reporting period) 35 TOTAL EXPENDITURE 36 Profit/(Loss) on ordinary activities before taxation 37 Profit/(Loss) on extraordinary activities before taxation 38 Taxation 39 Profit/(Loss) for the period before dividends and appropriations 40 Dividends and other appropriations 41 Retained profit Annual report and accounts 42 Date of most recent annual report and accounts dd/mm/yyyy

FCA 2024/42 FOS 2024/4 Page 78 of 106 43 Please provide an attachment or the link to the publication of your most recent annual report and accounts https:// PART TWO: SUPPLEMENTARY INFORMATION Column Row Item A B C SECTION C: AUDITED ACCOUNTS 44 If your firm is incorporated, does your firm qualify for the Companies House small firms exemption from having its accounts audited? Yes / No 45 If the firm is required to submit audited accounts, please report the date on which your accounts were last audited dd/mm/yyyy Column Row Item A B C PART THREE: REGULATORY CAPITAL SECTION D: CORE CAPITAL RESOURCES REQUIREMENT (as at the firm’s most recent accounting reference date) 46 Base requirement 40000 47 CORE CAPITAL RESOURCES REQUIREMENT

FCA 2024/42 FOS 2024/4 Page 79 of 106 (as at the firm’s most recent accounting reference date) SECTION E: CAPITAL RESOURCES (as at the firm’s end date of the reporting period) Incorporated businesses excluding limited liability partnerships 48 Share capital 49 Reserves 50 Interim net profits 51 Revaluation reserves 52 Eligible subordinated loans 53 less investments in own shares 54 less intangible assets 55 less interim net losses 56 TOTAL CAPITAL RESOURCES (as at the firm’s end date of the reporting period) Unincorporated businesses and limited liability partnerships

FCA 2024/42 FOS 2024/4 Page 80 of 106 57 Capital of a sole trader or partnership 58 Eligible subordinated loans 59 Personal assets not needed to meet non-business liabilities 60 less intangible assets 61 less interim net losses 62 less excess of drawings over profits for a sole trader or partnership 63 TOTAL CAPITAL RESOURCES (as at the firm’s end date of the reporting period) SECTION F: CAPITAL ADEQUACY POSITION (as at the firm’s end date of the reporting period) 64 CAPITAL RESOURCES SURPLUS/(DEFICIT) (as at the firm’s end date of the reporting period)

FCA 2024/42 FOS 2024/4 Page 81 of 106 16 Annex 58G Guidance notes for the Pensions Dashboard Service Firms – Half-Yearly Prudential Return Introduction This data provides the FCA with information on the solvency of firms engaged in regulated pensions dashboard activity, referred to as pensions dashboard service firms in this guidance note. The data items are intended to reflect the underlying adequate financial resources requirements contained in PDCOB 13. The data enables us to monitor firms against the requirements set out there, and also against the individual requirements placed on firms. We have included references to the underlying rules to assist in the completion of the return. The data assists the FCA in the ongoing supervision of firms engaged in regulated pensions dashboard activity. The data items apply to all pensions dashboard service firms subject to PDCOB. In the text below, we have identified where elements do not apply to all firms. This guidance note does not constitute individual or general FCA guidance. The purpose of this guidance note is to help firms complete the prudential return (FIN075). This summary is not a substitute for reading the actual text of the FCA Handbook. It is important to note that this guidance may be subject to periodic review. Currency All figures should be reported in Sterling (unless otherwise stated). Figures should be reported in single currency units (unless otherwise stated). Defined terms The descriptions indicated in these notes are designed simply to repeat, summarise or amplify the relevant statutory or other definitions and terminology, including, where appropriate, the pensions dashboard service firm’s accounting framework, without departing from their full meaning or effect. The defined terms are not meant to replace, redefine, or reinterpret relevant accounting standards or corresponding accounting terms. Data elements or items These are referred to by row first, then column. Basis of completion PART ONE: FINANCIAL STATEMENT INFORMATION SECTION A: BALANCE SHEET FIXED ASSETS

FCA 2024/42 FOS 2024/4 Page 82 of 106 1B – Intangible assets Pensions dashboard service firms should enter the amount of intangible assets that they hold. Intangible assets are identifiable non-monetary assets that are without physical substance. For example, goodwill, copyrights, patents and intellectual property. 2B – Tangible assets Pensions dashboard service firms should enter the amount of tangible assets that they hold. Tangible assets are assets that have physical substance and for which a measurable value can be attached. Examples include property, real estate, plant and equipment beneficially owned by the firm. 3B – Investments Pensions dashboard service firms should enter the amount of assets held for long-term investment purposes. This represents the firm’s long-term investments, including shares, bonds, real estate, exchange-traded funds, money market funds, cash or cash equivalents that are held for long-term investment purposes. 4B – Total fixed assets This amount should be the sum of items 1B (intangible assets), 2B (tangible assets) and 3B (investments). CURRENT ASSETS 5A – Stocks (or inventories) Pensions dashboard service firms should enter the monetary equivalent amount of their inventory held. These are assets held for sale in the ordinary course of business (finished goods), assets in the production process for sale in the ordinary course of business (work in progress), and materials or supplies that are consumed during production (raw materials). 6A – Debtors Pensions dashboard service firms should enter the amount of debtors. This includes loans and securities, and both trade and non-trade debtors. It also includes the total amount falling due within one year from directors, fellow group undertakings or undertakings in which the firm has a participating interest where included as debtors. 7A – Investments held as current assets Pensions dashboard service firms should enter the amount of assets held for short-term investment purposes. These are short-term investments that a firm holds for resale or pending their sale with a maturity date of less than one year and are generally easily converted to cash. These can include short-terms

FCA 2024/42 FOS 2024/4 Page 83 of 106 investments in, for example, equities, debt securities and exchange-traded funds. It also includes the value of shares in group undertakings where such investments are held as current assets. 8A – Cash at bank and in hand Pensions dashboard service firms should enter the amount of cash held by a business in the form of notes and coins (eg, petty cash) or which are held at a bank in the form of on demand deposits. 9A – Other assets Pensions dashboard service firms should enter the amount of other current assets held by the firm where they are not reported in items 5A (stocks (or inventories)), 6A (debtors), 7A (investments held as current assets) or 8A (cash at bank and in hand). 10A – Total current assets This amount should be the sum of items 5A (stocks (or inventories)), 6A (debtors), 7A (investments held as current assets), 8A (cash at bank and in hand) and 9A (other assets). CURRENT LIABILITIES 11A – Bank loans and overdrafts Pensions dashboard service firms should enter the amount of any borrowings sourced from banks or building societies. 12A – Other liabilities falling due within one year Pensions dashboard service firms should enter the amount of any borrowings that are not sourced from banks or building societies. These are short-term financial obligations that are not reported in item 11A (bank loans and overdrafts) to be settled within one year or within a normal operating cycle. 13A – Total current liabilities This amount should be the sum of items 11A (bank loans and overdrafts) and 12A (other liabilities falling due within one year). 14B – Net current assets This should equal item 10A (total current assets) minus item 13A (total current liabilities). 15B – Total assets less current liabilities This should equal the sum of item 4B (total fixed assets) and item 10A (total current assets), less item 13A (total current liabilities).

FCA 2024/42 FOS 2024/4 Page 84 of 106 16B – Other liabilities falling due after more than one year Pensions dashboard service firms should enter the amount of any long-term borrowings, including loans (eg, mortgage, bank loans or debt securities issued) that are due to be repaid after more than one year and debt securities with maturities greater than one year. 17B – Provisions for liabilities and charges Pensions dashboard service firms should enter the amount of any provisions for liabilities and charges. These represent liabilities of uncertain timing or amount. They come about because of a present obligation (legal or constructive) that has arisen as a result of a past event(s) (ie, an event that creates a legal or constructive obligation and where there is no realistic alternative but to settle the obligation). The payment is probable in that it is more likely than not to occur, and the amount can be estimated reliably. 18B – Net assets Net assets represent the residual interest that owners (or shareholders) have in the firm once the assets of the firm are used to settle all outstanding liabilities. This should equal item 15B (total assets less current liabilities) minus item 16B (other liabilities falling due after more than one year) and minus item 17B (provisions for liabilities and charges). Please note that this figure must be the same figure as item 25A (total capital and reserves); otherwise, the balance sheet (or statement of financial position) will not balance. 19B – Guarantees provided by firm Pensions dashboard service firms should enter the total value of guarantees provided by the firm to cover the indebtedness of other persons or entities. CAPITAL AND RESERVES Capital account (incorporated businesses excluding Limited Liability Partnerships) 20A – Ordinary share capital Pensions dashboard service firms should enter the face value of shares that have been issued and for which cash has been received. 21A – Preference share capital Pensions dashboard service firms should enter the face value of shares that have been issued and for which cash has been received, and which have preferential rights over the holders of ordinary shares. 22A – Share premium account

FCA 2024/42 FOS 2024/4 Page 85 of 106 Pensions dashboard service firms should enter the difference between the cash received in exchange for ordinary share capital and the face value of the shares issued. 23A – Profit and loss account (retained earnings) A pensions dashboard service firm should enter its retained earnings. This represents the accumulation of all profits previously retained by the firm (after the deduction of tax and dividends) since the birth of the firm. It would also include the profit retained by the firm in the financial year that is brought across from the firm’s profit and loss account statement (ie, it would include item 41B (retained profit)). 24A – Other reserves Pensions dashboard service firms should enter the amount of any other reserves that they hold and that are not reported in item 23A (profit and loss account (retained earnings)). This may include reserves created by appropriations of share premiums and similar realised appropriations, gifts of capital (such as those from a parent undertaking), and revaluation reserves (eg, reserves arising from the revaluation of land and buildings). 25A – Total capital and reserves Pensions dashboard service firms should enter the sum of item 20A (ordinary share capital), item 21A (preference share capital), item 22A (share premium account), item 23 (profit and loss account (retained earnings)), and item 24A (other reserves). Please note that this figure must be the same figure as item 18B (net assets); otherwise, the balance sheet (or statement of financial position) will not balance. Capital account (unincorporated businesses and limited liability partnerships) 26A – Sole trader / Partners' capital account / Members' capital For a pensions dashboard service firm that is a sole trader, the firm should enter the net balance on the firm’s capital account and current account. For a pensions dashboard service firm that is a partnership, the firm should enter the capital of the partnership (ie, capital made up from the partners). 27A – Other reserves Pensions dashboard service firms should enter the amount of any other reserves that they hold. 28A – Total capital and reserves Pensions dashboard service firms should enter the sum of item 26A (Sole trader / Partners’ capital account / Members’ capital) and item 27A (other reserves).

FCA 2024/42 FOS 2024/4 Page 86 of 106 Please note that this figure must be the same figure as item 18B (net assets); otherwise, the balance sheet (or statement of financial position) will not balance. 29A – Memo (1) Pensions dashboard service firms should enter the total amount of debtors falling due within one year from directors, fellow group undertakings or undertakings in which the firm has a participating interest where included as debtors. 30A – Memo (2) Pensions dashboard service firms should enter the total value of shares in group undertakings where such investments are held as current assets. SECTION B: PROFIT AND LOSS ACCOUNT REVENUE 31B – Revenue from all regulated pensions dashboard activities Pensions dashboard service firms should enter the total income accrued during the reporting period from regulated pensions dashboard activities. 32B – Revenue from all FCA regulated activities Pensions dashboard service firms should enter the total income accrued during the reporting period from all FCA regulated activities. This includes the income accrued during the reporting period from regulated pensions dashboard activities. 33B – Revenue from all non-FCA regulated activities Pensions dashboard service firms should enter the total income accrued during the reporting period from all non-FCA regulated activities. 34B – Total revenue Pensions dashboard service firms should enter the sum of item 32B (revenue from all FCA regulated activities) and item 33B (revenue from all non-FCA regulated activities). EXPENDITURE 35B – Total expenditure Pensions dashboard service firms should enter the total expenditure incurred during the reporting period both in relation to its regulated and non-regulated activities. It should exclude taxation payable on the firm’s profits during the reporting period. 36B – Profit/(Loss) on ordinary activities before taxation

FCA 2024/42 FOS 2024/4 Page 87 of 106 This figure is produced by deducting the total expenditure from ordinary activities (both regulated and non-regulated) incurred during the reporting period from the total revenue (both regulated and non-regulated) accrued during the reporting period. If the firm has not undertaken any extraordinary activities, this should be equal to item 34B (total revenue) minus item 35B (total expenditure). 37B – Profit/(Loss) on extraordinary activities before taxation Pensions dashboard service firms should enter any profits/losses on extraordinary activities before taxation during the reporting period. This should consider the proportion of total revenue obtained because of extraordinary activities, less the total expenditure incurred as a result of these extraordinary activities. An extraordinary event is a one-off (or non-recurring) event that has either generated a material profit or loss. Examples of an extraordinary activity may be the sale of a building or the purchase of new premises. 38B – Taxation A pensions dashboard service firm should estimate the tax that will be payable on its profits and insert that figure in this field. 39B – Profit/(Loss) for the period before dividends and appropriations This figure should be calculated by subtracting item 35B (total expenditure) and item 38B (taxation) from item 34B (total revenue). 40B – Dividends and other appropriations Pensions dashboard service firms should enter any dividends and other appropriations, which include dividends paid to shareholders, staff bonuses and wages paid to self (sole trader) etc. 41B – Retained profit Pensions dashboard service firms should calculate this by subtracting item 40B (dividends and other appropriations) from item 39B (profit/(loss) for the period before dividends and appropriations). Annual report and accounts 42B – Date of most recent annual report and accounts A pensions dashboard service firm should enter the date (in the format of dd/mm/yyyy) on which its most recent annual report and accounts were prepared. 43B – Please provide an attachment or the link to the publication of your most recent annual report and accounts A pensions dashboard service firm should provide either an attachment or the link to its most recent annual report and accounts.

FCA 2024/42 FOS 2024/4 Page 88 of 106 PART TWO: SUPPLEMENTARY INFORMATION SECTION C: AUDITED ACCOUNTS 44B – If your firm is incorporated, does your firm qualify for the Companies House small firms’ exemption from having its accounts audited? Answer ‘Yes’ or ‘No’. A pensions dashboard service firm should indicate in the affirmative (‘Yes’) if the firm is incorporated and has prepared its accounts under this exemption because the firm has qualified to apply the Companies House small firms’ exemption from having its accounts audited. Otherwise, the firm should indicate ‘No’ if this is not the case. 45B – If the firm is required to submit audited accounts, please report the date on which your accounts were last audited. If a pensions dashboard service firm is required to submit audited accounts, the firm should enter the date (in the format of dd/mm/yyyy) on which the firm’s accounts were last audited. PART THREE: REGULATORY CAPITAL SECTION D: CORE CAPITAL RESOURCES REQUIREMENT 46B – Base requirement With reference to PDCOB 13.5.1R, for a firm with a Part 4A permission to carry on regulated pensions dashboard activities, the base requirement is equal to £40,000. 47B – Core capital resources requirement The core capital resources requirement should be calculated in accordance with PDCOB 13.5.1R. A pensions dashboard service firm should enter its core capital resources requirement. SECTION E: CAPITAL RESOURCES Incorporated businesses excluding Limited Liability Partnerships 48A – Share capital In accordance with PDCOB 13.7.3R, a pensions dashboard service firm should enter its ordinary share capital and preference share capital (excluding preference shares redeemable by shareholders within 2 years) at the end of reporting period. 49A – Reserves In accordance with PDCOB 13.7.3R, a pensions dashboard service firm should enter its accumulated total of all retained profit, and other reserves created by appropriations of share premiums and similar realised appropriations at the end

FCA 2024/42 FOS 2024/4 Page 89 of 106 of reporting period. Reserves would also include gifts of capital, for example, from a parent undertaking. Refer to PDCOB 13.7.3R, to take into account the necessary adjustments that a firm must make to its reserves, where appropriate. 50A – Interim net profits In accordance with PDCOB 13.7.3R, a pensions dashboard service firm should enter its total interim profits net of tax, anticipated dividends or proprietor’s drawings and other appropriations. 51A – Revaluation reserves In accordance with PDCOB 13.7.3R, a pensions dashboard service firm should enter its revaluation reserves such as reserves arising from the revaluation of land and buildings, including any net unrealised gains for the fair valuation of equities held in the available-for-sale financial assets category. 52A – Eligible subordinated loans In accordance with PDCOB 13.7.3R and PDCOB 13.7.8R, a pensions dashboard service firm should enter its eligible subordinated loans. A subordinated loan/debt cannot be included as part of the firm’s capital resources to meet the firm’s core capital resources requirement unless it meets the conditions set out in PDCOB 13.7.8R. 53A – Less investments in own shares In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter any of its 'investments' in the balance sheet which are invested in the firm’s own shares in this field for deduction. 54A – Less intangible assets In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter its intangible assets for deduction. 55A – Less interim net losses In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter its interim losses, where they have not already been incorporated into the firm’s reserves, for deduction. 56A – Total capital resources In accordance with PDCOB 13.7, a pensions dashboard service firm should calculate its total capital resources as at the firm’s end date of the reporting period by using the following formula: item 48A (share capital) + item 49A (reserves) + item 50A (interim net profits) + item 51A (revaluation reserves) + item 52A (eligible subordinated loans) - item 53A (investments in own shares) - item 54A (intangible assets) - item 55A (interim net losses). Unincorporated businesses and limited liability partnerships

FCA 2024/42 FOS 2024/4 Page 90 of 106 57A – Capital of a sole trader or partnership In accordance with PDCOB 13.7.3R, a pensions dashboard service firm should enter its total net balance on its capital accounts and current account at the end of reporting period. 58A – Eligible subordinated loans In accordance with PDCOB 13.7.3R and PDCOB 13.7.8R, a pensions dashboard service firm should enter its eligible subordinated loans. A subordinated loan/debt cannot be included as part of the firm’s capital resources to meet the firm’s core capital resources requirement unless it meets the conditions set out in PDCOB 13.7.8R. 59A – Personal assets not needed to meet non-business liabilities In accordance with PDCOB 13.7.3R and PDCOB 13.7.6R, pensions dashboard service firms that are either sole traders or partnerships may use personal assets as eligible capital unless: i) these assets are being used to meet liabilities relating to other non-FCA activities (including personal and other business activities); or ii) the firm holds client money or other client assets in relation to regulated activities other than regulated pensions dashboard activity. Refer to PDCOB 13.7.6R. 60A – Less intangible assets In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter its intangible assets for deduction. 61A – Less interim net losses In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter its interim losses, where they have not already been incorporated into the firm’s capital or current accounts, for deduction. 62A – Less excess of drawings over profits for a sole trader or partnership In accordance with PDCOB 13.7.3R and PDCOB 13.7.5R, a pensions dashboard service firm should enter any excess capital removed from the firm over and above any profit made by the firm for deduction. 63A – Total capital resources In accordance with PDCOB 13.7, a pensions dashboard service firm should calculate its total capital resources as at the firm’s end date of the reporting period by using the following formula: item 57A (capital of a sole trader or partnership) + item 58A (eligible subordinated loans) + item 59A (personal assets not needed to meet non-business liabilities) - item 60A (intangible assets)

• item 61A (interim net losses) - item 62A (excess of drawings over profits for a sole trader or partnership).

FCA 2024/42 FOS 2024/4 Page 91 of 106 SECTION F: CAPITAL ADEQUACY POSITION 64A – Capital resources surplus/(deficit) In accordance with PDCOB 13.3.1R, pensions dashboard service firms must at all times maintain capital resources equal to or in excess of their core capital resources requirement. Pensions dashboard service firms that are incorporated businesses, excluding limited liability partnerships, should calculate this by subtracting item 47B (core capital resources requirement) from item 56A (total capital resources). Pensions dashboard service firms that are unincorporated businesses and limited liability partnerships should calculate this by subtracting item 47B (core capital resources requirement) from item 63A (total capital resources).

FCA 2024/42 FOS 2024/4 Page 92 of 106 Annex G Amendments to the Dispute Resolution: Complaints sourcebook (DISP) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Treating complainants fairly … 1 Annex 1R Complaints return form Complaints return form This annex consists only of one or more forms. Forms are to be found through the following address: [Editor’s note: insert link to form]

FCA 2024/42 FOS 2024/4 Page 93 of 106 Complaints Return (DISP 1 Ann 1R) … Part A-1, DISP 1 Annex 1R For firms receiving less than 500 complaints in the reporting period Table 1 Complaints opened when fewer than 500 total opened … A D H L M N Total Advising, selling and arranging Information, sums/ charges or product performance General admin /customer service Arrears related Other … … Decumulation & pensions 81 Pensions packaged multi products 224 Pensions dashboard services … … … Table 3

FCA 2024/42 FOS 2024/4 Page 94 of 106 Contextualisation metrics when fewer than 500 total opened complaints … Product/service grouping: A B Provision (at reporting period end date) Intermediation (within the reporting period) … 203 Decumulation & pensions Number of policies in force/service users Number of policies sold … Part A-2, DISP 1 Annex 1R For firms receiving more than 500 complaints in the reporting period Table 4 Complaints opened when greater than or equal to 500 opened complaints

FCA 2024/42 FOS 2024/4 Page 95 of 106 A B C E F G I J K M N O Total Advising, selling and arranging Information, sums/ charges or product performance General admin/ customer service Arrears Related Other Claims Product/ service grouping Product/service Total Unsuitable advice Unclear guidance/arrangement Disputes over sums/charges Product performance/features Product disclosure information Errors/not following instructions Delays/timescales Other general admin/customer service Arrears related Other Number of complaints in columns B to N which are claims related … … Decumulation & pensions 81 Pensions packaged multi products 224 Pensions dashboard services … …

FCA 2024/42 FOS 2024/4 Page 96 of 106 Table 5 Complaints closed, upheld and redress when greater than or equal to 500 opened complaints Redress paid reported in single units A B C D E F G H Product/service grouping Product/service Complaints closed within 3 days Complaints closed > 3 days but within 8 weeks Complaints closed > 8 weeks Total complaint s closed Total complaint s upheld Total redress paid for upheld complaints (single units) Total redress paid for complaints not upheld (single units) Total redress paid (single units) … … Decumulation & pensions 136 Pensions packaged multi products 225 Pensions dashboard services … … Table 6 Contextualisation metrics when greater than or equal to 500 opened complaints Reported in single units

FCA 2024/42 FOS 2024/4 Page 97 of 106 A B Provision (at reporting period end date) Intermediation (within the reporting period) Product/service grouping Product/service … Number of policies in force/Service users Number of policies sold/Service users … Decumulation & pensions 196 Pensions packaged multi products 226 Pensions dashboard services … 204 Decumulation & pensions contextualised Number of complaints opened per 1000 policies in force/service users 205 Number of complaints opened per 1000 policies sold/service users …

FCA 2024/42 FOS 2024/4 Page 98 of 106 … 2 Jurisdiction of the Financial Ombudsman Service … 2.5 To which activities does the Voluntary Jurisdiction apply? 2.5.1 R The Ombudsman can consider a complaint under the Voluntary Jurisdiction if: … (2) it relates to an act or omission by a VJ participant in carrying on one or more of the following activities: (a) an activity (other than auction regulation bidding and, administering a benchmark, meeting of repayment claims and, managing dormant asset funds (including the investment of such funds) and regulated pensions dashboard activity) carried on after 28 April 1988 which: … … (c) activities, other than regulated claims management activities, activities ancillary to regulated claims management activities, meeting of repayment claims and, managing dormant asset funds (including the investment of such funds) and regulated pensions dashboard activity, which (at 2 August 2024 30 November 2024) would be covered by the Compulsory Jurisdiction, if they were carried on from an establishment in the United Kingdom (these activities are listed in DISP 2 Annex 1G); … … … 2.7 Is the complainant eligible? … Eligible complainants …

FCA 2024/42 FOS 2024/4 Page 99 of 106 2.7.6 R To be an eligible complainant a person must also have a complaint which arises from matters relevant to one or more of the following relationships with the respondent: … (15) the complainant is either a borrower or a lender under a P2P agreement and the respondent is the operator of an electronic system in relation to lending.; (16) the complainant is a client (where the respondent is an ISPV).; (17) the complainant is a customer of the respondent in relation to regulated claims management activity.; (18) the complainant is a customer of the respondent in relation to regulated pensions dashboard activity. … 2 Annex 1G Regulated Activities for the Voluntary Jurisdiction at 2 August 2024 30 November 2024 … The activities which were covered by the Compulsory Jurisdiction (at 2 August 2024 30 November 2024) were: … The activities which (at 2 August 2024 30 November 2024) were regulated activities were, in accordance with section 22 of the Act (Regulated Activities), any of the following activities specified in Part II and Parts 3A and 3B of the Regulated Activities Order (with the addition of auction regulation bidding, administering a benchmark and dealing with unwanted asset money): … (47) … (48) regulated pensions dashboard activity (article 89BA); … … 4 Standard terms … 4.2 Standard terms

FCA 2024/42 FOS 2024/4 Page 100 of 106 … Application of DISP 1 to DISP 3 4.2.3 R The following rules and guidance apply to VJ participants as part of the standard terms, except where the context requires otherwise: … (2) DISP 2 (Jurisdiction of the Financial Ombudsman Service), except: … (f) DISP 2.7.6R(14D); (fa) DISP 2.7.6R(18); … … …

FCA 2024/42 FOS 2024/4 Page 101 of 106 Annex H Amendments to the Perimeter Guidance manual (PERG) In this Annex, all of the text is new and is not underlined. Insert the following new chapter, PERG 12A, after PERG 12 (Guidance for persons running or advising on personal pension schemes). 12A Guidance on operating a pensions dashboard 12A.1 Application This guidance applies to any person who needs to know whether their activities in relation to a particular pensions dashboard service amount to regulated pensions dashboard activity. 12A.2 Purpose Q1. What is the purpose of these questions and answers (‘Q&As’) and who should be reading them? The purpose of these Q&As is to help persons to consider whether they are carrying out regulated pensions dashboard activity and therefore whether they need authorisation or a variation of their Part 4A permission. Q2. To what extent can we rely on these Q&As? The answers given in these Q&As represent the FCA’s views but the interpretation of financial services legislation is ultimately a matter for the courts. If you have doubts about your position after reading these Q&As, you may wish to seek legal advice. The Q&As do not purport to be exhaustive and are not a substitute for reading the relevant legislation. 12A.3 Operating a pensions dashboard service Q3. What is the regulated activity in relation to pensions dashboard services? The regulated activity in relation to pensions dashboard services is found in article 89BA of the Regulated Activities Order, which provides: ‘operating a pensions dashboard service which connects to the Money and Pensions Service dashboards digital architecture is a specified kind of activity’. This regulated activity is referred to in the glossary as regulated pensions dashboard activity. Q4. What is a pensions dashboard service? A pensions dashboard service is a secure digital interface that will allow consumers to find their pensions that are not yet in payment and view basic information about them in one place. For the purposes of the regulated activity, ‘pensions dashboard service’ has the same meaning as in section 238A(1) of the

FCA 2024/42 FOS 2024/4 Page 102 of 106 Pensions Act 2004, where it is defined as ‘an electronic communications service by means of which information about pensions may be requested by, and provided to, an individual or a person authorised by the individual’. Q5. What does ‘which connects to the Money and Pensions Service dashboards digital architecture’ mean? The MaPS dashboards digital architecture means the information technology systems delivered by or on behalf of the Money and Pensions Service which enable the MaPS pensions dashboards ecosystem to work. The MaPS Pensions Dashboards Ecosystem is the interconnected system which enables pensions dashboard services to work and comprises: • the MaPS dashboards digital architecture; • the pensions dashboard services; • the interfaces of the relevant pensions schemes which connect to the MaPS dashboards digital architecture; • the interfaces of the relevant pension schemes that connect to the pensions dashboard services; and • any other party or service that needs to be connected in order for the system to work. Each individual pensions dashboard service will have a separate connection to the MaPS dashboards digital ecosystem. Q6. Who needs to be authorised? Persons who operate a pensions dashboard service will need to be (or to become) FCA authorised or vary their permission to undertake regulated pensions dashboard activity. Q7. What is involved in operating a pensions dashboard service? The regulated activity in article 89BA of the Regulated Activities Order refers to ‘operating’ a pensions dashboard service which connects to the MaPS dashboards digital architecture. The Regulated Activities Order does not attempt to define the word ‘operating’ for the purposes of the regulated activity in article 89BA. The explanatory memorandum to the Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2024 says that ‘operating a dashboard may include taking regulatory responsibility for any third parties involved in connecting to the MaPS digital architecture on their behalf’. Ultimately, it will be for the courts to determine its meaning. In the FCA’s view, the term ‘operating’ should be given its ordinary meaning. It is the FCA’s view, therefore, that ‘operating’ means to control the pensions dashboard service. There are other references in the Regulated Activities Order to ‘operating’. The FCA has provided guidance on some of those references – for example, in PERG 12, Q4 – which is consistent with the view the FCA has taken on the meaning of ‘operating’ for the purposes of article 89BA of the Regulated Activities Order. In determining whether a person is in control of a particular pensions dashboard service, it is the FCA’s view that the person who accepts responsibility for it will

FCA 2024/42 FOS 2024/4 Page 103 of 106 be in control of that particular pensions dashboard service. Therefore, the operator will be the person accepting responsibility for: • compliance with our rules; • compliance with the pensions dashboard standards and the Dashboard Regulations; • individual customers; and • the connection to the MaPS dashboards digital architecture, including where a third party connects to the MaPS dashboards digital architecture on their behalf. This is consistent with the explanatory memorandum to the Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2024. It follows, therefore, that an operator of a pensions dashboard service may or may not be the person that actually connects their particular pensions dashboard service to the MaPS dashboards digital architecture; the connection may be made by another person on their behalf. Instead, it is the person that remains responsible for the connection, and not the person actually connecting, that will be considered the operator, and would therefore be registered with the Money and Pensions Service as the operator of that particular pensions dashboard service. It is also the FCA’s view that a fundamental element of control is that a person has the authority to decide and direct how the pensions dashboard service is managed or run, with the ability to direct any third party carrying out activities or services to support the pensions dashboard service with whom they have an arrangement. So where the person with authority to decide and direct how the dashboard is managed and run outsources activities or services to a third party, or purchases a product from a third party that meets their requirements and is a part of the running of the service, that third party will not become the operator of the pensions dashboard service as they won’t decide and direct how the pensions dashboard service is managed or run (see further guidance in Q8). Q8. Who is operating the pensions dashboard service if activities/services that may involve ensuring the pensions dashboard service continues to run on a day-to-day basis are provided by third parties? As explained in Q7, the person who takes responsibility for a particular pensions dashboard service and/or has the authority to decide and direct how it is managed or run, will be the person in control of and operating it. In some circumstances, however, there may be outsourcing arrangements in place with third parties, or the person responsible may purchase a product from a third party that meets their requirements. This could include, for example, the provision of technical services to ensure that the pensions dashboard service can function and remain connected to the MaPS dashboards digital architecture. In such circumstances, the person who retains responsibility for the particular pensions dashboard service, and/or with the authority to decide and direct how the pensions dashboard service is managed or run, with the ability to direct the third party providing the technical services, will remain the operator and the person who is carrying on regulated pensions dashboard activity. The third party will not be operating the pensions dashboard service so long as they do not

FCA 2024/42 FOS 2024/4 Page 104 of 106 take any responsibility for it and because they act under the direction and decision making of the operator. In such arrangements, the apportionment of responsibility, and clarity around who has the authority to make decisions and direct, could be achieved by contractual terms and conditions ensuring that responsibility and high-level decision making/direction is assumed by one person such that they are the only person considered to be carrying on regulated pensions dashboard activity in relation to the particular pensions dashboard service. This will still be the case even if the third party takes decisions around technical details needed to achieve the high-level objectives set by the person engaging the third party or purchasing their product. Q9. Where there is more than one person involved, which person is required to be authorised? As explained in Q8, there may be several parties involved in the development, production or functioning of a particular pensions dashboard service. The person, or persons, who are operating the particular pensions dashboard service, as explained in Q7, will need Part 4A permission for regulated pensions dashboard activity. In some cases, only one person will be operating the pensions dashboard service and therefore only that person will need Part 4A permission (see Example 1 below). In some cases, there may be more than one person operating the pensions dashboard service – for example, if there is more than one person who is responsible for the particular pensions dashboard service and/or has authority to decide and direct how it is managed or run. Q10. Are there other activities that relate to the pensions dashboard service that do not amount to operating that pensions dashboard service? In our view, providing the following services in and of themselves is unlikely to amount to regulated pensions dashboard activity because it is unlikely these activities amount to operating the particular pensions dashboard service: (1) consultation services – for example, where a consultant advises their clients on how to undertake consumer research to inform design, how to develop their business case and how to prepare an application for FCA authorisation; (2) providing a publicly available link (for example, on a website) to a qualifying pensions dashboard service that is clearly operated by another person (who will therefore need to be a firm authorised to operate it); or (3) providing a link to the publicly available MaPS pensions dashboard service. Q11. Can you give some examples of what is and what is not operating a pensions dashboard service? The following are examples of the FCA’s view of what is and what is not operating a pensions dashboard service. Example 1

FCA 2024/42 FOS 2024/4 Page 105 of 106 A person (Person A), develops and produces a pensions dashboard service. Person A connects that particular pensions dashboard service to the MaPS dashboards digital architecture, and takes responsibility for compliance with the Dashboard Regulations, the pensions dashboard standards and our rules. In this example, Person A is operating the pensions dashboard service and will need Part 4A permission to undertake regulated pensions dashboard activity. Example 2 – consultancy service Person A (in Example 1) engages a third party, Person B, when developing and designing its pensions dashboard service, to provide advice in relation to, for example, how to use consumer research to inform design, how best to develop its business case and how to ensure compliance with the Dashboard Regulations and the pensions dashboard standards. Person B does not make decisions in relation to how the pensions dashboard service is managed or run, nor does it have direct involvement or interaction with the pensions dashboard service. The service provided by Person B is advisory only. It is therefore unlikely that Person B will need Part 4A permission for regulated pensions dashboard activity as it is unlikely to be operating a pensions dashboard service for the purposes of the regulated activity. As per Example 1, Person A will be operating the pensions dashboard service. Example 3 – licensed technical service or product Person C develops and builds the software which is necessary for a pensions dashboard service to function and which will enable the connection to the MaPS dashboards digital architecture. Person C allows Person D to use or purchase the use of that software – for example, by way of a licence agreement. Under the agreement, Person D has the authority to direct Person C to make changes to software that supports the pensions dashboard service. This includes resolving issues which need correcting or improving in order to continue to meet the relevant requirements for which Person D has accepted responsibility. Person C must follow those instructions. Person C may facilitate the connection of the particular pensions dashboard service to the MaPS pensions dashboard digital architecture on behalf of Person D, but Person D takes responsibility for the connection and the pensions dashboard service. Person D will also be registered with the Money and Pensions Service as being responsible for that particular connection. In this scenario, Person D is operating the pensions dashboard service because it has the authority to decide and direct how the pensions dashboard service is managed or run, which includes the ability to direct Person C. Person D takes responsibility for the connection to the MaPS dashboards digital architecture and is registered with the MaPS dashboards digital architecture in relation to that particular pensions dashboard service. Person D will need Part 4A permission to undertake regulated pensions dashboard activity. Person C is unlikely to be operating the pensions dashboard service and so is unlikely to need Part 4A permission to carry out regulated pensions dashboard activity. This will still be the case even if Person C takes decisions around technical details needed to achieve the high-level directions given and decisions taken by

FCA 2024/42 FOS 2024/4 Page 106 of 106 Person D in relation to the management and running of the pension dashboard service. Where Person D does not have the ability to instruct Person C to make the relevant changes necessary to allow Person D to completely fulfil the responsibilities Person D has accepted in relation to the pension dashboard service and its connection, Person C may also be considered the operator and need to apply for Part 4A permission. Example 4 – third-party dashboard arrangement In this scenario, Person E develops and produces a pensions dashboard service and connects to the MaPS dashboards digital architecture. Person E is operating the pensions dashboard service and obtains Part 4A permission for regulated pensions dashboard activity. Person E enters into an arrangement with Person F to provide access to a qualifying pensions dashboard service for Person F’s members, customers or consumers. For example, Person F is an employer, or trustee of a pension scheme, and arranges access to a qualifying pensions dashboard service for its employees or members. It is made clear to Person F’s members, customers or consumers that the qualifying pensions dashboard service is provided by Person E and Person E is responsible for it, in line with the rules in PDCOB 9 that apply to third-party dashboard arrangements. Person F does not control any aspect of the qualifying pensions dashboard service, apart from, for example, how the access to it may be presented or appear on Person F’s website, and so is not likely to be operating it. Person E is operating the pensions dashboard service and is likely to be the only party that needs Part 4A permission for regulated pensions dashboard activity.

© Financial Conduct Authority 2024 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 1-008220