Compliance reviews
We examine policies, contracts, controls and day-to-day practice, then show where the evidence is thin.
Review your business controlsRegulatory pressure can interrupt your operations and damage trust quickly. Rosie's Legis gives businesses clear advice on compliance reviews, regulator contact and investigations across the South East.
Get the facts in order early.
You get a focused plan, plain English advice and a record of what needs attention first. Fixed-fee review packages can be discussed at the outset.
We examine policies, contracts, controls and day-to-day practice, then show where the evidence is thin.
Review your business controlsPreserve records, scope interviews and keep findings separate from assumptions when a concern is raised.
Discuss an investigationWe help prepare accurate responses, organise supporting documents and manage the tone of regulator contact.
Plan your responseSet out ownership, governance and operating arrangements clearly before an application reaches the regulator.
Explore regulated business supportMap personal data, check notices and retention, and identify practical steps after a suspected breach.
Request a data reviewCheck customer terms, marketing claims and complaint routes before small issues become costly disputes.
Review customer-facing termsFCA expectations affect the whole business, from authorisation material to ongoing monitoring. Rosie's Legis helps fintechs, advisers and payment providers understand the work behind each obligation.
Early advice gives your team a better record and a steadier response when the FCA asks questions.
See regulated sector supportGDPR duties apply to small firms as well as large data-led organisations. The right review shows what personal data you hold, why you use it and where your controls need work.
Typical concerns include weak retention rules, unclear processor contracts, poor breach records and privacy notices that no longer describe actual practice.
We identify the personal data, systems, suppliers and teams involved.
We compare notices, contracts, records of processing and retention rules with actual use.
You receive a practical order of work, with urgent issues separated from longer-term improvements.
We help turn recommendations into updated documents, owner actions and repeatable checks.
Contact us before sending a rushed response. The first steps affect the records, people and explanations that follow.
Client feedback
"We knew what to preserve, who to speak with and what the regulator needed from us."Yueling B.
Save the letter, email and attachments. Record deadlines and the named contact.
Give one person responsibility for regulator contact while the facts are checked.
Preserve relevant files, messages and logs. Avoid changing documents after the request.
We can scope an internal investigation, prepare correspondence and advise on next steps.
One business can face several rulebooks. We help connect the legal duties to the way your people actually work.
Governance, patient information and supplier responsibilities need clear ownership.
Review operating procedures, consumer information and incident records.
Keep customer duties, licensing conditions and complaints processes aligned.
Check privacy, platform rules and commercial arrangements as products change.
Prepare for FCA obligations, reviews and correspondence with a documented plan.
Tell us what has changed, which regulator is involved or where your team feels exposed. The initial discussion will focus on scope, urgency and the documents worth gathering.
Review it at least annually and whenever your products, suppliers, ownership or regulator expectations change. A focused review after an incident can identify gaps that a routine calendar review misses.
Triggers can include customer complaints, suspicious activity reports, control failures, inaccurate regulatory returns or information identified during supervisory work. Early legal advice helps preserve a reliable record and set a response plan.
Some organisations must appoint one, while others need clear responsibility for data protection without a formal DPO. The answer depends on the nature, scale and regularity of processing, so we assess the actual operation.
A focused review can take several working days once the key documents and responsible people are available. Larger reviews take longer where several entities, systems or regulators are involved.