Anyone can copy and paste the FCA Handbook into a Word document and call it a compliance policy. It takes genuine enforcement experience to know how a regulator will actually interrogate that document under pressure.
We have seen the compliance consulting market become saturated with theoretical experts. These are individuals who understand the rules on paper but have never sat across from an FCA enforcement team. Over the past 25 years, our team of seven qualified consultants has reviewed hundreds of proposals and, more importantly, stepped in to fix the fallout when bad advice led to regulatory intervention.
This guide is designed to help you separate slide-deck merchants from seasoned practitioners. By the end, you will know exactly how to evaluate a compliance proposal to avoid costly regulatory blind spots.
Red Flag 1: The Copy-Paste Policy Approach
If a proposal treats compliance as a simple exercise in repeating FCA rules, walk away. The Financial Conduct Authority has become increasingly vocal about its disdain for boilerplate documentation. In its September 2025 observations on authorisation applications, the regulator specifically called out firms for submitting policies that simply repeat the Handbook without operational application.
A genuine expert knows that the FCA penalizes firms whose policies look generic. If your consultant provides a manual that says "The firm will monitor financial promotions," but doesn't explain who does it, what software is used, and how the results are reported to the board, it is useless. The regulator wants to see that you are "ready, willing, and organised."
In our analysis of failed applications, the root cause is almost always a lack of operational context. You can read more about why these documents fail in our guide on Why the FCA Rejects Authorisation Applications and How to Secure Your License. A proposal should detail how the consultant will tailor every procedure to your specific business model, not just hand you a folder of templates.
Red Flag 2: The "Culture of No" vs. Commercial Risk Assessment
Inexperienced consultants use the word "no" as a shield. When you propose a new marketing strategy or a fintech product pivot, their default answer is often negative because it is the safest path for them. However, compliance is not about preventing business; it is about managing the risk of doing business.
Enforcement-tested consultants understand the intersection of regulatory requirements and commercial viability. They should be able to provide a structured risk assessment that shows you how to achieve your goal compliantly. For example, rather than banning a specific financial promotion, an expert will suggest the specific disclosures or friction points required to meet Consumer Duty standards.
We believe that the best alternatives are derived from understanding and accuracy combined with effective strategy. If a proposal does not mention how the consultant will support your growth or handle commercial constraints, you are hiring a barrier, not a partner. A true partner provides a framework that allows you to scale while remaining within the FCA's guardrails.
Red Flag 3: The Deficiency Dump Without Privilege or Solutions
Be wary of any proposal that promises a massive audit report but fails to mention how they handle sensitive findings. Many consultants will hand you a raw roadmap of every deficiency they find—effectively creating a neatly packaged target for the FCA—without considering the implications.
If a consultant identifies a material breach, how is that documented? Does the proposal mention working under legal privilege or providing a remediation plan? Simply pointing out what is wrong is the easy part. A professional proposal should outline a clear methodology for fixing issues, such as our "Engage, Execute, Embed" approach.
We typically start with a sample department to test processes in real business situations before scaling. This prevents the firm from being overwhelmed by a massive list of failures. We focus on driving process change early, ensuring that by the time a report is finalized, the remediation is already underway. This is the difference between a consultant who wants to look smart and one who wants to keep you safe.
Red Flag 4: Paper-Pusher Mentalities for SMCR
The Senior Managers and Certification Regime (SMCR) has moved far beyond form-filling. The FCA has warned of greater scrutiny on senior management applications, particularly for SMF 16 (Compliance Oversight) and SMF 17 (MLRO) roles.
If a proposal outlines the process for filling out applications but doesn't mention interview preparation, it is incomplete. The regulator is actively interviewing candidates to test practical capability, not just checking for training certificates. A capable consultant will conduct rigorous mock interviews to ensure your senior team can demonstrate how they manage risks day-to-day.
You can learn more about the risks of getting this wrong in our SM&CR Personal Liability Guide. If your consultant isn't preparing your managers for a grilling from a Case Officer, they are setting you up for a rejection that could haunt those individuals' careers.
Red Flag 5: The 9-to-5 Emergency Response
Regulatory crises do not respect business hours. A surprise supervisory visit or an urgent Section 166 mandate can happen on a Friday afternoon. If a proposal's Service Level Agreement (SLA) only covers standard office hours with no defined escalation path, they are not built for enforcement reality.
Contrast this with a partner-level retainer. Our Gold tier, for example, includes a 4-hour response guarantee and direct mobile access to a dedicated consultant. When the regulator is at your door, you don't want to be told that your consultant is "out of the office until Monday."
Budgeting for compliance requires certainty. We recommend looking for proposals that offer tiered support with clear SLAs. This ensures you have on-demand access to a topic expert panel when you need it most, rather than waiting in a generic support queue during a critical incident.
What Most People Get Wrong
We often see firms confuse legal counsel with compliance operations. Assuming a law firm can build a working Compliance Monitoring Programme is a common mistake. Lawyers interpret the law and provide opinions; compliance consultants build the actual systems that prevent you from needing a lawyer in the first place. For a deeper look at this distinction, read our analysis on why Your Solicitor Can't Save You From the FCA.
Another frequent error is underestimating the true cost of ad-hoc advice. Firms often buy cheap hourly blocks thinking they are saving money, but they remain reactive. With FCA enforcement actions increasing by 24% recently, firms without structured, proactive programmes often end up paying more in the long run through fines or remediation costs.
A compliance hire can cost £60,000 or more annually when you include NIC and pension. A comprehensive retainer like our Gold tier typically costs less than 17% of that figure while providing a wider breadth of expertise. Choosing a partner based on their ability to integrate into your board-level governance is more valuable than finding the lowest hourly rate.
Auditing Your Proposals
You should use this framework to audit your next stack of compliance proposals. If you see generic templates, a lack of SMCR interview prep, or a restrictive 9-to-5 mentality, those are signs that the consultant lacks the depth of experience required to protect your firm.
It may be time to move away from a reactive model and upgrade to a fully integrated retainer that provides both the tools and the advisory hours needed to stay ahead of the regulator. We focus on transforming daunting legal obligations into manageable operational systems.
Book a free 30-minute discovery call to evaluate your current setup or discuss our Silver and Gold retainers. We can benchmark your existing framework against current FCA expectations and help you identify where your current support may be falling short.
Contact us at info@complianceconsultant.org or call 0800 689 0190. You can also visit Compliance Consultant's website to learn more about our tiered support options.