Lender Panel Due Diligence: What a Credit Broker Should Check Before Onboarding a Finance Provider

The commercial agreement is signed. The lender has sent its logo, pricing sheet and portal credentials. Someone asks when the first applications can arrive. It sounds like an implementation question. It is actually the last opportunity to ask a more important one: what, exactly, has the broker agreed to put in front of its customers?

A finance provider can be a legitimate business with an attractive product and still be the wrong addition to a particular customer journey. The product may serve a different market. The commission arrangement may distort referral choices. The lender may offer support that the broker’s handoff cannot reliably access. None of those problems is resolved by adding another name to the panel. This is the decision before the first referral, when the broker still has the leverage to ask for missing information, negotiate responsibilities and refuse a launch date. Lender panel due diligence should produce a reasoned admission decision, supported by evidence, for defined products, customers and channels. It should not produce a certificate of confidence in everything the lender does.

The decision needs a boundary

There is a timely reason to look closely at that distinction. In its July 2026 products and services review, the FCA identified weak explanations for distribution strategies, including insufficient explanation of why channels suited their target markets. These were supervisory findings, not a newly prescribed lender-onboarding checklist. They nevertheless expose the weakness of treating a completed commercial process as proof that a distribution arrangement makes sense. FCA products and services review. Start the admission file by defining what is being proposed: the lending entity, product, intended borrowers, distribution channel and broker service. A provider offering several products should not receive an unrestricted approval because one product has been reviewed. A portal introduction and an integrated application journey may also require different evidence, even when the lender is the same.

Establish the regulatory scope of that proposal. Consumer Duty applies to retail market business and relevant financial promotions within its application provisions; it is not a universal rulebook for every business-finance transaction. Borrower status, the agreement and applicable exclusions matter. Nor does the label “business finance” settle the position. Apply the relevant CONC provisions to the actual activity, rather than assuming the entire sourcebook applies. PRIN 3.2. The admission-file structure, testing approach and approval controls below are Authorised Compliance recommendations. Applicable rules are identified separately. Firms may choose proportionate versions of these controls for lending outside the consumer-credit perimeter, but should not describe that choice as an FCA requirement. Data-protection obligations can still apply to personal information used in business-finance applications.

Establish who is on the other side

The file should identify the legal entity that will contract with the borrower, not merely the brand on the presentation. Match that entity to the proposed broker agreement, relevant company records and, where applicable, its Financial Services Register entry. Check the activities permitted and any relevant limitations or requirements against the proposed lending, recording the date and the reviewer. The Register is a starting point for verification, not an endorsement of a product. FCA Financial Services Register.

Reconcile discrepancies before launch. If the commercial contact represents one group company but the sample credit agreement names another, obtain an explanation and verify the entity actually involved. Establish whether an intermediary sits between the broker and the lender, who receives applications, and who services the account. A familiar trading name is not a substitute for understanding the contracting chain. For genuinely unregulated lending, record the basis for that conclusion instead of treating an absent permission as automatic evidence of wrongdoing. Conversely, a permission held elsewhere in a group does not answer the question for the proposed entity. The practical question is whether the entity in the proposed agreement can lawfully do the business being referred.

A criteria sheet is not a product explanation

An acceptance-criteria sheet says which applications a lender might consider. It does not necessarily explain who the product is designed to serve, its limitations or the circumstances in which a customer could obtain poor value. For in-scope distribution, PRIN 2A.3.16R requires arrangements to obtain sufficient, adequate and reliable manufacturer information about the product, target market, relevant vulnerability characteristics and intended distribution strategy. The purpose is to enable appropriate distribution, not simply to populate a lender directory. PRIN 2A.3. Ask for current product terms, eligibility and exclusion criteria, pricing and fees, material restrictions, security or guarantee requirements where relevant, and an explanation of the intended customer use. Record the version received. Then compare those features with the customers the broker actually expects to refer. An attractive headline rate does little for applicants who cannot access it; a flexible facility may be poorly matched to customers expecting a fixed repayment pattern.

Where the Consumer Duty price and value rules apply, the broker also needs enough information to understand the outcome of the manufacturer’s value assessment. PRIN 2A.4.16R prohibits distribution unless the distribution arrangements are consistent with fair value, including the effect of remuneration within the chain. That is not an instruction to duplicate the lender’s assessment or demand its entire confidential pricing model. PRIN 2A.4; FCA explanation of manufacturer and distributor responsibilities. A useful admission note explains the broker’s conclusion in its own words: which customers the product could serve, which it should not reach, what customers pay, and what the broker’s service adds. If the lender’s material cannot support that conclusion, specify what is missing. The evidence gap is more useful than an optimistic tick.

Read the commission schedule before approving the route

Commercial terms belong in the admission decision because they can change how a product reaches customers. Examine ordinary commission alongside volume thresholds, enhanced rates, exclusivity, clawbacks, campaign payments and non-cash benefits. Ask what happens to referral choices near a bonus threshold and whether staff or automated routing could favour the new lender for reasons unrelated to the customer’s needs. The control recommended here is a documented comparison between the commercial agreement and the proposed selection process. Identify who can change lender priority, what criteria govern that change and how the rationale will be checked. A higher payment does not automatically make an arrangement unacceptable. It does make unexplained preferential treatment harder to defend.

For activity within CONC 4.5’s scope, the rules require prominent, timely disclosure of the existence and nature of remuneration where it could affect impartiality or materially influence the customer’s transaction decision. Where that disclosure is required, CONC 4.5.3AR also addresses how the remuneration may affect the customer’s payments. CONC 4.5.4R requires disclosure of the amount, or likely amount, on request before the relevant agreement. Check the application provisions and any product-specific restrictions rather than importing these rules wholesale into all commercial lending. CONC 4.5. Before admission, settle the wording, timing and staff response to a commission question. Disclosure is not a repair for an otherwise harmful selection process. The file should show that both have been considered.

Agree what crosses the data boundary

Connecting a lender means deciding which information leaves the broker, for what purpose and under whose responsibility. Start with a field-level description of the proposed transfer. An initial eligibility enquiry may need different information from a full application. Challenge fields included merely because they exist in the broker’s system. The ICO says a lawful basis must be identified before personal data is shared, with evidence that it was considered beforehand. Consent is not the only possible basis. Equally, a customer’s instruction to seek finance is not blanket consent for every subsequent use of their information. Document the basis for each purpose and meet its conditions; where consent is relied upon, keep evidence of valid consent and a workable withdrawal process. ICO lawful basis for sharing.

The journey also needs accurate privacy information about purposes, recipients or recipient categories, retention and relevant rights. Preserve the wording and version shown at the point of collection. Separately establish whether proposed follow-up is application servicing or direct marketing. Unsolicited marketing emails and texts to individual subscribers generally need consent or a valid soft opt-in; a finance referral does not automatically supply either. Different PECR treatment applies to corporate subscribers. ICO transparency guidance; ICO electronic-mail marketing guidance. Assess the parties’ actual data roles rather than labelling the lender a processor because it receives a feed. The ICO recommends data-sharing agreements between controllers; joint control carries a separate legal requirement to allocate responsibilities. For this admission, agree permitted uses, onward sharing, secure transfer, retention, incident contacts and handling of individual rights. A signed agreement helps organise those responsibilities. It does not itself make sharing lawful. ICO data-sharing agreements.

Referral consent is a separate check from the data-protection lawful basis. Where CONC 2.5.3R(4) applies, explain why the customer’s details will be disclosed and obtain their consent before the referral. Retain the wording, destination and evidence of that decision. Do not assume a general privacy notice replaces this requirement.

Keep lending decisions and broker responsibilities distinct

The handoff should explain what the lender decides, what information the broker supplies and what, if anything, the broker has agreed to explain to the customer. Eligibility, credit approval and the customer’s ability to afford repayments are not interchangeable concepts. CONC 5.2A’s creditworthiness-assessment requirements apply to consumer credit lending, subject to their scope and exceptions. Appointing a lender does not transfer those lending duties to the broker. But that boundary does not remove the broker’s own responsibilities. The FCA’s guide for smaller brokers explains that advice or recommendations should take account of customers’ needs and circumstances, including affordability, and identifies CONC 5.4 as relevant. CONC 5.2A; FCA credit-broker customer guidance.

Translate the allocation into the proposed operation. Who gives any required pre-contract information and explanations? What happens if an application contains inconsistent information? Who answers a question about a guarantee or a repayment change? Obtain evidence that any duties the broker accepts are understood, resourced and within its permitted role. Avoid a contract that allocates responsibilities nobody has built into the journey.

Find the person behind the support promise

Before the first customer needs help, agree how help will move between the firms. A service-level document is useful only if staff can reach the relevant team and the recipient understands the referral. Test the route for an application query, a communication adjustment and a complaint involving both businesses. Record contacts, cover arrangements and what happens when an acknowledgement does not arrive. For vulnerability-related information, establish what the recipient needs to support the person, rather than automatically forwarding an unrestricted case history. The joint FCA and ICO statement supports proportionate information sharing across distribution chains. Where information is special-category data, such as health information, an Article 6 lawful basis and an Article 9 condition are required, together with any applicable additional safeguards. Joint FCA and ICO statement.

Complaints need an agreed allocation, not a mutual promise to forward everything. Where DISP 1.7 applies, a firm with reasonable grounds to consider another respondent responsible may forward the complaint or relevant part promptly in writing, explain this to the complainant in a final response and provide the other respondent’s details. It must still handle the part for which it remains responsible. A lender agreement cannot erase those obligations. DISP 1.7.

Make the proposed connection prove itself

Operational testing should answer an admission question: can this particular arrangement do what the approval paper says it will do? Use an agreed test environment and synthetic records wherever possible. Do not create genuine borrowing applications or trigger real credit searches simply to demonstrate that the integration works. Test more than a successful submission. Try an excluded applicant, an incomplete record, a lender timeout, a duplicate request and a request for assistance. Establish what each response means, what the customer sees, which team owns the next action and what evidence is retained. If a lender returns a provisional result, the broker’s system should not quietly translate it into an unconditional approval.

Keep the test inputs, expected results, actual results, defects and retest evidence together. Separate unresolved launch blockers from improvements that can safely follow. For example, uncertainty about whether sensitive information reaches the correct recipient is not equivalent to a cosmetic portal defect. These test cases are recommended controls, not a fixed suite mandated by the FCA. Their value is that they let the decision-maker see the proposed arrangement working before customers depend on it.

Put a name against the admission decision

The file now needs a conclusion. Authorised Compliance recommends a named business owner and documented input from the relevant compliance, operations, technology and data-protection leads, proportionate to the firm. Record who has authority to approve the launch. Where an appointed representative is involved, bring the proposal through the principal’s applicable oversight and agreed activity limits, rather than treating an internal signature as sufficient. Approval should specify the entity, products, customer groups, channels, conditions and effective date. It may cover a narrower launch than the commercial team first proposed. A condition should have an owner, deadline and clear consequence if unmet; anything necessary for lawful operation or the agreed customer safeguards should be resolved before referrals begin. Calling a launch a pilot does not cure a missing requirement.

Make the evidence file navigable: retain the source documents and their versions, the broker’s assessment, questions and answers, test results, unresolved matters and final decision. A reviewer should be able to distinguish something independently verified from something asserted by the lender, and both from an assumption. That distinction matters when the original project team has moved on. Admission should also establish how the decision will be revisited. For in-scope distribution, regular review is required under PRIN 2A.3.19R and PRIN 2A.4.24R. An early post-launch review and risk-based triggers are recommended ways to organise that work, not a universal FCA timetable. Agree access to relevant feedback before launch and identify changes that reopen approval, such as revised pricing, eligibility, commission, data uses or servicing arrangements. Product-distribution review rules; value-related review rules.

Authorised Compliance Ltd’s credit broker compliance support and Consumer Duty support can help firms examine that proposed relationship and the evidence behind it. For a new lender launch, the useful conversation starts while questions can still change the agreement. The strongest admission file leaves the next decision-maker able to explain why this lender, for these customers, through this journey, was allowed onto the panel. A launch date tells the business when it can begin. The evidence should explain why it should.