Four cloud giants, one BNPL Day, and six weeks to the new conduct rules

The Accountability Record is a weekly briefing for the people who will personally answer for AI and regulatory failure inside a UK financial services firm: CCOs, CROs, SMF holders, MLROs, and the compliance leads who sit beneath them. It exists because regulatory change in UK financial services now moves faster than most firms' internal reporting cycles, and because the FCA, PRA and Bank of England have made individual accountability, not firm-level fines, their primary enforcement lever.

Every issue tracks the same five things: what changed in the rulebook this week, who got caught and how, where financial crime typologies are shifting, what AI and operational resilience regulation now expects of a named accountable individual, and which RegTech and GRC tools are worth your attention or your caution. The name change reflects that focus more precisely than the old one did. This was never really about the gap between adopting AI and governing it. It was always about the record a named individual can produce when a supervisor asks who approved what, and on what basis.

This newsletter is published by BuildMoat, a vendor in the AI governance and evidential accountability space. Where BuildMoat's own product appears below, it is clearly marked and flagged for the same scrutiny you would apply to any other vendor in this issue. The editorial content is not written to sell you anything; the product section is, and you'll know which is which.

🔴 The Update: UK regulators begin overseeing the first Critical Third Parties (13 July). HM Treasury designated Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle, and the Bank of England, PRA and FCA now jointly supervise them under the CTP regime. A memorandum of understanding with the European Supervisory Authorities links UK oversight with DORA on the same providers.

The Impact: High for everyone, not just the four firms. Regulators have been explicit that CTP oversight supplements, and does not replace, firms' own third-party risk obligations. Expect supervisory questions about your mapping of important business services, impact tolerances and tested exit plans.

Deadline: None formal, effective now. Treat your next resilience self-assessment refresh as the deadline.

🔴 The Update: BNPL Regulation Day (15 July). Deferred payment credit is now a regulated credit activity. The Temporary Permissions Regime closed to registrations on 1 July, and unregistered third-party BNPL lending is now a criminal offence. Affordability checks, clear disclosure, support in financial difficulty and FOS access apply to agreements from 15 July.

The Impact: High for the roughly £13bn market used by around 11 million UK adults, and for any bank or retailer partnering with BNPL providers at point of sale, whose third-party oversight now touches a regulated activity. Consumer Duty applies from day one.

Deadline: TPR firms have six months from registration to submit a full authorisation application or face automatic removal.

🟡 The Update: FCA publishes three asset management consultation papers as a package (14 July): CP26/28 on the UK AIFM regime, CP26/27 on remuneration rules for solo-regulated firms, and CP26/26 on Fund Reporting for Asset Management Entities (FRAME). Stated aims are proportionality, lower costs, and better supervisory data.

The Impact: Medium to high for asset managers. This is the largest proposed restructuring of the sector's rulebook since onshoring. Consultation responses are cheap regulatory risk management, and silence is a decision too.

Deadline: Responses due 16 September (CP26/27), 22 September (CP26/26) and 14 October (CP26/28).

🟡 The Update: PRA publishes PS16/26, final rule changes accommodating HM Treasury's Overseas Prudential Requirements Regime, and CP10/26 on ring-fenced bodies' continuity-of-services rules (14 July).

The Impact: Medium. PS16/26 is relevant to UK banks, building societies, PRA-designated investment firms and their holding companies. The new rules take effect alongside Basel 3.1 implementation.

Deadline: OPRR rules effective 1 January 2027.

🟡 The Update: EU AI Act simplification package finalised. The Council gave its final green light on 29 June following Parliament's endorsement, with publication in the Official Journal expected in July. High-risk obligations for standalone Annex III systems, which include credit scoring, are deferred to 2 December 2027. AI embedded in Annex I regulated products moves to 2 August 2028.

The Impact: Medium. Firms with EU operations get time, but UK regulators are supervising AI today through Consumer Duty, SM&CR, model risk and operational resilience. A deferred deadline is not a deferred risk.

Deadline: 2 December 2027 (Annex III), 2 August 2028 (Annex I).

🟢 The Update: FCA hosts webinar on its cryptoasset policy statements (17 July), walking through PS26/10 to PS26/13 published on 30 June, including the reduced K-SII stablecoin capital coefficient, cut from 2% to 1%.

The Impact: Low immediate action, but the fifteen-month authorisation runway to October 2027 is shrinking. Worth circulating the recording to any crypto-exposed teams.

Deadline: Regime in force 25 October 2027.

The best person for your next role might not live near your office—or even in the same country.

More companies are realizing they don't need to open entities everywhere just to access global talent. Instead, they're using EOR to hire internationally faster, stay compliant, and avoid building local infrastructure before they're ready.

Oyster's EOR helps companies hire, pay, and support employees in 180+ countries while Oyster handles payroll, compliance, taxes, and local employment requirements.

See how it works

No new financial penalties were published this week. The FCA's 2026 running total remains roughly £16.8m, still strikingly low by historical standards. But two actions this week show how enforcement now works: fast interventions instead of slow fines.

1. Anthony Jones (UK) Limited

2. The FCA's first-year strategy scorecard (9 July)

Most recent notable individual action: the FCA's proposed £99,600 penalty against Carlos Ricardo Fuenmayor, CEO and sole controller of BancTrust Investment Bank, for failing to disclose an overseas investigation, sanction and enforcement action to the FCA (decision notice published via Notice in a Nutshell, July).

OFSI publishes response summary on the ownership and control test. Following its call for evidence, OFSI summarised 42 responses focused on "hypothetical control." Respondents reported the issues bite hardest under the Russia regime around state-linked entities, PEPs and trust structures, and that assessing control on limited information drives up compliance cost through enhanced due diligence and delayed decisions. If your sanctions framework treats control assessment as a screening checkbox, this is your confirmation that expectations are tightening. Source: OFSI blog.

Joint taskforce removes another 170 misleading car finance claims adverts (16 July). The FCA, ASA, SRA and ICO taskforce had 170 adverts removed or amended in June alone, taking the total past 1,200 since January 2024, and agreed voluntary requirements with two firms to stop or change marketing. Adverts were disguised as consumer social posts, implied FCA affiliation, or hid free claim routes. MLROs and fraud teams should note the typology: redress schemes attract parasitic claims activity at scale. Source: FCA press release.

The finfluencer sweep numbers are now public. The FCA-led international week of action across nine regulators produced 3 arrests, 6 criminal proceedings, 11 warning or cease-and-desist letters, 50 warning list alerts and 650 takedown requests. Illegal financial promotion is being policed as financial crime, not marketing sloppiness. If your firm uses affiliates or introducers on social platforms, your financial promotions register should cover them. Source: FCA.

Read the CTP designation and the Mills Review together. The FCA-commissioned Mills Review, published earlier this month, warned that shared reliance on the same models, cloud providers and infrastructure could create herding and common points of failure across the financial system. Within a fortnight, HM Treasury designated four cloud and technology providers as Critical Third Parties. That is not a coincidence, it is a direction of travel. The accountability implication: concentration risk is now a named supervisory concern, and the SMF who owns operational resilience needs evidence of dependency mapping and credible exit options, not a vendor assurance letter.

The EU bought time on high-risk AI. The UK did not offer any. The AI Act omnibus defers high-risk obligations for credit scoring and similar Annex III systems to December 2027. Meanwhile Bank of England deputy governor Sarah Breeden has signalled that existing frameworks "were not built to contemplate autonomous agents," and that a human in the loop for every agent action is unlikely to be realistic. When a policymaker says that out loud, your board should be asking which named individual is accountable for the AI already running inside the firm, and what evidence exists that they exercised that accountability.

The regulator is using AI faster than most firms govern it. The ASA's AI-based Active Ad Monitoring system is scanning ad claims at pace and scale for the car finance taskforce. Supervisory technology now operates at machine speed while many firms still evidence promotions sign-off through email chains. Assume anything public-facing can be machine-read by a regulator, and make sure your approval evidence is retrievable at the same speed. No new ICO enforcement this week; the most recent notable action remains the £14.4m Reddit fine over children's data earlier this year.

The Launch: Regnology launched Regnology Risk Hub (RRiH) Ascend (10 July), a cloud-native platform combining regulatory reporting and risk analytics with what it calls governed intelligence, drawing on capabilities from its acquisitions of Wolters Kluwer's OneSumX for Risk and Moody's regulatory reporting business. Aimed at banks wanting straight-through regulatory reporting with risk and compliance in one environment.

The Graveyard: A historical case that belongs in every vendor migration plan: TSB's 2018 core banking migration, which locked up to 1.9 million customers out of accounts and drew a combined £48.65m fine from the FCA and PRA in 2022, plus a personal fine for the former CIO. The platform was not the failure, the governance of the implementation was. Lesson for vendor selection: interrogate the migration and testing plan as hard as the product demo, and put a named senior owner on the cutover decision.

Feature of the Month: Napier AI's Perpetual Client Risk Assessment, continuous dynamic client risk scoring instead of periodic KYC refresh cycles. Worth knowing because static 1/3/5-year refresh models are increasingly hard to defend when the data to score risk continuously exists, and regulators are shifting from asking whether controls exist to whether they demonstrably work.

1. Regnology Risk Hub Ascend

2. ASA Active Ad Monitoring (supervisory AI)

3. Innovate Finance RegTech Strategy Group

BuildMoat Product Spotlight

⚠️ Disclosure: BuildMoat publishes The Accountability Record. This section covers our own product with full transparency. We include it because we believe our work is directly relevant to the problems this newsletter covers. You should evaluate it with the same scrutiny you would apply to any vendor.

This week the regulators started supervising the four technology providers most UK firms depend on. The instinct across the industry has been relief, as if cloud risk just became someone else's problem. It did not. CTP oversight explicitly supplements, rather than replaces, each firm's own accountability. That means the named Senior Manager for operational resilience still personally owns the dependency map, the impact tolerances and the exit plan, and will personally answer for them if a supervisor asks. The gap the CTP regime exposes is evidential: most firms cannot show, on demand, who reviewed their third-party and AI dependencies, when, and on what basis. That evidential gap is what BuildMoat exists to close.

BuildMoat links every AI-driven decision in a regulated workflow to a named Senior Manager under SM&CR and generates the evidence trail a regulator can actually read: who approved what, when, and on what basis. Relevant to this week's news, that means accountability mapping that ties AI systems and their infrastructure dependencies to specific SMF holders, drift and performance monitoring that escalates to the accountable individual when outputs move beyond tolerance, and a governance layer ensuring a named human reviewed and signed off before anything reaches a risk committee or a regulatory submission. It is built for the second line: Heads of Compliance, CROs and operational risk leads who must demonstrate governance over first-line AI use across credit decisioning, KYC/KYB, AML transaction monitoring, complaints and RCSA.

Current status: BuildMoat is developing evidence-trail coverage for operational resilience and third-party dependency governance, so that the accountability chain from an AI-assisted decision down to the cloud infrastructure it runs on is documented against the named SMF, ahead of the supervisory questions the CTP regime will generate.

Learn more at buildmoat.co.uk

Markets don't wait for Monday. News breaks on a Saturday morning, and most traders can do nothing but watch.

Not on Liquid. Trade domestic and international equities, commodities, forex, crypto, and prediction markets — all from one account, 24 hours a day, 365 days a year. Liquid gives you access to any market, from anywhere, anytime. To us, access is arbitrage.

Getting started takes under 10 minutes: log in with Google, deposit with Apple Pay or a bank transfer, and trade from your phone or desktop — wherever you are in the world.

While everyone else is refreshing headlines and waiting for the open, you're already positioned. That's the difference between reacting to markets and actually trading them.

Trade 24/7 on Liquid Today

Six weeks to the non-financial misconduct rules. COCON 1.1.7FR comes into force on 1 September, extending the conduct rules to bullying, harassment and violence with a sufficient work-related link across roughly 37,000 non-bank firms. Not retrospective, but training, breach reporting and fitness and propriety assessments must be live on day one. If your September conduct rules training does not yet cover NFM, that is now a project with a hard deadline, and this is the last comfortable week to start it.

Personal disclosure obligations have teeth. The proposed £99,600 FCA penalty against BancTrust's CEO for failing to disclose an overseas investigation and sanction is a reminder that fitness and propriety is a continuing personal obligation, not an application-form formality. If any of your SMF holders have open matters anywhere in the world, disclosure is their obligation, and checking is yours.

The individual-accountability trendline is unmistakable. Eleven years' combined imprisonment for insider dealing in the FCA's first strategy year, criminal exposure for unregistered BNPL lending from 15 July, and SM&CR extending to crypto from October 2027. The regulator keeps choosing tools that attach consequences to people, not just firms.

Moves:

Roles: No specific senior openings verified this week. The hiring trend: BNPL firms in the TPR need authorisation-grade compliance leadership within six months, the 1 September NFM deadline is driving demand for conduct risk specialists, and the CTP regime is creating third-party risk and resilience roles inside second-line functions. SM&CR implementation experience is the most bid-for skill set in the market right now.

The Mills Review (FCA, published July 2026). The FCA-commissioned review of AI's long-term impact on financial services names AI a systemic driver of change to 2030 and warns that shared reliance on the same models, cloud providers and infrastructure creates herding and common points of failure. Read it alongside the 13 July CTP designations and you can see the next three years of supervisory strategy assembling itself in public. Read the recommendations chapter even if you skip the rest.

Was this forwarded to you? The Accountability Record goes out weekly to compliance leads at FCA-regulated UK firms.

Questions, feedback, or want to talk about what evidential accountability looks like at your firm: [email protected]

© BuildMoat. The Accountability Record.