£2m Lost, Two Guilty Pleas: What Every SME Should Learn About Internal Controls

A financial adviser spent her clients' money funding an extravagant lifestyle. Her operations manager helped falsify the documents that hid it. Four people lost £2 million. Nobody inside the business stopped it for four years.

This isn't a story about one bad actor. It's a story about what happens when internal controls don't exist, or exist only on paper.

What actually happened

Kerry Nelson, director of Nexus Independent Financial Advisers and Nexus Investment Managers, and Jacqueline Stephens, the firms' business operations manager, have pleaded guilty to fraud at Portsmouth Crown Court. According to the FCA's announcement, the pair defrauded clients between January 2019 and January 2023, using false documents to cover their tracks. Nelson also admitted a money laundering offence.

Both firms were FCA-authorised. Neither was permitted to hold or control client money. That permission structure existed precisely to prevent this kind of fraud. It didn't matter, because the people responsible for upholding it were the ones breaking it.

The FCA stepped in on 25 January 2023, restricting both firms from regulated activity. The High Court placed them into administration the next day. By then, the money was already gone.

Why this matters beyond one firm

It's tempting to treat this as an isolated case of two dishonest individuals. That reading misses the point.

Fraud like this doesn't happen despite controls — it happens because controls were weak, informal, or trusted too blindly. A director and an operations manager colluding over four years means nobody else in the business had the authority, visibility, or independence to raise a flag. That's a structural failure, not just a moral one.

Therese Chambers, the FCA's executive director of enforcement and market oversight, called it "a serious breach of trust." She's right. But trust isn't a control. It's what you rely on when controls are absent.

Regulators are watching governance, not just numbers

This case lands at a moment when the regulatory conversation is shifting. The Bank of England's own Market Participants Group minutes from September 2026 show senior market figures increasingly focused on trust, resilience, and governance quality — not just headline financial metrics.

The message from both the FCA and the Bank of England is consistent: oversight isn't a box-ticking exercise. It's the thing standing between a functioning business and a four-year fraud that nobody noticed until clients had already lost everything.

What SMEs should actually do

You don't need to be a regulated financial firm to learn from this. Most small and medium businesses have the same structural gap: too much trust concentrated in too few people, with too little independent verification.

Here's where to start:

Separate authorisation from execution. The person who approves a payment should not be the same person who processes it.
Audit regularly, not reactively. Internal reviews shouldn't only happen after something feels wrong.
Build in external checkpoints. An outside accountant, auditor, or compliance adviser catches what internal staff are incentivised to miss.
Document and verify, don't just trust. Written policies mean nothing if nobody checks whether they're followed.
Make reporting safe. Staff need a route to flag concerns without fear of retaliation from the person they're flagging.

None of this is complicated. It's also exactly what was missing at Nexus.

The cost of getting this wrong

Nelson and Stephens will be sentenced on 10 December 2026. The FCA will pursue confiscation proceedings against Nelson under the Proceeds of Crime Act 2002. That's a legal process that could take years and may never fully recover what clients lost.

For the four people defrauded, recovery — financial or otherwise — is uncertain. For every other business watching this unfold, the lesson is available right now, at no cost.

Key takeaways

A £2m fraud at Nexus IFA happened because internal controls failed, not because fraud is unavoidable.
Authority without oversight is a liability, regardless of how much trust exists between colleagues.
Regulators, including the Bank of England, are placing growing weight on governance and trust as risk factors — not just financial performance.
SMEs should separate approval and execution duties, audit proactively, and create safe channels for staff to raise concerns.
Waiting until something feels wrong is already too late. Build the checks before you need them.