Velos: founder control, a disbanded audit committee and an FCA skilled person review

Board composition and independence A five-person board with one non-executive, who is a former colleague of the CEO, cannot provide effective challenge. With the CEO also chairing, decision-making power is concentrated: the same person sets the agenda, controls the information flow and assesses performance. The two investor representatives have an ownership interest that may align with growth rather than with control.

Committee architecture Disbanding the audit committee removed the forum where external audit, internal audit and control findings are examined without the executive present. Absorbing that work into the main board agenda means it is discussed alongside strategy and growth, usually last, and often without minutes that record challenge. A risk committee that meets twice a year cannot oversee a payments business whose risk profile changes monthly.

Reporting lines and the three lines model Compliance reporting to the CFO creates a conflict: the CFO owns financial targets and cost control, so compliance findings that imply cost or constrain growth are filtered before they reach the board. The absence of a chief risk officer, after the head of risk resigned, leaves the second line leaderless. There is no evidence of a functioning third line with a direct line to an audit committee.

Culture and incentives The exit interview phrase 'risk is treated as a blocker to growth' is a culture signal, and it is corroborated by structure. Sales pay on new merchant volume with no clawback rewards volume regardless of suitability or disclosure quality. When 3,000 customers receive incorrect fee disclosures and a customer finds the error, the first and second lines have both failed to detect a conduct issue.

Mechanism to prudential and conduct risk Volume incentives plus weak second line plus no independent committee produce mis-selling and disclosure errors. That leads to customer harm, redress costs, FCA enforcement and reputational damage, and it can escalate to restrictions on business or capital add-ons. The prudential dimension is equally real: weak oversight of operational resilience, outsourcing and safeguarding means the firm cannot evidence that it can withstand disruption. This is a governance failure that produces conduct failures, not a compliance problem that can be fixed with training.

Sequence matters: independence and reporting lines first, because they enable everything else.

Months 0-3: restore independence and visibility

• Appoint an independent chair and two additional independent non-executive directors, replacing the former-colleague NED over a planned transition. Justification: without independent challenge, any other reform can be overridden by the founder.
• Reconstitute an audit committee and a risk committee, each with an independent chair, defined terms of reference, a minimum meeting frequency and the right to take external advice. A payments firm needs risk oversight monthly, not twice a year.
• Appoint an interim head of risk with a direct reporting line to the board risk committee and a dotted line to the CEO. Move compliance reporting out of the CFO's line, either to the head of risk or directly to the risk committee. Justification: reporting lines determine what the board is allowed to see.

Months 3-6: make the three lines real

• First line: business owners accountable for conduct outcomes, with product approval and disclosure sign-off documented.
• Second line: risk and compliance with authority to challenge and a documented escalation route to the board that cannot be blocked by the executive. Compliance monitoring should cover fee disclosure, onboarding and outsourced providers.
• Third line: internal audit with a direct line to the audit committee and an annual plan approved by that committee.
• Rebuild the risk register around conduct and operational resilience, with owners and tolerances.

Months 6-12: change the incentives and embed

• Rebalance sales incentives: introduce a conduct gate and quality metrics, defer part of variable pay, and add clawback. Volume-only pay is the single clearest driver of the disclosure failure.
• Introduce a board-level scorecard that includes customer outcomes, complaint root causes, error rates and remediation timeliness alongside revenue.
• Establish a whistleblowing route to the audit committee chair, with outcomes reported to the committee.
• Train the board on its obligations and run an independent culture review, reporting to the audit committee.

Justification Each change targets a specific mechanism: independence addresses challenge, reporting lines address information asymmetry, committees address oversight, and incentives address behaviour. Changing incentives before restoring independence would simply be reversed by the founder.

Handling the review The CEO's instinct to 'get it over with quickly and keep it internal' is the most dangerous position in this scenario. A section 166 review is commissioned by the regulator; attempting to narrow, delay or contain it is itself a governance and cooperation issue and will aggravate any eventual finding.

• Cooperate fully and visibly. Agree terms of reference, provide complete documentation, make staff available, and do not restrict the skilled person's access to the board. Appoint a single senior accountable contact.
• Do not pre-judge the outcome, but do begin remediation in parallel where the defect is already known: the 3,000 incorrect fee disclosures.
• Customer remediation first. Identify affected accounts, calculate redress, contact customers proactively and record outcomes. A regulator weighs how the firm treats affected customers more heavily than the elegance of the remediation plan.
• Board ownership. The remediation plan should be owned by the board, chaired through the audit or risk committee, with named executive owners and dated milestones. The CEO should not chair the committee overseeing remediation of a failure that occurred under the CEO's leadership.
• Communicate honestly. Avoid over-promising timelines; a missed public commitment is worse than a conservative one.

Evidence of cultural change a regulator would find credible

• Board minutes showing substantive challenge, including dissent recorded and acted on, and independent NEDs with relevant experience.
• Incentive documentation showing deferral, clawback and a conduct gate, with the first year of operation evidenced.
• Risk appetite metrics with thresholds, breaches and actions taken, not just a statement.
• Customer outcomes data: complaints, root causes, disclosure error rates, redress completion and repeat findings.
• Whistleblowing data: cases raised, outcomes, and evidence that raising concerns has no adverse consequence.
• Exit interview themes over time, and the appointment of a permanent head of risk with a direct board line.
• Independent assurance: internal audit findings and closure rates, plus a culture review.

Judgement The credible narrative is not 'we have fixed it'. It is: here is what failed, here is the mechanism, here is what we changed, here is the independent evidence, and here is the residual risk the board has accepted. That is what a skilled person and the FCA will test.