FSP evidence control
Month-end FSP evidence: what should be ready to produce?
A practical control review for locating the records behind current authorisation, accountable people, competence, customer outcomes and public claims.
Executive summary
The month-end evidence test in one page.
-
01
Fit and Proper is an ongoing evidence discipline, not only an examination or certificate task.
-
02
A regulatory plan is a roadmap for future work; it is not a commencement notice or a standalone obligation.
-
03
A useful review traces current people, permissions and controls back to dated supporting records.
-
04
Every unresolved exception should have an owner, decision date, evidence location and next review date.
Priority control areas
What management should be able to locate and explain.
Each area identifies the status of the underlying requirement or control question so that the response remains proportionate and evidence-led.
Treat Fit and Proper as an ongoing evidence discipline.
Board Notice 194 of 2017 addresses honesty, integrity and good standing; competence; continuous professional development; operational ability; and financial soundness. Qualifications and regulatory examinations are only part of the applicable record.
Separate the regulation plan from current obligations.
The FSCA's 2026 Three-Year Regulation Plan covers 1 April 2026 to 31 March 2029. It describes a programme of regulatory work; it does not, by itself, commence the COFI Bill or create a standalone implementation deadline.
Reconcile the licence profile to the business being conducted.
Compare current activities, products, distribution arrangements and recorded changes with the FSP's authorisation and internal permission map. A licence check is most useful when it is linked to the actual operating model rather than treated as a static certificate review.
Match accountable people to the roles they actually perform.
Reconcile key individuals, representatives, supervision arrangements and delegated controls with the people currently performing those functions. Do not treat an old organogram or register as proof that the present operating position has been checked.
Test whether customer-facing controls leave usable proof.
Select a risk-based sample of complaints, disclosures, advice or service records and compare it with the controls that are meant to govern the relevant activity. The sample size and frequency should reflect the FSP's business, risks and applicable obligations.
Verify public wording against actual permissions and capability.
Check material website, campaign and social claims against the services the relevant entity is permitted and operationally able to provide. Retain the approved wording, reviewer and approval date rather than relying on a live page alone.
Evidence register
The minimum management trail.
Month-end is used here as a practical internal control cadence. It is not presented as a universal statutory deadline.
| Evidence area | Question to answer | Record to retain |
|---|---|---|
| Licence profile | Does current activity match the recorded permission map? | Dated comparison, decision and change record. |
| Accountable people | Do role, appointment and supervision records match current practice? | Reconciled register and unresolved exceptions. |
| Competence | Can applicable experience, training, examinations and CPD be produced? | Competence register and supporting documents. |
| Customer outcomes | Did the sampled records operate as the control intended? | Sample basis, findings and remediation evidence. |
| Public claims | Can each material claim be supported and traced to approval? | Approved copy, reviewer and approval date. |
| Exceptions | Who owns the gap and when will it be reviewed again? | Owner, evidence location, decision date and next review date. |
Source-led follow-through
Turn the review into an owned evidence register.
Keep current obligations and future-readiness work separate, and route specialist legal, licensing or other technical questions to the appropriate adviser where the facts require it.
This publication provides general regulatory information and practical compliance guidance. It does not constitute legal advice on a particular institution, activity or licence. Applicability, required records and review frequency depend on the relevant entity, role, products, services and official instruments. Confirm the current requirement and effective date against the primary source before acting.