In partnership with
Hi there,
This is a weekly briefing for compliance, risk and financial crime leads in UK financial services, and increasingly, for anyone accountable for what AI systems do inside a regulated firm.
Each issue gives you The Radar (what's moved in regulation this week), enforcement and financial crime intelligence, a RegTech spotlight on what's actually shipping versus what's vapourware, and the dates that need to be on your calendar before your next committee meeting.
The goal isn't to summarise everything the FCA published. It's to tell you what changed, why it matters to the person who has to answer for it, and what to do before the deadline arrives instead of after.
In five days the FCA published the final rulebook for UK cryptoassets, watched part of its own motor finance redress scheme get suspended by a tribunal, proposed narrowing the Consumer Duty, and told providers sitting on £500bn of legacy pension assets that poor data does not excuse poor value. If you lead compliance, risk, or financial crime at a UK firm, this week rewrote your agenda. Here's what matters and what it means for you.
We're opening a six-week managed service for firms building evidential accountability infrastructure for agentic systems, limited to tier 2 UK financial services firms. Reply to this email if you want to talk.
TL;DR (Executive Summary)
The FCA published five policy statements (PS26/9 to PS26/13) establishing the full UK cryptoasset regime.From 25 October 2027 crypto firms need FCA authorisation, and SM&CR, the Consumer Duty and CASS will apply to them.
The Upper Tribunal partially suspended the motor finance redress scheme. Redress calculations and payments are on hold until challenges are heard in December 2026 or February 2027, but complaint response and communication duties continue.
The FCA proposed narrowing the Consumer Duty to retail customers usually resident in the UK (CP26/23), removing non-UK wholesale business from scope. Responses due 18 September.
BNPL Regulation Day is 15 July, nine days away. The temporary permissions registration window closed on 1 July. Unregistered third-party BNPL lenders will be lending illegally from Regulation Day.
Everything GTM. One platform.
Small teams don't have time to stitch together five tools and hope it works.
Apollo gives you everything you need to find leads, reach them, and close deals — all in one place:
230M+ verified contacts
AI-powered outreach
Data enrichment
Inbound lead capture
Meeting scheduler
And more
Stop juggling tools and start building pipeline that scales.
With Apollo, the AI revenue engine powering 4M+ users.
The Radar
🔴 FCA crypto regime goes live: Five policy statements (PS26/9–13) plus guidance, published 30 June. Trading platforms become admission gatekeepers, a new Market Abuse Regime for Cryptoassets (MARC) bans insider dealing and manipulation, CRYPTOPRU sets capital/liquidity rules, and PS26/13 confirms SM&CR, Consumer Duty, CASS and DISP all apply from authorisation. Solo-regulated firms will generally need a UK legal entity.
Deadline: Authorisation required by 25 October 2027 - 15 months to build governance from scratch.
🔴 Motor finance redress scheme partially suspended: Upper Tribunal order (2 July), agreed with four challengers (Consumer Voice, VW Financial Services, Mercedes-Benz Financial Services, Crédit Agricole Auto Finance). Firms don't need to calculate or pay redress yet, but must still respond to complainants owed nothing and update others on timing.
Deadline: Update complaint communications now. Tribunal hearings run 14–18 Dec 2026 or 16–26 Feb 2027; payments (if the scheme survives) start 2027, possibly 2028+ if the FCA has to re-consult.
🟡 Consumer Duty scope consultation: CP26/23 (29 June) would limit the Duty to retail business where the customer is usually UK-resident, narrowing "retail market business" and "material influence." Wholesale and non-UK books may fall out of scope. Policy statement expected Q1 2027.
Deadline: Responses due 18 September.
🟡 Legacy pensions review: Multi-firm review (2 July) covering unit-linked non-workplace pensions: ~17m policies, £500bn AUM. FCA found complex charging and weak data leaving some savers with poor value, and was explicit: data/systems limitations don't excuse Consumer Duty obligations.
Deadline: No fixed date, but named supervisory priority - if you can't evidence fair value, act now and engage the regulator.
Schadenfreude
No new fines this week - 2026 running total holds at ~£16.8m, low by historical standards. Most recent individual action: Richard Howson (former Carillion CEO), £237,700 for MAR/Listing Rules breaches (Feb 2026).
This week's real story: the FCA itself got challenged. The Upper Tribunal partially suspended its own motor finance redress scheme after four lenders contested the methodology. Even a regulator-designed, industry-wide scheme can be frozen by litigation.
Takeaway: documentation decides these fights - whichever side of a redress methodology you're on, your evidence trail today is your position tomorrow. Confirm your complaints function has updated its motor finance messaging to reflect the suspension.
Financial Crime & AML Frontline
OFSI (30 June): Call-for-evidence summary on ownership/control shows industry finds "hypothetical control" harder to operationalise than ownership. If your sanctions framework treats control as a checkbox, expectations are tightening.
PSR (1 July): Independent evaluation finds the mandatory APP scam reimbursement rule works overall - reimbursed value up from 54% to 65%. But outcomes vary widely across PSPs on Consumer Standard of Caution, vulnerability assessment and voluntary excess. If your firm sits at the bottom of that distribution, expect questions.
MARC: New market abuse perimeter for cryptoassets (PS26/9). Most entrants have zero market surveillance capability today - 15 months to build one.
AI, Cyber & Operational Resilience
Mills Review reports to the FCA Board this summer (external publication to follow). The FCA isn't writing an AI rulebook - it's deciding how existing frameworks flex. When an AI system fails at your firm, the question will be which named Senior Manager understood, approved, and monitored it.
AI Live Testing cohort 2 is running now - Barclays, Experian, Lloyds/Scottish Widows, UBS, GoCardless, Aereve, Coadjute, Palindrome, testing AI in AML/KYC. Concludes year-end, evaluation report Q1 2027. The regulator is gathering live deployment evidence while most firms are still drafting policy.
EBA (26 June): ICT risk, ESG and operational resilience folded into a single SREP framework from 1 Jan 2027 - UK firms with EU operations now feed evidence to two supervisory machines.
No new ICO enforcement; most recent notable action remains South Staffordshire Water, £963,900 (May 2026).
RegTech Spotlight
Oracle FCCM + Lucinity: Agentic AI now embedded in Oracle's AML/case investigation platform, automating context-gathering and next-best-action across the investigation lifecycle. Biggest cost line in financial crime ops (investigator hours/alert) is the target. Watch point: agent-drafted case narratives entering your SAR pipeline still need a named human reviewer.
Feedzai RiskFM: First tabular foundation model built for financial risk data, aiming to generalise fraud detection across institutions without months of bespoke training. Relevant now that PSR has confirmed reimbursement liability is permanent. Watch point: pre-trained foundation models raise explainability/drift questions your model risk framework may not yet cover.
ComplyAdvantage Mesh: Unified screening/monitoring/case management platform, reflecting 2026's dominant procurement trend: consolidation of point solutions (with single-vendor dependency as its shadow risk).
Connecting thread: the FCA's AI Live Testing cohort is watching live AML/KYC deployments in controlled conditions at the same time vendors above are selling those exact capabilities. The Q1 2027 evaluation report will likely become the de facto benchmark for "safe and responsible" AI in financial crime workflows.
BuildMoat : PS26/13 puts thousands of crypto-firm individuals into SMF roles for the first time, personally accountable for AI-driven systems they didn't build. BuildMoat maps AI-driven decisions in a regulated workflow to the named accountable Senior Manager and generates the evidence trail: who approved what, when, on what basis - built for second-line (Heads of Compliance, CROs) preparing for the October 2027 crypto authorisation gate, where governance evidence is now part of the application itself. More: buildmoat.co.uk
What is an EOR—and why are companies using it?
Opening entities in every country can be slow, expensive, and hard to scale.
That's why more companies are using EOR to hire globally faster.
See how Oyster helps teams hire, pay, and support talent in 180+ countries while staying compliant along the way.
Culture, Conduct & SM&CR
Eight weeks to NFM rules. COCON 1.1.7FR (1 Sept 2026) extends serious non-financial misconduct into conduct rules for ~37,000 non-bank firms. Not retrospective, but training/certification/breach-reporting need to be live on day one.
SM&CR comes to crypto via PS26/13 - a sector with no prior Statements of Responsibilities, certification, or conduct rules gets all three at once. Expect a hiring wave and a wave of underprepared applications.
FCA confirmed new statutory panel chairs (1 July) for the Listing Authority Advisory Panel and Practitioner Panel.
Movers, Shakers & Jobs
No major CRO/Head of Compliance moves this week. Crypto firms preparing for the Oct 2027 gate are recruiting compliance leadership now; the 1 Sept NFM deadline is driving demand for conduct risk specialists. If you have SM&CR implementation experience, the crypto sector is about to bid for your time.
Quick Takes
Consumer Duty's scope is shrinking three years in - CP26/23 is the deregulatory move at the flagship policy. Watch the response file.
Only 6% of 132 reviewed pre-sale investment disclosures were in plain English. Read that number aloud at your next product governance committee.
The motor finance suspension proves scheme design is litigable - every future FCA redress scheme will now be built tribunal-challenge-in-mind: slower, more documented, more defensive.
Crypto firms think authorisation is a licensing exercise. It's a governance transplant - SM&CR, CASS, Consumer Duty and a market abuse regime, simultaneously, in 15 months.
Reimbursement works: APP scam reimbursement rose from 54% to 65% by value. The "liability wouldn't change outcomes" argument is now empirically dead.
Calendar & Deadlines
This month
📌 15 July — BNPL Regulation Day in force: third-party BNPL agreements regulated, unregistered lenders must stop lending.
👀 16 July — EBA public hearing on MiCA fines methodology.
August
📝 14 August — CP26/21 response deadline (Listing Rules, closed-ended funds).
📝 21 August — CP26/24 response deadline (consumer investment disclosures).
September
📌 1 September — NFM rules (COCON 1.1.7FR) in force.
📝 4 September — CP26/22 response deadline (insurance rules).
📝 18 September — CP26/23 response deadline (Consumer Duty scope).
📌 28 September — Equity transparency changes in force; EBA MiCA consultation closes.
Later
👀 14–18 December 2026 (or 16–26 February 2027) — Upper Tribunal hears motor finance scheme challenges.
📝 = response required from you ·
📌 = rule now binding, check compliance ·
👀 = watch, no action required
One Thing to Read
Frontier Economics' independent evaluation of the PSR's APP scam policies (1 July) - a regulator commissioning an honest look at whether its own flagship policy worked, uneven bits included. The 54%→65% reimbursement rise, with sharp divergence across PSPs, is the most useful fraud-liability data point published this year.
Thanks for Reading
The gap this newsletter tracks every week isn't a knowledge gap. Compliance leaders know the FCA expects genuine oversight before AI-assisted decisions get made. The gap is evidential: when a regulator asks a named SMF holder to prove they exercised that oversight, in the moment, before the decision, not after. Most firms have a policy document. Almost none have a contemporaneous record.
If you're building that evidence trail, or trying to work out what it should even look like for your firm, we should talk. Not a sales call, a conversation about where you actually are.
If someone forwarded this to you and it landed, subscribe below. We publish weekly on the evidence trail FCA-regulated firms need before, not after, AI-assisted decisions.
Keep building,
Emeka Ogbonnaya | LinkedIn
BuildMoat - Pre-deployment evidential accountability infrastructure