Ongoing Forex Licence Compliance: Controls and Evidence

Quick answer: Ongoing forex licence compliance means demonstrating that the operating business stays within its permissions, with an owner, evidence, review and exception process for each applicable obligation. Start with permissions, money, customers, reporting, people, suppliers and changes. The framework below helps organise those controls; it does not prescribe a universal filing deadline, capital amount or regulatory calendar.

Information last verified on 10 October 2026. This is general operational planning information, not jurisdiction-specific legal advice. UK FCA and Australian ASIC examples concern their respective regimes. Other jurisdictions require a separate assessment of the licensed entity, licence class, conditions and current rules.

Can a broker launch first and finish compliance afterwards?

An internal implementation timetable is not a regulatory grace period. In its AFS licence application guidance, ASIC explains that the relevant obligations under sections 912A and 912B of the Corporations Act apply from the first day the licence takes effect, with supporting systems and processes ready at application. This Australian example should not be presented as another country’s law, but it demonstrates why a generic post-approval 90-day setup period is unsafe.

Separate three questions: has the licence been issued, have outstanding conditions been satisfied, and may the proposed activity begin? Management should check conditions, account purposes, key roles, system access and customer documents. A current register entry alone does not answer every launch-readiness question. Record which activities remain blocked until an unresolved condition is addressed.

Turn licence conditions into an ownership and evidence matrix

Work entity by entity, using the licence, approval letter, applicable rules and regulatory correspondence. Map each obligation to the actual operation. The following is an internal planning template, not a prescribed staffing structure or execution frequency. Small teams may combine some tasks, but need to identify conflicts and arrange effective review.

Add the applicable basis, effective date, frequency or trigger, reviewer, deputy and evidence location to each row. Determine retention periods, access and disposal against applicable recordkeeping and privacy requirements. Collecting unrelated personal information indefinitely is not an evidence strategy.

Connect financial controls to actual money movements

Keep regulatory resource calculations, operating cash forecasts and client-fund records distinct, with documented links between them. They answer different questions: compliance with applicable prudential requirements, capacity to pay operating expenses, and an explanation of customer money. Do not count group support, related-party receivables or customer balances as available capital or operating cash without analysing the applicable treatment.

Where customer funds are involved, establish whether the entity may receive or control them and which account, custody, segregation and reconciliation rules apply. Do not assume every forex broker has an identical daily reconciliation duty. Obtain the required method and frequency from the entity’s regime; operationally, assign responsibility for differences, investigation, escalation and resolution.

A useful walkthrough follows one de-identified deposit from the customer identifier to the receiving account, payment-provider record, general ledger and withdrawal handling. Inaccessible exports, unexplained group accounts or unallocated differences are concrete gaps to resolve. Our regulatory capital monitoring guide addresses the related calculation process.

Separate operating controls, periodic returns and event triggers

A calendar containing only a year-end audit is incomplete as an operating tool. The FCA’s regulatory reporting directory distinguishes financial, client-asset, complaints and investment-firm reporting areas. Applicability, forms and frequency require further entity-specific checking. The directory does not mean every firm submits every listed report; it illustrates why an audit, periodic return and event notification are different workstreams.

An earlier internal completion date can create a useful buffer, but label it as a management target rather than a statutory deadline. Another firm’s accounting year-end, permissions and reporting periods may differ. The regulatory reporting calendar guide explains the implementation detail.

Make customer reviews, marketing and complaints feed back into controls

Bring customer updates, unusual-activity investigations, advertising review and complaint analysis into a coordinated issue process, while restricting sensitive records appropriately. Track what happened, who assessed it, the supporting reasoning and potential effects on other customers. Determine the specific customer due-diligence and AML obligations from the entity’s jurisdiction and activities.

• When behaviour differs materially from known customer information, record information requests, risk assessment and decision authority.
• Check advertised products, markets and payment entities against permissions and contracts; preserve the approved version.
• Analyse complaints by cause, product, affected customers and recurrence, in addition to resolving individual cases.
• Handle sensitive matters, including suspicious-activity information, under applicable confidentiality and reporting rules.

Repeated withdrawal delays, for example, call for more than individually closed tickets. Investigate possible payment-interface failures, identity-review backlogs, account restrictions or liquidity arrangements. These are diagnostic possibilities, not an assumption about the cause of any particular incident. See our complaint procedure and root-cause guide.

Outsourcing the work does not remove the need for oversight

The FCA’s outsourcing and operational resilience guidance states that applicable regulatory responsibility cannot be delegated to a third party; intragroup outsourcing is not exempt simply because the provider is related. This is a UK example, not a substitute for checking other regimes. Operationally, confirm that data is accessible, important services can recover and supplier problems reach an accountable person.

Rehearse a key-person absence or provider interruption. Can the deputy retrieve records, explain the latest return and restore customer service? An external adviser delivering a file does not establish that someone inside the firm understood and checked it. Define deliverables, review ownership and exit arrangements; our broker outsourcing guide develops that assessment.

What makes remediation complete?

A practical sequence is discovery, containment, notification assessment, repair and retesting. Assess applicable reporting duties promptly; do not postpone that assessment until an internal investigation is complete. The examples below are management responses, not legal conclusions that a particular incident is or is not reportable.

The action owner’s statement that a task is complete is not sufficient verification. Arrange retesting by someone competent and able to challenge the result. Retain unresolved dependencies. Management reporting should show severity, customer impact, owner, target date and reasons for delay, instead of relying only on an overall completion percentage.

What should the budget cover, including before trading starts?

A single annual fee is not a complete operating budget. Separate people and review, systems and data, audit and reporting, advice and training, provider replacement and incident-response preparation. Show capital separately from expenditure. If the firm has no customers, establish which obligations continue and whether its non-launch status triggers a notification or licence condition; do not suspend the entire programme by assumption.

Ask suppliers to identify the serviced entity, deliverables, frequency, submission responsibility, record custody and extra charges for remediation. A low quote excluding data preparation and internal review may describe only part of the work.

A concrete next step is to select one money movement, customer review, return and business change. Ask each owner to reconstruct the basis, execution and review. Repair the most consequential evidence gaps before expanding the exercise across the control inventory. Our licensed-entity and group-responsibility guide helps identify where ownership should sit.

Frequently asked questions

Is there a universal 90-day compliance grace period after approval?

No such assumption is safe. Prepare against the effective date, licence conditions and applicable rules. An internal remediation timetable is not regulatory permission to delay; resolve outstanding launch conditions before starting the affected activity.

Do the annual audit and fee complete ongoing compliance?

No. Audit, fees, periodic returns, event notifications and operating controls are separate matters. Determine applicability and retain completion and review evidence for each.

Must every broker reconcile client money daily?

There is no safe universal answer. Establish whether the entity receives or controls client funds and identify the applicable frequency, account and handling rules. The workflow should also identify, investigate and escalate differences promptly.

Does an external compliance adviser replace internal capability?

No. Retain accountable ownership, data access, review, escalation and deputy arrangements as applicable. The precise roles and resources depend on the licence and operating business.

Can a broker pause compliance while it has no customers?

Do not pause it by assumption. Check the conditions and applicable obligations, determine whether non-launch requires notification or other action, and assess each workstream individually.

Can shareholders, directors or suppliers be changed before notification?

Not as a general rule. Before the transaction or change, assess prior approval, notification, licence variation and contractual restrictions. Do not wait until implementation to determine the requirements.

How can management tell whether a compliance gap is actually fixed?

Beyond changing a policy or submitting a document, retain the impact assessment, decisions and retesting results. Confirm that the control operates in practice and follow through on notifications and outstanding dependencies.