The Business Prevention Office

I. The Joke

Every insurance broker in the UK knows the joke. The compliance department, goes the punchline, is the Business Prevention Office. It produces not laughter but the slow, exhausted smile of someone who has spent the afternoon being told their client renewal letter requires a disclaimer that does not appear in any regulation, by a person who cannot say in which regulation it does not appear but is very confident it is required.

This essay is not an argument against compliance. Readers inclined to write letters explaining that mis selling and price walking are bad are invited to direct their energies elsewhere. The argument is narrower: that the compliance function has drifted — through perverse incentives, regulatory design failures, and a professional culture so relaxed about its own educational standards that it has not yet noticed they are missing — from its proper role as the firm’s regulatory conscience into something more troubling. It has become a power centre occupied by people who arrived sideways from other functional areas, enforcing requirements that frequently do not exist, over businesses run by people who know considerably more about the subject than they do.

II. What the Rulebook Actually Says

The Insurance: Conduct of Business Sourcebook (ICOBS to those who have had the pleasure) is, by the standards of the regulatory literature it has spawned, a remarkably brief document. The FCA designed it deliberately as a principles-based framework: it sets outcomes rather than prescribing specific processes. The core obligation, stripped of its drafting, amounts to this: be fair, be clear, don’t mislead, give customers appropriate information in good time. That is essentially it.

What most compliance officers either do not know or prefer not to mention is that the FCA Handbook distinguishes between three categories of provision. Rules, marked R, are binding. Guidance, marked G, is explicitly not binding — it represents one way of meeting a rule, not the only way. Evidential provisions, marked E, are relevant to assessment but not prescriptive. The compliance officer who tells a broker they must do a specific thing and cites a G paragraph as authority is telling them something that is not true. The paragraph says the firm might consider doing something like this. It does not say the firm has to.

When a compliance requirement is next asserted, ask for the paragraph number and its designation. R, G, or E? Follow the chain. You will be surprised how often it terminates not in the FCA Handbook, not in any regulation, but in the opinion of a previous compliance officer, now departed, whose reasoning was never recorded and whose qualifications we shall come to shortly.

III. The Factory of Phantom Rules

Invented requirements have a sociology. A large insurer develops an internal compliance manual that exceeds what the FCA actually requires. This is entirely rational given their size and the consequences of getting things wrong at that scale. A small broker becomes their appointed representative and receives the manual as their working framework. Over time, internal policy is mistaken for regulatory requirement. When the compliance officer moves on, the phantom rules travel with them. After several iterations, the industry contains people who believe with complete sincerity that specific disclaimer wording is FCA-mandated when it was invented by a legal team in Canary Wharf and has never appeared in any regulation.

Or: the FCA publishes a G paragraph. A compliance officer drafts internal policy based on it and presents it as regulatory requirement. The guidance — explicitly illustrative — has been quietly promoted to binding rule by a person with no authority to do so. Or, simplest of all: we have always required this. Why? Because we have always required it. Where does it say we must? Nobody knows. The previous compliance officer left in 2019. Nobody asked.

IV. Nobody Had to Pass Anything

Here is a fact that surprises almost everyone who has not looked into it: the FCA requires no formal qualification for insurance brokers. None. The CII has been lobbying for mandatory qualifications to be introduced precisely because they do not exist. A 2022 survey found that seventy per cent of consumers believed a professional qualification was already required. It is not. The industry has managed, through sheer accumulated professionalism, to give the impression of mandatory standards it has never possessed.

The compliance function operates under exactly the same absence, except for one significant difference. The broking world noticed this problem and has spent years trying to fix it. The compliance world, by and large, seem not to have noticed there is a problem.

What the broking profession has developed, through voluntary momentum, is a strong qualification culture. The CII’s Certificate, Diploma, and Advanced Diploma are pursued by serious brokers not because they must but because the profession expects it and clients value it. Chartered status is genuinely hard-won. The compliance function, by contrast, is populated in substantial measure by people who did not set out to work in compliance at all. Entry is possible, the profession’s own career guidance confirms, by ‘working in a business or compliance administration role.’ Entry pathways are broad — often via operations, customer service or administration. Promotion is ‘fast’: senior level within two to four years is described as typical. The broker who spent a decade voluntarily pursuing qualifications alongside a full career is being supervised by someone whose principal credential for the role was being present when the vacancy arose.

The ICA’s entry-level Certificate in Compliance is Level 2: Introductory, open to ‘anyone who is interested in the subject,’ assessed by a one-hour multiple-choice test, and awarded ‘in association with Alliance Manchester Business School, the University of Manchester’ — a commercial arrangement involving the University’s name rather than its academic oversight. The Alliance Manchester Business School is a serious institution. Its association with the ICA Certificate means roughly what ‘inspired by Mediterranean flavours’ means on a supermarket ready meal. The ICA’s Diploma, at Level 6, represents genuine study and is not dismissed here. But none of it is required. The SMF16 holder — personal criminal liability, effective veto over the business — may have the Diploma, the Certificate, or nothing at all. The FCA does not mind.

V. The Ratchet and the Remedy

The Senior Managers and Certification Regime attached personal criminal liability to the SMF16 function. A compliance officer who approves something that turns out to be wrong faces regulatory action. One who blocks something perfectly legitimate faces nothing — no consequence, not even a difficult conversation. This is not a balanced incentive structure. It is a ratchet that turns in one direction only: toward maximally conservative behaviour regardless of whether that conservatism has any regulatory basis. The rational SMF16 holder, uncertain of their ground, compensates with rigidity. The invented rule is not merely convenient. Under SMCR, it is personally protective.

Milgram demonstrated that ordinary people, given institutional authority and a plausible purpose, will exercise that authority in ways they would never countenance privately. The compliance officer who conducts a visit, queries the website, and departs leaving a list of changes sourced to nothing in particular is not being malicious. They are doing their job with the thoroughness their liability demands and the rigour their qualifications have not required them to develop. The institutional context is real. The authority is genuine in the organisational sense. And the business owner has no reliable way to distinguish a genuine requirement from a confident assertion — which is, of course, precisely how confident assertions maintain their grip.

The remedy is simple and free. When a compliance requirement is asserted, ask for the paragraph reference. R, G, or E? If R: comply. If G: note politely that guidance is not mandatory and ask what Rule it illustrates. If internal policy: trace it to its source. When the chain runs out — as it frequently will — you are in the territory of opinion. And in a business you have built, other people’s opinions, however confidently expressed and however grandly titled the person expressing them, remain exactly that.

Advisory. Not mandatory. Not regulatory.

The FCA Handbook says so. It is in the paragraph marked G.