Sponsored by
Hi there,
Welcome to The Adoption Gap, the weekly briefing for compliance leads, MLROs, CROs, and risk directors in UK financial services.
Each week I cut through the regulatory noise to bring you the updates that matter most at the intersection of AI, governance, and the changing compliance landscape. No filler. No vendor hype. Just the developments shaping how regulated firms are embedding AI into their systems, workflows, and teams, and what that means for accountability, oversight, and risk.
This week's edition covers the SM&CR Phase 2 confirmation, the EU AI Act omnibus deal, BNPL's approaching Regulation Day, and a set of enforcement and sanctions developments your firm should already have on its radar.
If someone forwarded this to you, you can subscribe here. If you have feedback, reply directly. I read every response.
Let's get into it.
TL;DR
BNPL TPR registration closes 1 July 2026 - any firm distributing or offering Buy Now Pay Later products without FCA authorisation must register for the Temporary Permissions Regime now or cease operating on 15 July. The window is open and closing fast.
EU AI Act high-risk AI obligations deferred 16 months to December 2027 - the omnibus deal covers Annex III use-based high-risk AI (credit scoring, employment, biometrics). Core prohibitions and GPAI obligations are unchanged. Treat this as preparation time, not a signal to slow down.
SM&CR Phase 2 Financial Services Bill confirmed in King's Speech - some SMF roles will move from pre-approval to notification. This increases individual exposure, it does not reduce it. The evidential burden shifts entirely to the firm.
Non-financial misconduct COCON rules hit 37,000 non-bank firms on 1 September 2026 - bullying, harassment, and violence at work are now regulatory conduct issues, not just HR matters. Four months remain.
Stop Paying for 6 Tools. One AI Does It All
Most e-commerce sellers are running their store across 6 to 8 separate tools — and paying hundreds of dollars a month for the privilege. StoreClaw replaces your entire stack with one autonomous AI engine that monitors competitors, optimizes listings, automates marketing, and tracks real profit across Shopify, Amazon, and beyond.
It doesn't wait for you to ask. It runs 24/7 in the background, so you wake up to a full dashboard instead of a list of things you forgot to check.
Connect your store, and StoreClaw gets to work — no prompts, no complex setup, no six-app stack.
Free to start. No credit card required.
The Radar (Regulatory Updates & Horizon Scanning)
BNPL TPR window closes 1 July — act now or stop trading
BNPL firms without FCA consumer credit authorisation have until 1 July to register for the Temporary Permissions Regime. From 15 July, entering new agreements without permission is a criminal offence. There is no grace period. Six months from Regulation Day to apply for full authorisation.
FCA and Bank of England set out UK tokenisation vision — respond by 3 July
The FCA and Bank of England have published a joint call for input on the future of tokenisation for UK wholesale financial markets, seeking industry views on prudential treatment, tokenised collateral, and how CASS rules apply. The Bank has committed to a live synchronisation service targeted for 2028. Feedback closes on 3 July 2026, with a feedback statement expected in the summer.
EU AI Act high-risk obligations pushed to December 2027
On 7 May 2026, EU Council and Parliament reached provisional agreement on the Digital Omnibus on AI. Annex III high-risk AI system obligations are deferred from August 2026 to 2 December 2027, a 16-month reprieve. Core prohibitions and GPAI obligations are unchanged. For UK firms, FCA AI governance guidance is still expected by end of 2026 — the delay is a preparation window, not a pause.
SMCR Phase 2 confirmed in King's Speech — accountability burden shifts, not accountability itself
The Financial Services and Markets Bill 2026-27 completed its first reading in the House of Lords on 19 May, delivering Phase 2 SMCR reforms announced in the King's Speech. The government is targeting a 50% reduction in administrative burden, with some SMF pre-approval roles moving to a notification model and the Certification Regime potentially removed from primary legislation. FCA/PRA consultation on the detail is expected in H2 2026.
Regulatory Initiatives Grid 10th edition published — 135 live initiatives, 24 months out
The Financial Services Regulatory Initiatives Forum published its 10th edition on 19 May 2026, covering 135 live initiatives across eight sectors over the next 24 months. Key milestones include BNPL Regulation Day (15 July 2026), stablecoin final rules (Q2 2026), and Basel 3.1 implementation (1 January 2027). If your firm cannot articulate how it processes the Grid's output, that is a change management gap.
FCA opens formal market study into claims management — motor finance lit the fuse
On 19 May, the FCA launched a formal market study into claims management services, working jointly with the Solicitors Regulation Authority, examining CMCs, legal professionals, and lead generation firms. Written representations on scope are invited by 19 June, with interim findings expected in December 2026 alongside possible consultations on regulatory changes. Firms with significant complaint volumes or CMC relationships should treat this as an early enforcement signal, not a background watch item.
ENFORCEMENTS & FINES
South Staffordshire Water: £963,900 for a breach nobody spotted for 20 months
The Cl0p ransomware group entered via a phishing email in September 2020 and stayed hidden for nearly two years, exposing data on 633,887 customers and employees. The pre-discount penalty was £1.6 million. A 40% settlement discount brought it to £963,900. The ICO's finding was not that the firm got hacked. It was that nobody was scanning for threats already inside. Perimeter controls existed. Active detection did not. The question for your next governance review is not "do we have a firewall?" but "how would we know if we had already been breached?"
FINANCIAL CRIME & AML
UK sanctions end-use controls live from 13 May - diversion risk is now a licensing trigger
The UK government has closed a known enforcement gap. From 13 May 2026, if the government formally notifies an exporter that goods risk being diverted to a sanctioned destination via a non-sanctioned third country, exporting without a licence is a criminal offence. This is not a blanket tightening. It is a targeted power, triggered by written notification, that applies across all 36 UK sanctions regimes including Russia, Belarus, Iran, and Syria. Trade finance, transaction banking, and correspondent banking teams should review export documentation and correspondent relationships against the updated framework now.
OFSI voluntary disclosure discount cut to 30% - recalibrate your escalation strategy
The previous voluntary self-reporting discount of up to 50% is gone. OFSI now applies a flat Voluntary Disclosure and Co-operation discount capped at 30% across all cases. A separate 20% Early Account Scheme discount and 20% settlement discount can be stacked, bringing the theoretical maximum to 70%, but only for firms that engage early, completely, and before OFSI comes to them. OFSI is also seeking to double maximum penalties to £2 million or 100% of breach value, pending legislation. Firms running legacy disclosure strategies built around the old 50% expectation need to recalibrate internal escalation thresholds now.
UK Sanctions List is now the only authoritative source - check your screening vendors
Since January 2026, the UK Sanctions List replaced the OFSI Consolidated List as the single definitive reference for all UK sanctions designations. If your compliance team is still running lookups against multiple lists, legacy databases, or vendor tools that have not been updated to draw exclusively from the UKSL, you have an operational hygiene problem with enforcement consequences. Confirm with your screening vendor today.
AI, CYBER & OPERATIONAL RESILIENCE
EU AI Act deferral: 16 months extra, one chance to use them
The Annex III high-risk AI obligations covering credit scoring, employment screening, biometric categorisation, and education access systems have moved from August 2026 to December 2027. Core prohibitions on unacceptable-risk AI and GPAI model obligations are unchanged. The FCA's own UK AI governance guidance is still expected by end 2026, and will likely land while EU compliance programmes are still being built. Firms that use the additional time to embed governance documentation will be differentiated when enforcement begins. Firms treating this as permission to pause will be scrambling again in late 2027. The deferral is a preparation window, not a reprieve.
South Staffordshire ICO fine: what it means for financial services cyber governance
The governance lesson from this fine applies directly to regulated firms. The ICO's primary finding was the absence of detection capability, not prevention capability. Perimeter controls existed. Active threat detection and regular vulnerability scanning did not. Financial services firms hold more sensitive data, operate under more intensive supervisory scrutiny, and now face the FCA and ICO coordinating on overlapping cyber and conduct failings. The standard being applied across enforcement is active, continuous detection. Not a firewall plus an annual pen test.
REGTECH SPOTLIGHT
Greenboard raises $20m and launches GreenboardGo - firm-specific AI compliance Q&A
Greenboard has raised $20m including a $15.5m Series A led by Base10 Partners, and launched GreenboardGo alongside it. The product sits as a conversational AI layer on top of a firm's own compliance books and records, not generic regulatory text. Employees get instant policy-grounded answers. Ambiguous queries route to the named compliance owner with a full audit trail. The platform is US/SEC-focused but the design principle is what UK compliance teams should benchmark against any AI vendor pitch. Watch point: the model is only as good as the currency of the firm's own policy library. Outdated policies produce confident, outdated answers.
The cost of buying AI before buying governance
Firms that purchased general-purpose LLMs, deployed them on generic regulatory text, passed internal demos, then failed at audit because outputs could not be traced to internal policy. The regulatory question "what policy governed this decision?" has no good answer when the AI was reasoning from public regulatory text. AI in compliance works. AI without a documented, firm-specific governance layer is a liability that compounds at exactly the moment you most need it to perform.
135 live regulatory initiatives: the Grid as a stress test for your change management process
At 135 live initiatives, manual horizon-scanning is a headcount problem. Compliance.ai cross-references new FCA publications against a firm's internal policy library in real time, flagging gaps as policy statements land rather than on a quarterly review cycle. The test is simple: can your current process reliably surface which of those 135 initiatives require a policy update, a system change, or board escalation? Watch point: these tools surface gaps, they do not assess materiality. That judgment, and its documentation, remains traceable to a named individual under SM&CR.
BuildMoat: SM&CR Phase 2 and the accountability gap AI creates
The shift from pre-approval to notification does not reduce accountability. It transfers the evidential burden entirely to the firm. The FCA's question will not be "did you tell us?" but "what did you document, who signed off, and what information did they have?" BuildMoat links every AI-assisted decision in a regulated workflow to a named Senior Manager under SM&CR, producing the evidence trail a regulator can read. Credit decisioning, KYC/KYB, AML transaction monitoring, complaints handling, RCSA workflows. Currently in early access with a small number of SM&CR firms.
CULTURE, CONDUCT & SM&CR
SM&CR Phase 2: accountability rising, not falling
The Financial Services Bill moves some SMF roles from pre-approval to notification. The market has read this as deregulation. That is wrong. Pre-approval was a regulatory gate. Notification removes the gate, not the accountability. The compliance burden shifts entirely to governance quality, fitness and propriety documentation, and audit trails. Firms where Senior Managers currently treat pre-approval as a proxy for regulatory sign-off need a material rethink before Phase 2 lands.
Non-financial misconduct: September is closer than it looks
The FCA's expanded COCON rules covering bullying, harassment, and workplace violence take effect 1 September 2026 for 37,000 non-bank firms including asset managers, wealth managers, and brokers. Four months. HR disciplinary processes, regulatory investigation standards, and fit and proper reporting obligations for NFM incidents all need review. The FCA has been explicit that tolerating non-financial misconduct is a leading indicator of wider governance failure. This is not a soft deadline.
FCA puts claims management market on notice
The FCA's 19 May blog questioning whether the claims management market is working is a supervisory signal, not a discussion paper. The FCA launched a formal market study on the same day with representations invited by 19 June and interim findings expected in December 2026. Firms operating in or adjacent to claims management, including those with significant complaint volumes or CMC referral relationships, should treat this as an early enforcement signal and consider a voluntary controls review now.
MOVERS, SHAKERS & JOBS
Moves: Chris Knight joins the FCA in July 2026 as Director of Insurance, coming from Legal and General where he was Group CRO. David Lymburn joined the Payment Systems Regulator as interim Deputy Managing Director in February 2026, previously COO at Nordea Bank.
Roles worth watching: BNPL compliance leads are urgently in demand ahead of 15 July. Operational resilience specialists remain among the most sought-after hires across Tier 1 and mid-tier banks, frame your experience around PS21/3 and CTP obligations. AI Governance roles (Chief AI Risk Officer, Head of Model Governance) are stabilising as a discrete category and volume is expected to increase materially in Q3 as FCA guidance lands.
QUICK TAKES
The EU AI Act deferral is not a win for financial services firms who were already behind. It is an invitation to repeat the August 2026 mistake in December 2027.
BNPL regulation going live on 15 July should not be news. If your compliance programme is not operational by now, the problem is prioritisation failure, not regulatory complexity.
The SM&CR Phase 2 debate is being conducted by lawyers arguing about which roles need pre-approval. The more consequential question: what does your accountability documentation look like if a Senior Manager is investigated under a notification model?
The South Staffordshire fine is the third major cyber enforcement this year with a phishing email as the entry point. The consistent failure is detection, not prevention.
CALENDAR
1 Jul: BNPL TPR registration closes
3 Jul: FCA/BoE tokenisation call for input closes
10 Jul: SM&CR Phase 1 Part 2 changes take effect
15 Jul: BNPL Regulation Day
1 Sep: Non-financial misconduct COCON changes effective for all firms
1 Jan 2027: Basel 3.1 implementation deadline
ONE THING TO READ
EU AI Act Omnibus: What Just Happened and What Comes Next, IAPP Notes from the AI Governance Center, May 2026. The clearest account of which obligations were deferred, which were tightened, and where financial services firms sit in the revised supervisory architecture. Required reading before any board presentation on AI Act exposure.
The Poll
Has your firm formally mapped which AI-assisted workflows will require compliance documentation under SM&CR accountability rules before the FCA publishes its AI governance guidance later in 2026?
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
