The GRC Navigator
Your Bi-Weekly GRC Intelligence Briefing
This was the fortnight the FCA tried to prove it means it when it calls itself a reform-minded regulator. On 30 April it published PS26/7, finalising guidance that lets asset managers use distributed ledger technology within existing rules and introducing an optional Direct to Fund dealing model, with chief executive Nikhil Rathi framing tokenisation, wholesale reform and a lighter Senior Managers and Certification Regime as a single push to cut friction and defend the UK’s position as a £16.5 trillion asset management hub. On 22 April the FCA and PRA confirmed the first phase of SM&CR reform, cutting certification roles by around 15% and raising enhanced-firm thresholds by 30%, with the Government committing to halve the regime’s administrative burden.
The deregulatory current ran through almost everything: simpler short selling rules, a consultation to strip the seven-day delay from IPO research, and a crypto perimeter guidance consultation ahead of the authorisations gateway opening on 30 September. But the FCA was equally clear that lighter process does not mean lighter standards. Sapia agreed to pay £19.6 million to WealthTek clients after failing to segregate client money, the FCA moved to enforcement against Hartley Pensions, and it ran its first crackdown on illegal peer-to-peer crypto trading. The PRA published a Business Plan 2026/27 that cuts 140 roles while sharpening its focus on private credit and a second system-wide stress test. The message is consistent: the FCA will remove cost wherever it can, and come down hard wherever controls fail.
The FCA Opens the Door to Tokenised Funds, and a New Way to Dealdummyanimatedrotating
On 30 April 2026 the FCA published PS26/7, finalising guidance on how asset managers can use distributed ledger technology within the existing rulebook, and confirming new rules to make fund dealing more efficient, including an optional Direct to Fund (D2F) model that lets investors deal directly with a fund whether it is traditional or tokenised. The regulator framed this as delivering what the market asked for: a practical framework that gives firms confidence to innovate without waiting for a new rulebook.
- The prize: The UK is a leading asset management hub, with around 2,600 firms managing £16.5 trillion for UK and global clients. The FCA has tied tokenisation directly to its growth strategy, and committed in its December 2025 letter to the Prime Minister to progress a roadmap for digital assets in asset management.
- What changes operationally: The Direct to Fund model removes intermediated layers from the dealing chain. Simon Walls, executive director of markets, said adoption will be driven by firms and investors, and that the guidance gives confidence in how tokenisation can operate within the rules now and in future.
- Industry read: The Investment Association’s John Allan called it a meaningful advance in UK funds market infrastructure, pointing to confidence around public-chain models where the right controls are in place and the use of digital cash tools for operational needs.
- What comes next: The policy statement sits within a wider roadmap, with the FCA signalling further work on DLT in UK wholesale markets and, later this year, consultations on decentralised finance and operational resilience guidance for firms using DLT.
This is not a crypto story dressed up for fund managers. It is the FCA accepting that the plumbing of the funds industry is going to change, and choosing to write the map rather than police the territory after the fact. The choice of guidance within existing rules, rather than a new sourcebook, is deliberate: it lets the regulator move at the market’s pace and adjust as models emerge.
The operational risk in tokenisation does not disappear because the FCA has blessed the direction. It moves. A Direct to Fund model collapses parts of the dealing chain that used to carry their own controls, reconciliation and oversight. Boards approving a tokenisation project should ask who now owns the controls those intermediaries used to run, and whether the firm’s operational resilience and valuation governance have been re-mapped to the new architecture. The guidance is permissive; the accountability is not.
There is a competitive clock here too. The FCA has handed every UK manager the same framework on the same day. The advantage will go to the firms that already understand their data, custody and dealing infrastructure well enough to act, and to those that engage with the forthcoming wholesale DLT and DeFi consultations rather than waiting for the rules to settle. Tokenisation will reward the operationally literate and expose the rest.
Regulatory Updates
FCA and PRA Confirm Phase 1 of SM&CR Reformdummyanimatedrotating
On 22 April 2026 the FCA and PRA confirmed the first phase of reform to the Senior Managers and Certification Regime, published as FCA PS26/6 and PRA PS12/26, alongside a Government consultation response setting up a more far-reaching second phase. The regulators kept the core principle of senior leader accountability while cutting cost and complexity around it.
- What changes now: The number of certification roles required falls by around 15% by removing the need to certify people for multiple overlapping functions. Enhanced-firm thresholds rise by 30% to reflect inflation since 2019, so only larger, more complex firms meet enhanced standards. Firms now have up to 12 weeks to submit a senior manager application after an unexpected or temporary change.
- What Phase 2 threatens: The Government proposes removing the Certification Regime from legislation entirely and giving regulators more freedom to cut the number of senior management functions needing pre-approval. This is part of the Leeds reforms, with a stated aim of halving the SM&CR’s administrative burden. The regulators plan to consult on wider changes later in 2026.
- The accountability line holds: Economic Secretary Lucy Rigby and FCA deputy chief executive Sarah Pritchard both stressed that high governance standards remain. FCA metrics show 99.7% of senior manager applications determined within the current three-month deadline; the PRA reports 100%.
Read the direction, not just the relief. Cutting 15% of certification roles is welcome, but the firms that benefit are the ones that can evidence why a role no longer needs certifying, not the ones that simply stop certifying. The harder question Phase 2 raises is cultural: if the Certification Regime leaves legislation, the burden of proving that non-senior staff are fit and proper shifts from a regulatory tick-box to the firm’s own governance. Boards should treat this as a transfer of responsibility, not a removal of it.
Year 2 Consumer Duty Board Reports: Progress, and Three Persistent Gapsdummyanimatedrotating
On 16 April 2026 the FCA published its review of second-year Consumer Duty board reports, drawing on 180 first-year and 80 second-year reports. The verdict: the Duty is making a difference, with stronger governance, clearer action plans and broader data, but the quality and depth of analysis remains variable, and three gaps recur.
- Where firms improved: Boards now formally review and approve reports and sign off actions, many have retained their Consumer Duty Board Champion, and firms are drawing on wider quantitative and qualitative data, including better segmentation of vulnerable customers.
- Where firms fall short: Some present extensive data without explaining what it says about outcomes, monitoring of third-party and distribution-chain outcomes is often weak, and many boards do not document the challenge they gave. The FCA plans to consult this year on changes to rules and guidance on distribution chains.
- The board test: The FCA wants minutes that show the questions asked and the follow-ups requested, and reports that go beyond management information dashboards to draw conclusions and identify emerging risks. The third reporting cycle is now on the horizon.
The most uncomfortable finding is the one about documented challenge. A board that approves a polished report but leaves no trace of having interrogated it has, in the FCA’s eyes, not done its job. For asset managers relying on platforms and intermediaries, the distribution-chain point is sharper still: you remain responsible for outcomes you do not directly deliver. Before the third cycle, test whether your board papers would convince a supervisor that someone senior actually pushed back.
FCA Consults on Cutting the Seven-Day Delay from IPO Researchdummyanimatedrotating
On 27 April 2026 the FCA published CP26/14, proposing to remove the requirement for a seven-day delay before connected research on an IPO can be published, and to drop the rule requiring firms to give independent analysts the same information as their own analysts. The 2018 rules were meant to encourage unconnected research but, the FCA says, did not achieve that aim while adding cost, complexity and a competitive disadvantage versus other listing venues.
- The effect: Removing the delay is expected to cut IPO lead times by around seven days, part of the FCA’s drive to reduce friction in UK capital raising. Jon Relleen, director of infrastructure and exchanges, called it smarter regulation that supports growth while keeping the UK a trusted place to raise capital.
- The process: No other rule changes are proposed at this stage, though the paper asks whether further reform of the 2018 information-flow rules is warranted. The consultation delivers a commitment from the FCA’s December 2025 letter to the Prime Minister. Feedback closes on 29 May 2026.
Faster IPOs are good for issuers and for the managers who buy into them, but compressing the research window also compresses the time analysts have to form an independent view. Buy-side firms should not assume that less friction means less diligence on their part. If the lead time falls, the burden of independent scrutiny shifts further onto the investor.
FCA Finalises Simpler Short Selling Rulesdummyanimatedrotating
On 16 April 2026 the FCA finalised a simpler UK short selling regime that reduces reporting burdens while keeping regulatory oversight. Under the Government’s repeal-and-replace programme, the FCA will now publish aggregated net short positions in each company rather than identifying individual short sellers.
- What firms gain: A more workable reporting timetable with extra time to calculate and submit short position reports, and simplified rules for market makers, who can replace frequent exemption notifications with a single annual confirmation.
- What stays: The FCA’s powers to intervene in exceptional market conditions, including emergency measures, are unchanged, with a deliberately high bar for their use. Jon Relleen described the package as cutting administrative burden while retaining the information the regulator needs.
Aggregated rather than named disclosure is a quiet but meaningful shift. It reduces the reputational exposure of taking short positions, which over time may deepen liquidity and price formation. Managers running long-short strategies should welcome the reduced notification load, but should confirm their systems are configured for the new timetable rather than assuming the old one still applies.
FCA Consults on Guidance for the UK’s Future Crypto Regimedummyanimatedrotating
On 15 April 2026 the FCA opened a consultation on perimeter guidance for the UK’s cryptoasset regime, which will take full effect from October 2027. The guidance clarifies how firms should interpret the regulated activities of issuing qualifying stablecoins, operating trading platforms, dealing and arranging deals, safeguarding cryptoassets and staking. Parliament confirmed the scope of regulation through a statutory instrument made on 4 February 2026.
- The timeline: Crypto firms can apply for authorisation from September 2026, with the authorisations gateway opening on 30 September. Substantive rules will be published this summer, with the perimeter guidance final policy due in autumn. This consultation closes on 3 June 2026.
- What follows: The FCA will later consult on decentralised finance guidance, operational resilience guidance for firms using distributed ledger technology, and updates to the Financial Crime Guide for cryptoasset firms. Until the regime is live, crypto remains largely unregulated except for financial promotions and financial crime.
The crypto perimeter and the fund tokenisation guidance are two ends of the same strategy. Traditional managers exploring tokenised funds need to know where the asset-management rulebook ends and the cryptoasset regime begins, because the same token can sit on either side depending on how it is structured. Firms building digital-asset capability should map their activities against this perimeter guidance now, well before the September 2026 gateway, to avoid discovering they need an authorisation they did not plan for.
The FCA is cutting friction everywhere at once, but the accountability core of the rulebook is not moving.Asad Bukhory
PRA Developments
PRA Business Plan 2026/27: Leaner Regulator, Sharper Focus on Private Creditdummyanimatedrotating
Published on 17 April 2026, the PRA’s Business Plan 2026/27 confirms a regulator trying to do more with less. It cuts headcount by around 140 roles to 1,385 full-time staff and trims its budget to £347 million, while sharpening supervisory focus on the risks that matter most. Chief executive Sam Woods, whose term ends in June, hands over to Katharine Braddick in July. The PRA now regulates 1,254 firms: 686 deposit-takers and 568 insurers.
- Private credit in the crosshairs: Counterparty credit risk to non-bank financial institutions is a named supervisory priority. The PRA warns that gaps in data quality and aggregation mean many firms cannot form a complete view of their exposures to private markets, hedge funds and other NBFIs, and flags rising intraday exposures for firms financing electronic market-makers.
- A second system-wide test: The PRA is supporting the Bank of England’s second system-wide exploratory scenario, designed to show how private markets behave under severe but plausible stress, examining leverage, liquidity dynamics and interconnected exposures.
- The growth agenda: Alongside Basel 3.1 implementation towards 1 January 2027 and the FPC’s reduced system-wide Tier 1 capital benchmark of around 13% of risk-weighted assets, the PRA points to securitisation reform, a joint Scale-up Unit with the FCA, and a two-year cycle for periodic summary meetings.
Operational resilience note: jointly with the FCA and Bank, the PRA finalised in March 2026 a single standardised regime for reporting operational incidents and third-party dependencies, in force from March 2027. Climate expectations under SS5/25 require firms to show a credible timetable to close gaps from June 2026.
April Consultations: Funded Reinsurance, Fees and Low-Impact Amendmentsdummyanimatedrotating
The PRA used the second half of April to advance several technical consultations consolidated in its April Regulatory Digest. The headline item for the life sector is CP8/26 on funded reinsurance, published on 29 April, taking forward the next phase of the PRA’s approach after the Financial Policy Committee warned that growing use of FundedRe structures could build systemic risk in UK life insurance if poorly managed.
- Also consulted: CP7/26 on regulated fees and levies for 2026/27, published on 17 April alongside the Business Plan, and the Low Impact Amendments Consultation LIAC01/26 on proportional consolidation in the Groups Part of the PRA Rulebook, published on 23 April.
- Watch the deadline: LIAC01/26 closes on 21 May 2026, with implementation proposed for July 2026. Insurers should note the PRA’s intention to consult on a proportionate UK captive insurer regime later in 2026.
Fund Launches
Tokenised Funds and the Direct to Fund Model Reshape Product Designdummyanimatedrotating
The fortnight’s most consequential development for fund product teams was structural rather than a single raise. With PS26/7, the FCA has cleared the path for tokenised funds and an optional Direct to Fund dealing model, giving managers a sanctioned route to launch funds on distributed ledger technology within existing rules.
- Why it matters for launches: Tokenisation and D2F change the economics of bringing a fund to market, potentially lowering dealing costs and widening access. The FCA has explicitly linked this to opening up investment opportunities to a broader audience.
- The build-versus-wait choice: Firms now face a product decision, not just a compliance one. Early movers can design tokenised share classes with the FCA’s framework in hand, while others will wait for the wholesale DLT and DeFi consultations later in 2026.
The Retail Private-Markets Push Keeps Buildingdummyanimatedrotating
Beneath the tokenisation headline, the structural shift toward semi-liquid and retail-accessible private markets vehicles continued through April. The PRA’s Business Plan flags how far capital has moved into private credit and non-bank lending, and the FCA’s growth agenda is built around channelling long-term savings into these strategies through structures such as the Long-Term Asset Fund.
- The regulatory backdrop: Every new private-markets vehicle aimed at retail or defined contribution money lands into a regime where the FCA’s valuations and liquidity expectations, and the PRA’s system-wide stress work, apply from day one.
- The watch item: With both regulators naming private credit as a focus, managers launching into this space should expect scrutiny of liquidity-redemption alignment and valuation governance to scale with their assets, not lag them.
Enforcement
Sapia: £19.6m to WealthTek Clients After a Client-Money Control Failuredummyanimatedrotating
On 23 April 2026 the FCA censured Sapia Partners LLP and confirmed the firm had agreed to make a voluntary payment of £19,637,950 to WealthTek clients after failing to protect client money. Sapia held client money arising from the activities of WealthTek, which was its appointed representative before becoming directly authorised, and did not put adequate safeguards in place.
- The control failure: Sapia admitted it failed to separate key roles relating to client money. The people who could make payments from client money accounts also carried out the checks of those accounts required by FCA rules. That lack of segregation increased the risk that client money could be lost through misuse or poor management.
- The numbers: Of the £19.6 million, WealthTek’s administrators receive £19.1 million and the FSCS £500,000. The FCA chose not to fine Sapia because of its exemplary cooperation and voluntary payment, but says the penalty would otherwise have been £7,412,000 after a 30% settlement discount. Barclays was separately fined £3,093,600 and agreed a £6.3 million voluntary payment over the same matter.
- The wider case: WealthTek’s former principal partner, John Dance, faces a criminal trial at Southwark Crown Court in September 2027. Therese Chambers said poor safeguards around client money create opportunities bad actors exploit, and noted the investigation concluded in 12 months.
This is the most important governance lesson of the fortnight, and it is brutally simple. The breach was not exotic. The same people who could move client money also signed off the checks on it. That is a segregation-of-duties failure any board could have caught by asking one question. The case also makes clear that a firm carries the client-money risk of its appointed representatives. If you have ARs touching client money, the duty under Principle 10 and CASS is yours, not theirs. Test the four-eyes principle on every client-money account this week.
FCA Moves Toward Enforcement Against Hartley Pensions and an Individualdummyanimatedrotating
On 15 April 2026 the FCA set out plans to take action against Hartley Pensions Limited and an individual at the firm, issuing Warning Notices. Hartley, a Self-Invested Personal Pension operator, went into administration in July 2022. The FCA alleges Hartley provided false and misleading information and improperly withdrew and invested substantial customer pension funds without consent, to benefit an individual at the firm.
- The allegation: The individual is alleged to have dishonestly used the pension funds and made false representations to obtain money for a company they owned, then misled the FCA to conceal it. Warning Notices are not final decisions, and there is a right to make representations to the Regulatory Decisions Committee.
SIPP operators sit on other people’s retirement savings, which is exactly why the alleged conduct, moving client pension money without consent, is treated as a near-existential integrity failure. The publication of a Warning Notice Statement before any final decision is itself a signal: the FCA wants the market to see the direction of travel. Any firm holding custody of client assets should re-read this case as a warning about the gap between having controls and operating them.
FCA Runs First Crackdown on Illegal Peer-to-Peer Crypto Tradingdummyanimatedrotating
On 22 April 2026 the FCA carried out its first operation to disrupt illegal peer-to-peer crypto trading, targeting eight premises across London with HM Revenue & Customs and the South West Regional Organised Crime Unit. It issued cease-and-desist letters and gathered evidence supporting ongoing criminal investigations.
- The legal point: Peer-to-peer crypto trading carried out by way of business in the UK requires registration under the Money Laundering Regulations 2017, and there are currently no FCA-registered peer-to-peer crypto businesses. Steve Smart said unregistered traders pose a financial crime risk the FCA will work with partners to disrupt.
The timing is deliberate. As the FCA builds the legitimate crypto regime ahead of the September 2026 gateway, it is simultaneously demonstrating that the unregulated edges will be policed, not tolerated. For firms preparing crypto authorisation applications, the read-across is that financial crime controls are the gateway test, not an afterthought. The regulator is drawing a hard line between the regime it is building and the activity it intends to shut down.
Market Developments
Rathi Makes the Case for a Reform-Minded Regulatordummyanimatedrotating
On 30 April 2026, at the Association of Foreign Banks luncheon at Mansion House, FCA chief executive Nikhil Rathi set out the philosophy tying the fortnight’s announcements together: adaptive stability. The argument is that in a new era of pace and volatility, with AI capabilities he said are doubling roughly every seven months, holding rules in place is riskier than reforming them.
- The strength claim: London now sits a single point behind New York in the Global Financial Centres Index and hosts more than 160 foreign banks. Rathi cited high volumes, with quarterly growth of 69% in Brent trading, more than 100% in SONIA futures and 21% in gilts, as evidence that global clients trust the UK under stress.
- The reform tally: New listing and prospectus rules and a Public Offer Platform, securitisation and fixed income reforms, the strongest year for UK listings since 2021, mortgage rules letting lenders offer around £30,000 more to many borrowers, and the removal of the contactless payment cap. The fund tokenisation guidance and the SM&CR cuts were presented as the same thread.
- The non-negotiable: Rathi was explicit that none of this comes at the expense of standards. The FCA is bringing more market abuse and insider trading prosecutions than ever, consulting on a stronger transaction reporting regime, and treating financial crime as a national security issue in which firms are the first line of defence.
The speech is the operating manual for how to read this regulator. Every deregulatory move is paired with a hardening somewhere else: lighter SM&CR process but more data-led supervision, simpler short selling but unchanged emergency powers, an open crypto regime but raids on illegal traders. Firms that hear only the friction-cutting half will misjudge the FCA. The institutions that thrive will treat reform as an invitation to compete, and the integrity message as a warning not to cut corners while doing so.
Motor Finance Redress Scheme Faces Legal Challengedummyanimatedrotating
On 27 April 2026 the FCA confirmed that its motor finance compensation scheme had been challenged, calling the scheme the quickest, fairest and most efficient way to compensate consumers and warning that the challenge prolongs uncertainty that is not good for investment or a healthy motor finance market. It said it was considering its approach and would set out more shortly, the start of a sequence that would dominate the following fortnight.
- The context: Days earlier, on 23 April, the FCA had called on law firms and claims management companies to consider the position of their clients, stressing it has no vested interest in setting up a redress scheme and reminding consumers that complaining directly is free.
For lenders, the lesson is to plan for both outcomes at once. A scheme under legal challenge is neither confirmed nor cancelled, and the prudent finance function provisions for the range rather than the hope. The deeper signal is about regulatory durability: when a flagship redress scheme can be sent to a tribunal, firms cannot treat any single regulatory outcome as settled until the legal road is fully run.
Calendar
May 2026
- 11 May Cryptoasset firms can request pre-application meetings via the FCA’s Pre-Application Support Service.
- 13 May Deadline to register interest in the FCA’s voluntary ESG ratings reporting pilot.
- 21 May PRA LIAC01/26 Low Impact Amendments consultation closes; implementation proposed for July 2026.
- 29 May FCA CP26/14 (IPO research information flows) consultation closes.
June 2026
- 3 Jun FCA cryptoasset perimeter guidance consultation closes.
- From Jun Firms expected to show a credible timetable to close climate-risk gaps under PRA SS5/25.
- Jun Sam Woods’ term as PRA chief executive concludes.
July to Autumn 2026
- Jul Katharine Braddick becomes PRA chief executive.
- 30 Sep FCA cryptoasset authorisations gateway opens (applications from September 2026).
- Autumn FCA final policy statement on cryptoasset perimeter guidance.
- Later 2026 FCA and PRA to consult on SM&CR Phase 2 and a proportionate UK captive insurer regime.
Key Dates Later in 2026 and Beyond
- H2 2026 FCA to consult on distribution-chain rules under Consumer Duty, and on DeFi and DLT operational resilience guidance.
- 1 Jan 2027 Basel 3.1 final rules and the SDDT simplified capital regime take full effect.
- Mar 2027 Standardised operational incident and third-party reporting regime comes into force.
- Oct 2027 UK cryptoasset regime takes full effect.
Sapia was censured because the same people who could move client money also signed off the checks on it. So ask the uncomfortable version about your own firm: on every client-money or client-asset account, can the person who authorises a payment also approve the reconciliation that should catch it? If you cannot answer with certainty today, you have found this fortnight’s priority.
We’d welcome your perspective. The best responses may feature in a future edition.
The defining feature of this fortnight was a regulator cutting friction in almost every direction while refusing to move the accountability core of its rulebook. Fund tokenisation, simpler short selling, faster IPOs, a lighter Senior Managers regime and an open crypto perimeter all landed within two weeks. Read in isolation, each looks like deregulation. Read together, through Nikhil Rathi’s adaptive stability, they are something more disciplined: the FCA removing cost wherever it can, precisely so it can concentrate force wherever controls fail.
For regulated firms, this changes how risk should be read. The danger is hearing only the friction-cutting half. The same fortnight that opened the door to tokenised funds also produced a £19.6 million client-money settlement against Sapia for a basic segregation failure, enforcement steps against Hartley Pensions, and the first raids on illegal crypto trading. The pattern is consistent: lighter process is matched by harder enforcement, and the firms that confuse the two will be exposed.
The practical step this week is to separate the two messages and act on both. Take one reform that benefits you, tokenisation, short selling or the SM&CR cuts, and build the business case to use it. Then take the Sapia lesson and test the four-eyes principle on every account that touches client money or assets. Do not let the excitement of reform distract from the controls that enforcement is quietly tightening.
To receive our bi-weekly regulatory insights directly in your inbox, subscribe to The GRC Navigator:
Subscribe NowFounded by Asad Bukhory, helps financial institutions turn GRC challenges into growth assets.
Navigation
Copyright © 2026 Artizan Governance | All Rights Reserved