FRE2 · Skills, Principles and Ethical Behaviours
AC7.2 tests three rulebooks that sit behind every mortgage case: record keeping and FCA notifications, money laundering and proceeds of crime, and data protection. Expect scenarios rather than definitions: an adviser spots a suspicious gifted deposit, a customer asks why completion is delayed, a laptop goes missing, a client wants his data erased. Most wrong answers use a figure that changed recently. Since 2025 the POCA account threshold is £3,000, UK GDPR has seven lawful bases, the regulator is the Information Commission, and large organisations can commit the failure to prevent fraud offence.
10 min read7 sections
Checked against: Walbrook (formerly LIBF) FSRE specification v7 (July 2026), FRE2 LO7 AC7.2; FCA Handbook SYSC 9.1, SUP 15.3, SUP 15.5, MCOB 4.7A.25R, MCOB 11.6.60R; MLR 2017 regs 5, 18, 21, 27, 28, 33, 35, 37, 40; POCA 2002 ss327-339A; ECCTA 2023 ss199 and 201; UK GDPR Arts 5, 6, 9, 12, 17, 33, 34, 83 (legislation.gov.uk, ico.org.uk); checked 11 Oct 2026. Independent prep, not endorsed by Walbrook (formerly LIBF).
SYSC 9.1.1R requires every firm to keep orderly records of its business and internal organisation, sufficient for the FCA to check compliance. Specific rules then set how long particular records are kept. Learn the four periods in the table, because examiners swap them.
| Record | Minimum period | Source |
|---|---|---|
| Adviser's suitability record for a mortgage recommendation | 3 years | MCOB 4.7A.25R |
| Execution-only sale record | 3 years | MCOB 4.8A.18R |
| Lender's affordability assessment record | Term of the regulated mortgage contract | MCOB 11.6.60R |
| Complaint record and measures taken | 3 years from receipt | DISP 1.9.1R |
| Customer due diligence records | 5 years from the end of the relationship | MLR 2017 reg 40 |
Some events must reach the FCA straight away. SUP 15.3.1R covers matters with a serious regulatory impact, SUP 15.3.11R significant breaches of rules and Principles, and SUP 15.3.17R significant fraud or irregularities, including fraud by employees against customers. All are 'immediately'. Changes of name or principal business address need reasonable advance notice (SUP 15.5.1R and 15.5.4R).
Every note. Every question. One pass.
5 more sections of this note are part of Premium.
From ≈£2.72/mo on the Until-you-qualify pass (18 months)
Trap: Candidates give the lender's affordability record the adviser's three-year period, or wait for a periodic return before reporting a significant breach.
Takeaway: Advice records 3 years, affordability records for the mortgage term, CDD 5 years after the relationship ends; significant breaches go to the FCA immediately.
The Money Laundering Regulations 2017 build everything on risk. Reg 18 requires a written, firm-wide assessment of money laundering and terrorist financing risks. Reg 27 says when CDD applies, and reg 28 says what it involves.
The firm appoints a nominated officer, usually called the MLRO, to receive internal suspicion reports (reg 21(3)).
Trap: A customer's signed declaration of address is not verification, because it does not come from an independent source.
Takeaway: CDD applies at the start, on suspicion and on doubt; verify from independent sources; beneficial owners hold more than 25%.
