KNDI Licensing cheat sheet

Licensing is granted by the regulator only to legal persons (or defined sole traders) that satisfy fit-and-proper, capital, and governance thresholds before any regulated activity begins.

Regulated activities are defined by activity type, not by firm name: dealing, arranging, managing investments, custody, and advising each trigger separate permission scopes.

A firm may only carry on an activity that appears expressly on its licence; unlisted activities are prohibited even if the firm is otherwise authorised.

Variation of permission is required before adding a new activity, new client category, or new product line not covered by the existing licence.

Approved persons regime: senior managers and key function holders must be individually pre-approved or notified, and their responsibilities must be documented in a statement of responsibilities.

Change-of-control rules require prior notification and regulator approval when a qualifying holding (commonly 10%, 20%, 30%, 50%) is acquired or increased.

Licence conditions can include restrictions on client types, product classes, distribution channels, and cross-border passporting.

Passporting/equivalence regimes allow cross-border service only where the host state recognises the home state licence; otherwise a local licence is required.

Withdrawal or lapse of licence triggers wind-down obligations: orderly transfer of client assets, client notification, and retention of records for the statutory period.

Two-tier or unitary board structure must include a defined number of independent non-executive directors; independence is assessed against tenure, remuneration, and commercial links.

Board committees required typically: audit, risk, remuneration, and nominations; each must have written terms of reference and majority independent membership.

Segregation of duties: front office, risk control, compliance, and internal audit report through separate lines; internal audit reports to the audit committee, not to the CEO.

Three lines of defence model: business units own risk, risk/compliance oversee, internal audit provides independent assurance.

Conflicts of interest must be identified, logged, and managed by organisational separation, disclosure, or declining the mandate.

Senior manager accountability: each material risk and business line must map to a named accountable individual with documented responsibilities.

Succession planning and fitness-and-propriety checks apply to all board members and key function holders, with periodic re-assessment.

Whistleblowing arrangements must include protected disclosure channels independent of line management and annual reporting to the board.

Capital adequacy ratio = eligible capital / risk-weighted assets; eligible capital is split into tiers with deductions for intangibles and insufficient provisions.

Minimum ratios commonly applied: Common Equity Tier 1, Tier 1, and total capital ratios, plus a capital conservation buffer and any countercyclical or systemic buffers.

Risk-weighted assets are computed from credit risk (standardised or internal ratings), market risk (standardised or internal models), and operational risk (basic indicator, standardised, or advanced).

Liquidity coverage ratio = high-quality liquid assets / net cash outflows over 30 days; must meet or exceed 100%.

Net stable funding ratio = available stable funding / required stable funding over one year; must meet or exceed 100%.

Large exposures limits cap single-counterparty exposure as a percentage of eligible capital, with stricter limits for connected counterparties.

Leverage ratio = Tier 1 capital / total exposure measure, applied as a non-risk-weighted backstop.

Capital planning must include stress testing against adverse scenarios, with results reported to the board and regulator.

Breach of capital or liquidity thresholds triggers immediate notification, remediation plans, and possible restrictions on distributions or new business.

Client categorisation: retail, professional, and eligible counterparty; each category carries different disclosure, suitability, and best-execution obligations.

Suitability assessment requires knowledge, experience, financial situation, and investment objectives before recommending a product to a retail client.

Best execution: take all sufficient steps to obtain the best result for clients considering price, cost, speed, likelihood of execution and settlement, size, and nature.

Fair treatment of customers: clear, fair, and not misleading communications; conflicts disclosed; complaints handled within defined timeframes.

Inducements: fees or commissions must enhance service quality, be disclosed, and not impair the duty to act in the client's best interest.

Market abuse prohibitions: insider dealing, unlawful disclosure of inside information, and market manipulation, including spoofing and layering.

Order handling rules: client orders executed promptly, fairly, and in sequence; client orders not front-run or aggregated unfairly.

Product governance: target market definition, appropriateness testing, and post-sale review across the product lifecycle.

Financial promotions must be fair, clear, and not misleading, with risk warnings proportionate to the product's complexity.

Client money must be segregated from firm money in designated client accounts held with approved banks or custodians.

Client money calculation: daily reconciliation of client cash balances against the amount held in client accounts, with any shortfall funded from firm resources.

Client assets must be registered in the client's name or clearly designated as client assets in the firm's books and records.

Title transfer collateral arrangements permit reuse of client assets only where documented and disclosed; otherwise no reuse without client consent.

Custody rules require independent custody, periodic reconciliation, and safe custody of client documents and financial instruments.

Client money must be returned promptly on client request or on firm insolvency, with a documented distribution plan.

Internal client money audit is required at defined intervals by an independent function, with findings reported to the board.

Segregation must survive operational disruption: contingency arrangements for access to client accounts and records must be tested.

Records of client assets must be retained for the statutory period and be available to the regulator on request.

Risk-based approach: customer risk assessment, business risk assessment, and country/geography risk drive the depth of due diligence.

Customer due diligence (CDD) requires identification and verification of identity, beneficial ownership, and purpose and intended nature of the relationship.

Enhanced due diligence applies to politically exposed persons, high-risk jurisdictions, correspondent relationships, and complex ownership structures.

Simplified due diligence is permitted only for demonstrably lower-risk situations, with documented rationale and ongoing monitoring.

Ongoing monitoring: transaction monitoring systems with defined thresholds, periodic review of customer files, and update triggers on material change.

Suspicious activity reporting: internal escalation to the nominated officer (MLRO), external report to the financial intelligence unit, and no tipping off.

Recordkeeping: customer identification records and transaction records retained for the statutory period (commonly five years after the relationship ends).

Sanctions screening: screening against applicable lists at onboarding and on an ongoing basis, with escalation and freezing procedures.

Training: role-based AML/CTF training at induction and at defined intervals, with attendance and competency records retained.

Regulatory returns must be submitted within prescribed deadlines, with a designated senior individual accountable for accuracy and completeness.

Financial reporting: periodic financial statements, capital and liquidity returns, and large-exposure reports, each with defined content and frequency.

Ad-hoc notification: material breaches, operational incidents, fraud, and significant changes in senior personnel must be reported promptly.

Transaction reporting: reportable transactions must be submitted to the regulator or trade repository with complete and accurate reference data.

Client disclosure: terms of business, fee schedules, conflicts of interest, order execution policy, and risk warnings must be provided before or at the point of service.

Recordkeeping: retention periods for client, transaction, and compliance records (commonly five to seven years), with retrievability and integrity controls.

Data protection: personal data handled lawfully, with retention limits, access controls, and breach notification obligations.

Audit trail: records must be tamper-evident and reconstructable, with version control for policies and procedures.

Public disclosure: annual publication of capital, risk management, and governance information as required by the applicable disclosure regime.