CeMAP Module 1 common mistakes
CeMAP Module 1 · Understand the traps and how to avoid them.
Answers "FOS" when asked which body can fine a firm for poor complaint handling, and says the FSCS handles complaints about advice.
The FCA, FOS and FSCS all have financial-sounding names and sit in the same chapter, so candidates memorise "complaints = Ombudsman" without separating adjudication, compensation and enforcement.
What to do instead
Build a three-column card: FCA/PRA = authorise, supervise and fine; FOS = resolve individual complaints and award compensation up to the limit, but cannot fine; FSCS = pay compensation when a firm fails. Rehearse "who does what?" questions until the function, not the name, triggers the answer.
Chooses "consumer protection" or "market integrity" as a PRA statutory objective.
Learners memorise the FCA's three operational objectives and then apply the same list to both regulators because the FCA and PRA are always studied together.
What to do instead
Write a two-column table from memory: FCA = strategic objective plus consumer protection, market integrity and competition; PRA = general safety-and-soundness objective and insurance objective, with competition as a secondary objective. Cover one column and reproduce the other.
Assumes every financial promotion must be pre-approved by the FCA before it is issued.
The phrase "approved financial promotion" in FSMA is misread as regulator approval; candidates conflate "approved by an authorised person" with approval by the regulator.
What to do instead
Learn the s21 rule: an unauthorised person may communicate a promotion only if an authorised person approves it or an exemption applies. The FCA does not sign off adverts; it imposes the clear, fair and not misleading rule. Use a one-line flow: who communicates -> authorised? -> if not, approved by an authorised person or exempt.
Cites COBS when the question is about complaint handling, or SYSC when it is about the fit and proper test.
The Handbook contains many sourcebooks with overlapping content, so learners remember topic names without mapping them to the correct module code.
What to do instead
Keep a one-page sourcebook map: DISP = complaints; COBS = conduct of business; ICOBS/MCOB = insurance/mortgages; SYSC = systems and controls; COND = threshold conditions; FIT = fit and proper; PRIN = principles; PROD = product governance. Practise locating a rule by topic rather than by keyword.
Gives the 8-week final response deadline but forgets the 3-business-day resolution route, the acknowledgement rule and the FOS six-month referral window.
The complaint journey has several clocks; candidates memorise the headline "8 weeks" and stop there.
What to do instead
Write the complaint timeline as a sequence: receipt -> if resolved by close of the third business day, no written final response is needed; otherwise acknowledge promptly and keep the customer informed; final response within 8 weeks; tell the customer about FOS and the 6-month referral deadline. Then add FOS limits: 6 years from the event or 3 years from knowledge, whichever is later.
Says the Financial Ombudsman can impose an unlimited award or fine the firm.
FOS sounds like a court or regulator, so candidates transfer court and FCA powers onto it.
What to do instead
Memorise the boundary: FOS can award compensation up to £430,000 for complaints referred on or after 1 April 2024, plus directions, but cannot fine or withdraw permission. Compensation covers financial loss, distress/inconvenience and costs. Contrast this with the FCA's fining power.
Reports a suspicious transaction directly to the FCA instead of the firm's MLRO or the National Crime Agency.
The FCA is the visible regulator, so candidates assume it is the reporting destination; the internal/external SAR split is easy to blur.
What to do instead
Learn the two-step route: staff report internally to the MLRO; the MLRO decides whether to submit a SAR to the National Crime Agency. Never tip off the customer. Add the rule that records must be kept for 5 years after the relationship ends.
Uses the old 40-day/£10 subject access request rule, or says consent is always needed to process personal data.
Legacy Data Protection Act 1998 material and the general "privacy = consent" intuition survive in candidates' memory.
What to do instead
Refresh to UK GDPR/DPA 2018: a SAR must be answered within one month, extendable by two further months for complex cases, and is usually free; consent is only one of several lawful bases. Make a comparison card: old 40 days/£10 versus current one month/free.
Treats Treating Customers Fairly as a standalone compliance add-on and cannot name the Consumer Duty's four outcomes.
TCF and the Consumer Duty overlap, and candidates learn them as separate lists without seeing the progression from principles to outcomes.
What to do instead
Learn the Consumer Duty as four outcomes - products and services, price and value, consumer understanding, consumer support - under the overarching duty to act in good faith, avoid foreseeable harm and enable customers to pursue their financial objectives. Then note that TCF's six outcomes are the earlier expression of the same fair-treatment idea.
Confuses the FCA's Principles for Businesses with the SM&CR Individual Conduct Rules, for example selecting "act with integrity" as a Principle for Businesses or "take reasonable steps to control the business effectively" as an Individual Conduct Rule.
Both codes contain similar integrity and fair-treatment language; candidates memorise the words without the code and the audience (firm versus individual).
What to do instead
Separate by audience and number: PRIN = 11 firm-facing principles; COCON Individual Conduct Rules = 5 (integrity; skill, care and diligence; open and cooperative with regulators; pay due regard to customers and treat them fairly; proper standards of market conduct); Senior Manager Conduct Rules = 4 (control, compliance, delegation, disclosure). Recite each list aloud from a blank page.