Re-test the operating model, not only the licence
A permissions review should begin with the activities the firm actually performs: who contracts with the customer, who controls funds, who provides information or recommendations, and which entity carries operational responsibility. Labels such as agent, distributor, or technology provider do not decide the regulatory analysis on their own.
Cross-border structures deserve particular attention because a model that is acceptable in one jurisdiction may trigger authorisation, registration, or local conduct requirements in another.
Map responsibility across the customer journey
The most useful review follows the customer from acquisition through onboarding, payment, servicing, complaints, and exit. At each stage, firms should record the regulated activity, the responsible entity, the contractual basis, and the evidence retained to demonstrate oversight.
- Compare customer-facing language with the legal allocation of responsibility.
- Confirm that outsourced activities remain within documented oversight controls.
- Check whether product or channel changes have moved an entity beyond its permissions.
- Escalate unresolved perimeter questions before launching in another market.
Treat permissions as a continuing control
A perimeter assessment should be refreshed when the firm adds a product, changes a distribution relationship, enters a jurisdiction, or alters the flow of customer funds. Governance should assign an owner to each identified obligation and establish a record of the decisions made.
The practical objective is not a one-off legal opinion. It is an operating model in which permissions, contracts, controls, and customer communications continue to describe the same business.
Discuss the implications
Speak with our advisory team about how these considerations apply to your organisation or transaction.
Contact our team