CISI Capital Markets Programme — UK Financial Regulation Cheat Sheet
Last revised: September 28, 2026
Cheat sheet: UK financial regulation reference for candidates preparing for the Chartered Institute for Securities & Investment CISI Capital Markets Programme — UK Financial Regulation exam.
Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.
Scope and study context
This page is independent exam-prep support. It is not affiliated with, endorsed by, or issued by the Chartered Institute for Securities & Investment.
For CISI CMP UK Reg, passive rereading is not enough. Use a question bank to convert rules into decisions.
Practice mode
Best use
Topic drills
Build accuracy in one area, such as market abuse or suitability.
Mixed sets
Practise switching between perimeter, conduct, CASS, AML, and governance.
Mock exams
Test timing, stamina, and decision consistency.
Detailed explanations
Learn why the correct answer is better and why tempting distractors fail.
Error log
Track repeat mistakes and convert them into review prompts.
What to write in your error log
For each missed question, record:
topic;
rule tested;
fact you missed;
why the wrong answer was tempting;
the corrected decision rule;
whether you need another topic drill.
Example:
Missed topic
Corrected decision rule
Appropriateness
Non-advised complex product sale tests knowledge and experience; it does not prove suitability.
Conflicts
Disclosure is not the first control if the conflict can be prevented or managed.
Market abuse
Inside information does not need to be acted on profitably to create risk.
CASS
Client money must be protected through segregation, records, and reconciliation, not just internal notation.
High-yield exam map
Area
What to recognise quickly
Common exam trap
Regulatory structure
FCA, PRA, Bank of England, HM Treasury, FOS, FSCS, NCA, OFSI
FCA is not the prudential regulator for every firm. PRA supervises banks, insurers and designated investment firms for prudential matters.
Regulatory perimeter
Regulated activities, specified investments, by way of business, exclusions, financial promotions
A communication may be a restricted financial promotion even if no regulated activity is yet performed.
Authorisation
Part 4A permission, threshold conditions, appointed representatives, variation/cancellation of permission
An appointed representative is exempt only for appointed activities; the principal remains responsible.
FCA conduct
Principles for Businesses, COBS, PRIN, Consumer Duty, conflicts, communications, best execution
Disclosure alone is usually not enough if a conflict can be prevented or managed.
Client classification
Retail client, professional client, eligible counterparty
Eligible counterparty status reduces protections only for eligible business; it is not a complete regulatory waiver.
SM&CR
Senior managers, certification staff, conduct rules, duty of responsibility
Certification staff are certified by the firm, not pre-approved by the regulator.
HM Treasury sets the legal framework; the Bank of England has financial stability functions; the FCA focuses on conduct, markets, consumers, and competition; the PRA focuses on prudential soundness of relevant firms.
Distinguish conduct risk from prudential risk.
Regulatory perimeter
A firm usually needs permission if it carries on a regulated activity, by way of business, in relation to specified investments, without an exclusion or exemption.
Identify whether authorization is required.
FCA Principles
Broad standards such as integrity, skill, care and diligence, management and control, financial prudence, market conduct, client interests, communications, conflicts, client assets, regulator relations, and Consumer Duty.
Principles apply even when detailed rules are not quoted.
Client classification
Retail clients receive the highest conduct protection; professional clients receive reduced protection; eligible counterparties receive the least for eligible activities.
Do not assume “professional” means no duties.
Advice vs execution
Suitability applies to personal recommendations and portfolio management; appropriateness applies to non-advised complex product business; execution-only is narrower.
Separate suitability, appropriateness, and best execution.
Financial promotions
Communications must be fair, clear, and not misleading; unauthorised persons generally need approval or an exemption.
Approval does not remove responsibility for accuracy.
Best execution
Firms must take sufficient steps to obtain the best possible result for clients, considering relevant execution factors.
Retail analysis often focuses heavily on total consideration.
Conflicts
Identify, prevent or manage conflicts; disclosure alone is normally a last-resort control, not the whole answer.
“Just disclose it” is often too weak.
CASS/client assets
Client money and custody assets must be protected, segregated, recorded, and reconciled according to applicable rules.
Do not confuse firm assets with client assets.
Market abuse
Insider dealing, unlawful disclosure, and market manipulation are core categories.
Inside information is precise, non-public, price-sensitive information.
Must be fair, clear and not misleading where FCA rules apply
Balanced risk disclosure matters; small-print risk warnings do not cure misleading headline claims
Real-time vs non-real-time
Interactive calls/meetings differ from written, website or email promotions
Cold-calling and direct offer materials are commonly tested
Approval
Authorised approver must understand the product and relevant rules
Approval is not a rubber stamp; responsibility attaches to the approver
Financial promotions
A financial promotion is broadly an invitation or inducement to engage in investment activity. The key review rule is: communications must be fair, clear, and not misleading.
Financial promotion checklist
Question
Why it matters
Is there an invitation or inducement?
Determines whether the communication is within the financial promotion regime.
Is the communicator authorised?
Unauthorised persons generally need approval or a valid exemption.
Who is the audience?
Retail, professional, and exempt recipient categories affect the analysis.
Is the product high risk or complex?
Additional restrictions, warnings, or processes may apply.
Are benefits and risks balanced?
Selective presentation is a common exam red flag.
Is performance information presented properly?
Past performance and projections must not mislead.
Common financial promotion mistakes
highlighting upside while burying risk;
using unrealistic examples without clear assumptions;
implying capital protection where none exists;
presenting past performance as a promise;
approving a communication without adequate review;
relying on an exemption without satisfying its conditions;
treating social media or informal messaging as outside the regime.
Authorisation, permissions and supervision
Topic
Key points
Scenario cue
Part 4A permission
Authorised firms need permission for each regulated activity, investment type and client type
“Firm wants to add derivatives advice” means variation of permission may be needed
Threshold conditions
Minimum conditions for authorisation, including appropriate resources, suitability, effective supervision and viable business model
“Firm lacks systems/capital/competent management”
Scope of permission
Activities outside permission may be unauthorised
“Permitted to arrange but starts managing portfolios”
Variation/cancellation
Permissions can be varied by the firm or regulator; cancellation ends authorisation for those activities
“Firm exits business line” or “regulator restricts activity”
Appointed representative
Exempt person acting for an authorised principal under a written arrangement
Principal accepts regulatory responsibility for appointed activities
Exempt professional firm
Professional firms may conduct limited regulated activity under specific conditions
Do not assume full investment permissions
Ongoing supervision
Returns, notifications, visits, skilled person reports, thematic reviews, attestations
“FCA asks for independent review” often points to skilled person powers
Principle 11 / openness
Firms must deal with regulators openly and cooperatively
Significant breaches, CASS issues, capital problems and financial crime concerns require prompt regulator-facing escalation
FCA objectives, principles and Consumer Duty
FCA objectives
Objective type
FCA focus
Strategic objective
Relevant markets function well
Operational objective
Appropriate degree of consumer protection
Operational objective
Protecting and enhancing UK financial system integrity
Operational objective
Promoting effective competition in consumers’ interests
Secondary objective
International competitiveness and growth, while operating within the statutory framework
Notes and examples
FCA Principles for Businesses
Principle
Short form
Exam application
1
Integrity
Dishonesty, misleading conduct, concealment
2
Skill, care and diligence
Poor advice process, weak execution controls
3
Management and control
Weak governance, no risk oversight, failed supervision
4
Financial prudence
Inadequate financial resources or liquidity planning
Per se professionals or elective professionals meeting criteria
Reduced
Knowledge/experience assumed in some areas; can opt down
Eligible counterparty
Certain sophisticated institutions for eligible business
Lowest for relevant activities
Not a universal exemption from all rules
Classification traps
Trap
Correct approach
“Wealthy” automatically means professional
Wealth alone is not enough; elective opt-up criteria and process matter
Eligible counterparty receives no protections
Some protections still apply, and status applies only to eligible business
A firm can classify to reduce obligations without evidence
Classification must be documented and supportable
Client can never opt down
Higher protection can be requested where rules allow
Notes and examples
Client classification
Client classification drives the level of conduct protection. Always identify the client category before deciding the rule outcome.
Category
Typical meaning
Exam significance
Retail client
Client not classified as professional or eligible counterparty.
Highest conduct protection. Suitability, disclosure, risk warnings, and complaints protections are often most relevant.
Professional client
Client with sufficient experience, knowledge, and expertise, either per se or elective.
Reduced protections, but firms still owe important duties.
Eligible counterparty
Certain sophisticated counterparties for eligible business.
Lowest conduct protection for specific eligible activities, but not outside all regulation.
Reclassification traps
Scenario
Key point
Retail client wants to be treated as professional
Opt-up requires a proper assessment and process; it is not just a client preference.
Professional client wants more protection
Clients may request different categorisation where rules allow.
Eligible counterparty receives a financial promotion
Do not assume all communication standards disappear.
Firm labels a client “sophisticated” internally
Internal labels do not replace regulatory classification requirements.
Conduct of business decision table
Scenario
Main rule area
Required response
Personal recommendation to buy/sell/hold an investment
Suitability
Assess objectives, financial situation, knowledge/experience; recommend only suitable transactions
Discretionary portfolio management
Suitability
Portfolio and mandate must remain suitable
Non-advised sale of complex product
Appropriateness
Assess knowledge/experience; warn if inappropriate or insufficient information
Pure execution-only in non-complex product
Execution-only conditions
No suitability assessment, but communications, conflicts, order handling and CASS still apply
Client order execution
Best execution
Take all sufficient steps under execution policy; consider price, costs, speed, likelihood, size, nature
Firm receives third-party benefit
Inducements/conflicts
Check permissibility, quality enhancement, no impairment of duty, disclosure
Firm has proprietary interest against client order
Conflicts and market conduct
Identify, prevent/manage, disclose only where residual risk remains
Investment research provided
Research/inducements/conflicts
Ensure independence, disclosure and payment rules are met
Product manufactured or distributed
Product governance
Define target market, distribution strategy, review outcomes
Notes and examples
Suitability vs appropriateness vs execution-only
Test
Trigger
Information required
Result if concern
Suitability
Advice or discretionary management
Objectives, risk tolerance, capacity for loss, financial situation, knowledge and experience
Do not recommend/manage in unsuitable way
Appropriateness
Non-advised service in complex products
Knowledge and experience relevant to product/service
Warn client if inappropriate or if insufficient information
Execution-only
Client gives order without advice; conditions met
Limited product/service checks, depending on product complexity
Firm may execute if conditions met, but other conduct duties remain
Best execution quick reference
Factor
What it means
Price
Execution price achieved
Costs
Explicit and implicit transaction costs
Speed
How quickly execution occurs
Likelihood of execution
Probability order will be completed
Likelihood of settlement
Probability trade will settle
Size
Impact of order size on execution
Nature
Any specific order characteristics
For retail clients, total consideration is commonly central: price plus costs. Best execution is not always the lowest displayed price; venue reliability, liquidity, settlement and order characteristics can matter.
Notes and examples
Best execution and order handling
Best execution is not the same as getting the best price in every isolated case. It is about taking sufficient steps to obtain the best possible result, considering relevant execution factors.
Execution factor
What it means
Price
Price at which the order is executed.
Costs
Explicit and implicit costs of execution.
Speed
How quickly execution can occur.
Likelihood of execution
Probability the order can be completed.
Likelihood of settlement
Probability the trade will settle successfully.
Size
Size of the order relative to market liquidity.
Nature
Special characteristics of the order.
Other considerations
Any factor relevant to achieving the best result.
Order handling controls
execute client orders promptly, fairly, and sequentially where required;
avoid misuse of information about client orders;
have and follow an order execution policy;
disclose appropriate execution information to clients;
monitor execution quality;
manage aggregation and allocation fairly;
keep records capable of demonstrating compliance.
Best execution traps
Trap
Correct approach
“Best execution always means best price.”
Price is important, but other factors may matter, especially for size, liquidity, or settlement risk.
“Retail and professional analysis is identical.”
Retail outcomes often focus strongly on total consideration, while professional analysis may weigh factors differently.
“Following the policy once is enough.”
Policies must be monitored and reviewed.
“Client instruction removes all obligations.”
A specific instruction may affect the instructed part, but not necessarily all other aspects.
Conflicts of interest
Step
Required action
Identify
Map conflicts between firm/client, staff/client, client/client and group/client
Prevent or manage
Segregation of duties, information barriers, remuneration controls, allocation policies
Record
Maintain conflicts register and evidence of controls
Disclose
Use only where residual risk remains and disclosure is specific enough
Decline
If conflict cannot be managed adequately, do not proceed
Common capital markets conflicts include proprietary trading against client flow, allocation of scarce IPO stock, analyst independence, corporate finance mandates, personal account dealing and inducements from product providers.
Notes and examples
Conflicts of interest and inducements
Conflicts are not automatically prohibited, but firms must identify and control them.
Conflict management hierarchy
Identify actual and potential conflicts.
Prevent or manage the conflict through effective arrangements.
Disclose only where arrangements are not sufficient to ensure, with reasonable confidence, that client interests will not be harmed.
Decline to act where the conflict cannot be managed appropriately.
Common conflict examples
Situation
Conflict risk
Firm sells in-house products to clients
Revenue interest may conflict with client interest.
Analyst coverage linked to investment banking revenue
Research objectivity risk.
Gifts or hospitality from brokers
Inducement and independence concerns.
Aggregated client orders
Allocation fairness risk.
Personal account dealing by staff
Misuse of information or front-running risk.
Remuneration based solely on sales volume
Poor customer outcome risk.
Inducement exam points
Ask whether the payment, commission, benefit, or hospitality could impair the firm’s duty to act in the client’s best interests.
For relevant investment business, inducements often require a quality-enhancement rationale, proper disclosure, and no impairment of duty.
Minor non-monetary benefits may be treated differently from substantial benefits, but they still require controls.
Research, corporate access, and broker benefits can create conflicts and should not be treated casually.
Capital markets structure
Concept
Meaning
Exam cue
Primary market
Issuance of new securities to raise capital
Prospectus, underwriting, placing, admission
Secondary market
Trading of existing securities
Trading venues, best execution, transparency
Regulated market
Authorised multilateral market with non-discretionary rules
Main exchange-style venue
MTF
Multilateral trading facility, typically non-discretionary matching
Alternative trading venue
OTF
Organised trading facility for non-equity instruments with operator discretion
Bonds, derivatives, structured finance products
SI
Systematic internaliser; investment firm dealing on own account outside venues in organised, frequent, systematic and substantial way
Bilateral execution by investment firm
OTC trading
Off-venue bilateral trading
Counterparty credit and transparency issues
CCP
Central counterparty interposes itself between buyer and seller
Clearing, margin, default management
CSD
Central securities depository
Settlement and securities records
Custodian
Safeguards/administers assets
CASS custody rules and asset protection
Issuer, listing and disclosure controls
Area
Key idea
Exam cue
Prospectus
Required for many public offers or admissions to regulated markets unless exemption applies
“Offer to public”, “admission to trading”
FCA listing/prospectus role
FCA administers relevant listing and prospectus rules
“Official listing”, “approved prospectus”
Continuing obligations
Issuers must comply with ongoing disclosure and governance requirements
Periodic reporting, inside information disclosure
Inside information disclosure
Issuer must disclose inside information as soon as required unless delay conditions are met
“Results known internally but not announced”
Insider lists
Record persons with access to inside information
“Wall-crossed staff/advisers”
PDMR dealing
Directors/senior managers face dealing notification and closed-period controls
“Director trades before results”
Market soundings
Controlled communication of information before transactions
“Wall-crossing investors before placing”
Market abuse
Inside information test
Information is likely inside information where it is:
Element
Meaning
Precise
Indicates circumstances/events or allows a conclusion about possible price effect
Not public
Not generally available to the market
Related to issuer/instrument
Directly or indirectly concerns issuer, instrument, derivative or relevant market
Price-sensitive
A reasonable investor would likely use it as part of investment decision-making
Notes and examples
Main abuse types
Abuse type
Description
Example
Insider dealing
Using inside information to acquire/dispose/cancel/amend orders, or recommending/inducing another
Trading before unpublished takeover announcement
Unlawful disclosure
Improperly disclosing inside information outside normal employment/professional duties
Assess precision, non-public nature, and price sensitivity.
“Cancelling an order means no manipulation.”
Placing orders to create a false impression can still be problematic.
“Disclosure to one analyst is fine if accurate.”
Selective disclosure of inside information can be unlawful unless properly controlled.
Market integrity controls
insider lists and information barriers;
wall-crossing procedures;
restricted lists and watch lists;
personal account dealing controls;
suspicious transaction and order escalation;
surveillance of trading patterns;
clear escalation to compliance and senior management;
staff training on inside information and confidentiality.
Client assets and client money: CASS
Concept
Meaning
Exam trap
Client money
Money held for or on behalf of a client in connection with investment business
Must be segregated from firm money unless an exemption applies
Custody asset
Designated investment held for a client
Not money; subject to custody record and reconciliation rules
Segregation
Client assets/money kept separate from firm assets/money
Reduces loss on firm failure
Statutory trust
Client money is held on trust for clients
Firm cannot use it as working capital
Reconciliations
Internal and external checks of records against banks/custodians
Breaks must be investigated promptly
Acknowledgement letters
Banks/custodians acknowledge client money status where required
Missing/incorrect letters are common CASS breaches
CASS resolution pack
Key information to help return assets on failure
Tests operational readiness
Title transfer collateral
Client transfers full ownership to firm, with contractual obligation to return equivalent
Not the same as holding client assets under CASS
Delivery versus payment
Settlement timing arrangements can affect client money/custody treatment
Do not assume all settlement cash is automatically long-term client money
Notes and examples
CASS scenario decoder
Scenario cue
Likely issue
Firm uses client cash to fund expenses
Client money breach, Principle 10
Custodian records do not match firm books
Custody reconciliation breach
Bank account title does not show client status
Segregation/acknowledgement failure
Firm failure with pooled client money
Client money distribution and shortfall allocation
Asset transferred under title transfer collateral
Ownership has moved; assess whether arrangement is valid and appropriate
Client securities held in nominee
Custody asset controls, records and reconciliations
Client money and custody assets
Client asset protection is highly testable because the logic is practical: if the firm fails, client assets should be identifiable and protected as far as the rules require.
Client asset distinction
Concept
Meaning
Key risk
Client money
Money held for or on behalf of a client.
Commingling with firm money; shortfalls; poor reconciliations.
Custody asset
Designated investment held for or on behalf of a client.
Poor registration, custody records, or third-party custodian oversight.
Firm money/assets
Belong to the firm.
Must not be mislabelled as client assets.
Title transfer collateral
Ownership transfers to the firm under the arrangement.
Client may not have the same protection as client asset treatment.
CASS control themes
segregate client money where required;
use appropriate client bank or custody accounts;
maintain accurate books and records;
perform reconciliations and resolve discrepancies;
conduct due diligence on third-party banks, custodians, and depositaries;
provide appropriate disclosures;
have governance oversight and escalation for breaches;
maintain plans and documentation that support orderly return of client assets if needed.
CASS traps
Trap
Better reasoning
“The firm recorded it in a spreadsheet, so assets are protected.”
Records must be accurate, reconciled, and supported by proper segregation and controls.
“Client money can be used temporarily for firm liquidity.”
Client money must not be used as firm working capital.
“A third-party custodian removes the firm’s responsibility.”
The firm still has selection, oversight, and recordkeeping duties.
“Title transfer is just another custody arrangement.”
Title transfer changes ownership and protection analysis.
Financial crime
AML/CTF framework
Area
Key requirement
Exam cue
Risk-based approach
Assess and mitigate money laundering and terrorist financing risks
Identify and verify customer; identify beneficial owner; understand purpose/nature
New relationship, occasional transaction, suspicion
Ongoing monitoring
Monitor transactions and keep customer information current
Activity inconsistent with profile
Enhanced due diligence
Apply extra scrutiny to higher-risk situations
PEP, high-risk jurisdiction, complex structure
Simplified due diligence
Lower-risk process where permitted
Not “no due diligence”
Beneficial ownership
Identify natural persons who ultimately own/control customer
Shell company, trust, nominee structure
PEPs
Politically exposed persons require senior attention and enhanced controls
Family members and known close associates may matter
MLRO/nominated officer
Receives internal reports and decides on external SARs
Staff report suspicion internally
SAR
Suspicious activity report to NCA where required
Suspicion of criminal property
Tipping off
Improperly alerting suspect to investigation/report
Telling client “we filed a SAR”
Sanctions screening
Check against designated persons and asset-freeze obligations
Match to sanctioned individual/entity
OFSI reporting
Sanctions breaches and frozen assets may require reporting
Sanctions hit or attempted payment
Notes and examples
Money laundering stages
Stage
Meaning
Example
Placement
Criminal proceeds enter financial system
Cash used to buy investments
Layering
Transactions obscure origin
Multiple transfers through entities/accounts
Integration
Funds appear legitimate
Sale proceeds reinvested in mainstream assets
Other financial crime areas
Area
Core point
Bribery
Bribes, facilitation payments and inadequate prevention procedures create risk
Fraud
False representation, failure to disclose, abuse of position
Tax evasion facilitation
Firms need prevention procedures against facilitating tax evasion
Market abuse
Separate from AML but may overlap through suspicious trading
Data theft/cybercrime
Operational, conduct and notification implications
Prudential regulation and risk
Risk type
Meaning
Typical control
Credit risk
Counterparty fails to pay
Limits, collateral, credit assessment
Market risk
Loss from price, rate, FX or volatility moves
Limits, stress testing, hedging
Liquidity risk
Cannot meet obligations when due
Liquidity buffers, cash-flow monitoring
Operational risk
Failed processes, people, systems or external events
Controls, incident management, resilience testing
Settlement risk
Trade does not settle as expected
DvP, confirmations, fails management
Counterparty risk
Trading counterparty defaults before settlement/maturity
Margin, netting, exposure monitoring
Concentration risk
Excess exposure to client, sector, asset or counterparty
Diversification and limits
Conduct risk
Poor outcomes or market integrity harm
Governance, monitoring, incentives controls
Legal/regulatory risk
Breach of law/rules or unenforceable contracts
Legal review, compliance monitoring
Cyber/technology risk
System compromise or outage
Access controls, testing, incident plans
Outsourcing risk
Third-party failure affects regulated services
Due diligence, contracts, oversight, exit plans
Notes and examples
Investment firm prudential concepts
Concept
Meaning
Own funds
Regulatory capital resources
Liquid assets
Resources available to meet cash needs
K-factor-style risks
Activity-based risk measures for investment firms
ICARA-style assessment
Internal assessment of capital/liquidity adequacy and risk
Wind-down planning
Plan for orderly cessation without harming clients or markets
Remuneration governance
Incentives should not encourage excessive risk or poor conduct
Public disclosure
Some firms disclose prudential information to market/stakeholders
Operational resilience and outsourcing
Requirement area
Practical focus
Scenario cue
Important business services
Identify services whose disruption could cause intolerable harm
Trading platform, payments, client asset access
Impact tolerances
Define maximum tolerable disruption
“How long can service be unavailable?”
Mapping
Map people, process, technology, data and third parties
Dependency on cloud provider
Testing
Test ability to remain within tolerances
Severe but plausible scenario
Lessons learned
Improve controls after incidents/tests
Repeat outage without remediation
Outsourcing oversight
Firm remains responsible for outsourced functions
“Vendor failed” does not excuse firm
Exit planning
Ability to transfer or terminate service
Critical provider concentration
Notes and examples
Prudential regulation and operational resilience
Prudential and resilience questions focus on whether the firm can remain safe, sound, and orderly under stress.
Topic
Review point
Capital resources
Firms must maintain adequate financial resources for their business and risks.
Liquidity
Ability to meet obligations as they fall due.
Risk management
Identify, measure, manage, and monitor material risks.
Wind-down planning
Ability to cease regulated business in an orderly way if required.
Operational resilience
Identify important business services, set tolerances, and manage disruption risks.
Outsourcing
Due diligence, oversight, access, audit, exit plans, and regulatory access.
Cyber and technology risk
Systems must be secure, recoverable, and appropriately governed.
Practical distinction
If the firm’s issue is…
Most likely theme
Insufficient capital to support trading activity
Prudential resources
Trading platform outage harming clients
Operational resilience and systems
Failure of outsourced data processor
Outsourcing oversight
Inability to return client assets during insolvency
CASS and wind-down planning
Unclear escalation after a breach
Governance and SYSC
Complaints, FOS and FSCS
Area
Key point
Exam distinction
Complaint
Expression of dissatisfaction involving financial loss, distress, inconvenience or alleged failing
Not every query is a complaint, but firms should recognise substance over label
DISP process
Prompt investigation, fair assessment and clear response
Procedure and evidence matter
Summary resolution
Very fast resolution can use simplified communication
Do not confuse with ignoring the complaint
Final response
Sets outcome, redress if any, and ombudsman rights where applicable
If unresolved by the relevant deadline, FOS rights arise
Financial Ombudsman Service
Resolves eligible complaints against firms
Dispute resolution, not firm failure compensation
Financial Services Compensation Scheme
Pays eligible claims where authorised firm cannot meet liabilities
Safety net, not protection against market loss
Redress
Aim to put customer in position they should have been in
May include compensation, interest, correction, apology
Enforcement and regulatory powers
Tool
Used for
Exam cue
Information requirement
Obtain documents, data, explanations
Regulator asks for records
Skilled person report
Independent review under regulator power
Systems, CASS, AML or governance concerns
Own-initiative requirement/variation
Restrict firm’s business or permissions
“FCA stops firm taking new clients”
Public censure
Public disciplinary statement
Breach but no financial penalty or alongside penalty
Financial penalty
Monetary sanction
Serious rule breach
Restitution
Return benefit or compensate loss
Customer detriment from breach
Prohibition order
Ban individual from regulated functions
Lack of fitness and propriety
Suspension/restriction
Limit firm or individual activity
Immediate risk to consumers/markets
Injunction
Court order to stop conduct
Ongoing unlawful activity
Criminal prosecution
Criminal offences such as insider dealing or misleading statements
Higher procedural seriousness
Tribunal route
Challenge certain regulatory decisions
Warning/decision notice escalation
Rapid scenario decoder
If the question says…
Think first of…
“Unauthorised firm sends investors an invitation to buy bonds”
Financial promotion restriction
“Firm advises client to buy unsuitable structured product”
Suitability, COBS, PRIN, Consumer Duty if retail
“Client asks firm to execute a complex derivative without advice”
Appropriateness
“Portfolio manager trades at poor venue without monitoring outcomes”
Best execution
“Firm allocates IPO stock to favoured clients”
Conflicts, allocation policy, fair treatment
“Trader places orders to move price then cancels”
Market manipulation/spoofing
“Director tells friend unpublished results”
Unlawful disclosure; possible insider dealing by friend
“Firm cannot reconcile custody records”
CASS custody breach
“Client cash mixed with house account”
CASS client money breach
“Client refuses beneficial ownership information”
CDD failure; do not proceed if CDD cannot be completed
“Payment match to designated person”
Sanctions freeze/escalation
“Senior manager delegated compliance but never checked it”
SM&CR reasonable steps issue
“Firm wants to start managing investments”
Variation of permission
“Customer unhappy after final response”
FOS
“Authorised firm fails and cannot return client assets”
FSCS eligibility and CASS failure process
Common traps to review before the exam
Trap
Correct distinction
FCA and PRA are interchangeable
FCA focuses on conduct/markets and prudential regulation for many investment firms; PRA focuses on prudential soundness of banks, insurers and designated firms
Guidance equals binding rule
Rules bind; guidance indicates expected interpretation and can be persuasive
Financial promotion equals investment advice
A promotion is an invitation/inducement; advice is a personal recommendation
Suitability and appropriateness are the same
Suitability applies to advice/discretionary management; appropriateness applies to non-advised complex product services
Best execution means cheapest price only
Execution factors include costs, speed, likelihood, size, nature and settlement
Disclosure cures every conflict
Firms must prevent or manage conflicts where possible; disclosure is not a default solution
Retail client can waive all protections
Some protections cannot simply be waived by agreement
Eligible counterparty means unregulated relationship
Some rules still apply; status is activity-specific
Client money and custody assets are identical
Money and assets have separate CASS rules
Market abuse requires criminal conviction
Civil/regulatory market abuse is separate from criminal prosecution
SAR requires proof of crime
Suspicion is enough to trigger reporting obligations
Appointed representative carries full regulatory burden alone
Principal firm is responsible for appointed activities
FSCS compensates investment underperformance
FSCS addresses eligible claims when a firm cannot meet liabilities, not normal market loss
Senior manager escapes liability by delegation
Delegation must be reasonable and overseen
Final review checklist
Can you identify the correct regulator or body from a scenario?
Can you run the perimeter test: activity, investment, business, territorial link, exclusion?
Can you distinguish financial promotion, advice, arranging, dealing and managing?
Can you apply FCA Principles, Consumer Duty and COBS to retail scenarios?
Can you classify clients and explain the protection consequences?
Can you choose between suitability, appropriateness and execution-only treatment?
Can you identify inside information and the three main market abuse types?
Can you separate client money from custody assets under CASS?
Can you spot AML, sanctions, bribery and fraud red flags?
Can you explain SM&CR accountability and conduct rules?
Can you distinguish FOS complaint handling from FSCS compensation?
Can you select the likely enforcement tool from the regulator’s concern?
Regulatory perimeter: the authorization decision
A frequent exam pattern is to describe a business activity and ask whether authorization or permission is required. Work through the perimeter in a structured way.
flowchart TD
A[Proposed activity] --> B{Is it a regulated activity?}
B -- No --> X[Likely outside permission requirement, but other rules may still apply]
B -- Yes --> C{Is it linked to a specified investment?}
C -- No --> X
C -- Yes --> D{Carried on by way of business?}
D -- No --> X
D -- Yes --> E{Any exclusion or exemption?}
E -- Yes --> F[May be outside authorization, subject to conditions]
E -- No --> G[Permission likely required before carrying on activity]
Notes and examples
Regulated activity review
Common investment-related activities include:
dealing in investments as principal;
dealing in investments as agent;
arranging deals in investments;
advising on investments where the advice is a personal recommendation;
managing investments;
safeguarding and administering investments;
operating certain investment or trading arrangements;
establishing, operating, or winding up collective investment arrangements, where applicable.
Specified investments commonly include shares, debt instruments, government and public securities, units in collective investment schemes, options, futures, contracts for differences, warrants, and rights to or interests in investments.
Perimeter traps
Trap
Better exam reasoning
“The firm is authorised, so it can do any regulated activity.”
Authorisation must cover the relevant activity and investment type through the firm’s permissions.
“The client is professional, so regulation does not apply.”
Client category changes conduct protections; it does not automatically remove the regulatory perimeter.
“The activity is only introducing parties, so it is never regulated.”
Arranging can be regulated depending on what is done and whether an exclusion applies.
“Information about an investment is the same as advice.”
Advice generally requires a personal recommendation to a person in relation to a specific investment decision.
“An exemption always applies broadly.”
Exemptions and exclusions are conditional and must be applied narrowly to the facts.
FCA Principles and conduct mindset
The FCA Principles are high-level standards. In exam questions, they often appear indirectly: a firm may technically follow a narrow rule but still fail because its overall conduct is poor.
Ignoring conflicts or accepting improper incentives
Conflicts of interest; integrity
Mishandling client money or records
Clients’ assets; skill, care and diligence
Delayed or incomplete regulator notification
Relations with regulators
Poor product design or foreseeable retail harm
Consumer Duty and customer outcomes
Trading that distorts the market
Market conduct
Notes and examples
Consumer Duty quick distinction
Consumer Duty is especially relevant where retail customers are involved. It is broader than simply providing a disclosure document. It requires firms to consider customer outcomes across the product and service lifecycle.
Weak answer
Stronger answer
“Give the customer more information.”
Ensure communications are understandable and support informed decisions.
“The customer agreed to the terms.”
Consider whether the product, price, support, and communications deliver appropriate outcomes.
“The firm disclosed the risk in small print.”
Risk information should be clear, timely, and capable of being understood by the target customers.
FCA Handbook and rulebook navigation
You do not need to recite every sourcebook, but you should know what type of issue belongs where.
Conduct of business for investment business: client classification, information, advice, inducements, order handling, best execution.
CASS
Client money and custody asset protection.
SUP
Supervision, notifications, regulatory reporting, relationships with the regulator.
DISP
Complaint handling and dispute resolution.
MAR / market conduct materials
Market conduct standards and interaction with market abuse requirements.
MIFIDPRU / prudential materials
Prudential requirements for investment firms where applicable.
Advice, information, suitability, and appropriateness
This is one of the most testable distinction areas.
Concept
Applies when…
Main requirement
Information
Firm gives factual or generic information without a personal recommendation.
Must still be fair, clear, and not misleading.
Investment advice
Firm gives a personal recommendation about a specific investment decision.
Suitability applies.
Portfolio management
Firm manages investments on a discretionary basis.
Suitability applies.
Non-advised complex product sale
Client makes own decision, but product is complex.
Appropriateness assessment applies.
Execution-only non-complex transaction
Client initiates and no advice is given, subject to conditions.
Appropriateness may not be required, but other duties still apply.
Best execution
Firm executes or transmits client orders.
Obtain the best possible result under the relevant standard.
Notes and examples
Suitability vs appropriateness
Feature
Suitability
Appropriateness
Trigger
Personal recommendation or portfolio management.
Non-advised transaction in complex products.
Focus
Is the recommendation suitable for the client?
Does the client have knowledge and experience to understand the risks?
Information considered
Objectives, financial situation, knowledge and experience, risk tolerance, capacity for loss, and related factors.
Primarily knowledge and experience regarding the product or service.
If information is insufficient
Do not recommend or manage on that basis.
Warn the client where required; do not treat warning as advice.
Common trap
Thinking suitability is only about risk appetite.
Thinking appropriateness means the product is suitable.
Exam decision rule
If the firm says, in effect, “Given your circumstances, you should buy/sell/hold this specific investment,” think personal recommendation and suitability.
If the firm says, “Here are the product features; you decide,” think information or non-advised business, then decide whether appropriateness is required.
Primary and secondary market regulation
Capital markets candidates should connect conduct rules with issuer disclosure, trading venue behavior, and market transparency.
Area
What to review
Issuer disclosure
Accurate, timely disclosure supports informed markets and prevents selective information advantages.
Prospectus and offering materials
Must not mislead; disclosure standards depend on the transaction and audience.
Listing and continuing obligations
Listed issuers face ongoing obligations around information, governance, and market announcements.
Trading venues
Regulated markets, multilateral trading facilities, and other venues have rulebooks and market integrity responsibilities.
Transaction reporting
Helps regulators detect market abuse and monitor markets.
Short selling and positions
Disclosure or restriction regimes may apply depending on instrument and circumstances.
Derivatives and clearing
Risk mitigation, reporting, clearing, and collateral controls may be relevant.
Notes and examples
Exam shortcut
If a question involves information asymmetry, think disclosure, inside information, market abuse, and investor protection.
If it involves trade data, think transaction reporting, venue rules, transparency, and surveillance.
If it involves post-trade risk, think clearing, settlement, collateral, custody, and operational controls.
AML, counter-terrorist financing, sanctions, and financial crime
Financial crime controls are risk-based, ongoing, and governance-heavy. The firm must know who it is dealing with, understand risk, monitor activity, and escalate suspicion.
AML control framework
Control
Purpose
Business-wide risk assessment
Understand money laundering and terrorist financing risks across products, clients, geographies, and delivery channels.
Customer due diligence
Identify and verify customers and, where relevant, beneficial owners.
Enhanced due diligence
Apply more scrutiny to higher-risk situations.
Ongoing monitoring
Ensure transactions and client behavior remain consistent with known risk profile.
Suspicious activity escalation
Report internally to the appropriate function and externally where required.
Training
Ensure staff identify red flags and know escalation routes.
Recordkeeping
Evidence compliance and support investigations.
Sanctions screening
Prevent prohibited dealings with sanctioned persons, entities, or jurisdictions.
Notes and examples
Red flags
complex structures with unclear commercial purpose;
reluctance to provide ownership or source-of-funds information;
transactions inconsistent with the client profile;
rapid in-and-out movement of funds;
high-risk jurisdictions or unusual routing;
use of nominees without clear rationale;
pressure to avoid normal onboarding steps;
adverse media or sanctions links.
Financial crime traps
Trap
Better reasoning
“CDD is complete once the account is opened.”
CDD is supported by ongoing monitoring and refresh where needed.
“A wealthy client is automatically low risk.”
Wealth does not remove AML, sanctions, bribery, or tax evasion facilitation risk.
“Suspicion must be proven before escalation.”
Suspicion is an escalation trigger; proof is not required at the initial stage.
“Sanctions are just an AML subset.”
Sanctions controls have distinct strict restrictions and screening expectations.
“Only compliance owns financial crime risk.”
First line staff, senior management, and control functions all have roles.
Governance, systems and controls, and SMCR
Governance questions test accountability. The regulator expects clear responsibility, adequate resources, competent staff, risk management, and escalation.
SMCR core concepts
Concept
Meaning
Senior Managers
Individuals performing senior management functions with defined responsibilities.
Statement of Responsibilities
Document setting out what a Senior Manager is responsible for.
Prescribed responsibilities
Specific responsibilities allocated to appropriate Senior Managers where applicable.
Duty of responsibility
Senior Managers may be accountable where they fail to take reasonable steps in their area.
Certification functions
Roles that can cause significant harm; firms assess and certify fitness and propriety.
Conduct Rules
Individual standards applying to relevant staff, including integrity, due skill, care and diligence, openness with regulators, and proper treatment of customers.
Fit and proper
Assessment of honesty, integrity, reputation, competence, capability, and financial soundness.
Notes and examples
Governance traps
Trap
Correct approach
“Compliance is responsible for all regulatory failures.”
Business owners and senior managers retain responsibility for controlled areas.
“Certification staff are approved by the FCA.”
Firms certify relevant staff as fit and proper; this is distinct from Senior Manager approval.
“A responsibility map is enough.”
Responsibilities must match real governance, reporting, and decision-making.
Weak systems and controls can be a breach even without immediate loss.
Complaints, redress, and compensation
Complaint handling is about fair treatment, proper investigation, clear responses, and escalation where the complainant remains dissatisfied.
Area
Key review point
Complaint identification
A complaint may be formal or informal if it expresses dissatisfaction about regulated activity.
Investigation
Firms must investigate competently, diligently, and impartially.
Response
The firm should explain its position clearly and offer redress where appropriate.
Escalation
Eligible complainants may have access to the Financial Ombudsman Service.
Compensation
The Financial Services Compensation Scheme may apply where an authorised firm cannot meet eligible claims.
Root-cause analysis
Repeated complaints may show a systems or conduct issue.
Complaint traps
treating a complaint as “not a complaint” because the client did not use the word complaint;
focusing only on legal liability rather than fair customer outcome;
failing to identify systemic issues from repeated complaints;
confusing firm redress, ombudsman review, and compensation scheme claims;
assuming professional clients can never complain.
Supervision, notifications, and enforcement
Regulators expect openness, cooperation, and timely notification of material issues.
Supervision tools
Tool
Purpose
Authorisation and variation of permission
Controls which regulated activities a firm may perform.
Threshold conditions
Minimum conditions for authorisation and continuing permission.
Supervisory information requests
Allow regulators to assess risk and compliance.
Skilled person reviews
Independent review of specific issues where required.
Restrictions or requirements
Limit or condition a firm’s activities.
Enforcement investigation
Investigates suspected breaches.
Disciplinary outcomes
May include public censure, financial penalty, prohibition, restitution, or other action depending on powers and facts.
Notes and examples
Notification examples
Firms may need to notify regulators about material matters such as:
significant rule breaches;
major systems failures;
financial resource concerns;
fraud or financial crime issues;
changes in control or senior management;
significant client asset issues;
disciplinary matters involving relevant staff;
inability to meet regulatory obligations.
Enforcement traps
Trap
Better reasoning
“If the firm fixes the issue, no notification is needed.”
Remediation does not necessarily remove notification duties.
“Only deliberate misconduct is enforceable.”
Negligent systems failures can also matter.
“The regulator must wait for customer loss.”
Regulatory action can address risk, poor controls, or market integrity threats before loss occurs.
“Junior staff misconduct never affects the firm.”
Firms may be responsible for poor supervision, culture, systems, or incentives.
High-yield comparison tables
Suitability, appropriateness, best execution
Question asks whether…
Think…
The recommendation fits the client’s needs and circumstances
Suitability
The client understands the risks of a complex product in a non-advised sale
Appropriateness
The order was executed on the best available terms under the policy and circumstances
Best execution
The communication fairly presented risks and benefits
Financial promotion / client communication
The product should have been offered to that target market
Product governance / Consumer Duty
Notes and examples
Conduct breach vs market abuse vs financial crime
Fact pattern
Most likely issue
Client sold unsuitable structured product
Conduct / suitability
Broker trades ahead of client order
Conflict, personal dealing, market conduct
Employee trades before unpublished results
Insider dealing
Trader places fake orders to move price
Market manipulation
Client uses complex offshore structure with unclear source of funds
AML / financial crime
Firm fails to segregate client funds
CASS
Firm ignores repeated platform outages
Operational resilience / systems and controls
Disclosure is not enough when…
Situation
Why disclosure alone is weak
Conflict can be prevented by separating duties
Prevention is stronger than disclosure.
Client cannot reasonably understand the risk
Disclosure does not create understanding.
Product is unsuitable
Risk warning does not make it suitable.
Inside information is involved
Disclosure to selected persons may worsen the issue.
Client money is mishandled
Disclosure does not cure segregation failures.
Common candidate mistakes
Skipping the perimeter analysis
Always ask: activity, investment, by way of business, exclusion, exemption, permission.
Confusing client categories with product risk
A professional client can still be sold an unsuitable product in the wrong context; a retail client can still make an execution-only decision if conditions are met.
Using suitability and appropriateness interchangeably
Suitability is about whether the recommendation or discretionary decision is right for the client. Appropriateness is about whether the client understands the risks of a complex product in a non-advised transaction.
Assuming disclosure cures everything
Disclosure is important, but conflicts, suitability failures, client asset failures, and market abuse issues often require stronger action.
Treating market abuse as only insider trading
Market manipulation and unlawful disclosure are equally important.
Forgetting governance accountability
Many questions are not asking “who did the task?” but “who had responsibility for the control environment?”
Ignoring ongoing monitoring
AML, suitability, conflicts, CASS, outsourcing, and operational resilience are ongoing, not one-off.
Overlooking the word “attempt”
In market abuse and some conduct contexts, an attempted action can still be relevant even if it fails.
Choosing the most client-friendly answer without checking rules
Regulation protects clients and markets, but answers must follow the correct regulatory mechanism.
Relying on memory instead of fact classification
The exam often rewards methodical classification of the scenario over memorised slogans.
Quick scenario drills
Scenario 1: Research before an offering
An analyst is asked to adjust a research note because the corporate finance team wants to win an issuer mandate.
Issue
Review answer
Main risk
Conflict of interest and research independence.
Controls
Information barriers, supervision, conflicts policy, review process, inducement controls.
Trap
Treating it as only a disclosure issue.
Notes and examples
Scenario 2: Client chooses a complex derivative
A client asks to buy a complex derivative without receiving advice.