What the Seychelles FSA Corporate Governance Code Actually Requires Before Year End 2026
Most operators handling a Seychelles FSA licence in 2026 already know the Code of Corporate Governance is in play. Fewer have sat down and worked through what it concretely demands before the 31 December 2026 Annex 1 deadline.
This piece does that. It covers the requirements that are most likely to catch firms off guard — whistleblowing infrastructure, the annual risk assessment submission, and the tightened audit and disclosure expectations — and offers a practical sequence for getting ready without a last minute scramble.
The “apply or explain an alternative” structure of the Code is worth understanding clearly. The nine principles — covering board responsibilities, independence, composition, corporate culture, remuneration, risk oversight, reporting, internal and external audit, and conflict management — are not optional for smaller firms. Entities that cannot fully implement a principle must explain what they are doing instead, and that explanation has to hold up under regulatory scrutiny.
Whistleblowing: more than a mailbox
The Code requires the board to ensure the company has an independent and confidential mechanism through which employees or shareholders can raise concerns — without fear of retaliation — about potential breaches of the company’s code of ethics or Seychelles law.
That is an explicit governance obligation, not a soft recommendation.
In practice, meeting this standard means having a written policy, a defined intake and investigation process, and a channel that is genuinely independent from line management. It also means being able to show the regulator, if asked, that the mechanism actually functions — which requires some form of board level oversight and a paper trail of how concerns are received and handled.
A shared email address that routes to the compliance officer does not meet this standard. An external or board monitored channel, documented policy, and clear escalation path does.
The annual risk assessment is a regulatory submission
This is one of the requirements firms most frequently misread as internal housekeeping.
The Code calls for the board to assess the company’s key risks annually — including likelihood, potential impact, and the controls or mitigating measures in place — and then submit that assessment to the FSA as part of the Institutional Risk Assessment. It is a formal regulatory deliverable, not just an internal presentation the board reviews and files away.
The scope of what counts as relevant risk is also broader than many operators assume. AML and financial risk sit within it, but the Code explicitly references threats to the business model, cybersecurity, performance, solvency, liquidity, reputation, technology, compliance, and regulatory exposure. For VASPs, that framework extends naturally to custody architecture, outsourced infrastructure, wallet security, and transaction monitoring. For securities dealers, it tends to reach execution quality, IT continuity, liquidity arrangements, and third-party service provider dependencies.
Getting this submission right is not about writing more. It is about the board being able to demonstrate it has actually engaged with these questions — not delegated them downward and signed off on a summary.
Audit and disclosure: the standard has moved
Two areas of the Code have materially raised the bar on year end reporting.
Internal audit. Companies are expected to have a functioning internal audit structure with defined oversight and reporting lines. Where that function does not exist, the entity must fully explain why to the regulator and describe what alternative assurance mechanisms are in place. “We are too small” is not, on its own, an acceptable answer under the Code. A credible alternative explanation is.
Audit committee. The Code requires an audit committee composed entirely of directors, with at least one member holding recent and relevant financial expertise. That committee’s mandate covers financial reporting integrity, key accounting policies, audit scope, external auditor independence, non-audit service fees, and management responses to audit management letters. Where no audit committee exists, these responsibilities fall to the full board — but the expectation of substantive engagement does not go away.
Disclosure in the annual report. The board needs to describe the audit committee’s work, explain how significant audit issues were addressed, and include a summary of the external auditor’s findings. If an auditor resigns, that has to be disclosed to the FSA along with the board’s position on replacement.
Taken together, these requirements make it significantly harder to treat audit as a year end formality with a clean sign off and no further commentary.
31 December is not the start date
A surprisingly common assumption is that 31 December 2026 is when preparation needs to begin. It is not. The Code became effective on 1 January 2026. Year end is when the first Annex 1 form is due — along with the policies, board minutes, committee records, and risk documentation that give the filing substance.
Firms that treat the next several months as a waiting period will find themselves trying to reconstruct governance evidence in Q4 rather than generating it organically through normal board and audit cycles. That is both harder and less convincing.
Where to start
A governance gap analysis across the nine principles is the most efficient starting point. From there, the sequencing that tends to work in practice is: board adopts an implementation roadmap → whistleblowing policy and conflicts policy updated → risk assessment framework built or documented → internal audit or alternative assurance arrangements confirmed → audit committee terms reviewed → Annex 1 evidence pack assembled ahead of the filing deadline.
None of that needs to be done all at once. But it does need to be started now.
A note on what this actually signals
The Seychelles governance regime in 2026 is part of a broader pattern across offshore financial centres: the regulatory question is no longer just whether an entity holds a valid licence, but whether there is real governance behind it. Banks, institutional counterparties, and auditors are increasingly asking the same question when they conduct their own due diligence on Seychelles licensed firms.
That is the market reality that makes this compliance exercise matter beyond the regulatory filing itself.
FinPro Consulting supports Seychelles licensees with governance gap analysis, board and committee structuring, annual risk assessment preparation, audit disclosure review, and year end compliance health checks. If you want to use 2026 productively rather than reactively, earlier is better.
