Compliance is the part of running a business that no founder gets into business for, and the part that quietly ends companies that ignore it. The headline numbers come from the regulated end of the market: in 2024/25, the Financial Conduct Authority imposed fines of more than £186 million and cancelled the authorisations of over 1,400 firms. Those penalties largely fall on banks, payment firms and other authorised financial businesses, not on the average startup, but the underlying message reaches everyone: regulators expect you to know the rules that apply to you, and “I did not realise” is not a defence.
After more than a decade advising founders, I have learned that most compliance trouble is not dramatic. It is a missed Companies House deadline, a VAT registration left too late, a data breach with no process behind it, or a compounding payroll error. This guide sets out what financial regulations and compliance actually mean for a UK business, separating the obligations every company carries from the heavier rules that apply only if you work in a regulated sector, so you can spend your attention where it genuinely matters.
Start With the Compliance Every UK Business Carries
Before worrying about the FCA, get the universal obligations right, because these are the ones that catch ordinary businesses.
Company filing comes first. If you trade through a limited company, Companies House requires annual accounts and a confirmation statement, filed on time, with your statutory registers and people with significant control information kept current. Late filing brings automatic penalties and, left unresolved, the threat of being struck off. Recent reforms have also tightened identity verification requirements for directors and people with significant control.
Tax is the second pillar, and the one with the most moving parts. Depending on your size and structure, you will deal with Corporation Tax, VAT once you cross the registration threshold, PAYE and National Insurance for employees, and the Making Tax Digital regime, which requires digital record-keeping and software-based submissions for VAT and, increasingly, for income tax self-assessment. The practical point is that tax compliance is a calendar, not an event: the businesses that struggle are the ones treating each deadline as a surprise.
Data protection is the third, and it applies to almost every business because almost every business holds personal data about customers or staff. The UK regime is the UK GDPR and the Data Protection Act 2018 (as amended). You need a lawful basis for processing personal data, appropriate security around it, a way to handle individuals’ rights requests, and, for many businesses, registration with the Information Commissioner’s Office. Penalties for serious breaches are significant, up to the higher of £17.5 million or 4% of global annual turnover, but the more common cost is reputational: customers do not forgive a careless breach quickly.
Employment and payroll compliance is the fourth. Once you employ people, you take on obligations covering contracts, the National Minimum and Living Wage, pension auto-enrolment, working time, and accurate payroll reporting to HMRC. These are not financial services rules, but they are financial compliance in the sense that getting them wrong creates direct liabilities.
Get these four right, and you have covered the compliance that applies to you regardless of sector. Everything below is additional and only relevant to some businesses.
The Rules That Apply Only in Regulated Sectors
If your business handles other people’s money, gives regulated advice, or operates in a sector the law treats as high-risk, a second layer applies. This is where the FCA, the Money Laundering Regulations and the payment services rules live, and it is the layer that the original version of this guide mistakenly applied to everyone.
The Financial Conduct Authority regulates firms in financial services: banks, lenders, insurers, payment and e-money firms, investment managers, consumer credit providers and more. If your business needs FCA authorisation, the FCA Handbook governs how you conduct business, prevent financial crime and treat customers, and operating without the required authorisation is itself an offence. Most startups do not need it; if you are unsure whether you do, that question is worth professional advice before you launch, not after.
The Money Laundering Regulations (the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017) apply to specified sectors, including financial firms, accountants, estate agents, and certain high-value dealers. Where they apply, you must carry out customer due diligence, monitor transactions, and report suspicious activity. They do not apply to every business, but where they do, the obligations are strict, and the supervisor takes them seriously.
The Payment Services Regulations govern firms that provide payment services, covering security, transparency, and customer protection. Again, this is a sector-specific regime, relevant if payments are your business rather than simply something you accept from customers.
Finally, financial reporting standards (the FRS suite issued by the Financial Reporting Council, principally FRS 102 and FRS 105 for most UK companies) govern how you prepare your accounts. These apply broadly, but the level of detail scales with your size, and your accountant will normally handle the mechanics.
Building Compliance Into the Business, Not Bolting It On
Whatever your sector, the businesses that stay compliant treat it as a system rather than a scramble. A few principles do most of the work.
It starts at the top. If the founder treats compliance as an irritation, everyone else will too. Setting a visible expectation that the business does things properly is the single biggest cultural lever, and it costs nothing. From there, the practical machinery is straightforward: know which obligations actually apply to you and write them into a compliance calendar with owners and dates; keep simple, current policies for the areas that matter most, usually data protection, financial controls and, where relevant, anti-money-laundering; train the people who need to know rather than issuing policies no one reads; and use software to carry the load where you can, since accounting, payroll and Making Tax Digital obligations are far easier to meet with the right tools than with spreadsheets and good intentions.
The last principle is review. Regulations change, your business changes, and a control that worked with five employees may not work with fifty. A periodic check, even an annual one, that your obligations and your processes still match, is what prevents the slow drift into non-compliance that catches growing businesses off guard.
For businesses that want a structured financial footing rather than a patchwork, our financial management consulting service helps founders put the controls, reporting and processes in place properly, and our guide to risk management covers how compliance fits into a wider approach to protecting the business.
How SGI Helps
We are not a law firm or a regulated compliance consultancy, and for FCA authorisation or formal anti-money-laundering supervision, you will need specialist regulated advice. Where we help is upstream of that: making sure founders understand which obligations genuinely apply to their business, building the financial controls and reporting that keep a growing company in good standing, and aligning compliance with the rest of the plan so it supports funding and growth rather than surprising you later. If you would like an objective view of where your business stands, book a free consultation.
Frequently Asked Questions
What financial compliance does a new UK business actually need?
For most new businesses, the core obligations are Companies House filing if you are a limited company, registering for and meeting your tax duties (Corporation Tax, VAT once you pass the threshold, PAYE if you employ staff) under Making Tax Digital, data protection compliance under the UK GDPR and Data Protection Act 2018, and employment and payroll obligations once you hire. FCA, anti-money-laundering and payment services rules only apply if you operate in those specific regulated sectors.
Does my business need to be FCA authorised?
Only if you carry on a regulated activity, such as lending, insurance, investment, payments, e-money or consumer credit. Most ordinary trading businesses do not. Because operating without the required authorisation is an offence, if there is any doubt about whether your model is regulated, get professional advice before you launch.
Do the anti-money-laundering regulations apply to me?
Not to every business. The Money Laundering Regulations apply to specified sectors, including financial firms, accountants, estate agents and certain high-value dealers. If you fall within scope, you must carry out customer due diligence, monitor transactions, report suspicious activity, and register with the relevant supervisor.
What happens if I miss a Companies House or tax deadline?
Late filing typically triggers automatic penalties that increase the longer the delay continues, and persistent failure can lead to a company being struck off or to enforcement by HMRC. The practical fix is to treat statutory deadlines as a managed calendar with clear ownership rather than dealing with each one reactively.
How are data protection rules different in the UK after Brexit?
The UK no longer directly applies the EU GDPR. Instead, UK businesses follow the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The core duties, a lawful basis for processing, appropriate security, respecting individuals’ rights, and, for many, ICO registration, remain in place, and serious breaches can attract penalties up to the higher of £17.5 million or 4% of global turnover.
References
- Financial Conduct Authority: Enforcement data 2024/25 and the FCA Handbook.
- GOV.UK and Companies House: company filing and director duties.
- HMRC: Making Tax Digital, VAT, PAYE and Corporation Tax obligations.
- Information Commissioner’s Office: UK GDPR and the Data Protection Act 2018.
Related Posts
Kurt Graver is the founder and CEO of SGI Consultants, a business consultancy that has helped over 2,000 entrepreneurs establish successful startups using systematic business development methodologies. An accountant with an MBA and 25 years of commerce and consultancy experience, Kurt specialises in strategic planning, market analysis, and sustainable business growth