FCA review shows some firms take up to four months