Supplier oversight for FCA-regulated firms
SYSC 8 applies to the way every firm oversees the suppliers it relies on. From 18 March 2027, the firms FG26/4 brings into scope, among them enhanced scope SM&CR firms, Solvency II firms, banks and CASS large firms, must also notify the FCA of material third-party arrangements and submit an annual register. The first register is as at 31 December 2026. Quillion is the system of record that lets a broker, MGA or insurer evidence its oversight, and it produces the register for the firms that have to file one.
Oversight from £100 a month. Unlimited users in every band. Prices exclude VAT.
The problem
A supervisor picks an arrangement that is not on the register and asks how it got left off. The judgement was made eighteen months ago by somebody who has since left, and the logic is buried in an email thread.
A supplier let its cyber cover lapse in March. The spreadsheet still shows it as held, because a spreadsheet has no diary and ownership has been diluted.
A provider goes into administration and you find out on a Tuesday morning with everybody else. There is no exit plan written and no substitute identified.
The tool serves three kinds of firm, helping each satisfy its governance, risk and reporting needs.
SYSC 8 applies to you as guidance, and a supervisor, a network or an insurer partner can still ask how you oversee the suppliers you rely on. Quillion keeps the materiality judgement, the due diligence and the monitoring together so the answer is on file. There is no register to submit unless you become enhanced scope, but you still have a supplier estate to run and you need a record of how you run it.
A firm with £45 million or more of intermediary regulated business revenue, averaged over three years, is enhanced scope, as is a firm that has opted up. Both are in scope of PS26/2. From 18 March 2027 that means notifying the FCA of material arrangements and submitting the annual register. The first register is as at 31 December 2026.
Solvency II firms are in scope of the register and notification rules. Quillion generates the register in the aligned FCA, PRA and Bank of England template and holds the evidence behind every line of it.
Sources: FCA PS26/2 and FG26/4 (scope at section 1.2, position date at section 7.5); SYSC 8.1.1A; SYSC 23 Annex 1 Part 8.
WHAT QUILLION DOES
Every judgement along the way is signed off by someone other than the person who made it, and stays on the record.
Add the supplier and decide whether it is material.
Names, company numbers and status are pulled from Companies House.
The FG26/4 materiality questionnaire proposes an outcome and a tier, with reasons that cite the rule. The assessor can record a different outcome, with a reason.
An approver who is not the assessor signs it off, and that version cannot be changed.
Every materiality decision has its reasoning on file.
Gather the evidence before anything goes live.
Financial standing, sanctions and information security are assessed once per supplier and carried across to every arrangement.
A question that needs a certificate will not submit without one, and the expiry date goes straight into the diary.
The SYSC 8 clause checklist shows what each contract is missing.
A tier 1 arrangement taken live before sign-off needs a reason, and the reason goes on the record.
Going live early is a decision somebody owns.
Monitoring runs every day without anyone having to start it.
One daily pass turns every expiry, review date and contract end into work for a named owner, ordered by tier.
Reviews fall due on the cycle the tier sets, and open with the incidents and missed service levels since the last one already gathered.
A completed review cannot be edited.
Nobody has to remember to check.
Know how you would leave before you have to.
The stressed exit and the planned exit are set out separately, and both go through the same four-eyes approval.
A supplier entering administration is picked up from Companies House and flagged on the day.
An exit plan you could hand to a supervisor.
SUP 16.33
For firms in scope of SUP 16.33, the annual register is generated in the aligned FCA, PRA and Bank of England template, with a readiness report naming every field the template would reject. Your firm submits it.
For every firm, the same record prints as board MI, with tier 1 arrangements at the top.
It prints, because board packs are read on paper.
Why firms use it
An approver who is not the assessor signs each assessment off, and from that moment the version cannot be changed. When a supervisor asks how a decision was reached, the reasons, the rule and the sign-off are on the record.
One daily pass turns every date the firm has committed to into work waiting for a named owner, ordered by tier. A supplier entering administration is picked up from Companies House and flagged on the supplier, on the list and on the arrangement.
The annual register is generated in the aligned FCA, PRA and Bank of England template. A readiness report names every field the regulator's template would reject, before you submit.
Users are unlimited in every band, and a read-only role for the board and internal audit costs nothing. Oversight stops depending on one person's spreadsheet.
Reviews, incidents, performance against the contract and the documents behind them are all kept on the arrangement. When the renewal comes round, or the supplier lets the firm down, the history is in one place and it reads in order.
A review falling due, a document about to expire or a contract renewing on its own becomes work on the day it happens, ordered by tier, before the board hears about it from somebody else.
For brokers and MGAs · included in every band
Insurer security is a different question from third-party oversight, and it is the one a network or an insurer partner asks a broker about first.
For an MGA the same module covers capacity security and the section is called Capacity. Markets is kept separate from the third-party register, and the register export is identical whether or not Markets is in use.
Ratings, solvency, regulatory standing, track record, and the extra questions an unrated market needs. Quillion comes with a sensible default policy, which your firm then adapts.
A dated, fixed list of approved and conditional markets, with the conditions shown, generated from the record on the day you need it.
Premium placed per market against the firm’s stated GWP: the top ten markets, anything above your own threshold, and the premium placed with unrated, conditional or declined markets.
Our own oversight pack
We would tell you to demand this pack from any material third party, so here is ours, including the parts that are not finished.
The system is designed for UK-hosted data and UK-hosted backups. The hosting contract is not signed and the provider is not chosen. You will have the provider, the region and the sub-processor list in writing before you commit to anything.
Every change records who did it, what they did, what it was done to, and the before and after. Nothing in the system can update or delete an audit entry, including our own administrative tools. Administrators can export the whole log as CSV at any time.
Our staff have no access to any firm’s business data. The one exception is support access your administrator grants. It is time-limited, the reason is written down for you to read, it is shown at the top of every screen while it lasts, and you can withdraw it at any moment.
An administrator can export every record the firm holds and the full audit log without asking us. If you want to leave, you can, and you take everything with you.
Pricing
The band follows the obligation. What a firm has to do under the rules drives the work, so that is what sets the price.
For firms that have to evidence oversight under SYSC 8 but have no annual register to submit
£1,080per year
Saves £120 against monthly billing
£100per month
Rolling monthly arrangement
For firms in scope of the annual register under SUP 16.33
£9,180per year
Saves £1,020 against monthly billing
£850per month
Rolling monthly arrangement
Multiple FRNs, consolidators and networks, and insurance groups
Groups are priced per group, not per user. The price depends on how many entities share a register and how much of it they share.
Prices exclude VAT. Annual billing saves 10%. Monthly billing is a rolling arrangement. Changing band never blocks your access to your data or your exports. Pricing is indicative ahead of general availability.