THE OVERSIGHT FALLACY

Beneath the true-sale analysis, the non-consolidation opinion, the non-petition language and the limited-recourse provisions sits an assumption so basic that nobody writes it down: the administrator will still be there tomorrow. The SPV is bankruptcy-remote from its sponsor. It is not, and has never been, operationally insulated from the failure of its own administrator. Yet practically every structured finance offering memorandum rests on that silent premise. Not a clause — a premise.

Investors read the structural protections and move on. Rating agencies model the cash flows and issues the ratings. Lawyers copy the substitution mechanics from last quarter’s deal and change the date. Nobody stops. Nobody asks the only question that decides whether the structure survives contact with reality: who is checking that the operator of this machine is itself sound — and what happens to hundreds of vehicles at once when it isn’t?

I structure non-securitisation, single-tranche asset-backed securities (ABS) deals for a living — the edge-case stuff nobody writes textbook chapters about. In No. 02 of this series, The Structural Paradox of Structured Finance, I proposed a three-pillar reform architecture and deliberately kept each pillar at blueprint level.1 This piece takes a closer look at the second pillar, prudential oversight. It is not a detour. The first pillar (the bankruptcy-remote Administrative Agent, or AA) and the third (independent governance with operational teeth) each assume something this pillar supplies: administrators that are examined for the things that can actually kill a deal.

§1

Strip the legal terminology away and look at what is actually happening. A special purpose vehicle is, operationally, a company that does nothing by itself. It has no employees, no office of its own, no IT systems, no payroll. Every function a living company performs — accounting, payments, filings, noteholder communications, tax compliance, board administration, etc. — is performed for it by the CSP. In the typical structure the CSP holds the records, controls the bank mandates, files the accounts and convenes the meetings. The SPV’s legal isolation from its sponsor is real. Its operational dependence on its administrator is total. Figure 1 shows that structure, and where supervision does and does not attach to it.

Now consider what every structural analysis in the deal quietly assumes: continuity of administration. The separateness covenants assume someone is maintaining separate books, records and bank accounts. The cash-flow model assumes someone shows up to move the money. The priority of payments assumes someone applies it. The market treats the probability of administrative discontinuity as effectively zero — not because anyone has measured it, but because, to my knowledge, no regulator, rating criterion or offering document has ever required anyone to.

No. 02 walked through how an administrator disruption could propagate into a credit event. I will not repeat that here. The question this piece asks first: who, if anyone, is charged with asking whether the disruption is likely?

That is not risk management. That is an unexamined assumption wearing risk management’s clothes.

§2

Ask a practitioner whether CSPs are regulated and, in my experience, you will usually get a confident yes. Press on what that means and the answer resolves to something much narrower: registered for anti-money-laundering supervision. In the UK, that has meant registration under the Money Laundering Regulations 2017 and supervision by HMRC or one of 22 professional body supervisors — 23 supervisors in all, as at October 2025, in a regime the Government itself calls “complex and disjointed.”2 Under the Economic Crime and Corporate Transparency Act 2023, firms that file at Companies House on behalf of clients will have to register as Authorised Corporate Service Providers (ACSPs); on Companies House’s transition plan as updated on 5 August 2026, that will not happen before November 2027, and registration has been open to AML-supervised firms since March 2025. It is a regime built to protect the integrity of the register, not the solvency of the filer.3

Here is the category error, stated plainly. AML supervision asks one question: are you facilitating financial crime? Prudential supervision asks a different one entirely: can you keep doing your job tomorrow? A CSP can be impeccably AML-compliant and simultaneously thinly capitalised, thinly insured, operationally fragile and one acquisition away from deprioritising your SPV’s administration. The first question is examined. So far as I can identify, the second is examined by no one with the power to insist on an answer. Figure 2 sets the two side by side.

Read the regulation closely and the gap is narrower, and sharper, than the word “regulated” suggests. Regulation 12(2) of the Money Laundering Regulations 2017 makes a firm a trust or company service provider only if it provides specified services to other persons by way of business: forming companies, acting as (or arranging for another to act as) a director or secretary, providing a registered office or business address, or acting as a trustee or nominee shareholder. The obvious rejoinder, that the CSP supplies the SPV’s directors and registered office and is therefore regulated, is right as far as it goes, and that is the point. What attracts registration is the address, the officer appointment or the formation service, sold as a service. On my reading it is not the waterfall, the bank mandates or the ledger. The qualifier does the work: an address supplied to an SPV as a service falls within the regime, while premises the SPV leases in its own name do not, and nothing in the law requires the SPV to buy the service rather than lease the office. In practice a vehicle with no premises of its own buys the address, and the directors, from its CSP.3

For UK-incorporated Issuers, two further features of the orphan structure bear on the same gap. I offer them as structural observations rather than legal conclusions, because scope in any transaction turns on the documents. The first is the ownership layer. The Issuer’s shares are typically held pursuant to a private charitable trust by a Share Trustee, and it is tempting to assume that the Share Trustee supplies the missing regulated party. It may not. Where it is a professional trust company it is itself within the definition, supervised for financial-crime risk and nothing more. Where it is not, because it may not act by way of business or may act pursuant to an exemption, there may be no supervised party at the ownership layer at all. The trust deed is private; as far as I am aware, an investor has no public means of telling which case applies. The second is formation. Directors’ identity verification has been a legal requirement since 18 November 2025,3 and, as I understand the regime, a natural person director who has verified their identity with the UK Companies House can incorporate the vehicle or its holding company directly, on their own behalf and supplying their Companies House Personal Code as evidence of verification, without an ACSP, including once ACSP registration becomes mandatory for third-party filing agents. ACSP status is a gatekeeper for intermediaries acting for others; it is not a structural requirement of setting the vehicle up. In practice an intermediary, whether a law firm or a CSP, will usually form the vehicle and is then supervised for that formation service, though not for the administration that follows. The point is that the law does not require one.

None of this suggests the regime is badly drawn. It suggests it was drawn to answer a different question. Registration follows the services a firm sells, not the dependence investors place on it. The address, the officer appointments and the filings sit inside the perimeter; the administration on which the vehicle actually depends does not. And an orphan with no parent, owned on a private trust, leaves no owner with an obvious commercial reason to ask. These are questions for regulatory review, not determinations. But they point one way: the orphan architecture that gives the vehicle its bankruptcy remoteness is the same architecture that leaves its operating layer outside the perimeter the market assumes is there.

Neutral and independent were not the same word in No. 01. Supervised and sound are not the same word either. Structured finance keeps treating registration as regulation. They are not. Not even close.

§3

The UK’s AML supervisory reform is the perfect case study in how the illusion sustains itself, because it is a genuine, welcome reform that will nonetheless be misread as solving a problem it does not touch.

On 21 October 2025, HM Treasury confirmed that the FCA will become the single professional services supervisor for AML/CTF purposes, covering legal service providers, accountancy service providers and trust and company service providers: approximately 60,000 firms, at that date spread across HMRC and 22 professional body supervisors.2 Timing depends on legislation and funding; as at 22 September 2026, the FCA did not expect to begin taking on supervision until autumn 2028, with a phased transition completing around 2030.4 In June 2026 HM Treasury set out the design of the new regime: a public register of firms maintained by the FCA, regulation 58 fit-and-proper tests extended to legal and accountancy providers (trust and company service providers are already within them), a risk-based supervisory framework and new powers to appoint skilled persons and issue directions, with some of the key enabling provisions included in the Financial Services and Markets Bill.5

All of that is real progress on financial-crime supervision. And the headline it generates will be some version of “FCA to supervise trust and company service providers.” Market participants will file that under regulated now and move on — the same way they filed “independent director” under governed in No. 01. But read the scope. It is AML/CTF supervision. On the published proposals it is designed to examine whether firms have adequate financial-crime controls. It is not designed to set minimum operational-resilience standards, to require capital adequacy or continuity planning, to mandate professional indemnity insurance, or to test whether a CSP administering hundreds of vehicles could be replaced in an orderly way if it failed. The register will list firms; nothing I have seen suggests it will map which SPVs they administer, so concentration stays invisible.

The reform tightens the financial-crime perimeter. The prudential perimeter — the one whose absence lets a CSP failure turn into technical defaults across dozens of deals — still does not exist. If anything, the illusion gets stronger: the market will now believe the administrator is supervised in the full sense, and administrative continuity risk will stay unpriced with even more confidence than before.

I want to be precise about how far this claim goes. The UK reform is good policy on its own terms, and my argument is not that it should not happen. Nor is it a first step towards something wider: the Government has said in terms that the FCA’s role will be restricted to AML/CTF supervision of professional services firms, and that its powers under the Regulations can be used only for that purpose.5 My argument is that the reform answers a different question from the one structured finance needs answered, and that the market is already primed to confuse the two.

§4

Below are six structural issues, stated as plainly as I can. Issues 1 and 5 rest on public documents. Issues 2, 3, 4 and 6 rest on practitioner observation and are offered as testable hypotheses, not findings, because the data needed to test them is not public — which is itself part of the problem.6

1. No prudential supervisor exists for CSPs. In the UK market this series principally covers, I have not identified any authority charged with the operational resilience, financial standing or continuity of the firms that administer SPVs. Cayman, by contrast, licenses company managers and corporate services providers through the Cayman Islands Monetary Authority (CIMA), under a regime that, by statute, includes financial-resource, insurance and fit-and-proper requirements.7 CIMA’s framework therefore provides a concrete example of a corporate-services regime incorporating financial and professional safeguards of the kind proposed here. I have not identified an equivalent prudential framework specifically applicable to UK CSPs performing comparable corporate-administration functions.

2. Insurance is not mandated at any meaningful scale. I have not identified a regulatory regime that requires a CSP’s professional indemnity cover to bear any relationship to the liabilities it administers; where PII is required at all, it appears to be sized to the firm’s professional practice, not to the vehicles it runs. Cayman also requires licensed firms to hold professional indemnity insurance, though I have not seen it calibrated to administered liabilities.7 When an administrator’s negligence or failure triggers a technical default — missed payments, missed filings, missed noteholder communications — recovery is a function of whatever cover the CSP happened to buy and of the liability caps in the administration agreement, and in the administration agreements I have reviewed the contractual claim belongs to the Issuer, reaching noteholders only indirectly through the security. I have not identified a public disclosure framework that routinely requires disclosure of the administrator’s insurance programme. In the offering documents I have seen, that information is not disclosed.

3. Concentration is unobservable. I have not identified a public register that maps SPVs to their administrators in the role that matters: company registers record officers and registered offices, not who performs the administration. In my experience a small cluster of large CSP groups administers a very large share of UK quoted-Eurobond SPVs; No. 02 explains why I offer that as practitioner judgement and not as a market-share statistic. A failure, cyber event, sanctions designation or change of control at one such provider would propagate across many unrelated deals at once: correlated operational risk that the market cannot price because it cannot see it. I frame this as a testable hypothesis. The data to quantify it is not public.

4. Substitution provisions are provisions, not plans. Every administration agreement contains termination and replacement mechanics. I am aware of few, if any, that have been tested end to end at scale, under time pressure, against a hostile or insolvent outgoing administrator, disputed fees, and data that lives in proprietary systems. Noteholder consent mechanics, trustee cooperation and data portability are assumed to work because they have never had to. The deals assume substitution never happens; until proven otherwise, the provisions are decoration.

5. Registration is mistaken for regulation, and the coming reform will entrench the mistake. A CSP can pass every AML examination ever devised and still be the single point of failure for hundreds of vehicles. The FCA transition is exactly the moment the market is most likely to stop asking: once TCSPs are described as FCA-supervised, the prudential gap becomes harder to see and harder to argue for.

6. Gatekeeping is unobservable. In my experience, onboarding, service-provider selection and independent-director sourcing run largely through informal relationships, in a market at times described from within as an “old boys’ club”, and in the absence of a conduct or prudential regulator that network has effectively defined “market practice” on CSP governance, with no requirement to show its working. A refusal to onboard is rarely explained beyond “risk appetite”, “jurisdictional complexity” or “compliance de-risking”, language that can just as easily launder a decision to preserve an existing commercial relationship. Because nothing records declined requests, nothing can show whether refusals are principled or merely protective. In my experience the UK and European structured finance community is slow to change and slow to admit people and firms from outside its established networks, and some older assumptions about who belongs in the room persist. I am currently unable to find any public data on the matter, and that is the point. But the consequence is structural, not just cultural: a closed network narrows the pool of administrators, trustees and independent directors that deals actually draw on, which repeats the same names across many vehicles (§4(3)) and thins the pool of credible replacements on which any substitution depends (§4(4)). A closed network does not announce itself. It just never has to explain itself. No. 01 raised the gatekeeping side of this from the practitioner’s side; I frame all of it, as there, as a distinct hypothesis, not a finding.

§5

In much of finance, critical third parties are supervised or contracted for resilience — except here, for what is arguably the single most critical one.

Banks’ material outsourcing is governed by dedicated regimes, the Prudential Regulation Authority’s (PRA’s) outsourcing and third-party risk management expectations and, in the EU, Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA), precisely because regulators learned that a bank is only as resilient as its critical vendors. The UK has now extended that logic beyond banks. Its critical third parties regime took effect on 1 January 2025, and the first designations came into force on 13 July 2026, bringing four major cloud and technology providers under direct oversight by the Bank of England, the PRA and the FCA. The FCA has expressly identified the systemic risk that can arise from concentrated dependence on common third-party providers.8

I am not suggesting that a CSP meets the statutory designation threshold today. I do not know, and without a register nobody can. That is the point. Designation depends on someone being able to see a dependency. Nobody can see this one.

In securitisation’s own backyard the contrast is sharper. Rating agencies assess servicers — operational reviews, advancing obligations and backup servicing arrangements are a familiar feature of RMBS and auto ABS. The market asks for a backup for the entity collecting the mortgage payments. And then it accepts, in many structures, a single un-backstopped administrator for the SPV itself — the entity without which nothing in the structure functions at all. The servicer, in many deals, has a backup. The administrator has a clause.

None of this is exotic. Most other critical dependencies in structured finance are examined, insured or backed up. The administrator is the exception, and, as with the independent director in No. 01, the exception has survived largely because nobody has had to explain it.

§6

Predictably, the industry falls back on a few standard responses to preserve the status quo.

Q1 “CSPs are sophisticated, well-capitalised businesses.” Sophistication is not supervision. Being well capitalised today is not being committed to stay so: I am not aware of anything in the UK regime that requires a CSP to hold resources against the operational liabilities it carries for others, or restricts a parent from upstreaming them. And the largest, most sophisticated CSPs are precisely the concentration risk. Their failure is the correlated event.

Q2 “Deals have substitution provisions.” Provisions, not plans — see §4(4). A termination clause that has never been exercised under stress is a hypothesis, not a control. Ask the trustee of any live deal when administrator substitution was last tested end to end. In my experience, the silence is instructive.

Q3 “Nobody’s actually been hurt by this.” Yet — and we might not know. An administrator failure resolved quietly, by a back-channel transfer or a sponsor’s rescue, generates no case law and no headline, and there is no register or incident reporting that would show it. Absence of a public blowup is not absence of risk. It is absence of a stress test with a witness.

Q4 “The FCA will grow into this.” Not on the Government’s stated design: HM Treasury has said the FCA’s role will be restricted to AML/CTF supervision of professional services firms,5 and a prudential mandate is not a larger version of an AML mandate: it needs different objectives, different powers and different expertise, and the AML reform itself shows how many years the legislative and funding path takes. If the market waits for the FCA to grow into it, the 2028–2030 window closes with the scope already set. Better to argue for the mandate while the design is open.

Q5 “The Administrative Agent from No. 02 makes this unnecessary.” It makes much of it less urgent, and I would rather see it adopted than not. But structure and supervision are complements. An AA that can replace a failing CSP still needs a pool of replacements that are sound, insured and examinable, and it still needs someone looking at the AA. Structure without supervision leaves the vendor pool unexamined. Supervision without structure leaves every deal exposed to its vendor’s failure. The market needs both.

Q6 “The market has moved on.” Parts of it may have, and I would be glad to be wrong. But nothing measures it: no register shows who administers what, no log shows who was declined and why, and no supervisor asks. Change that cannot be observed cannot be credited, and in my experience older assumptions about who belongs in this market have outlasted more than one round of good intentions.

None of this is a knock on CSPs, and it is not a knock on the people doing this work. Most administrators are conscientious professionals operating exactly as the market’s incentives reward. This is not personal. It is structural — and structural problems are the most dangerous kind precisely because nobody feels it is their job to fix them. Investors assume the regulators checked. Regulators assume the market would have said something. The market assumes the administrator’s owners have kept the resources in place. Round and round it goes.

§7— The reform blueprint

The fix is not complicated. Inconvenient, sure; but not complicated. If the administrator is systemically important to every SPV it touches, then supervise it as something that matters — for the prudential questions, not just the financial-crime ones.

A note on what I am and I am not proposing. In No. 02 I argued that CSPs should be supervised on a professional-services model, closer to law and accountancy firms than to banks: AML supervision, mandatory professional indemnity insurance, professional-body-style oversight and dual firm-and-individual accountability. I hold to that, and I am not proposing a bank-style capital regime for administrators. What this piece adds is a specification of what that supervision must be able to ask, because the professions’ model only works if the supervisor’s questions include the ones AML supervision never will. Five elements follow. Figure 3 maps them to the issues in §4.

Element 1— A supervisor with a conduct and prudential mandate.

License CSPs that administer rated or listed SPVs, or SPVs above an administered-volume threshold. Three layers:

Firm-level licensing. Minimum operational-resilience standards, data-portability mandates, recovery and orderly wind-down planning, periodic examination of business continuity, and mandatory logging of objective, non-discriminatory onboarding criteria and declined service requests subject to supervisory audit, with aggregate, anonymised statistics on applications received, accepted and declined published so that the market can see whether the door is open — proportionate, but real.

Individual professional certification. Senior administrators and persons discharging managerial responsibilities are subject to fit-and-proper standards modelled on the Senior Managers and Certification Regime (SM&CR), ensuring they carry personal regulatory risk — including suspension or revocation of approval — if they participate in governance capture, unmanaged structural conflicts, or administrative suppression. In law and accountancy, individual practitioners can face licence revocation, public censure and personal fines if they prioritise commercial relationships over professional conduct rules. The same logic applies here.

Whistleblowing and escalation pathways. Formal channels through which administrative personnel or independent board members can report governance capture, procedural failures or unexplained onboarding refusals directly to the supervisor, without commercial reprisal. The Government regards existing whistleblowing protections as sufficient for AML/CTF disclosures, with the FCA as the prescribed authority for them,5 but nothing equivalent is framed around governance capture or unexplained onboarding refusals, and the gatekeeping problem identified at §4(6) is reinforced by that absence.

Whether that mandate sits with the FCA under a second remit, with a professional body supervisor, or with a new body is a question for the 2028–2030 design window. What matters is that someone is charged with asking.

Element 2— Mandatory professional indemnity insurance and a statutory duty of care.

Cover levels set by reference to the liabilities under administration, not the administrator’s convenience, and coverage disclosed to trustees and noteholders in offering documents, so the market can finally price what it currently assumes. Alongside PII, the reform should introduce an explicit statutory duty of care owed by CSPs to secured noteholders during distress, eliminating the current moral hazard in which administrators rationally prioritise their own indemnification position and arranger relationships over waterfall execution. I am aware of no such general statutory duty, which is why No. 02 recorded that CSPs facing a dispute may reasonably put their own interests first.

Element 3— A public register mapping SPVs to administrators.

Extend the register concept beyond firm names to deal-level relationships: which administrator runs which vehicles. Concentration becomes visible, measurable and, for the first time, diligenceable by investors. Each entry should also record which authority supervises the firm and for what purpose (AML/CTF only, or conduct and prudential as well), so that the label stops doing work it has not earned. What gets measured gets managed; what stays invisible gets assumed away.

Element 4— Fit-and-proper scrutiny of ownership and control.

The supervisor should ask whoever ultimately controls the administrator whether they are financially sound and committed to continuity, and require advance notification of changes of control to trustees. The FCA reform tests something different: regulation 58 already applies fit-and-proper tests to trust and company service providers and to their beneficial owners, officers and managers, and is being extended to legal and accountancy providers, but it assesses integrity, competence and compliance history for AML purposes.5 A change of control at a concentrated CSP is a market-wide event wearing a corporate-action costume.

Element 5— Transaction-level resilience requirements.

Backup-administrator provisions with tested data portability: not clauses, drills. Concentration and insurance disclosure in offering memoranda: who administers this SPV, how many others it and its affiliates administer, and what the substitution plan actually is. Where an Administrative Agent structure of the kind proposed in No. 02 is adopted, much of this is delivered structurally; where it is not, this is the interim mitigant. Either way, someone needs to be asking whether the drill happened.

§8— Who should read this and how

Arrangers and trustees: you are the parties who will operate the substitution mechanics when — not if — they are ever tested. Commission the drill before the event does. Ask your administrators for their insurance towers and continuity plans, and put the answers in the deal file. None of this requires legislation; the disclosure above can be a deal term tomorrow.

Institutional investors: administrative continuity risk is currently treated as zero in the SPVs you hold. It is not zero. Ask for administrator concentration and insurance disclosure as a standard part of pre-trade diligence, and treat their absence as information. This paper should not be read as evidence that administrator failures are already causing defaults; it is a case that no one is positioned to find out.

Regulators and policymakers: the FCA’s new AML mandate is necessary and welcome, and it is not prudential supervision. Close the actual gap: a conduct and prudential regime for CSPs, with resilience standards, personal accountability and a deal-level public register. The 2028–2030 transition window is the moment to design it, before the market files TCSPs under supervised and stops asking. Formal rule-making would, of course, need empirical data and impact assessment beyond practitioner observation; the register proposed here is how that data gets created.

Academics and researchers: five testable hypotheses are offered here: CSP market concentration at the SPV level; the historical incidence of administrator substitution events and their costs; the relationship between PII coverage levels and recovery outcomes; the incidence and stated grounds of declined onboarding requests; and how open the administrator, trustee and independent-director pools are to new entrants. The data is not public. That is itself a finding worth publishing.

Every structured finance transaction assumes the administrator will still be standing tomorrow. Nothing in the regulatory architecture requires it to be.

So next time a prospectus hands you pages of bankruptcy-remoteness engineering, don’t just nod along. Ask the question the documents never answer: supervised — for what?

References

Legislation and Regulations

Policy Documents, Statements and Guidance

Notes

I welcome thoughts, counter-perspectives and practitioner feedback on the arguments advanced in this article. If you arrived here via LinkedIn, feel free to join the discussion directly on the original post. Alternatively, you can share your observations via the Contact Form or by emailing me directly at peterson@petersonfrederick.com.

About Peterson

Peterson Frederick is Chairman and Interim CEO of Northern Providence Investments (NPI), a Montreal-based asset management firm specialising in socially responsible investing (SRI) for institutional investors. His practice centres on bespoke, non-securitisation private credit and ABS structures — bankruptcy-remote SPVs, limited-recourse facilities, and ESG-integrated frameworks — aiming to deliver resilient, predictable yields tailored for Tier-1 pension funds and insurers across UK/EU markets. Broken Structured Finance: Where We Keep Getting It Wrong is his ongoing series examining the governance and market assumptions structured finance treats as settled — how embedded market architecture, administrative design, and institutional practice shape who gets access and on what terms.

Mr. Frederick holds a Master of Business Administration (MBA) with a concentration in Corporate Finance from HEC Montréal and a graduate diploma in Treasury Finance from McGill University. He also holds double Bachelor of Science degrees in Mathematics & Statistics and in Economics from Concordia University and double undergraduate certificates in Risk Management and Public Relations Management also from McGill University. Mr. Frederick obtained a Certified Risk Manager (CRM) designation from the Global Risk Management Institute in 2005. Further details and other credentials are available at petersonfrederick.com.