In partnership with
Good Morning and Happy Tuesday,
Welcome to The Adoption Gap from BuildMoat.
Last weekend had a lot competing for my attention.
Sebastian Sawe broke the two-hour marathon barrier, rewriting what we thought was possible. The White House Correspondents' Dinner started well and didn't quite finish that way. But neither of those can trump what's moving in UK financial services regulation, and no pun intended.
The FCA named eight firms for AI Live Testing. SM&CR changes from the FCA and PRA took effect on 24th April. There is a lot to unpack.
This week I'm going deep on those stories alongside FCA updates, recent enforcements, and RegTech tool spotlights. I've also pulled together some resources worth your time, a few of which are on sale right now.
If someone forwarded this to you, you are welcome. This is The Adoption Gap. And if you know someone who should be reading this, send it on.
TL;DR
SM&CR Phase 1 is live. The FCA and PRA changes took effect 24 April. The 12-week rule now runs to submission (not approval), criminal records checks are gone for internal moves, and enhanced firm thresholds have risen 30%. Update your SMF appointment processes this week.
The FCA named eight firms for AI Live Testing cohort 2 - including Barclays, Lloyds (Scottish Widows), UBS, and Experian. Use cases include AML detection, credit scoring, and agentic payments. The FCA is building its supervisory playbook from this. Your firm needs to know what it's learning.
Consumer Duty boards are not off the hook. FCA observations on board reports published 16 April make clear: data dashboards are not analysis. Boards must draw conclusions, identify risks, and challenge their own practices. The evidence standard just went up.
The EU adopted its 20th Russia sanctions package on 23 April - including a total ban on crypto platforms established in Russia. UK firms with EU branches or EU-domiciled clients need to run screening against the updated designations immediately.
ADHD management designed for how your brain actually works
Most ADHD apps are just glorified timers. Inflow is different - built by people with ADHD, backed by clinical psychologists, using CBT-inspired strategies. Learn to manage time blindness, burnout, overwhelm, and procrastination in 5-minute daily modules. Real tools, real change.
The Radar (Regulatory Updates & Horizon Scanning)
🔴 URGENT | SM&CR Phase 1 reforms now in force - FCA PS26/6 and PRA PS12/26, effective 24 April 2026
The Impact: High. The 12-week rule now measures time to submission, not to approval - individuals covering SMF roles can remain in post while the FCA processes the application. Criminal records checks are no longer required for internal or intragroup SMF moves. Enhanced firm thresholds raised 30% with a new five-year adjustment mechanism. The FCA estimates 15% of certification roles will be removed (overlapping functions no longer need dual certification). NFM-related changes to COCON alignment take effect 1 September 2026.
What firms need to do now: Audit your SMF appointment workflow against the new rules. If your tracking systems are still configured to the old 12-week approval deadline, they need updating this week. Review your certified population and identify roles affected by the overlapping function removal. Firms with enhanced status near the old financial thresholds should reassess their classification.
Deadline: Most changes effective now (24 April). Reporting improvements from 10 July 2026. NFM/COCON alignment from 1 September 2026.
🟡 REVIEW NEEDED | FCA Consumer Duty board report observations - published 16 April and 24 April 2026
The Impact: Medium-High. Two separate FCA publications in one week signal a hardening supervisory expectation around board-level consumer outcomes evidence. The 16 April publication reviewed the first two years of board reports and found boards are presenting data without drawing conclusions. The 24 April Consumer Understanding publication reinforces that firms must evidence how consumer understanding is achieved and improved, not just describe the steps they have taken. The FCA is moving from intent to proof.
What firms need to do now: Before your next board report cycle, review whether your MI tells a story or just fills pages. The FCA expects boards to identify emerging risks, challenge firm practices, and formally approve reports with explicit confirmation they have done so. If your AI-driven customer communication tools are not yet within scope of your Consumer Duty evidence framework, they need to be.
Deadline: Ongoing - next annual board report due on your firm's usual cycle.
🟡 REVIEW NEEDED | FCA/PRA operational incident and third-party reporting - PS26/2 and PS7/26
The Impact: Medium. Published in March but practical implications are crystallising this week via commentary and firm guidance. The framework requires: initial reporting of serious operational incidents within 24 hours of determining a threshold is met; annual submission of a material third-party arrangements register to the FCA; a single submission channel for dual-regulated firms via FCA Connect. Eleven months to go. For firms with complex outsourcing stacks, that is not a long runway.
What firms need to do now: Map your material third-party arrangements now. Firms that do not have a clean, up-to-date third-party register are already behind. Define your internal threshold criteria for what constitutes a serious operational incident and begin testing your 24-hour escalation process.
Deadline: 18 March 2027.
🟡 MONITOR | FCA announces AI Live Testing cohort 2 - 22 April 2026
The Impact: Medium. Eight firms - Barclays, Experian, GoCardless, Lloyds Banking Group (Scottish Widows), UBS, Aereve, Coadjute, and Palindrome, are now live-testing AI applications under FCA observation. Use cases include AML detection, credit scoring, targeted investment support, and agentic payments. The FCA's good and poor practice AI report, due Q1 2027, will be informed by what it observes in these tests. That report will define the supervisory standard your firm is held to, whether you are in the cohort or not.
What firms need to do now: Review your AI governance documentation against the questions the FCA is probing: who is accountable for each AI decision? What was the approval process? How is performance monitored? What happens when the model drifts? If you cannot answer these questions today, start building the documentation.
Deadline: FCA report Q1 2027. Testing ongoing through end of 2026.
🟢 AWARENESS | FCA cryptoasset perimeter guidance consultation - CP26/13, published 15 April 2026
The Impact: Low-Medium. Relevant for firms with crypto or digital asset business. The FCA is consulting on guidance to help firms determine whether their operations fall within the scope of the forthcoming cryptoasset regulatory regime (effective October 2027). The guidance covers trading, custody, stablecoin issuance, and staking. The application window for firms seeking crypto authorisation opens 30 September 2026.
Deadline: Consultation closes 3 June 2026.
The "Schadenfreude" Section (Enforcement & Fines)
1. The finfluencer who got a criminal charge
Who: Aaron Chalmers, former Geordie Shore cast member
What: Criminal proceedings and guilty plea for conducting illegal financial promotions on social media. Part of the FCA's coordinated global finfluencer enforcement week, 20-24 April 2026. Criminal proceedings commenced against two further unnamed individuals.
Why: The FCA identified 1,267 illegal financial adverts reaching over 2.3 million UK accounts. The FCA made 120 account takedown requests to social media platforms and issued 34 warning alerts against unauthorised firms or individuals.
Where They Went Wrong: No authorisation to communicate financial promotions. No approval from an authorised person. The standard section 21 FSMA requirement, ignored. The precedent here is that the FCA is now treating social media financial promotions as a criminal matter, not just a regulatory one.
Your Takeaway: Review your financial promotions sign-off process and any third-party marketing or affiliate arrangements that touch social media. If someone is promoting your products or services to UK consumers on social platforms, their communications need to meet the financial promotion rules. You are responsible for ensuring they do.
2. Carillion's finance director, fined eight years later
Who: Richard Adam, former group finance director of Carillion plc
What: FCA fine of £232,800 for involvement in issuing misleading financial information. The 2026 fine relates to conduct at a company that collapsed in January 2018.
Why: The FCA found Adam was knowingly involved in publishing misleading statements about Carillion's financial position in the period before the firm's collapse.
Where They Went Wrong: A failure of personal accountability at CFO level - the specific individual responsible for financial information signed off statements that materially misrepresented the firm's position. The long enforcement tail means this is a live warning, not a historical footnote.
Your Takeaway: The FCA enforcement clock does not run on your retirement timeline. The governance decisions made today in relation to financial reporting, AI outputs in risk assessments, and regulatory submissions will be scrutinised years from now if your firm encounters difficulties.
3. No major new UK institutional enforcement action this week. The FCA's enforcement focus this week was on the finfluencer coordinated action. The most recent major institutional fine in 2026 totals £16.1m across all cases. The Bureau of Investigative Journalism noted in March 2026 that UK financial crime fines have dropped 78% from peak levels - a trend worth watching as the FCA recalibrates its enforcement approach under the competitiveness mandate.
Financial Crime & AML Frontline
EU's 20th Russia sanctions package targets crypto evasion infrastructure - 23 April 2026
The EU adopted its 20th Russia sanctions package on 23 April, introducing a full ban on Russian crypto asset platforms, prohibiting transactions in RUBx and the digital rouble, and designating a Kyrgyz entity tied to the A7A5 stablecoin used to move funds for sanctioned parties.
UK firms with EU branches, EU clients, or correspondent banking relationships should treat this as a screening update requirement this week. OFSI published an updated FAQ and a new Legal Services General Licence on 24 April. EU and UK lists are not identical. Check both.
OFSI call for evidence on ownership and control - closed 13 April 2026
OFSI ran a call for evidence on how the UK financial sanctions regulations on ownership and control are applied in practice, launched 16 February and closed 13 April. The findings will inform how OFSI clarifies or revises the ownership and control rules that underpin sanctions screening obligations. MLROs and sanctions compliance leads should note that guidance changes are likely in H2 2026 as a result.
The current complexity around assessing 50% ownership thresholds through chains of corporate entities remains a persistent compliance challenge - OFSI's response to the call for evidence will either resolve or entrench it.
Failure to prevent fraud - seven months in, SFO signalling intent
The failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 has been live since 1 September 2025. Seven months on, no public prosecution has been brought. The SFO has been explicit that it is watching.
The offence applies to large organisations (turnover above £36m, balance sheet above £18m, more than 250 employees) and is strict liability - if an associated person commits a qualifying fraud offence, the corporate has committed the offence unless it had adequate prevention procedures. Financial institutions are explicitly in the highest-risk category. If your firm has not completed its fraud risk assessment and documented its prevention procedures under ECCTA, it is seven months behind.
AI, Cyber & Operational Resilience
The FCA is in the room with your competitors' AI systems - Cohort 2, April 2026
The FCA's second AI Live Testing cohort is live. Barclays, GoCardless, Lloyds via Scottish Widows, and Experian are testing AI across investment support, agentic payments, credit scoring, and AML detection, with the FCA observing directly.
Every participating firm must demonstrate a named individual who approved deployment, a governance process for reviewing outputs, and a monitoring framework for drift and failure.
The FCA's good and poor practice report lands Q1 2027. That report will set supervisory expectations for everyone, not just the cohort. If your AI governance documentation cannot answer those three questions today, you will feel the gap when it publishes.
Operational incident and third-party reporting - 11 months to build
The FCA (PS26/2) and PRA (PS7/26) published final rules in March 2026 requiring firms to report serious operational incidents within 24 hours of determining a threshold is met and to maintain a register of material third-party arrangements submitted to the FCA annually. Implementation date: 18 March 2027.
This week's practitioner commentary from Sidley Austin flags the practical complexity: the definition of 'material third-party arrangement' is broad, the annual register submission is a new process for most firms, and the 24-hour initial reporting requirement will expose firms with poor incident detection and escalation processes. Firms that have not started their third-party mapping exercise are already at risk of a last-minute scramble next spring.
ICO enforcement guidance consultation closes 27 April 2026
The ICO's draft guidance on its enforcement procedures closes today (27 April). The guidance replaces a 2018 policy document and introduces substantially more detail on how the ICO investigates, escalates, and fines under UK GDPR. Of particular note for financial services firms: the ICO now has new powers under the Data (Use and Access) Act 2025 to require organisations to provide reports and individuals to answer questions.
The ICO's shift toward serious security failures (following the £14m Capita fine in October 2025) continues. If your firm handles personal data at scale, which all regulated FS firms do, the ICO's enforcement posture now sits alongside the FCA's as a parallel regulatory risk.
The RegTech Spotlight
The Launch: REG Risk 365
REG Technologies, the UK compliance platform, launched REG Risk 365 this month, a new compliance module welcomed by the MGAA (Managing General Agents Association). The module is designed to provide continuous compliance monitoring rather than point-in-time assessments, a relevant development for firms trying to demonstrate ongoing adequacy rather than annual snapshots. The product is currently focused on the insurance sector but the underlying architecture is applicable to broader FS compliance functions.
The Graveyard: The identity verification vendor failure pattern
No major RegTech shutdowns this week, but one pattern worth flagging. Several large firms reverted to manual KYC processing in 2025 after automated identity verification produced unacceptable false rejection rates across elderly customers, non-standard documentation holders, and customers from less standardised ID jurisdictions. Consumer Duty implications followed.
The vendor selection lesson is simple: demand accuracy rates tested against your customer population, not the vendor's. Those two numbers are rarely the same.
Feature of the Month: FCA AI Live Testing as a governance template
The FCA's AI Live Testing programme itself functions as a governance template for any firm deploying AI in regulated activities. The FCA's participation requires firms to document: the AI system's purpose and scope, the named individual accountable for its outputs, the approval process before deployment, ongoing performance monitoring, and escalation procedures for failures or drift. This is not a complex list. It is a governance framework that every firm deploying AI in a regulated activity should already have. The firms that are least prepared for an FCA supervisory visit on AI are the ones who have deployed AI in production without documenting any of these things.
Culture, Conduct & SM&CR
Non-financial misconduct rules effective 1 September 2026, the gap between knowing and doing.
The FCA's non-financial misconduct guidance takes effect 1 September 2026, extending COCON to 37,000 non-bank firms for the first time. Bullying, harassment, and discrimination are now explicitly within the Fit and Proper framework.
A 2024 culture survey found a 60% rise in reported incidents across regulated firms over three years. The FCA has that data.
Firms have until September to build credible investigation processes, documentation standards, and board reporting for NFM. The ones treating this as an HR matter rather than a regulatory one will find out the difference when the FCA asks.
100+ Claude Code hacks to ship code 10X faster
Top engineers at Anthropic and OpenAI say AI now writes 100% of their code.
If you're not using AI, you're spending 40 hours doing what they do in 4.
These 100+ Claude Code hacks fix that and help you ship 10x faster.
Sign up for The Code and get:
100+ Claude Code hacks used by top engineers — free
The Code newsletter — learn the latest AI tools, tips, and skills to code faster with AI in 5 minutes a day
D&I plans dropped — what that actually means
The FCA and PRA confirmed they are not proceeding with the diversity and inclusion rules consulted on in CP23/20. This does not mean D&I obligations have gone away. It means the FCA is relying on the NFM framework, existing Equality Act obligations, and board diversity reporting requirements to drive the same outcomes. The practical effect: if your firm built its D&I programme around the anticipated CP23/20 requirements and has now quietly parked it, you may have created a governance gap in a space the FCA is still actively supervising through the NFM lens.
SM&CR Phase 1: accountability unchanged, process simplified
It is worth saying plainly what the Phase 1 reforms do not do. They do not reduce the personal liability of named Senior Managers. The Duty of Responsibility, the obligation of Senior Managers to take reasonable steps to prevent regulatory breaches in their area, is unchanged. The presumption of responsibility in enforcement cases is unchanged. What has changed is the administrative burden around appointments, certification, and enhanced firm thresholds. Compliance leads who interpret Phase 1 as a softening of personal accountability expectations are misreading the direction of travel. Phase 2, when it arrives, will change the Certification Regime but explicitly preserve the Senior Manager accountability framework.
Movers, Shakers & Jobs
Moves:
Graeme Forrester confirmed as Chief Risk Officer at Principality Building Society, April 2026. Forrester had been serving as interim CRO and was previously interim CRO at Coventry Building Society following the Co-operative Bank acquisition. His confirmation signals Principality's risk and transformation agenda is stabilising after a period of senior interim coverage. Experience spans retail, corporate, and investment banking.
Roles:
The SM&CR Phase 1 reforms and the NFM changes coming in September are driving a visible uptick in demand for Heads of Compliance and Senior Compliance Advisors with specific COCON and Fit and Proper assessment experience. The 37,000 non-bank firms newly in scope for COCON from September have a short window to hire or develop that capability.
AI Governance and Model Risk roles continue to attract premium salaries across major UK banks and insurers. The FCA AI Live Testing cohort firms are the most active hirers. Titles vary - Model Risk Manager, AI Governance Lead, Responsible AI Officer - but the underlying skill set is consistent: understanding of model validation, ability to document governance processes, and credibility with both technical and compliance stakeholders.
MLRO roles at crypto-adjacent firms are increasing as the October 2027 authorisation deadline approaches and firms build out compliance infrastructure ahead of the application window opening in September 2026.
Calendar & Events
27 April 2026 | ICO enforcement procedural guidance consultation closes. Last chance to submit a response.
18 May 2026 | FCA/PRA securitisation framework consultation (CP26/6 and CP2/26) closes. Relevant for securitisation desks and structured finance compliance teams.
19-21 May 2026 | ICA Flagship Compliance Conference, Leonardo Royal Hotel London St Pauls. Senior compliance and financial crime prevention leaders. int-comp.org/events
3 June 2026 | FCA cryptoasset perimeter guidance consultation (CP26/13) closes. Relevant for all firms with crypto or digital asset business.
10 July 2026 | SM&CR Phase 1 reporting and process improvements take effect.
1 September 2026 | FCA non-financial misconduct rules (PS25/23) and SM&CR COCON alignment effective. COCON scope extends to 37,000 non-bank firms. NFM investigation processes, documentation, and board reporting mechanisms must be in place.
30 September 2026 | Crypto authorisation application window opens. Firms seeking to conduct cryptoasset regulated activities from October 2027 must apply during the September 2026 to February 2027 window.
Poll / Pulse Check
The SM&CR Phase 1 reforms took effect on Thursday 24 April. Has your firm already updated its SMF appointment processes to reflect the new rules?
Results shared in next week's issue.
Resources available to download now
A growing library of practical tools built for compliance and risk professionals navigating AI-driven change.
AI Literacy Toolkit ⭐ On sale now - understand what AI actually does, in plain language your team can act on.
AI-Proof Your GRC Career ⭐ On sale now - a playbook for staying relevant as governance, risk and compliance roles evolve.
SMF16 & SMF17 Regulatory Change Guide - everything the money laundering reporting function needs to track what's changing and why it matters.
Reasonable Steps Evidence Pack - document your decisions. Protect your name. This is the pack that builds your accountability trail.
SAR & AML Case File Quality Pack - raise the standard of your financial crime casework with structured templates and quality benchmarks.
SMF16, SMF17 & MLRO Pain Point Library - a curated reference of the real-world frustrations facing senior compliance functions, with practical responses for each.
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
The Adoption Gap is published by BuildMoat. Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
Emeka Ogbonnaya
Founder BuildMoat