$3 Billion in the Dark

In June 2024, a firm introduced a new order management platform. It worked exactly as intended: trades executed, clients served, revenue generated. The compliance system also worked exactly as intended: it monitored every platform it knew about. The problem was nobody told it about the new one. For four months, $3.05 billion in CFD trades moved through the firm without a single alert reaching compliance. The FCA found out. It took them nine months from opening to fine. The firm had already stopped selling CFDs.

Market Abuse Surveillance: The FCA Fines Dinosaur Merchant Bank £338,000 for a Gap Nobody Closed

On 27 March 2026, the FCA fined Dinosaur Merchant Bank Limited (DMBL) £338,000 for failing to maintain effective systems and controls to detect and report suspicious trading in its CFD business. Between June and October 2024, trades with a corresponding asset value of approximately $3.05 billion were executed via a new order platform. Those trades were not captured by the firm's automated market abuse surveillance system. No suspicious transaction reports were filed. No alerts were generated. The platform and the surveillance system simply never met.

DMBL breached Article 16(2) of the UK Market Abuse Regulation (UK MAR), which requires firms to have effective systems to detect and report suspicious transactions. It also breached SYSC 6.1.1R, the Senior Management Arrangements, Systems and Controls chapter of the FCA Handbook, and Principle 3 of the FCA's Principles for Businesses. The firm cooperated fully and received a 30% discount. Without it, the fine was £482,900. The FCA noted the case was concluded in nine months, citing this as evidence of its drive to accelerate enforcement pace.

For any firm running automated order infrastructure, this case is not about a rogue bank. It is about what happens when new technology is deployed and existing governance frameworks are not updated to include it. The SM&CR accountability sits with the named Senior Manager responsible for market abuse surveillance. Delegating the task of maintaining surveillance coverage to a technology team does not transfer that accountability. SYSC 6.1.1R requires the Senior Manager to ensure adequate systems exist, not to assume they do. If a new platform goes live, the question is not whether compliance was informed. The question is whether the named accountable individual verified, in writing, that the surveillance perimeter was extended before the first trade was executed.

Most news outlets tell you what to think. The Flyover just tells you what happened.

Quick, fact-focused coverage across politics, business, sports, tech, science, and more — delivered free to your inbox every morning.

No paywall. No political agenda. No endless scrolling.

Join over 2.3 million readers who start their day informed, confident, and ahead of the curve.

Join Free Today

Motor Finance Redress: £7.5 Billion, 12.1 Million Agreements, and Three Months to Assess Them All

On 30 March 2026, the FCA published PS26/3, its final Policy Statement on the motor finance consumer redress scheme. Twelve point one million credit agreements made between 2007 and 2024 are now eligible for compensation, with an average payout of approximately £830 per agreement and a total scheme value of £7.5 billion. Lenders have until 30 June 2026, the end of the implementation period for post-April 2014 agreements, before the three-month clock for contacting and compensating consumers begins. The same day, the FCA, Solicitors Regulation Authority, Information Commissioner's Office, and Advertising Standards Authority launched a joint taskforce to crack down on poor practice by claims management companies exploiting the scheme.

Lenders affected are primarily motor finance providers and banks with historic discretionary commission arrangements between brokers and dealers. The FCA has already removed or amended 800 misleading adverts and secured fee reductions from CMCs protecting over 500,000 consumers. The scheme is free to use for consumers, and the regulator has made clear that those using third-party claims managers may lose up to 30% of any compensation. Firms will be required to proactively identify affected agreements, assess them consistently, communicate outcomes clearly, and handle disputes under a structured process.

The AI governance implication here is operational and underexamined. Twelve point one million agreements cannot be assessed manually at scale. Lenders will use automated decisioning systems to determine eligibility, calculate redress amounts, and generate consumer communications. Consumer Duty requires that firms act in good faith and deliver good outcomes. When an automated system is making those determinations, the SM&CR owner for complaints or customer outcomes must be able to demonstrate how the model was validated, what assumptions it applied, how edge cases were handled, and how the output was reviewed before consumers were contacted. The FCA's scheme has a defined structure. Any lender whose redress calculation engine produces inconsistent outputs will face both regulatory challenge and legal exposure from CMCs whose business model depends on finding exactly those inconsistencies.

Both stories this week describe the same failure in different contexts. A firm deploys new infrastructure, whether a trading platform or a decisioning engine, and the human governance layer does not move with it. In the Dinosaur case, a new order system went live and nobody verified the surveillance perimeter extended to cover it. In the motor finance case, lenders are now required to run mass automated redress assessments at speed and must be able to account for every decision those systems make.

The gap is not technical in either case. It is a failure of named human accountability. The SM&CR framework exists precisely to close this gap. It requires specific individuals to take ownership of specific risks. What this week demonstrates is that firms continue to treat that ownership as procedural rather than active. Active ownership means a Senior Manager asking, before any new system goes live: is my governance framework updated to cover this, and can I prove it?

You're spending 40 hours a week writing code that AI could do in 10.

While you're grinding through pull requests, 200k+ engineers at OpenAI, Google & Meta are using AI to ship faster.

How?

The Code newsletter teaches them exactly which AI tools to use and how to use them.

Here's what you get:

Sign up and get access to the Ultimate Claude code guide to ship 5X faster.

Join 200K+ engineers

If a regulator asked your named SM&CR accountable individual to walk through the governance approval process for every automated system currently touching a customer-facing workflow or market-facing trade, how many of those systems would have a complete, dated, signed-off record?

If this is a live problem in your organisation, reply to this email. BuildMoat works with UK financial services firms to build the human infrastructure that closes the gap between AI deployment and regulatory accountability.

BuildMoat — buildmoat.co.uk

Building human infrastructure for AI adoption isn't theory for us. It's what we do: champion networks, behavioral pilots, AI Adoption Offices. The MOAT Framework applied to real enterprises.

Questions about scaling AI adoption in your organization? Book a call. We'll assess where you are and show you exactly what's missing.

Did someone forward this to you? Subscribe here for weekly insights on AI adoption that actually works.

Keep building,

BuildMoat
Human infrastructure for AI adoption