Twenty plus AR networks: why the 54-AR principal firm pattern matters

A principal firm with twenty or more appointed representatives sits in the most operationally complex band of the UK AR market. Below twenty, manual oversight just about works. A Head of Network Compliance with a structured spreadsheet, a disciplined annual review cycle, and a willingness to chase can hold the line. Above twenty, the model breaks. Not gradually. It breaks in a quarter, usually the one the regulator asks a question the firm cannot answer from the existing artefacts.

The supervisory architecture around this band has shifted hard in 2026. The FCA's inactive AR review on 21 April 2026 set the bar as "active and data-led oversight", not self-reported attestation. The HMT consultation on AR regime reform closed on 9 April 2026, pushing principal accountability further into the operating reality of each AR. The FCA's AR oversight programme 2022-25 sits underneath both, having already terminated more than 1,300 principal-AR relationships. The 2,469 UK principal firms include roughly 120 in this 20+ band. They are where the next supervisory cycle lands hardest.

This piece covers three areas:

1. Why the 20+ AR band breaks the manual oversight model.

2. What the FCA now expects of firms in this band.

3. The three structural shifts the 54-AR principal firm pattern shows in working form.

Why the 20+ AR band breaks the manual oversight model

The manual model rests on one operating assumption. The Head of Network Compliance holds the picture of the network in working memory, supplemented by a spreadsheet and a disciplined annual review cycle. A complaint pattern at AR seven shows up because the same person reads the AR seven complaints. A revenue mis-coding at AR three surfaces because the same person reviews the REP025 return. The cognitive load fits inside one head.

The break point is around twenty ARs. Beyond it, the function stops noticing and starts assembling. At thirty ARs the Head of Network Compliance spends most of the week on assembly. At fifty ARs the assembly never finishes. The picture is stale by the time it is complete. The FCA's 21 April 2026 review effectively measured this without naming it that way: smaller principals struggled with whether the annual review happened, larger principals struggled with whether it stood up to scrutiny when it did. The direction of travel is from notice-and-respond to model-and-monitor.

Where the manual model trips up at this scale is rarely a resourcing question. Adding a second Head of Network Compliance splits the picture in two without making either half complete. The structural cost is the assembly itself. The picture is built in a person's head from twenty separate streams, then written down, then submitted. By the time the regulator reads it, the operating reality has moved.

What the FCA now expects of firms in this band

The current pattern across most principals reading this is annual-review-led. The Head of Network Compliance runs a SUP 12.6 self-assessment cycle, gathers REP025 returns from each AR, reviews complaints quarterly, and produces a board pack once a year. The artefact set is the AR file, the network spreadsheet, and the annual return. The unit of control the function defends to the regulator is the annual review.

The 21 April 2026 FCA inactive AR review names a different test. "Active and data-led oversight" is the phrase. Active means the principal forms the view of the AR's operations, not the AR. The self-assessment, the attestation, the questionnaire response all sit at the AR's end of the relationship; the FCA's position is that they are inputs, not the answer. Data-led means the view comes from the operating signal: revenue patterns, complaints volumes and themes, claims ratios, customer outcomes measurable from data the principal already holds. The review explicitly criticises principals whose oversight rested on REP025 returns that were "incorrectly coded" or "lacked credible explanations". The HMT consultation that closed on 9 April 2026 reinforces the direction, pushing principal permission gateways, AR-into-SM&CR alignment, and FOS jurisdiction extensions to ARs. The annual review is no longer the unit of control. The operating picture between annual reviews is.

Where this is hardest is in the question the function answers in a supervisory conversation. The honest answer to "what does your AR oversight look like between annual reviews?" is, for most firms in the band, "very little". The artefacts are point-in-time. The data is at the AR's end of the relationship. The picture is built once a year, in a hurry, against a deadline.

The three structural shifts the 54-AR pattern shows

CoVi's anchor customer in this band is a UK principal firm overseeing 54 appointed representatives across three jurisdictions with a single Head of Network Compliance. The model is instructive because the operating shape is what the band requires, not what it can optionally adopt. The network is structured as a single hierarchy with each AR as a node and controls, indicators, complaints, and actions sitting as children of each AR. The Head of Network Compliance moves from "what is happening at AR 37" to "what is the network state today" in one change of view, not a thirty-step assembly.

Underneath the hierarchy, the operating signal is wired into the control state. Complaints volumes move the relevant indicator. Revenue patterns surface as a movement on the AR's commercial control. Claims ratio shifts move the relevant claims-handling control. The supervisory cut is on demand. The SUP 12.6 self-assessment, the REP025 return, and the annual review submission all draw from the same underlying state, as different cuts of the same picture rather than three construction exercises. The shift is from assembling the picture to reading the picture.

The traps in this transition are subtle. Firms that lift the hierarchy without rewiring the indicators end up with a tidier spreadsheet, not a live operating layer. Firms that rewire the indicators on a flat AR list lose the network view and never reach aggregation. Firms that sequence the annual review last, rather than first, find the function still scrambling against the old deadline while the new operating cadence is half-built underneath.

The solution: continuous oversight as an operating layer

• Pitfalls 1 and 2 (assembling 20+ ARs in a single head, attestation-led evidence base) are fixed by the Controls-First Approach. The function starts from the AR-level controls that actually operate, decomposes each into RCIA, and wires the indicator off the operating signal. The annual review becomes a formal cut of a continuously maintained picture.

• Pitfall 3 (no live network view, supervisory conversation built from scratch) is fixed by the Parent-Child module. Each AR is a child of the principal, configured once and instantiated for every AR. Controls, indicators, complaints, and actions aggregate upward. The network state is one view, with drill-down to any AR.

The operating layer that comes out of this is the picture the FCA's "active and data-led" test points at. The annual review still gets filed. It just stops being the moment the picture gets built.

Next step

This week, pick one AR. Map its three highest-stakes controls. For each, name the operating signal that would tell the principal the control is working, independent of anything the AR submits. That single-AR exercise is the smallest credible test of the shift. If the three signals exist and the principal already holds them, the operating layer is closer than the function thinks. If they do not, the gap is the work.

If this matches the function you are running, see how it works in an AR network setting at /who-its-for/ar-network-oversight.