Authorisation is the start of an obligation, not the end of one. In the twelve months after a licence is granted a trading firm typically faces several distinct examinations, run by different people, on different timetables, testing different things. Founders who treat them as one annual event get caught out, because the calendars do not align.
The financial audit, and what makes it harder here
Every licensed firm has a statutory audit of its accounts. What makes it different for a trading business is that the auditor is often also asked to report to the regulator on specific regulatory matters, and in several regimes the audit firm has to be on an approved list. Appoint late and the calendar becomes the constraint, because approved firms are finite and everyone files in the same quarter.
The problems auditors find in a first year are consistent. Revenue recognition on spreads, markups and commissions that was never documented as a policy. Client balances that do not tie back cleanly from the trading platform to the ledger to the bank. Related party transactions with a founder's technology company that have no written agreement behind them. None of these are exotic. They happen because the accounting was built after the fact from platform exports rather than designed alongside the operation.
Capital adequacy and periodic returns
Separate from the annual audit, most regimes require regular prudential returns, often quarterly, showing that regulatory capital remains above the required level. The requirement scales with permissions and model, and in many frameworks it also moves with fixed overheads and with risk based measures, so it is not a number a firm sets once. A firm that adds staff and offices can drift toward a breach without any change in trading. The underlying calculation logic is covered in capital requirements for brokers.
The mechanical failure here is a late or restated return. Regulators treat reporting accuracy as a proxy for internal control quality, and a restatement in the first year invites a closer look at everything else. The fix is unglamorous: someone owns the return, the calculation is documented, and it is prepared with time to check rather than on the deadline.
Report a breach yourself. Most regimes require prompt notification of a capital breach or a client money shortfall, and self reporting with a remediation plan is treated very differently from a breach the supervisor discovers in the next return.
Client money examinations
Where a firm holds client money, this is the examination with the sharpest teeth, because the money belongs to someone else. Reviewers look at whether client funds sit in properly designated accounts with acknowledgment letters from the banks, whether internal and external reconciliations are performed at the required frequency, whether differences are investigated and cleared rather than carried, and whether the firm can produce a client money calculation at any date on request.
Reconciliation breaks are common in trading firms because balances move constantly through floating profit and loss, swaps, and payment processor settlement delays. A processor holding a rolling reserve, for example, creates a receivable that has to be treated correctly rather than counted as client money in the bank. The rules and the practice are described in client fund segregation.
AML review and the compliance monitoring programme
Many regimes require an independent review of the anti money laundering framework, performed by someone outside the compliance function, plus an annual report from the money laundering reporting officer to the board. The review tests whether the written policy is actually being followed: were customer risk ratings applied, was enhanced due diligence performed where it was triggered, were screening alerts cleared with a recorded rationale, were internal reports considered and either filed or documented as not filed.
The most frequent finding is not a missing policy. It is a good policy nobody operated. A firm that promised annual refresh of documents for high risk clients and never ran it has a gap that is visible in the client records themselves. Building the policy so it matches what the operation can actually do is the whole argument, and the evidence behind it is covered in compliance audit trails.
Supervisory contact, and preparing for it properly
Beyond the scheduled items, supervisors run thematic reviews, ad hoc information requests and visits. Requests often arrive with short deadlines and ask for records rather than explanations: a list of complaints with outcomes, all marketing published in a period, execution data for a sample of orders, the training register, the breach log.
Firms that answer these quickly share one characteristic. The records were captured as the business ran, not assembled afterwards. Complaints are logged where they arrive, marketing goes through a recorded approval before publication, execution and order data is exportable from the platform without a vendor ticket, and every change is timestamped against a user. That is a systems decision taken at launch, and it is why record retrieval belongs on the platform and CRM selection checklist rather than being solved later. The wider picture of what supervisors examine sits in broker audits explained.
Requirements, frequencies and thresholds differ by jurisdiction. This is a description of common mechanisms, not advice, and each firm should work from its own licence conditions and the regulator's published rules.
"Supervisors form their view of a new firm in the first twelve months, and most of that view comes from whether the returns arrive on time and reconcile."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- The first year brings several separate examinations on different calendars, not one annual review
- Late or restated prudential returns are read as evidence of weak internal control and invite broader scrutiny
- Client money reviews test reconciliations and designated accounts, and payment processor reserves are a frequent source of breaks
- AML reviews usually find a sound policy that was never operated, which is visible directly in client records
Frequently Asked Questions
Can any accountant perform a licensed firm's audit?
Often not. Several regimes require the auditor to be approved or registered for regulated firm work, and may require the auditor to report separately to the supervisor. Approved firms have limited capacity, so appointment should happen early.
What should a firm do when it discovers a capital shortfall?
Most rulebooks require prompt notification to the regulator. Self reporting with a dated remediation plan is treated very differently from a shortfall found later in a routine return, so the practical step is to escalate internally the same day it is identified.
How much notice does a supervisory visit come with?
It varies. Some visits are scheduled with a document request in advance, others are unannounced, particularly where premises or record keeping conditions are being tested. Firms that keep records as they operate handle both without difficulty.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.