Two Days and a Legal Challenge

UK financial services leaders are entering May under pressure from two directions at once. The FCA, the Financial Conduct Authority, the UK's main financial regulator, has hard new rules coming into force in six days. From 7 May, every payment institution and e-money firm must meet daily reconciliation, monthly reporting, and annual audit obligations on the customer funds they hold. These are not guidelines. They are enforcement-grade requirements with no grace period. At the same time, the FCA's motor finance redress scheme, the compensation framework that major lenders have been building their complaint handling operations around for months, was legally challenged this week. Consumer Voice applied to the Upper Tribunal on 27 April, arguing the scheme fundamentally underestimates the harm done to millions of borrowers. Two deadlines in motion. Two firm types suddenly exposed. Both cases make the same point: the gap between what firms have built and what the regulator will actually ask for is wider than most compliance leaders have estimated.

FCA Safeguarding Supplementary Regime: two days to the new standard

On 7 May 2026, the FCA's Safeguarding Supplementary Regime comes into force under Policy Statement PS25/12. The rules apply to all authorised payment institutions, registered payment institutions, and e-money institutions, covering the customer funds these firms hold and must protect. From that date, firms face four concrete obligations: daily internal reconciliation of relevant funds, mandatory monthly reporting of safeguarded funds to the FCA, an annual independent audit of safeguarding arrangements submitted within six months of the firm's first relevant period end, and a detailed resolution pack demonstrating a clear wind-down plan for distributing customer funds in a failure scenario. Firms that already hold third-party safeguarding arrangements, such as a safeguarding bank or custodian, must review those appointments within three months of the rules coming into force.

The scope of firms affected is broad. Authorised payment institutions, e-money institutions, and credit unions issuing e-money in the UK all fall within scope. The FCA has been explicit that these reforms were triggered by concern that some payments firms do not currently have sufficiently robust safeguarding practices, and that the risk of harm to consumers and market integrity is unacceptable at present levels. This is not a procedural update. It is the regulator drawing a line and saying that what many firms currently have is not good enough.

The AI governance implication is direct and underappreciated. Payments and e-money firms have increasingly built AI into their fund monitoring, reconciliation, and anomaly detection workflows. Under the new regime, those AI-driven processes must produce audit-grade outputs. Daily reconciliation cannot be a figure that an AI system generates and a human signs off without understanding how it was calculated. Monthly FCA returns must be accurate and evidenced. Annual audits will probe whether the controls that produced the numbers can be examined, questioned, and relied upon. The named individual under SM&CR, the Senior Managers and Certification Regime, who owns the safeguarding function must be able to explain what the AI is doing, what data it is using, and what happens when it produces an anomaly. If your firm has automated safeguarding monitoring without building that accountability layer, 7 May is not a deadline you can defer.

Tech moves fast, but you're still playing catch-up?

That's exactly why 200K+ engineers working at Google, Meta, and Apple read The Code twice a week.

Here's what you get:

All delivered twice a week in just 2 short emails.

Join 200K+ engineers

Motor finance redress scheme under legal challenge as complaint handling pause prepares to lift

On 27 April 2026, Consumer Voice, a pro-consumer organisation, applied to the Upper Tribunal to judicially review the FCA's motor finance consumer redress scheme, which the FCA finalised in Policy Statement PS26/3 in March 2026. Consumer Voice argues that the FCA's calculation methodology is fundamentally flawed, that it significantly underestimates the harm suffered by borrowers who were subject to discretionary commission arrangements, and that the FCA has incorrectly used the Supreme Court's judgment in Johnson v FirstRand as the benchmark for setting which cases are in scope. The FCA has confirmed it is considering its approach and will set out more information in due course. The application requires court permission to proceed.

The timing matters acutely. The FCA confirmed in December 2025 that the pause on handling motor finance complaints will lift on 31 May 2026, now less than 30 days away. Lenders have been preparing their complaint handling operations around the existing scheme parameters. Some have built or are building AI-assisted complaint triage systems, document review pipelines, and redress calculation tools calibrated to those parameters. A successful legal challenge could require the FCA to revise the scheme's scope or methodology. Firms that have hard-coded the current scheme's eligibility thresholds into their AI complaint processing workflows now face a scenario where those assumptions may be legally unstable.

The AI governance implication here is structural. Complaint triage and redress calculation are exactly the kind of high-volume, rules-based workflows where firms reach for AI. The efficiency case is obvious. But when the rules underpinning those workflows are contested, the accountability question becomes acute. If a borrower's complaint is screened out of scope by an AI system built around criteria that a court later overturns, who is accountable for that outcome? The answer under SM&CR is the named Senior Manager who owns the complaints function. If that individual cannot explain the logic the AI applied, or demonstrate that it was reviewed and approved as the scheme evolved, the governance gap is not hypothetical. It is the FCA's next enforcement avenue.

Both stories this week expose the same underlying failure mode. Firms automate regulatory workflows to handle volume and reduce cost. That is rational. But automation without accountability infrastructure creates exactly the kind of evidence gap that regulators and courts are trained to find. The safeguarding regime requires daily proof that customer funds are protected. The motor finance scheme requires firms to explain, borrower by borrower, why each complaint was handled the way it was. In both cases, firms using AI to generate those outputs are one enforcement visit, or one Upper Tribunal hearing, away from being asked a question their AI cannot answer on its own. The Head of Compliance or Head of AI who has mapped every AI system in these workflows to a named Senior Manager, documented the logic, and built a review cadence into the governance framework is the one who can answer that question. Everyone else is hoping the question does not come.

For every AI system your firm uses in safeguarding monitoring, complaint triage, or redress calculation, can you produce a written record showing who reviewed and approved the logic, when it was last checked against current regulatory requirements, and who is accountable if it produces the wrong output?

If this is a live problem in your organisation, reply to this email. BuildMoat works with UK financial services firms to build the human infrastructure that closes the gap between AI deployment and regulatory accountability.

BuildMoat — buildmoat.co.uk

That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.

Forward this to one person who should be reading it.

Find me on X and LinkedIn if you want to continue the conversation there.

For sponsorship enquiries, email [email protected]

Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.

Until next week.