FCA Regulatory Compliance in 2026: What UK Financial Services Firms Must Get Right
By Adrian Lawrence FCA, Founder, FD Capital Recruitment Ltd — ICAEW Registered Practice
The regulatory environment facing UK financial services firms has rarely been more demanding. The period since 2023 has seen the full implementation of the Consumer Duty, a significant tightening of the FCA's approach to financial promotions, the continued bedding-in of the SMCR's individual accountability framework, and an increasingly assertive supervisory posture from the regulator across every sector it oversees. At the same time, the May 2026 core update to Google's search rankings has made authoritative, original compliance content more important than ever for firms communicating their expertise. For compliance teams, senior managers, and the boards overseeing regulated firms, 2026 is not a year for passive compliance. It demands active governance, well-resourced control functions, and senior managers who understand their personal accountability obligations.
This article covers the principal FCA regulatory obligations that are generating the most supervisory activity in 2026, drawing on the FCA regulatory framework that applies across the sector.
Consumer Duty: Moving From Implementation to Evidencing Outcomes
The Consumer Duty came into force in July 2023 for new and existing products, and in July 2024 for closed book products. By 2026, the FCA's supervisory focus has shifted from implementation readiness to outcome evidencing. Firms are expected not merely to have policies and frameworks in place, but to demonstrate — through data, MI and board reporting — that they are actually delivering good outcomes for retail customers across all four outcome areas: products and services, price and value, consumer understanding, and consumer support.
The annual Consumer Duty board report is now a live document in every retail firm's governance cycle. The FCA has been reviewing these reports and is increasingly focused on whether they reflect genuine outcome analysis or are simply attestation documents. Boards that receive a Consumer Duty report containing real data on vulnerable customer outcomes, fair value assessment results and consumer understanding testing are demonstrating the governance standard the FCA expects. Boards receiving a general assurance statement are not.
The FCA's priority areas in 2026 include: fair value in consumer credit, particularly for products where ongoing charges do not correspond to ongoing service; vulnerable customer identification in wealth management and investment advisory services; and consumer understanding of complex products including structured investments and high-risk instruments. Firms whose Consumer Duty framework was built for July 2023 but has not been actively developed since should treat this as an urgent remediation priority.
SMCR: Personal Accountability Is Now Real Enforcement
The Senior Managers and Certification Regime has been in place since 2016 for banks and 2019 for solo-regulated firms. The FCA's enforcement track record under SMCR now extends to individual senior managers, and the pattern of cases reveals consistent expectations about what adequate reasonable steps look like — and what they do not.
The Duty of Responsibility requires SMF holders to take reasonable steps to prevent regulatory failures within their area of accountability. The FCA's assessment of whether those steps were adequate is not a theoretical exercise. It looks at what MI the senior manager received, whether they asked the right questions, what actions they took when concerns were raised, and whether their governance documentation evidences an active oversight role rather than passive receipt of reports. What the FCA looks for in practice has become significantly clearer through its enforcement decisions, and senior managers who have not reviewed their oversight arrangements against those decisions are taking on unnecessary personal risk.
The recruitment of SMF16 and SMF17 holders remains one of the most sensitive areas for FCA-regulated firms. The compliance officer and MLRO functions carry significant personal accountability under SMCR, and firms that fill these roles with individuals who do not have the specific regulatory knowledge applicable to the firm's activities consistently generate FCA queries at the Form A stage and more significant problems thereafter. The FCA's fit and proper assessment is looking for genuine competence, not CV length.
Financial Crime: POCA, AML and Sanctions in 2026
The financial crime compliance landscape in 2026 is shaped by three intersecting frameworks: the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017, and the sanctions regime administered by OFSI. Together they create a web of obligations that touch every FCA-regulated firm, regardless of size or sector.
The Proceeds of Crime Act creates the primary criminal prohibition on money laundering and the statutory basis for the suspicious activity reporting regime. Firms that do not have a clear understanding of the POCA consent mechanism and the DAML process — and the tipping-off offences that restrict what firms can say to customers once an SAR has been filed — are operating with a significant compliance gap. The MLRO's role under POCA is not merely administrative: it carries personal criminal exposure if the firm processes transactions that constitute money laundering without the appropriate authorisation.
The Regulation 18 firm-wide risk assessment under the MLR 2017 is the document that the FCA will examine first in any AML supervisory engagement. Assessments that are generic, template-based or fail to reflect the firm's actual customer base, geographic exposure and product risk profile do not satisfy the regulatory standard. The FCA expects the risk assessment to be a living document that drives the calibration of CDD, transaction monitoring and SAR processes — not a compliance artefact filed after the annual policy review.
Sanctions compliance has become significantly more operationally demanding in recent years, with the UK sanctions regime diverging from the EU framework post-Brexit and the frequency of new designations increasing substantially. For payment firms, the challenge of balancing screening speed against accuracy is a live operational problem: real-time payment rails leave minimal processing time for screening checks, and fuzzy matching thresholds that are too low generate alert volumes that overwhelm compliance teams, while thresholds that are too high create genuine miss risks. Getting this calibration right requires a documented methodology, regular testing and annual review — not a vendor default configuration applied at implementation and left unchanged.
For customer due diligence, the triggers for enhanced due diligence under the MLR 2017 — high-risk third countries, PEP status, complex transaction structures and certain high-risk product types — create mandatory obligations that must be embedded in the firm's onboarding and periodic review processes. The FCA's view of what constitutes adequate EDD documentation has become more demanding: a checkbox confirming EDD was conducted is not evidence. The file must show what information was obtained, how it was assessed, and how the risk was mitigated.
Financial Promotions: A Tightened Regime With Active Enforcement
The FCA's approach to financial promotions enforcement has become significantly more assertive since the introduction of the financial promotions regime reforms in 2023-24. The extension of the regime to cryptoasset promotions, the introduction of the Financial Promotions Gateway for authorised approvers, and the FCA's InvestSmart campaign have all increased the regulatory salience of financial promotions compliance.
For investment firms, wealth managers and consumer credit providers, the financial promotions obligations touch every piece of client-facing communication: not just traditional advertisements, but social media posts, email campaigns, website content, pitch materials and even informal communication that constitutes an invitation or inducement to engage in investment activity. Firms that have not mapped their communication channels against the financial promotions framework — identifying which communications are promotions, which exemptions apply, and what approval processes are in place for non-exempt promotions — have a material compliance gap.
The Section 21 approval mechanism, under which an FCA-authorised person approves a financial promotion on behalf of an unauthorised communicator, now requires the approver to hold a specific gateway permission. Firms that have been operating as Section 21 approvers without this permission, or whose processes for assessing the compliance of promotions they approve are not robust, face significant enforcement risk.
Governance: SYSC 4 and the Four-Eyes Principle
The FCA's SYSC 4 governance requirements set the baseline for how regulated firms must structure their management and control functions. The four-eyes principle — requiring at least two individuals to manage the firm's business — is more demanding in practice than it appears: it requires genuine joint management, not a nominal second signatory. The management body must collectively have the expertise to oversee the firm's principal activities and risks, and the firm's organisational structure must have clear, documented lines of responsibility.
In 2026, the FCA's supervisory focus on governance has extended to the adequacy of compliance and risk function resourcing. Firms whose compliance officer is carrying an unmanageable workload, or whose risk function lacks the independence to provide genuine second-line challenge to the business, are consistently identified as having governance weaknesses. The test is not whether the compliance function exists, but whether it has the resource, authority and independence to function effectively.
Disclosure and Notification: Principle 11 and SUP 15
Two of the most consistently breached regulatory obligations in FCA-regulated firms are also among the least well understood: the Principle 11 disclosure obligation and the specific notification requirements in SUP 15. Together they require firms to maintain an open and cooperative relationship with the FCA and to disclose, promptly, anything that the FCA would reasonably expect to be informed of.
The FCA's consistent message is that it treats firms differently depending on how they manage their supervisory relationship. A firm that discovers a significant compliance failure, acts promptly to remediate it, and notifies the FCA before it becomes aware through other channels is in a fundamentally different supervisory position from one that is reactive, slow to disclose, or that the FCA discovers has been aware of a material issue for months without notification. The Principle 11 obligation is not a technicality. It is the foundation of the FCA's supervisory model, and breaching it consistently leads to escalated supervisory engagement and enforcement action.
The Resourcing Challenge: Compliance Leadership in 2026
The regulatory demands described above converge on a single practical challenge: regulated firms need compliance professionals who can genuinely lead across multiple regulatory frameworks simultaneously, advise boards on their Consumer Duty obligations, manage the MLRO function under POCA, design the transaction monitoring calibration, and engage constructively with FCA supervisors. This is a demanding combination of skills that is not widely available at the level the FCA's standards require.
The market for experienced SMF16 holders, MLROs and compliance directors has been structurally tight for several years, driven by the increased personal accountability that SMCR places on individuals in these roles and the consequential increase in their negotiating power. Firms that approach compliance recruitment with salary benchmarks calibrated to 2020 levels, or that expect an SMF16 holder to manage a compliance framework that requires three full-time professionals, will consistently fail to attract or retain the talent they need.
The most effective approach to compliance resourcing in 2026 — particularly for smaller regulated firms that cannot sustain a full compliance team — is the fractional or interim model: engaging a senior compliance professional on a part-time or project basis who brings the specific expertise the firm needs at a particular moment in its regulatory lifecycle, without the full-time cost of a permanent hire at that seniority level. This model has become significantly more sophisticated since the early SMCR implementations, with a growing market of experienced compliance professionals who operate on exactly this basis.
Conclusion
The regulatory obligations facing FCA-regulated firms in 2026 are not new, but the FCA's willingness to enforce them against both firms and individual senior managers is at a level the sector has not seen before. Consumer Duty evidencing, SMCR reasonable steps, AML framework quality, financial promotions compliance and governance adequacy are all active supervisory priorities. Firms that have treated the years since SMCR implementation as a time to stabilise their frameworks rather than actively develop them are likely to find that stabilisation was insufficient.
The common thread across all of these areas is that the FCA is looking for evidence of genuine governance — boards that receive meaningful MI, compliance functions that provide genuine challenge, senior managers who can demonstrate what they knew and what they did, and firms that come to the regulator proactively rather than reactively. That standard of governance is achievable, but it requires the right compliance leadership, adequate resourcing, and an organisational culture that treats regulatory compliance as a board-level priority rather than a support function overhead.
About the author: Adrian Lawrence FCA is the founder of FD Capital Recruitment Ltd, an ICAEW Registered Practice (Co. No. 13329383) specialising in the placement of CFOs, Finance Directors and compliance professionals at FCA-regulated financial services firms. Adrian holds an ICAEW practising certificate as a Fellow Chartered Accountant. FD Capital's FCA regulatory knowledge centre provides in-depth practical guides for UK regulated firms across the full range of FCA compliance obligations.