A regulatory return can look like an administrative deadline. CCR009 is better understood as a structured version of a credit broker's business model.

The FCA is asking firms to connect five things that are often owned by different teams: permissions, business model, marketing, revenue and staff. The form is tailored to the activities and answers of each firm, but the underlying test is consistent. Do the numbers and descriptions submitted to the regulator match how the business actually operates?

For credit brokers, that makes preparation less about finding somebody who can complete RegData quickly and more about reconciling the systems that produce the answers.

What CCR009 changes

CCR009 applies to consumer credit firms with permission for credit broking, debt adjusting, debt counselling or providing credit information services. It replaced CCR004 and CCR005 and also removed some overlapping questions from CCR002 and CCR007.

Most firms submit annually. Firms with annual revenue of £5 million or more from credit-related regulated activities report every six months. The FCA has moved the return onto a calendar-year basis, rather than a firm's accounting reference date. Its live CCR009 guidance says annual reporting windows for 2026 data onwards open in January and firms have 40 business days after their window opens. The firm's own My FCA schedule remains the place to confirm the applicable task and deadline.

The return is intended to be proportionate: questions appear according to the firm's permissions, activities and previous answers. Proportionate does not mean impressionistic. The FCA Handbook completion notes say the data should be accurate and should not give a misleading impression by omitting a material item, including an immaterial item or presenting information misleadingly.

That is why five reconciliations are worth running during the reporting year, not in the final week.

1. Permissions against real activity

Start with the permissions the FCA expects to see, then compare them with the journeys the firm actually operates.

CCR009 asks what activities have been undertaken using the credit broking permission and why the firm holds that permission. The Handbook examples cover more than a traditional broker arranging a loan. They include comparison sites, suppliers introducing customers to third-party lenders, motor dealers arranging finance or hire, and businesses that pass customers through another broker.

A useful review should therefore test:

• the Financial Services Register entry and any limitations;
• the products, customer types and sales journeys currently in use;
• new websites, lead sources, affiliates, introducers or retailer relationships;
• activities that have stopped but remain described in policies or reporting logic; and
• the reason any permission is held but not currently used.

A mismatch is not something to disguise in the return. It is a prompt to establish the facts, take appropriate advice where the perimeter is uncertain, and decide whether the permissions, activity or internal records need attention.

2. Introductions against CRM and partner records

The word introduction deserves its own data definition.

The Handbook notes repeatedly describe total introductions as introductions made regardless of outcome. For lead generators, that includes customers whose contact details were passed to a lender or another credit broker. Counting only completed loans, approved applications or commission-bearing cases can therefore produce the wrong picture.

Reconcile the total using more than one source. Depending on the model, that may include CRM events, API hand-off logs, lender or broker statements, affiliate reports and customer-journey records. Agree how the firm treats duplicate submissions, repeat applications, withdrawals, failed transfers and a customer sent to more than one recipient.

The objective is not to force every system to hold the same raw number. It is to document a consistent definition and show how each source is transformed into the reported figure.

3. Counterparties and channels against the operating map

CCR009 does not ask only how much activity took place. It also asks where it went and how the customer reached the firm.

The credit broking section includes questions about relationships with lenders, brokers and owners, total introductions, revenue connected with those relationships, sales channels and personalised digital comparison tools. For principal firms, the completion notes generally require a consolidated view that includes appointed representatives and introducer appointed representatives, while limiting multi-principal AR data to activity for which that principal is responsible.

That makes the operating map important. Compare the return logic with:

• the current lender and broker panel;
• contracts and commission statements;
• active websites, telephone journeys, retail locations and comparison tools;
• affiliate, publisher and introducer relationships; and
• the AR or IAR population and the scope each party is permitted to carry on.

If a partner appears in finance but not in the CRM, or a live channel appears in marketing reports but not in the regulatory data map, the gap should be investigated before it becomes a reporting assumption.

4. Revenue against introductions and finance

Revenue is not a free-standing accounting answer in CCR009. It is part of the same account of how the credit broking model works.

The Handbook asks for revenue by channel and, in relevant sections, commission earned from counterparties alongside introduction volumes. Those figures should be reconciled to the accounting records, but also sense-checked against operational data.

For example, an active partner with material introductions but no recorded revenue may be entirely correct. It may also reveal a timing issue, missing statement, incorrect counterparty mapping or misunderstanding about who pays whom. Equally, revenue attributed to a channel with no recorded customer activity deserves an explanation.

Build a bridge from the general ledger and commission statements to the CCR009 categories. Record any timing rules, accruals, refunds, clawbacks, VAT treatment and allocation methods used. The person signing off the return should be able to follow that bridge without reverse-engineering a spreadsheet assembled for the deadline.

5. People and oversight against the organisation that exists

The fifth mandatory section is staff. That matters because a business model is not controlled by a diagram; it is controlled by people with responsibilities, access and evidence.

Reconcile the reporting answer with HR records, role profiles, compliance responsibilities, training records and outsourced arrangements. For a principal, connect that view to the people who oversee ARs and IARs and to the quality and frequency of information received from the network.

Use the exercise to ask practical questions. Who owns the definition of an introduction? Who validates partner revenue? Who can explain a change in product mix? Who checks that a new channel has entered the reporting map? Who challenges an unusual movement before the return is submitted?

If every answer is "compliance", the control may be too dependent on one function receiving perfect information from everybody else.

When inconsistent data becomes a conduct signal

A disagreement between systems is not automatically a rule breach or evidence of customer harm. It is, however, a control signal.

The FCA's policy statement PS25/3 explains that the previous data was inconsistent and did not align well enough with the harms the regulator sees. Better data is intended to support more targeted supervision and quicker action where risk is greatest. The FCA's wider consumer credit reporting guidance says the returns will help it understand firms' ability to meet threshold conditions, identify higher-risk characteristics and prioritise supervisory resources.

That does not mean firms should manufacture smooth trends. It means movements and inconsistencies should be understood. A sharp change may reflect growth, a new lender, a closed channel, a data migration or a corrected definition. The strongest evidence is a documented explanation supported by the underlying records.

A practical CCR009 evidence pack

A proportionate evidence pack does not need to become a second reporting system. It should make the submitted return reproducible.

• a current data dictionary for each applicable CCR009 field;
• named owners for the source data and final answer;
• the source-system extract or report used;
• reconciliations between CRM, counterparties, finance and HR;
• documented assumptions, exclusions and treatment of edge cases;
• an exceptions log showing what was investigated and resolved; and
• review and sign-off evidence linked to the submitted version.

Do a dry run before year end. It will expose missing fields while there is still time to correct the process, ask a partner for data or clarify a definition. Waiting for the reporting window turns every uncertainty into a deadline problem.

The return should tell the same story as the business

CCR009 is a regulatory return, not a Consumer Duty assessment or a substitute for reviewing permissions. Firms should avoid stretching it into a test it was not designed to be.

But the return does assemble a revealing picture: what the firm is permitted to do, what it actually does, how customers arrive, where introductions go, how money is earned and who operates the model.

Authorised Compliance's practical view is simple. Treat CCR009 as a reconciliation exercise across the business, not a form owned at the edge of it. If permissions, customer journeys, partner records, revenue and people all tell the same story, submission becomes easier and the evidence behind it becomes much stronger.

Source note

This article is based principally on the FCA's live CCR009 guidance, PS25/3, the FCA Handbook notes in SUP 16 Annex 38D, and the FCA's consumer credit reporting guidance. It also considers A&O Shearman's summary of the final policy. Firms should use their own My FCA schedule and the live Handbook when preparing a return.