FCA Compliance for UK Mortgage Providers 2026: Complete Guide

FCA compliance for a UK mortgage business extends far beyond following the Mortgage Conduct of Business sourcebook. Mortgage lenders, brokers and administrators can also be subject to the FCA Principles, Consumer Duty, SYSC governance and systems requirements, the Senior Managers and Certification Regime, Training and Competence rules, MIPRU prudential requirements, financial promotion rules, complaints and Financial Ombudsman requirements, regulatory reporting and financial crime controls. The precise framework depends on whether the firm lends, advises, arranges, administers mortgages or combines several of those activities.

MCOB nevertheless sits at the centre of the regime. It governs much of the mortgage lifecycle, from advertising and initial customer contact through advice, disclosure and affordability assessment to the mortgage offer, post-sale servicing, payment difficulties and repossession. Consumer Duty overlays those detailed rules by requiring firms within scope to demonstrate that their products, pricing, communications and customer support produce good outcomes in practice, rather than relying on technical compliance with individual rules.

The framework continues to develop in 2026. The FCA has continued its Mortgage Rule Review, published a detailed review of second charge mortgage practices and introduced annual sector Regulatory Priorities reports that give firms a clearer indication of its supervisory focus. Mortgage providers therefore need to comply with the rules in force today while maintaining a structured process for assessing forthcoming changes before they affect underwriting, advice, product design or customer servicing.

FCA mortgage compliance requirements at a glance

Regulation or FCA sourcebook	What it covers	Main firms affected
FSMA and Regulated Activities Order	FCA authorisation and permission perimeter	Lenders, brokers, arrangers, advisers and administrators
PERG 4	Guidance on regulated mortgage activities	All mortgage businesses assessing their perimeter
PRIN and Consumer Duty	High-level conduct and retail customer outcomes	Authorised firms within scope
MCOB	Mortgage conduct requirements across the customer lifecycle	Lenders, intermediaries and administrators according to activity
SYSC	Governance, risk management, controls and outsourcing	Authorised firms according to applicable SYSC provisions
SMCR, FIT and COCON	Individual accountability, fitness and propriety and Conduct Rules	Senior managers and relevant staff
TC	Training, competence and supervision	Mortgage advisers and other specified activities
MIPRU	Capital resources and professional indemnity insurance	Relevant non-bank mortgage and home finance firms
DISP	Complaints handling and Financial Ombudsman requirements	Firms dealing with eligible complainants
SUP	Notifications and regulatory reporting	Authorised firms according to permissions
SYSC 15A	Formal operational resilience regime	Banks, building societies and relevant enhanced-scope firms
Financial crime framework	Fraud and broader financial crime controls	All firms, with MLR scope differing by activity
SUP 12	Appointed Representative oversight	Principal firms operating mortgage AR networks

Which UK mortgage activities require FCA authorisation?

Entering into a regulated mortgage contract as lender and administering a regulated mortgage contract are regulated activities under the Financial Services and Markets Act framework. Advising on regulated mortgage contracts and arranging or making arrangements with a view to regulated mortgage contracts can also require FCA permission. A business should therefore identify the specific activities it carries on and ensure that its permission profile covers the real customer journey rather than relying on a generic description such as mortgage provider.

Mortgage brokers generally need either direct FCA authorisation or an Appointed Representative arrangement with a principal holding the relevant permissions. Non-bank mortgage lenders and third-party mortgage administrators normally require their own appropriate permissions, while banks and building societies are dual regulated and have PRA prudential requirements in addition to FCA conduct obligations. Perimeter analysis should be completed before the compliance framework is designed because the firm's role determines which detailed rules apply.

MCOB is the core mortgage conduct sourcebook

MCOB is the FCA's specialist conduct sourcebook for mortgages and home finance. Its application depends on the activity performed, so lenders, advisers, arrangers and administrators do not simply apply every provision in the same way. A firm combining several roles may therefore need to comply with different MCOB chapters at different stages of the same customer relationship.

The sourcebook follows the mortgage through sale, disclosure, affordability, servicing and financial difficulty. Specific provisions also deal with execution-only sales, equity release, charges, responsible lending and customers in payment difficulty. Firms need procedures that translate those rules into actual systems, scripts, underwriting decisions and customer communications rather than a policy that merely reproduces Handbook wording.

Consumer Duty is now central to mortgage compliance

Consumer Duty applies across relevant retail mortgage products and services and materially changes what good mortgage compliance looks like. Firms within scope must consider the products and services, price and value, consumer understanding and consumer support outcomes together with the cross-cutting obligations. Those requirements can apply across a distribution chain, so lenders and intermediaries need to understand how their own activities influence the outcome ultimately received by the customer.

Mortgage manufacturers should define the target market and demonstrate that products are designed to meet the needs, characteristics and objectives of that market. Intermediaries need sufficient product information to distribute appropriately, while both manufacturers and distributors should use outcome data to identify whether customers outside the intended market or particular customer groups are receiving systematically poorer outcomes. Consumer Duty therefore turns lender-broker information exchange into an important regulatory control rather than a purely commercial issue.

Fair value applies to mortgages and intermediary charges

The price and value outcome is wider than checking that a broker fee or product fee has been disclosed correctly. For a mortgage, fair value can involve the overall economic relationship between the price paid and the benefits the customer receives, including interest rates, arrangement fees, intermediary charges, early repayment charges and the way the product is expected to perform over time. The assessment should be supported by evidence rather than a general conclusion that the product appears competitively priced.

Second charge and debt consolidation business deserves particular attention because intermediary fees can be substantial and may be added to the borrowing. The FCA's 2026 second charge review considered advice, fees and affordability together, showing that firms should assess value in the context of the customer's complete position rather than as an isolated pricing exercise. Where high fees or product structures produce weaker outcomes for particular groups, the firm should be able to explain and address the issue.

Consumer understanding requires more than compliant disclosure

MCOB contains extensive disclosure requirements, but Consumer Duty requires firms to consider whether communications actually support customer understanding. A technically complete document can still produce a poor outcome where the timing, language or presentation prevents the customer from understanding important costs, risks or consequences. Firms should therefore consider both prescribed disclosure and whether the overall journey enables an informed decision.

Important areas can include the difference between fixed and variable rates, early repayment charges, interest-only repayment strategies, term extensions into retirement and the consequences of securing previously unsecured borrowing against a home. Digital journeys need equivalent care because automation can improve consistency while also removing opportunities to identify misunderstanding. Customer testing, complaints, file reviews and support data can help demonstrate whether communications work in practice.

Mortgage advice and suitability

Mortgage advice is governed by MCOB advice and selling standards, and an adviser needs enough information about the customer's needs and circumstances to support an appropriate recommendation. The assessment can include borrowing objectives, term, repayment method, rate preferences, affordability considerations and other material features relevant to the product. The advice record should explain why the recommendation meets those needs rather than simply recording which product was selected.

Debt consolidation requires particular care because moving unsecured debts into a secured mortgage can reduce monthly payments while increasing the repayment period, total interest or risk to the customer's home. The FCA's 2026 second charge findings make the quality of advice, alternatives considered, customer circumstances and written rationale especially important. File reviews should therefore test substantive suitability rather than only whether standard documents are present.

Execution-only sales require careful controls

MCOB permits execution-only mortgage sales in defined circumstances, but firms should not use execution-only processes to avoid the obligations associated with advice. The journey must satisfy the relevant conditions and records should demonstrate why execution-only treatment was appropriate. This is particularly important in digital models where questions or prompts can inadvertently steer a customer towards a specific product even if the journey is labelled non-advised.

Equity release is subject to especially careful controls because of the potential long-term impact on customers. Firms should ensure that execution-only processes do not encourage customers to reject advice or bypass safeguards designed for complex products. Product, legal and compliance teams should assess the actual customer interaction rather than relying solely on the label attached to the journey.

Mortgage disclosure requirements continue after completion

MCOB contains detailed information requirements before application, at offer stage and after the mortgage begins. Depending on the product, firms can need to provide prescribed illustrations or other standardised information about costs, remuneration, features and the service being provided. Controls should ensure that required information is accurate, timely and consistent with the actual product terms.

Post-sale obligations can continue for many years. Lenders and administrators need reliable processes for payment information, interest-rate changes, transfers, contract variations and other events during the life of the mortgage. Long-duration products make record keeping and system change particularly important because a customer may rely on information generated by systems that have been replaced several times since origination.

Responsible lending and affordability remain lender responsibilities

MCOB 11 contains the FCA's responsible lending framework and is central to mortgage lenders. Before entering a regulated mortgage contract, a lender normally needs to assess whether the customer will be able to make the payments due, subject to specific exemptions and modified rules for certain transactions. The assessment should be based on appropriate information and should not rely simply on property value or an expectation that house prices will rise.

The FCA's 2026 Mortgage Rule Review proposes targeted changes intended to support access for creditworthy consumers, including some customers with variable income or other non-standard circumstances. Those proposals should not be treated as final rules until the FCA completes the policy process. Lenders should continue complying with current MCOB requirements while separately assessing how proposed reforms could affect underwriting policy, affordability models and product design.

Second charge mortgages are a specific FCA focus in 2026

The FCA's March 2026 review of second charge mortgages examined intermediary advice, fees and charges and lender affordability assessments. It identified practices that could put customers at risk, including apparent affordability weaknesses, debt consolidation recommendations that were not always clearly justified, inadequate records and unclear fees. The findings matter because second charge customers often have existing debt and can have lower financial resilience.

Intermediaries should ensure that fact finding and advice demonstrate why the transaction is suitable, particularly where debt is being consolidated or substantial fees are added to the loan. Lenders remain responsible for their own affordability assessment even where information is obtained through an intermediary. Both sides should therefore have governance that tests the quality of business rather than relying on contractual allocation of responsibility.

Financial promotions and mortgage communications

Mortgage advertising, websites, social media, emails, comparison information and lead-generation activity can fall within the financial promotions and communications framework. Communications should be fair, clear and not misleading and should give important information appropriate prominence. Firms need to consider the overall impression created rather than assume that a technically correct risk statement cures a headline or illustration that otherwise creates a misleading impression.

Lead generation and outsourced marketing require particular care. Mortgage firms should understand who creates and communicates promotions, what approvals are required and whether affiliates, introducers or Appointed Representatives remain within the permitted framework. Approval, version control and periodic review should prevent outdated rates, obsolete wording or unsupported claims remaining live after the underlying product has changed.

Customers in payment difficulty and MCOB 13

MCOB 13 governs the treatment of customers experiencing payment difficulty, including arrears, payment shortfalls and repossession. Firms need appropriate policies and procedures and should treat customers fairly and proportionately rather than move mechanically through a collections process. Consumer Duty reinforces this by requiring firms to avoid foreseeable harm and provide effective support where customers need help.

Management information should identify whether particular products, strategies or customer groups are generating unusually high arrears, repeat arrangements or repossessions. Where patterns emerge, the firm should investigate whether product design, affordability, servicing or communications contribute to the outcome. Collections compliance should therefore combine individual case quality with portfolio-level analysis.

Vulnerable customers require embedded support

Mortgage businesses frequently deal with vulnerability arising from illness, bereavement, divorce, job loss, low financial resilience, cognitive limitations and significant life events. These circumstances can affect a customer's ability to understand information, manage payments or engage with the firm. Firms should understand the characteristics and needs likely to exist within their customer base and design support accordingly.

Vulnerability should be embedded across advice, underwriting, servicing, arrears and complaints rather than placed in a standalone policy. Staff should know how to identify relevant indicators and adapt communication or support without removing the customer's autonomy. Data handling should also be proportionate because vulnerability information can include sensitive personal data that needs appropriate protection.

SMCR, fitness and propriety and Conduct Rules

The Senior Managers and Certification Regime applies to FCA-authorised mortgage firms according to their regulatory classification. Senior Managers performing applicable functions need clear responsibilities and should take reasonable steps to ensure that the areas allocated to them are controlled effectively. Delegating work to compliance teams, consultants or outsourced providers does not eliminate senior accountability.

Certification staff need periodic fitness and propriety assessment, while the Conduct Rules apply directly to relevant individuals. Mortgage firms should connect certification and conduct assessment with competence records, file-review results, complaints and disciplinary information rather than treat annual certification as an automatic HR exercise. Training should explain how the rules apply to the employee's actual role, whether that person is an adviser, underwriter, collections specialist or senior manager.

Training and Competence is particularly important for mortgage advice

The Training and Competence sourcebook applies to specified mortgage activities and requires firms to assess and maintain the competence of relevant staff. Holding an appropriate qualification is an important component, but competence also involves practical ability, supervision, knowledge and ongoing development. Firms should therefore avoid treating qualification alone as evidence that an adviser is competent for every product or customer situation.

A strong T&C framework connects supervision with file quality, customer outcomes, complaints, vulnerable-customer handling and regulatory change. Higher-risk work such as equity release, complex debt consolidation or unusual customer circumstances may justify more intensive monitoring. Supervisors also need sufficient competence to identify weak advice rather than relying on a checklist of documents.

SYSC governance, risk management and compliance monitoring

SYSC provides much of the organisational framework that sits behind individual MCOB obligations. Mortgage firms need governance, staff, systems, risk management and controls proportionate to their business, with responsibilities clearly allocated and enough information reaching decision-makers. Compliance monitoring should be risk-based and connected to the firm's actual permissions and customer journey.

For an intermediary, monitoring can include advice quality, financial promotions, Consumer Duty outcomes, AR oversight and complaints. A lender will ordinarily need additional testing of underwriting, affordability, servicing, arrears, intermediary relationships and prudential controls. Findings should be tracked to sustainable remediation, because repeatedly closing individual file issues without addressing the underlying cause does not demonstrate effective control.

Outsourcing does not outsource regulatory responsibility

Mortgage providers commonly outsource technology, servicing, document processing, call handling and other operational functions. Outsourcing can be legitimate and efficient, but the authorised firm remains responsible for obligations that apply to it. Due diligence should therefore consider provider capability, data, resilience, customer impact and contractual protections before the arrangement begins.

Ongoing oversight should examine actual performance and regulatory outcomes rather than rely only on service-level agreements. This principle is particularly important where a lender uses an external mortgage administrator or where intermediaries rely on lead generators and technology platforms. The regulated firm should know how it would intervene or exit if the outsourced arrangement begins to create customer harm or regulatory risk.

Operational resilience applies differently across the mortgage sector

The formal SYSC 15A operational resilience regime does not apply automatically to every small mortgage broker or non-bank lender. It applies to specified firms including banks, building societies and certain enhanced-scope firms, while other mortgage businesses remain subject to broader governance, outsourcing and business continuity expectations. Firms should therefore determine their exact scope rather than applying the full framework indiscriminately.

Where SYSC 15A applies, firms need to identify important business services, set impact tolerances, map dependencies and test their ability to remain within those tolerances during disruption. Mortgage providers outside the formal scope should still consider how technology or third-party failure could prevent customers from obtaining information, making payments or receiving support. Consumer Duty and Principle 3 can make resilience failures a conduct issue even where the detailed operational resilience chapter is not directly applicable.

MIPRU prudential requirements for relevant non-bank mortgage firms

MIPRU applies financial resource and, for relevant intermediaries, professional indemnity insurance requirements to specified mortgage and home finance firms. The precise calculation depends on the activities carried on, so a mortgage intermediary, administrator and lender can have materially different capital requirements. Firms should therefore apply the rule relevant to their permission profile rather than use one generic broker capital figure across the sector.

Minimum regulatory capital is not the same as an assessment of overall financial resilience. Firms also need enough resources to meet threshold conditions and operate sustainably, while lenders should understand liquidity, credit risk and the cost of an orderly wind-down. Financial forecasts and board reporting should therefore consider both mechanical minimums and the resources needed under realistic stress.

Financial crime controls depend on the mortgage provider role

Mortgage financial crime compliance requires careful scoping because the Money Laundering Regulations do not apply identically to every participant in the sector. A pure mortgage broker is not subject to the MLRs simply because it brokers mortgages, although it still needs appropriate systems and controls to prevent financial crime and remains subject to legislation such as the Proceeds of Crime Act. Mortgage lenders and firms carrying on other relevant activities can have broader AML obligations.

Fraud risks can include false income documents, manipulated valuations, identity fraud, undisclosed borrowing, fraudulent deposits and collusion involving customers, staff or introducers. Firms should therefore calibrate controls to their actual role and risk rather than use the same AML manual for brokers, lenders and administrators. Due diligence on introducers and effective escalation of suspected fraud are particularly important where business is sourced through third parties.

Complaints and the Financial Ombudsman Service

DISP requires firms within scope to maintain effective and transparent complaint-handling procedures. Mortgage complaints can concern advice, affordability, fees, administration, payment difficulty, product switching or communications, and eligible complainants can ultimately refer unresolved matters to the Financial Ombudsman Service. Firms should ensure complaint handling is sufficiently independent and supported by records capable of explaining the original decision.

Root-cause analysis should identify whether individual complaints reveal wider weaknesses in advice, underwriting, servicing, communications or third-party arrangements. Consumer Duty makes complaints especially valuable as an outcomes data source, so complaint themes should feed into compliance monitoring and board reporting rather than remain isolated within a customer service function.

FCA reporting and notifications

Regulatory reporting depends on the firm's permission profile. Mortgage intermediaries commonly report through relevant retail mediation returns, while lenders and administrators have mortgage-specific reporting obligations and the FCA also receives product sales data. These returns give the regulator detailed information that can be used to identify outliers, supervisory concerns and changes in the risk profile of a firm.

Firms also need to consider event-driven notifications under SUP. Significant breaches, changes affecting threshold conditions and other specified events may need prompt notification rather than waiting for a periodic return. A documented regulatory calendar, clear data ownership and senior review help reduce the risk of inaccurate or late submissions.

Appointed Representative networks require strong principal oversight

Mortgage networks and other principals accepting Appointed Representatives assume substantial regulatory responsibility. The principal should assess an AR before appointment and maintain effective oversight throughout the relationship, including its business model, people, financial position, regulated activities, financial promotions and customer risks. The relationship should be treated as a regulatory control arrangement rather than merely a distribution contract.

Ongoing monitoring should consider advice quality, complaints, competence, Consumer Duty outcomes and whether the AR remains within the permitted scope. Principal firms also need enough internal resources to supervise the network, because rapid AR growth without corresponding compliance capacity can undermine oversight. Where poor outcomes appear in one AR or business type, the principal should assess whether the issue is systemic across the wider network.

Record keeping and file reviews are regulatory evidence

Mortgage firms need records capable of showing what information was obtained, what decisions were made and why. For advice businesses, the file should allow a competent reviewer to understand the customer's circumstances, recommendation and reasoning without reconstructing the transaction from assumptions. For lenders, underwriting and affordability records should show the evidence and methodology supporting the decision.

Quality assurance should test substance rather than document presence. A checklist confirming that an illustration, fact find and suitability letter exist is less useful than testing whether the information is internally consistent and whether the outcome is supported by the evidence. The FCA's 2026 second charge findings make record keeping and quality assurance particularly important across the mortgage market.

What should boards and compliance teams prioritise in 2026?

Boards should begin with an obligations map based on the firm's current permissions and operating model, then assess whether evidence shows those obligations work in practice. Consumer Duty, advice quality, affordability, financial promotions, vulnerable customers, payment difficulty, financial crime, AR oversight and regulatory reporting should be prioritised according to the firm's own risk profile rather than given equal weight automatically.

The FCA's Mortgage Rule Review should be monitored separately from current-law compliance. Consultation proposals should be translated into likely business impact, responsible owners and implementation dependencies, but live policies should not be changed prematurely where the legal position remains unsettled. The board should receive concise regulatory change information that explains what has changed, what may change, which part of the business is affected and what decision is required.

How Buckingham Capital Consulting can help

Buckingham Capital Consulting supports UK mortgage lenders, brokers, administrators and other regulated financial-services firms with FCA authorisation, ongoing compliance, regulatory audits and remediation. We can assess the complete regulatory framework against the firm's actual permissions and business model rather than provide a generic mortgage compliance template.

Our mortgage compliance reviews can cover MCOB, Consumer Duty, governance and SYSC, SMCR, Training and Competence, financial promotions, affordability and responsible lending, arrears and vulnerable customers, financial crime, complaints, prudential requirements, regulatory reporting, outsourcing and Appointed Representative oversight. We can also undertake focused reviews of advice quality, second charge mortgages, Consumer Duty outcomes or mortgage lending controls and provide a prioritised remediation programme where weaknesses are identified.

For firms entering the mortgage market, we can support the FCA authorisation workstream including regulatory structuring, permissions, business planning, governance, compliance frameworks, financial forecasts and supporting documentation through to determination. For existing firms facing FCA engagement or material compliance change, we can provide independent assessment and remediation support designed around the regulatory issue rather than a generic compliance package.

Frequently asked questions

What FCA rules apply to UK mortgage providers?

The precise rules depend on whether the firm lends, advises, arranges or administers mortgages, but the principal framework can include MCOB, the FCA Principles and Consumer Duty, SYSC, SMCR and the Conduct Rules, Training and Competence, MIPRU, DISP, SUP, financial promotions and financial crime requirements. Banks and building societies also have PRA requirements, while formal operational resilience obligations apply to specified firms. The compliance framework should therefore be mapped to the firm's actual permissions rather than built from one generic mortgage checklist.

Does Consumer Duty apply to mortgage lenders and brokers?

Yes, where the relevant mortgage product or service falls within the scope of Consumer Duty. Lenders and intermediaries can have different responsibilities within the distribution chain, but both need to consider how their activities affect products and services, price and value, consumer understanding and consumer support. Firms also need evidence that customers are receiving good outcomes and appropriate board or governing-body oversight of those outcomes.

What is MCOB compliance for a mortgage broker?

For a mortgage intermediary, MCOB compliance can include initial disclosures, advice and selling standards, suitability, execution-only requirements, prescribed mortgage information, financial promotions and records supporting the recommendation. The firm also needs to consider Consumer Duty, SMCR, Conduct Rules, Training and Competence, complaints, MIPRU requirements and broader governance and financial crime controls. The framework should demonstrate why the customer received an appropriate outcome rather than merely confirm that required documents were issued.

Are mortgage brokers required to comply with the Money Laundering Regulations?

A firm acting purely as a mortgage broker is not subject to the Money Laundering Regulations merely because it carries on mortgage broking. It still needs systems and controls to prevent financial crime and remains subject to other relevant legislation, including the Proceeds of Crime Act. Mortgage lenders and firms carrying on other activities can have separate MLR obligations, so AML scope should be assessed against the firm's actual activities.

How often should a mortgage firm carry out an FCA compliance review?

There is no single rule requiring every mortgage firm to commission the same external review at a fixed interval. The firm should maintain an ongoing, risk-based compliance monitoring programme, with frequency and depth reflecting its activities, scale, customer risks and previous findings. An independent periodic review can provide valuable assurance where the business is growing, operating an AR network, undertaking higher-risk lending, preparing for FCA engagement or where the board wants evidence that MCOB and Consumer Duty controls are working effectively.

#FCA Compliance for UK Mortgage Providers 2026: Complete Guide