Northbridge Pay Ltd: Fit-and-Proper and Outsourcing Deficiencies in a Payments Licence Application
Northbridge Pay Ltd applies to the Authority for a payments and stored-value licence. Its largest shareholder, a 30% offshore holding company, is ultimately owned by a former bank director who settled an enforcement case in another country without admission of wrongdoing. The proposed CEO was an unapproved director for 11 months at a licensed firm that later reported a client-money shortfall; she was not personally censured. The core ledger will be hosted by a cloud provider in a jurisdiction with no data-sharing arrangement with the Authority, and the contract gives Northbridge no right to audit the provider. Of the five policies the application requires, three are submitted; the complaints and outsourcing policies are missing. Projected cash flow is negative for 14 months, supported only by a non-binding letter of comfort from the 30% shareholder. The application fee has been paid and a decision is due in 60 days.
1. Identify the three deficiencies most likely to cause the Authority to refuse the application, and explain why each is material.
Read the worked answer
The strongest refusal grounds are:
- Fit and proper of the shareholder and CEO. The 30% owner's ultimate controller settled an enforcement matter abroad, and the CEO served as an unapproved director at a firm with a client-money shortfall. Neither fact is automatically disqualifying, but together they require explanation, evidence of remediation and an assessment of honesty, competence and willingness to comply. The Authority cannot rely on the shareholder's non-binding support if its controller's integrity is unresolved.
- Outsourcing and audit access. Hosting the core ledger with a cloud provider in a non-cooperative jurisdiction, with no audit rights, prevents effective supervision and creates operational and data-access risk. Licensing conditions cannot cure a contract that gives the Authority no practical access.
- Financial resources and missing policies. The 14-month negative cash flow is not matched by legally enforceable funding, and the missing complaints and outsourcing policies show the control framework is incomplete. A letter of comfort is not capital.
The other issues matter, but these three go to the statutory licensing tests rather than to presentation.
2. Should management proceed to a decision, withdraw, or request a pre-decision meeting? Justify your answer.
Read the worked answer
Management should not simply proceed. A decision based on the current file is likely to be refusal, which is harder to recover from than a short deferral. The better route is to request a pre-decision meeting and, if the Authority indicates the gaps are curable within the timetable, seek a short extension or withdraw and reapply.
The reasoning is evidential: the shareholder and CEO issues require documents, references and possibly interviews, not just assertions. The cloud contract must be renegotiated to include audit, access and data-location rights. The funding letter must become a binding, enforceable commitment or be replaced by paid-in capital. The two missing policies must be adopted by the board, not produced as drafts. If these cannot be delivered in 60 days, withdrawal preserves credibility and avoids a refusal finding that must be disclosed in future applications.
3. If the Authority nevertheless grants a licence, what conditions would address the residual risks?
Read the worked answer
Conditions should be proportionate and enforceable. Likely conditions include:
- Ownership and management: prior approval before the 30% shareholder increases its stake or changes ultimate ownership; notification of any change in CEO; a specified period of enhanced supervision of the CEO's responsibilities.
- Outsourcing: no live customer onboarding until the cloud contract grants the Authority audit and access rights; a documented exit plan and data-recovery testing; notification of any change of hosting jurisdiction.
- Financial resources: maintained paid-in capital or a binding standby facility; no dividends or shareholder distributions without written non-objection; monthly management accounts and 13-week cash-flow reporting.
- Governance and conduct: board-approved complaints and outsourcing policies within 30 days; an independent review of the control framework after six months.
The conditions should be time-bound and tied to evidence, not merely promises.