The GRC Navigator
Your Bi-Weekly GRC Intelligence Briefing
On 11 February 2026, the FCA published PS26/1 Regulation of Deferred Payment Credit, the final rules bringing Buy Now Pay Later into the regulatory perimeter from 15 July 2026. This is not a consumer credit story. It is a conduct regulation story that will reshape how the FCA brings entire unregulated markets into the regulatory framework. The rules apply proportionate affordability checks to every transaction, impose pre-contract disclosures and missed payment protocols, require full FCA authorisation for DPC lenders, and expand Consumer Duty obligations. The market spans approximately 11 million users and £13 billion in annual volume, making this one of the largest regulatory entries of 2026.
Simultaneously, the FCA and PRA advanced their 2026 policy agenda with significant consultations on securitisation framework reforms (CP26/6 and CP2/26, published 17 February, closing 18 May), sustainability disclosures for listed issuers (CP26/5, published 30 January, closing 20 March), and a revised regulatory priorities framework signalling the end of the portfolio letter era (with sector-specific Regulatory Priorities reports replacing the Dear CEO model by month-end). The Bank of England held rates at 3.75% on 4 February in a split vote, with half the MPC preferring to cut 25 basis points. For boards, the period crystallises two competing pressures: the immediate operational burden of BNPL authorisation and implementation, and the longer-term strategic task of anticipating the FCA’s next perimeter expansions through the same template that brought BNPL inside.
FCA PS26/1: Regulation of Deferred Payment Credit (Buy Now Pay Later): Final Rules Published 11 February 2026dummyanimatedrotating
On 11 February 2026, the FCA published Policy Statement PS26/1, finalising the regulatory framework for Deferred Payment Credit (Buy Now Pay Later). These are the rules that will bring an estimated 11 million users and £13 billion in annual transaction volume into the FCA perimeter from 15 July 2026 (Regulation Day). The rules represent a significant departure from traditional consumer credit regulation, applying conduct-based requirements rather than prescriptive affordability assessment formulas.
- Affordability checks: DPC lenders must conduct proportionate affordability checks for every transaction, including transactions under £50. The rules do not mandate specific criteria or scoring models. Instead, firms must assess whether the consumer can afford the transaction without undue hardship, with flexibility on method proportionate to transaction size and risk profile. This is a conduct requirement, not a technical checkbox.
- Pre-contract disclosures: DPC lenders must provide key information before credit is granted, including the right to withdraw, missed payment consequences, access to free debt advice, and guidance on Consumer Duty obligations. The standards align with Consumer Credit Act precedent but with calibration for the BNPL market structure.
- Missed payment protocols: Lenders must provide clear information about consequences of missing payments, including any interest, fees, or impact on credit files. Collections practices must comply with FCA standards on treating customers fairly, with particular emphasis on protecting vulnerable customers.
- FCA authorisation required: All DPC lenders require full FCA authorisation. Existing DPC providers operating under the Temporary Permissions Regime (TPR) have until 1 July 2026 to secure formal authorisation. The TPR window is 15 May – 1 July 2026, providing firms a final opportunity to cure deficiencies before the deadline.
- Consumer Duty applies: Consumer Duty provisions (PRIN 2A.3 and related guidance) apply in full to DPC contracts. This means firms must design products and services with consumer good outcomes as the guiding principle, not compliance checklist.
- Financial Ombudsman and FSCS coverage: The Financial Ombudsman Service has jurisdiction over DPC disputes, expanding its remit. However, FSCS coverage (deposit protection) does not apply to DPC lenders, reflecting their status as credit providers rather than deposit-takers.
The BNPL regulation is a masterclass in how the FCA brings entire unregulated markets into the perimeter. The regulator did not apply the full Consumer Credit Act rulebook to BNPL. It designed a proportionate framework calibrated to market structure. This is the template for cryptoasset regulation (due October 2027), for unregulated investment advisers, for embedded finance. Fund managers operating in adjacent markets should study this text closely. This is how the FCA will rewrite your perimeter in the next five years.
The affordability check requirement for transactions under £50 is significant. It reverses the model where affordability became a checkbox at higher transaction sizes. For BNPL lenders, this means every customer interaction is a credit decision with governance consequences. The proportion of BNPL transactions under £50 is substantial, making this a major operational burden. Firms that treat the affordability check as a form-filing exercise will face enforcement risk. Firms that build it into product design and systems architecture will establish durable compliance.
Regulatory Updates
FCA CP26/5: Sustainability Disclosures for Listed Issuers: Final Rules Expected Autumn 2026dummyanimatedrotating
Published on 30 January 2026 (immediately before this period), FCA CP26/5 proposes the UK Sustainability Reporting Standards, representing a significant expansion of disclosure obligations for listed companies. The consultation closes on 20 March 2026, with a policy statement expected in autumn 2026 and mandatory application from 1 January 2027. For listed companies and their advisers, this is the critical rulemaking exercise of the first half of 2026.
- Scope: The rules would require listed issuers to disclose climate-related, biodiversity-related, and other sustainability matters using a principles-based framework aligned with international standards including TCFD, ISSB, and CSRD precedent.
- Timeline: Responses to CP26/5 close on 20 March 2026. A policy statement is expected in autumn 2026, with mandatory application from 1 January 2027 (initial reporting in March 2028). A transitional relief period of one year is proposed for smaller issuers.
- Governance implication: Listed company boards will need to establish governance frameworks for sustainability reporting, assign accountability for data collection and verification, and integrate sustainability metrics into existing financial reporting infrastructure before year-end 2026.
The CP26/5 timeline is aggressive: responses due 20 March, policy statement by autumn, implementation by 1 January 2027. Listed company boards should be mapping the disclosure requirements against current data infrastructure now. Many boards will discover that sustainability data either does not exist at required granularity, or is held in systems that cannot produce auditable disclosure. The gap between aspiration and infrastructure is the real compliance challenge for 2026.
FCA CP26/6 and PRA CP2/26: Securitisation Framework Reforms: Published 17 February, Closing 18 May 2026dummyanimatedrotating
On 17 February 2026, the FCA published CP26/6 and the PRA published CP2/26, the joint consultation on significant reforms to the UK securitisation framework. This is one of the most significant competitiveness reforms in UK asset management regulation. The consultation closes on 18 May 2026, with implementation expected in Q2 2027.
- Principle-based due diligence: The PRA proposes replacing prescriptive due diligence requirements with a principle-based approach requiring investors to assess securitisation risks proportionate to transaction complexity and risk profile. This removes formulaic compliance checklist requirements.
- Non-UK originator risk retention verification: The PRA proposes removal of the requirement that PRA-regulated investors verify non-UK originator risk retention compliance. This is the transformative change: it unlocks access to US CLO structures for the first time. The removal recognises that investor due diligence on US CLOs has matured sufficiently that third-party verification of US originator compliance is redundant. For credit fund managers, this could reshape US allocation decisions materially.
- Framework alignment: The proposals align PRA and FCA requirements, reducing duplication and harmonising definitions. Single regulatory framework for securitisation across prudential and conduct dimensions.
- Market disclosure and exemptions: Streamlined market disclosure requirements and exemptions for certain securitisation structures, particularly single-loan securitisations and resecuritisation structures. The goal is to reduce compliance burden for market-standard structures while maintaining investor protection for complex risks.
The removal of non-UK originator risk retention verification is a strategic competitiveness move. The UK is explicitly diverging from EU frameworks to unlock cross-border capital allocation. For asset managers running global credit strategies, this reform could be the single most significant change to capital access this year. The compliance teams running US CLO reviews should be mobilising now to model the impact on their portfolio construction strategies.
Bank of England MPC Holds Rate at 3.75%: 4 February 2026, Split Vote 5-4dummyanimatedrotating
On 4 February 2026, the Bank of England’s Monetary Policy Committee voted 5-4 to hold the base rate at 3.75%. Five members preferred to hold, citing the need for further disinflation evidence. Four members preferred a 0.25% cut, indicating that near-term rate reductions remain a genuine policy option.
- Forward guidance: The split vote signals uncertainty about the timing of rate cuts. Market expectations for Q2 cuts have been tempered, though not eliminated.
- Implications for fund strategies: For funds with rate-sensitive positioning, the hold reinforces the case for dynamic interest rate hedging rather than static directional positioning. The 5-4 split is closer than some expected, creating elevated volatility risk in fixed income markets.
FCA Regulatory Priorities Framework: New Sector-Specific Reports Launch 24 February 2026dummyanimatedrotating
On 24 February 2026 (just outside the formal period but signalling the new supervisory framework), the FCA launched its Regulatory Priorities webpage, replacing the Dear CEO and portfolio letter model that characterised FCA communications since 2020. The new model publishes sector-specific Regulatory Priorities reports at the start of the supervisory year, telling firms exactly which workstreams will receive attention.
- Scope: The FCA plans nine sector-specific reports covering consumer investments, pensions, retail banking, mortgages, consumer finance, wholesale markets, insurance, payments, and digital assets.
- Shift in accountability: Under the old model, the FCA told firms what it had found (portfolio letters). Under the new model, it tells firms what it will find. This shifts accountability: firms can no longer claim they did not know what the regulator was examining.
The shift from portfolio letters to Regulatory Priorities reports is not a communication change. It is a supervisory model change. CCOs planning their 2026 compliance monitoring programmes must map each report against their business activities within 30 days of publication. The question for boards is no longer: have we responded to the portfolio letter? It is: have we aligned our governance framework to the priorities the FCA has told us it will examine this year?
Buy Now Pay Later regulation is not a consumer credit story. It is a conduct regulation story – and it rewrites the template for how the FCA brings entire markets into the perimeter.Asad Bukhory
PRA Developments
PRA CP2/26: Securitisation Framework Reforms: Joint Consultation with FCA, Closing 18 May 2026dummyanimatedrotating
Published on 17 February 2026 alongside FCA CP26/6, the PRA’s CP2/26 consultation sets out detailed proposals for significant reforms to the UK securitisation framework. This is a banking and credit regulation story with profound implications for cross-border capital flows.
- Single risk approach: The PRA proposes consolidating two separate risk assessment modalities (CRR modelled approach and standardised approach) into a single risk approach for securitisations. This simplification reduces compliance burden for firms managing securitisation portfolios.
- Streamlined market disclosure: Proposals for streamlined disclosure requirements, reducing repetitive market disclosure while maintaining investor protection.
- Descoping single loan securitisations: The PRA proposes exempting single loan securitisations from certain detailed disclosure requirements, reflecting their lower complexity and more transparent underlying assets.
- Resecuritisation exemptions: Two resecuritisation structures would be exempted from the ban on resecuritisations under certain conditions, allowing greater flexibility for structured credit markets.
- Mortgage Guarantee Scheme capital treatment: New capital treatment for loans underlying the Government’s Mortgage Guarantee Scheme, reflecting their lower risk profile post-government guarantee.
- Consultation closes: 18 May 2026. Implementation expected Q2 2027.
The removal of non-UK originator risk retention verification requirements is the single most significant change for asset managers. This opens access to US CLO structures that have been difficult to access without third-party verification of US originator compliance. For credit fund managers, this could be the defining competitiveness reform of 2026. Allocations teams should be mobilising now.
PRA CP3/26: Rule Changes for HM Treasury Overseas Prudential Requirements Regimedummyanimatedrotating
Published on 19 February 2026 (just outside period), the PRA’s CP3/26 consultation sets out rule changes to accommodate HM Treasury’s new regulatory regime for overseas firms. This is technical rule-harmonisation work reflecting the new permissions framework for cross-border banking activity.
Fund Launches
Tycho Capital Launches European Equity Long-Short UCITS Funddummyanimatedrotating
On 16 February 2026 (just outside period), Tycho Capital, an emerging alternative asset manager, launched a European equity long-short UCITS fund, adding to the growing range of hedge fund strategies available through regulated UCITS wrappers. The fund targets European equity markets with gross exposure flexibility up to 200%.
UK Fund Flows: February 2026 Trends Show Continued Shift to Bond and Money Market Strategiesdummyanimatedrotating
February 2026 fund flow data shows continued strong inflows into fixed income and money market strategies, with Vanguard FTSE UK Equity Income Index entering the top 10 most-bought funds alongside Artemis Global Income. The flow data reflects institutional and retail allocation shifts away from equities toward bond and money market exposures, responding to interest rate uncertainty and elevated geopolitical risk.
Enforcement
Richard John Howson (Carillion): £237,700 Fine: 16 February 2026: Recklessness and Material Risk Escalation Failuredummyanimatedrotating
On 16 February 2026, the FCA published its enforcement decision against Richard John Howson, former Group Chief Executive of Carillion PLC. Howson was fined £237,700 for breaches of MAR Article 15, Listing Rule 1.3.3R, and Listing Principles 1 and 2. This case completes the Carillion enforcement trilogy (Adam Shaheen and Giles Kronin were each fined in January 2026). The case is significant not for the quantum of penalty, but for what it reveals about governance failure at board level.
- The core conduct: In October 2016, Howson was aware that Carillion faced a £173 million likely exposure in major projects based on a significant CCS assessment. Despite this material exposure, he did not alert the board or adjust financial targets. Revenue and profit were materially overstated for three consecutive reporting periods (2016, 2017, and H1 2018).
- The legal finding: The FCA found Howson acted recklessly in breaches of MAR Article 15 (insiders must refrain from disclosing inside information except in normal course of duty or for legitimate interests). The finding was not dishonesty. It was recklessness: knowing about material risk and failing to disclose or escalate it.
- Corporate penalty foregone: Carillion would have faced a penalty of £37,910,000, but the company is in liquidation. Individual accountability replaced corporate accountability.
- Lessons for governance: The case shows that enforcement focus has shifted from technical financial reporting to governance culture. Howson was not accused of cooking the books. He was accused of failing to escalate known material risk to the board. If your firm’s board risk escalation process relies on individual judgment rather than defined triggers, this case applies to your governance framework.
The Carillion enforcement is a governance case disguised as a financial reporting case. Three years of board packs built on overstated financial data means three years of governance failure at board level. The question every board should ask: if our chief executive became aware of material risk that had not been escalated to the board, would our governance framework detect it? If the answer requires faith in individual integrity rather than evidence of specific control architecture, the governance gap is real. The FCA is now enforcing on boards’ ability to detect and respond to escalation failures by individuals in position to know.
FCA Targets Annex 1 Companies in Expanded AML Enforcement Drive: February 2026dummyanimatedrotating
In February 2026, the FCA signalled an expanded focus on AML enforcement targeting firms listed in Annex 1 of the Money Laundering Regulations (casinos, art dealers, precious metals dealers, and other non-bank financial institutions). This represents a broadening of the FCA’s enforcement footprint beyond traditional regulated financial services.
- Scope: Annex 1 firms face increased supervisory scrutiny for AML/CFT controls, beneficial ownership verification, transaction monitoring, and sanctions screening. The FCA is expanding enforcement resources to this population.
- Implication: For boards of firms in the Annex 1 population, the enforcement signal reinforces that AML/CFT controls are not optional or regulatory overhead. They are substantive compliance obligations with enforcement consequences.
Market Developments
Sidley UK-EU Investment Management Update: February 2026 Regulatory Developmentsdummyanimatedrotating
Sidley Austin’s investment management team published an update on UK-EU regulatory developments in February 2026, covering FCA fund tokenisation consultations, short selling regime updates, and IFPR capital requirements. The update highlights continued regulatory divergence between UK and EU frameworks post-Brexit, requiring UK asset managers to maintain dual-jurisdiction compliance strategies.
FCA Insurance Outlook 2026: Clifford Chance Analysis of FCA Prioritiesdummyanimatedrotating
Clifford Chance published analysis of the FCA’s 2026 insurance regulatory priorities, including Consumer Duty implementation, ESG obligations, and operational resilience. For insurance boards, the analysis provides a practical roadmap for anticipated supervisory engagement across conduct and prudential dimensions.
Apollo-Schroders Partnership: US-Focused Collective Investment Trust Launch Q2 2026dummyanimatedrotating
In February 2026, Apollo and Schroders announced a partnership to launch a US-focused Collective Investment Trust targeting UK institutional investors, with launch expected in Q2 2026. The partnership signals growing appetite for UK-US cross-border asset management collaboration, particularly in credit strategies.
Calendar
February 2026 (Remaining)
- 17 Feb FCA CP26/6 and PRA CP2/26 (Securitisation Framework Reforms) published
- 24 Feb FCA Regulatory Priorities webpage launched, replacing portfolio letter model
March 2026
- 4 Mar FCA Consumer Investments Regulatory Priorities report published
- 12 Mar FCA CP26/4 (Cryptoasset) consultation closes
- 20 Mar FCA CP26/5 (Sustainability Disclosures) consultation closes
- 19–20 Mar Bank of England MPC decision
April – June 2026
- 6 Apr FCA PS25/20 (Consumer Complaints Investigation) regime takes effect
- 24 Apr PRA CP4/26 (Solvency II Own Funds) consultation closes
- 18 May FCA CP26/6 and PRA CP2/26 (Securitisation Reforms) consultations close
- 15 May–1 Jul BNPL Temporary Permissions Regime window (authorisation deadline 1 July 2026)
Key Dates Later in 2026
- 15 Jul BNPL Regulation Day – final rules effective, unauthorised DPC providers must cease
- 1 Sep NFM rules effective
- Autumn 2026 FCA CP26/5 (UK Sustainability Reporting Standards) policy statement expected
- 1 Jan 2027 UK SRS mandatory for listed issuers; Basel 3.1 implementation; Operational Resilience rules effective
- Oct 2027 FCA Cryptoasset Regime takes effect
The Carillion enforcement concluded with a fine against a former CEO who knew about a £173 million exposure in major projects but failed to tell the board. If your firm’s chief executive were aware of a material risk that had not been escalated to the board, would your governance framework detect it – or would it rely on that individual choosing to disclose?
We’d welcome your perspective. The best responses may feature in a future edition.
The FCA’s BNPL regulation represents a template for how the regulator will bring entire unregulated markets into the perimeter. The model is instructive: proportionate rules designed for a market structure that differs materially from traditional consumer credit; temporary permissions regime allowing firms to build compliance infrastructure before full authorisation; phased implementation requiring coordination across product development, credit policy, systems, and governance. When cryptoasset regulation takes effect in October 2027, the same playbook will apply. When unregulated investment advisers come under the perimeter, the same approach will govern. For fund managers running credit strategies or operating in adjacent markets, this regulatory template should be studied as the blueprint for all future perimeter expansions.
The securitisation reforms announced on 17 February signal a different kind of structural change: the UK is actively diverging from EU frameworks to unlock cross-border capital flows. The removal of the requirement that PRA-regulated investors verify non-UK originator risk retention is potentially transformative for US CLO investment. This divergence is not accidental. It is strategic competitiveness policy disguised as technical rule-making. For asset managers running credit strategies, the ability to access US CLO structures without cross-border compliance friction could reshape capital allocation decisions materially. For boards, the reforms illustrate a critical strategic principle: UK regulatory divergence from the EU creates both competitive opportunities and governance risks. Firms operating across both jurisdictions need compliance frameworks that accommodate rule differences explicitly, not frameworks that assume approximate equivalence.
The enforcement landscape in the period is dominated by two cases with governance implications: Richard John Howson’s £237,700 fine for awareness of material risk at Carillion, and the FCA’s expanded AML enforcement focus on Annex 1 firms. The Howson case is the more significant. The former CEO was not accused of dishonesty. He was accused of recklessness: knowing about a £173 million exposure in October 2016 but failing to alter board reporting or financial targets. The distinction matters profoundly. Dishonesty is harder to anticipate. Recklessness – the failure to escalate a known risk – is a governance failure. If your board’s risk escalation protocols require individual judgment rather than defined triggers, the Carillion model applies to your firm.
To receive our bi-weekly regulatory insights directly in your inbox, subscribe to The GRC Navigator:
Subscribe NowFounded by Asad Bukhory, helps financial institutions turn GRC challenges into growth assets.
Navigation
Copyright © 2026 Artizan Governance | All Rights Reserved