Kession v KVB clarifies principal responsibility under section 39 FSMA

1. Overview and Result

The unanimous Supreme Court decision in Kession Capital Ltd (in Liquidation) v KVB Consultants Ltd and others [2026] UKSC 11 concerns the scope of an authorised person’s responsibility under section 39 of the Financial Services and Markets Act 2000 (“FSMA”) for the activities of its appointed representative (“AR”). The Court allowed Kession Capital Ltd’s appeal, overturning the majority of the Court of Appeal ([2024] EWCA Civ 765), and held as a final decision that an authorised person which restricts its AR’s permission to dealing with professional clients only is not responsible under section 39(3) when the AR, in breach of that restriction, deals with retail clients.

The central legal question was whether dealing with retail clients constitutes a “part” of the business of a prescribed description (e.g., advising on investments, arranging deals in investments) within the meaning of section 39(1)(b). The Supreme Court held that it does, meaning the authorised person can validly accept responsibility for only part of the business — namely, the professional-client part – and thereby exclude responsibility for the retail-client part.

2. Key facts

Element	Detail
Authorised person	Kession Capital Ltd – held Part 4A permission for advising on and arranging deals in investments, limited to professional clients and eligible counterparties (i.e., excluding retail clients)
Appointed representative	Jacob Hopkins McKenzie Ltd (“JHM”) – appointed under a written Appointed Representative Agreement (“ARA”) dated 30 June 2015
ARA restriction	JHM was expressly prohibited from conducting any business with retail clients (Recital (B), definition of “Relevant Business” para (4), and Schedule 5)
What JHM did	Promoted property development investment schemes to investors it classified as professional clients. All schemes failed. Investors lost £1.7 million. Most investors alleged they were in truth retail clients who had been misclassified.
Procedural posture	Investors obtained summary judgment against Kession in the High Court on the basis of section 39(3) liability. The Court of Appeal majority (Males LJ, Sir Geoffrey Vos MR) affirmed. Lewison LJ dissented. The Supreme Court reversed.

3. The statutory framework

Section 39 creates a tripartite structure:

1. Section 39(1)(a): The authorised person contracts with the AR to permit or require the AR to carry on “business of a prescribed description.”
2. Section 39(1)(b): The authorised person accepts responsibility in writing for the AR’s activities in carrying on “the whole or part of that business.”
3. Section 39(1) (tail): The AR is exempt from the general prohibition (section 19) only in relation to regulated activities comprised in the business for which the principal has accepted responsibility.

Section 39(3) then provides that the principal is responsible “to the same extent as if he had expressly permitted it, for anything done or omitted by the representative in carrying on the business for which he has accepted responsibility.”

Crucially, the Court held that the extent of the exemption under section 39(1) and the responsibility under section 39(3) are coterminous – they are defined by the same contractual acceptance of responsibility (para 43).

In Anderson v Sense Network Ltd [2019] EWCA Civ 1395, the Court of Appeal (Lord Richards giving the judgment) held that:

• An authorised person can limit its acceptance of responsibility to a part of the generic business description.
• There is an important distinction between restricting what business the AR may carry on (valid limitation on scope of responsibility) and prescribing how the AR must carry on permitted business (does not limit the scope of responsibility).
• For example, a contractual term requiring the AR to comply with regulatory standards is about “how” business is conducted and does not limit the principal’s responsibility if the AR breaches those standards.

The Supreme Court in Kession affirmed and applied this framework without any reservation (para 38).

4. The core ruling

The Supreme Court held:

Dealing with retail clients is a “part” of the business of a prescribed description within the meaning of section 39. An authorised person may therefore validly limit its acceptance of responsibility to dealing with professional clients only, and will not be responsible under section 39(3) for an AR’s dealings with retail clients where the ARA expressly excludes such dealings.

(Para 84)

This was a final determination, not merely the refusal of summary judgment. The issue was fully argued before the Supreme Court.

5. The court’s reasoning

Lord Richards’ reasoning rests on three principal pillars, each framed as a ground of consumer protection – deliberately rebutting the respondents’ argument that consumer protection demanded the opposite result.

Pillar 1: Competence-based supervision (paras 63–65)

The entire AR regime depends on the principal having the expertise and experience to assess, supervise, and monitor the AR’s conduct of the permitted business. The Court reasoned that an authorised person whose own experience and expertise lay in dealing with professional clients would not be well placed to supervise an AR’s conduct of retail business. The Court held that requiring it to assume responsibility for retail dealings it was not equipped to oversee would undermine, not promote, consumer protection.

“It would defeat the regulatory purpose if an authorised person, whose experience and expertise lay in dealing with professional clients, was required to assume responsibility for an appointed representative’s conduct of retail business” (para 64).

The Court drew support from SUP 12.4.2 R, which requires the principal to have “adequate controls” and “resources to monitor and enforce compliance” for the regulated activities for which it is responsible.

Pillar 2: Assessment of the AR’s qualifications (para 69)

Even where the principal itself holds retail permissions, it may legitimately form the view that a particular AR is not qualified to deal with retail clients – for example, because the AR’s staff lack the specific FCA-approved qualifications required under TC 2 and TC App 1. In such cases, it makes no sense to impose retail responsibility on the principal when it has correctly limited the AR’s permission for protective reasons.

Pillar 3: The “promiscuously broad exemption” problem (para 70)

If dealing with retail clients is not a “part” of the business, then an AR expressly prohibited from dealing with retail clients would nevertheless be exempt from the general prohibition if it did so. It would:

• Commit no criminal offence under section 23
• Face no civil consequences under section 26 (unenforceability of agreements)

This would perversely strip away a layer of protection from the very consumers who most need it.

Rejection of the Court of Appeal’s reasoning

The Court systematically rejected Males LJ’s three reasons:

Males LJ’s reason	Lord Richards’ response
The “type” of business is distinct from the identity of clients (para 88 CA)	True at a generic level, but does not follow that client categories cannot constitute “parts” of a business. The retail/professional distinction is a fundamental feature of the regulatory regime (para 73).
Classifying clients involves an “assessment” similar to suitability assessment, making it part of “how” business is done (para 89 CA)	The classification of clients is often mechanical/objective (per se professional clients, per se eligible counterparties). Even elective professional client status involves a structured test quite different from the holistic suitability assessment. In any event, the need for some assessment does not prevent a category from being a “part” of the business (para 74).
Retail clients would have less protection than professional clients, which “makes little sense” (para 91 CA)	This misunderstands how section 39 primarily protects consumers: not by providing a remedy against the principal, but by putting in place a structure ensuring only competent persons deal with retail clients under competent supervision (para 78).

Other points

• Mr Sims’ “centrality of regulated activities” argument – that any valid restriction must be by reference to categories of regulated activity or investment type, not client type – was rejected. There is nothing in the language of section 39 to support such a limitation, and Anderson already permitted a restriction by reference to investment providers (not a statutory category) (paras 80–82).
• Mr Sims’ alternative argument – that the ARA could validly prohibit retail dealing as a matter of contract (giving rise to breach remedies) while the principal remained responsible under section 39(3) – was rejected as inconsistent with the statutory scheme, which uses the agreement to define both the scope of permission and the scope of responsibility (para 79).
• Lewison LJ’s dissent below was vindicated in its result but not entirely in its reasoning. The Supreme Court disagreed with his tentative view that Kession was not an “authorised person” at all when it came to retail clients. Under FSMA, a person once authorised is an authorised person for all purposes; it is simply in breach of regulatory obligations if it acts outside its Part 4A permission (para 83).

6. What this means in practice

For authorised persons (principals)

1. Effective scope limitation is possible. Principals can now limit their section 39(3) responsibility by restricting the AR’s permission to specific client categories. A restriction to professional clients and eligible counterparties, excluding retail clients, is a valid limitation on the scope (“what”) of the permitted business, not merely a prescription as to how business is conducted.
2. Drafting matters, but substance prevails. The ARA in Kession was robustly drafted: the restriction appeared in the recitals, the definition of Relevant Business, and Schedule 5. Practitioners should ensure that client-category restrictions are clearly expressed as scope limitations rather than conduct obligations. That said, Lord Richards endorsed the Judge’s warning (para 26) against “dissect[ing] an appointment in a spirit of pedantry, divorced from commercial reality” – so substance will prevail over form.
3. Supervision obligations align with responsibility. The ruling is consistent with SUP 12.4.2 R. Principals should ensure that they have adequate resources and competence to supervise whatever business they permit. The judgment provides powerful support for the position that a principal should not accept responsibility for categories of business it cannot properly oversee.
4. Due diligence on AR competence. Where a principal holds retail permissions but appoints an AR without retail-qualified staff, the prudent course is to restrict the ARA to professional clients. The judgment validates this approach and provides comfort that such a restriction will be effective.

For appointed representatives

1. Exceeding scope has severe consequences. If an AR deals with retail clients in breach of an ARA restricted to professional clients, it is not exempt from the general prohibition in respect of those dealings. The consequences flowing from that loss of exempt status include: (i) Potential criminal liability under section 23 FSMA; (ii) Potential unenforceability of agreements against the retail client under section 26; and (iii) No statutory responsibility on the principal – the principal is not responsible under section 39(3), because the retail dealings fall outside the business for which it accepted responsibility. This is a dramatically worse position than if the AR had been permitted to deal with retail clients and simply done so negligently or incompetently.
2. Client classification is now safety-critical in a new way. Misclassifying a retail client as professional is no longer ‘merely’ a regulatory breach for which the principal bears responsibility. It potentially takes the AR outside the protection of the section 39 exemption in respect of those dealings. ARs must therefore invest heavily in robust classification procedures.

For retail investors

1. No section 39(3) remedy against the principal. Where an AR has acted outside the scope of its appointment by dealing with retail clients, those clients cannot look to the principal for compensation under section 39(3). They must pursue the AR directly – which, as in this case, may be insolvent.
2. Alternative remedies remain. The judgment does not foreclose all claims against principals. The Supreme Court resolved only the section 39(3) point and expressed no view on other potential causes of action. The High Court in this case had refused summary judgment on two other bases (damages under section 138D for breach of SUP 12 rules, and damages under section 241 on the basis that Kession itself approved marketing material). Those claims were not the subject of this appeal and may continue to be pursued, though their viability remains to be determined. Practitioners acting for investors should carefully consider:
   • Whether the principal was itself directly involved in the relevant conduct (not merely vicariously responsible)
   • Whether breaches of SUP 12 supervisory obligations are actionable under section 138D
   • Common law claims in negligence or for breach of statutory duty
3. Check the FCA register. Retail investors dealing with an AR should verify the scope of the AR’s appointment on the FCA Register. If the AR is not authorised to deal with retail clients, the investor should be aware that the principal will not stand behind those dealings.

For the FCA

1. Regulatory approach validated. The judgment endorses the FCA’s power to impose client-category limitations on Part 4A permissions and confirms that these limitations are meaningful within the section 39 framework.
2. Potential regulatory gap identified. The Court noted at para 71 that if the FCA considers it appropriate that principals should only appoint ARs competent to deal with all categories of client, “it may well be able to achieve it through its rule-making powers.” This is a clear signal that the Supreme Court sees this as a matter for regulatory policy, not judicial extension of section 39.
3. Enhanced scrutiny of AR arrangements likely. The judgment may prompt the FCA to strengthen the supervisory framework around AR appointments — particularly regarding principals’ obligations to monitor whether ARs are staying within scope. The FCA’s ongoing review of the AR regime (which has been a supervisory priority in recent years) may be informed by this decision.

7. Wider implications

The “what/how” distinction is entrenched

The framework from Anderson v Sense Network – distinguishing between restrictions on what business an AR may carry on (effective scope limitation) and prescriptions as to how it should carry on that business (ineffective as scope limitation) – has now been affirmed and applied at Supreme Court level. Practitioners must work within this framework when drafting and interpreting ARAs.

The judgment provides the following guidance on classification:

“What” (effective limitation)	“How” (ineffective limitation)
Restriction to specific investment types	Requirement to comply with regulatory standards
Restriction to specific investment providers (Anderson)	Requirement to assess suitability of investments
Restriction to specific client categories (Kession)	Requirement to conduct business fairly and honestly

Prophylactic vs remedial purpose of section 39

Lord Richards disagreed with the characterisation of section 39(3) as primarily a ‘long stop’ remedy for clients (disagreeing with HH Judge Waksman QC in Ovcharenko v InvestUK Ltd [2017] EWHC 2114 (QB), which the Court of Appeal had endorsed). Instead, the primary purpose is prophylactic: ensuring that only competent persons, properly supervised, carry on regulated business. This emphasis on the prophylactic purpose of section 39 is significant and may inform the interpretation of other provisions of the AR regime.

Regulatory overkill – a live consideration

The judgment quotes Lord Sumption’s observation in FCA v Asset LI Inc [2016] UKSC 17 that “most regulatory legislation is a compromise between the protection of consumers and the avoidance of regulatory overkill” (para 54). Lord Richards applied this directly, describing the imposition of retail-client responsibility on a principal that had excluded retail dealing as “an element of regulatory overkill, and indeed unfairness” (para 71). This signals a willingness to resist expansive interpretations of regulatory provisions where they would impose disproportionate burdens without corresponding protective benefit.

Implications for the broader AR regime

The decision may encourage more principals to impose explicit client-category restrictions in ARAs, with greater confidence that such restrictions will be effective to limit the scope of their section 39(3) responsibility. This could:

• Reduce the number of ARs authorised to deal with retail clients
• Increase the importance of the FCA Register as a source of information about AR scope
• Shift risk onto retail investors who deal with ARs without verifying their permissions

The FCA may need to respond with enhanced disclosure requirements or gateway controls to ensure retail investors are not left without recourse.

The “authorised person” point

The Court’s clarification (para 83) that a person once authorised is “an authorised person for all purposes” under FSMA – even when acting outside its Part 4A permission – resolves a point of some uncertainty. This has implications beyond the AR context, for example in determining whether a firm can rely on “authorised person” status for the purposes of other FSMA provisions even in respect of activities not covered by its permission.