FCA authorisation is often treated as the finish line. Operationally, it is the starting gun.

The permission notice may have arrived, the firm may be visible on the Financial Services Register and months of application work may finally be over. But the controls described in the application now need to operate under real conditions: live promotions, real customers, actual lender relationships, complaints, management information and regulatory reporting.

The FCA describes authorisation as the beginning of the firm's relationship with the regulator. Newly authorised consumer credit firms must continue to meet the standards demonstrated at authorisation, report accurately, notify material changes, pay the correct fees, follow the Handbook and tell the FCA about potential problems.

A 90-day plan is not an FCA rule or a universal regulatory deadline. It is a practical way for a new credit broker to turn its approved model into evidence before small gaps become normal business practice.

Before day one: read the permission as an operating boundary

Start with the FCA decision letter and the live Register entry. Record the regulated activities, customer types, limitations, requirements, trading names and approved individuals that actually apply. Then compare them with the proposition that sales and marketing teams intend to launch.

Do not assume the permission covers whatever appeared in an early business-plan draft. If the firm wants to add an activity, serve a different market or change the scope of regulated work, a variation of permission may be required through Connect. If the operating model has moved while the application was being assessed, resolve the difference before launch.

For firms still deciding on the correct regulatory route, our guide to mapping credit-broking activity to FCA permission explains why the customer journey matters more than the label attached to the business.

Days 1 to 30: make the regulatory infrastructure work

1. Set up the FCA systems and ownership

Register the appropriate users for My FCA, Connect, RegData and online invoicing. Give each task a named owner and a deputy. Access should be tested, not merely requested, and permissions should follow the responsibilities of the people using them.

Open the firm's RegData schedule and record every return, reporting period and deadline. The reporting profile depends on the firm's permissions, activities and size. For consumer credit firms, returns may be quarterly, six-monthly or annual. Credit brokers should also identify whether CCR009 applies and configure data collection around the questions it asks about permissions, business model, marketing, revenue and staff.

The first return may not fall within the first 90 days. That is precisely why the definitions should be agreed now. Reconstructing regulated revenue, introductions, lead sources or staff figures at the filing deadline is a poor substitute for collecting them correctly from the start.

2. Turn application promises into a control register

Extract the commitments made in the regulatory business plan, policies and application responses. For each control, record:

• the accountable owner and operator;
• the trigger or frequency;
• the evidence the control produces;
• the escalation route when it fails; and
• the management forum that reviews the result.

This should cover at least financial promotions, customer disclosures, complaints, vulnerable customers, lead sources, lender onboarding, commission and fee disclosure, staff competence, conflicts, data handling, Consumer Duty monitoring and regulatory notifications.

3. Review every live promotion and customer journey

Authorisation does not approve a website, advert or sales script by osmosis. Credit-broking promotions must be clear, fair and not misleading. The firm's legal name should appear where required, its broker status should be clear, and customers should understand the nature of the service and whether the firm works with one or more lenders or independently.

Capture the live journey from first impression to lender introduction on mobile and desktop. Keep the approved version, approval evidence and publication date. Include affiliates, lead generators and other third-party sources rather than limiting the review to the firm's own website.

Days 31 to 60: test what customers actually experience

4. Sample files from end to end

Select a proportionate sample of real cases across products, channels, lenders and lead sources. Rebuild each journey and test whether the record supports what the firm says it does.

Useful questions include:

• Did the customer understand that the firm was a broker rather than a lender?
• Was the promotion still the approved version?
• Were fees, commission arrangements and material panel limitations disclosed when required?
• Did any advice or recommendation take account of the customer's needs and circumstances?
• Were consent and data-sharing records specific enough for the activity performed?
• Were vulnerability indicators recognised and acted on?
• Can the firm explain the outcome, not just the conversion?

Record exceptions, root causes and actions. A sample that produces no written conclusion is inspection, not assurance.

5. Run the complaints process before it is needed

Confirm that staff can identify a complaint regardless of the label used by the customer. Test acknowledgement, investigation, root-cause analysis, redress authority, Financial Ombudsman Service wording and complaint reporting data.

Early complaints and expressions of dissatisfaction are valuable signals. They may expose unclear broker-versus-lender wording, poor lead quality, consent disputes or lender hand-off failures before those problems appear in a larger data set.

6. Build Consumer Duty evidence around decisions

Consumer Duty monitoring should show more than a green dashboard. The governing body needs evidence about the outcomes customers receive and the actions required where those outcomes are not good. For a new broker, that means agreeing the first set of measures, thresholds and escalation rules while the operating model is still easy to change.

Useful measures may include customer understanding, application drop-off after key disclosures, complaints by source, duplicate or unwanted leads, lender rejection reasons, vulnerable-customer outcomes, contactability and the timeliness of support. The right measures depend on the firm's role and influence in the distribution chain.

Days 61 to 90: challenge the model and close the evidence loop

7. Hold a formal post-authorisation review

Bring together compliance, senior management and the commercial owners of the customer journey. Compare the approved model with actual activity and decide:

• whether permissions and limitations still match the business;
• whether promotions and disclosures work in practice;
• whether lender, introducer and lead-source oversight is proportionate;
• whether complaints and outcome data identify any foreseeable harm;
• whether financial and people resources remain adequate; and
• whether any FCA notification, variation or remediation is required.

Minutes should capture the evidence reviewed, the challenge applied, the decisions made, owners and completion dates. The value is not the meeting. It is the documented link between evidence and action.

8. Test the notification discipline

Create a change register for addresses, trading names, approved people, controllers, permissions, business model changes and potential problems. Train senior managers to involve compliance before commercial decisions are irreversible.

The FCA expects firms to tell it about material changes and potential problems. Some actions, including relevant changes in control, require prior approval. A governance process that discovers the regulatory question after a contract has been signed is already late.

9. Set the next 12 months

Use the first review to establish a proportionate annual assurance plan. It should include regulatory returns, complaints reporting, promotion sampling, file reviews, staff training, lender and lead-source oversight, Consumer Duty reporting, policy review, financial-resource monitoring and horizon scanning.

Our guide to navigating the FCA application process for credit brokers can also help firms reconnect the evidence promised during authorisation with the controls that now need to operate.

A practical 90-day outcome

By the end of the first 90 days, a newly authorised credit broker should be able to show five things:

1. its live activity matches its permissions and limitations;
2. FCA systems, returns and notifications have clear ownership;
3. promotions and customer journeys have been approved and tested;
4. complaints and Consumer Duty information lead to decisions; and
5. senior management has reviewed the evidence and closed or assigned the gaps.

Authorisation gives a firm permission to begin. The first 90 days reveal whether the business can operate that permission with control, clarity and evidence.

Authorised Compliance helps credit brokers move from application commitments to a working compliance framework, including post-authorisation reviews, promotion and journey testing, reporting readiness and Consumer Duty monitoring.

This article provides general compliance information and is not legal advice. FCA obligations and reporting schedules depend on the firm's permissions, activities, size and circumstances. Firms should check their decision letter, Register entry, RegData schedule and the current FCA Handbook.