Regulatory consulting exists because financial services regulation has become a full-time job that most regulated firms cannot staff full-time: FCA authorisation, the Senior Managers regime, Consumer Duty evidence, financial crime frameworks, prudential returns, and a change pipeline that never empties. The consulting market that serves this need ranges from excellent to actively dangerous — templated compliance manuals are their own risk category — so here is what regulatory consulting actually covers, when firms genuinely need it, and how to buy it well.
What the work actually is
Five recurring engagement types cover most of the market:
- Authorisation support — building an FCA application that succeeds first time: the regulatory business plan, financial projections, capital calculations, governance map and the senior managers' statements of responsibility. The regulator's questions are predictable to people who see them weekly and expensive to discover mid-application; weak applications burn months in back-and-forth or die quietly by withdrawal;
- Compliance frameworks — the monitoring plan, policies, and management information that turn rulebook obligations into something a firm actually operates. The test of a good framework is not its page count but whether breaches surface through it before customers or supervisors find them;
- Reviews and health checks — gap analyses against specific regimes (Consumer Duty outcomes evidence, financial crime systems, safeguarding, SM&CR allocation), either proactively or ahead of a supervisory visit;
- Skilled person and remediation work — when the regulator requires an independent review (a section 166) or a firm must fix findings under scrutiny: the most demanding strand, where the consultant's credibility with the regulator is most of the value. Our three lines of defence guide covers the governance architecture these reviews test;
- Ongoing outsourced compliance — a retained function for smaller firms: monitoring, regulatory returns, horizon-scanning, training. Legitimate and common, with one hard caveat — accountability cannot be outsourced; the SMF holders remain personally on the hook, and a consultant "doing compliance" without engaged senior managers is a liability generator for both sides.
When firms genuinely need it
The honest triggers: seeking authorisation (first-timers who go alone have a materially rougher ride); a change of business model, scale or products that outgrows the framework built at authorisation; a supervisory letter, visit or data request; the departure of the one person who understood compliance; and the standing burden of regulatory change — the FCA's initiatives grid alone is a part-time job to track, and firms discover regimes like Consumer Duty not at consultation but at enforcement. The wrong trigger is decoration: buying a policy suite to have one. Supervisors read firms quickly, and a pristine manual with no monitoring output behind it signals exactly what it is.
Buying it well
The selection questions that separate the market: Who does the work? — the partner who pitched or an analyst with a template; ask for the named team's regulatory background. Have they handled your permission set? — payments firms, investment managers, consumer credit and insurance intermediaries live under materially different rules, and generalists paper over the differences. What happens after the deliverable? — a framework nobody embeds is shelfware; the better firms build the handover and training into scope. Will they disagree with you? — the consultant's job includes telling the founder the business model has a regulatory problem, and a proposal that promises frictionless approval of whatever you already planned is a sales document, not advice.
On cost: authorisation projects and reviews are usually fixed-fee; retained compliance runs monthly; skilled-person work bills like litigation. The comparison to run is never fee against zero — it is fee against the cost of a refused application, a s166, or remediation under enforcement timescales, each of which prices consulting very generously in hindsight.
Where accountants fit in the regulatory picture
A slice of this market is genuinely accounting-shaped, and it is the slice we occupy: prudential and capital adequacy calculations, CASS and client-money audits, safeguarding audits for payments firms, financial crime and AML reviews, regulatory reporting, and the outsourced internal audit that regulated firms above a certain size are expected to maintain. The advantage of buying these from a firm that also audits and accounts is prosaic but real: the numbers in the regulatory return reconcile to the numbers in the ledger, because the same people can see both.
Acumon supports regulated businesses across that accounting-regulatory boundary — financial services audit, CASS work, AML and financial crime reviews, and governance support for boards facing their first effectiveness declarations. If your firm's compliance framework was last rebuilt at authorisation and the business has since doubled, the gap analysis is due — ideally commissioned by you rather than prompted by your supervisor.