The GRC Navigator

Your Bi-Weekly GRC Intelligence Briefing

Issue 1615 February 2026

On 11 February 2026, the FCA published PS26/1 Regulation of Deferred Payment Credit, the final rules bringing Buy Now Pay Later into the regulatory perimeter from 15 July 2026. The rules regulate BNPL through conduct requirements rather than the consumer credit rulebook, using an approach the FCA is likely to reuse for other unregulated markets. The rules apply proportionate affordability checks to every transaction, impose pre-contract disclosures and missed payment protocols, require full FCA authorisation for DPC lenders, and expand Consumer Duty obligations. The market spans approximately 11 million users and £13 billion in annual volume, making this one of the largest regulatory entries of 2026.

Simultaneously, the FCA and PRA advanced their 2026 policy agenda with consultations on securitisation framework reforms (CP26/6 and CP2/26, published 17 February, closing 18 May), sustainability disclosures for listed issuers (CP26/5, published 30 January, closing 20 March), and a revised regulatory priorities framework signalling the end of the portfolio letter era (with sector-specific Regulatory Priorities reports replacing the Dear CEO model by month-end). The Bank of England held rates at 3.75% on 4 February in a split vote, with half the MPC preferring to cut 25 basis points. For boards, the period brings two competing pressures: the immediate operational burden of BNPL authorisation and implementation, and the longer-term task of anticipating the FCA's next perimeter expansions through the same template that brought BNPL inside.

Top Story

FCA PS26/1: Regulation of Deferred Payment Credit (Buy Now Pay Later): Final Rules Published 11 February 2026

HIGH RISK · Sectors: Consumer Finance, Retail Distribution, All Regulated Firms

On 11 February 2026, the FCA published Policy Statement PS26/1, finalising the regulatory framework for Deferred Payment Credit (Buy Now Pay Later). These are the rules that will bring an estimated 11 million users and £13 billion in annual transaction volume into the FCA perimeter from 15 July 2026 (Regulation Day). The rules depart from traditional consumer credit regulation, applying conduct-based requirements rather than prescriptive affordability assessment formulas.

  • Affordability checks: DPC lenders must conduct proportionate affordability checks for every transaction, including transactions under £50. The rules do not mandate specific criteria or scoring models. Instead, firms must assess whether the consumer can afford the transaction without undue hardship, with flexibility on method proportionate to transaction size and risk profile. This is a conduct requirement, not a technical checkbox.
  • Pre-contract disclosures: DPC lenders must provide key information before credit is granted, including the right to withdraw, missed payment consequences, access to free debt advice, and guidance on Consumer Duty obligations. The standards align with Consumer Credit Act precedent but with calibration for the BNPL market structure.
  • Missed payment protocols: Lenders must provide clear information about consequences of missing payments, including any interest, fees, or impact on credit files. Collections practices must comply with FCA standards on treating customers fairly, with particular emphasis on protecting vulnerable customers.
  • FCA authorisation required: All DPC lenders require full FCA authorisation. Existing DPC providers operating under the Temporary Permissions Regime (TPR) have until 1 July 2026 to secure formal authorisation. The TPR window is 15 May - 1 July 2026, providing firms a final opportunity to cure deficiencies before the deadline.
  • Consumer Duty applies: Consumer Duty provisions (PRIN 2A.3 and related guidance) apply in full to DPC contracts. This means firms must design products and services with consumer good outcomes as the guiding principle, not compliance checklist.
  • Financial Ombudsman and FSCS coverage: The Financial Ombudsman Service has jurisdiction over DPC disputes, expanding its remit. However, FSCS coverage (deposit protection) does not apply to DPC lenders, reflecting their status as credit providers rather than deposit-takers.

The BNPL regulation shows how the FCA brings an unregulated market into the perimeter. The regulator did not apply the full Consumer Credit Act rulebook to BNPL. It designed a proportionate framework calibrated to market structure. This is the template for cryptoasset regulation (due October 2027), for unregulated investment advisers, for embedded finance. Fund managers operating in adjacent markets should study this text closely. Expect the FCA to use the same template as it expands the perimeter over the next five years.

The affordability check now applies to transactions under £50, reversing the model where affordability became a checkbox at higher transaction sizes. For BNPL lenders, every customer interaction is a credit decision with governance consequences. A substantial proportion of BNPL transactions fall under £50, making this a major operational burden. Lenders that build the check into product design and systems architecture, rather than treating it as a form-filing exercise, will avoid enforcement risk.

Regulatory Updates

FCA CP26/5: Sustainability Disclosures for Listed Issuers: Final Rules Expected Autumn 2026

HIGH RISK · Sectors: Listed Companies, Asset Management

Published on 30 January 2026 (immediately before this period), FCA CP26/5 proposes the UK Sustainability Reporting Standards, a significant expansion of disclosure obligations for listed companies. The consultation closes on 20 March 2026, with a policy statement expected in autumn 2026 and mandatory application from 1 January 2027. For listed companies and their advisers, it is the main rulemaking exercise of the first half of 2026.

  • Scope: The rules would require listed issuers to disclose climate-related, biodiversity-related, and other sustainability matters using a principles-based framework aligned with international standards including TCFD, ISSB, and CSRD precedent.
  • Timeline: Responses to CP26/5 close on 20 March 2026. A policy statement is expected in autumn 2026, with mandatory application from 1 January 2027 (initial reporting in March 2028). A transitional relief period of one year is proposed for smaller issuers.
  • Governance implication: Listed company boards will need to establish governance frameworks for sustainability reporting, assign accountability for data collection and verification, and integrate sustainability metrics into existing financial reporting infrastructure before year-end 2026.

The CP26/5 timeline is tight: responses due 20 March, policy statement by autumn, implementation by 1 January 2027. Listed company boards should be mapping the disclosure requirements against current data infrastructure now. Many boards will discover that sustainability data either does not exist at required granularity, or is held in systems that cannot produce auditable disclosure. Closing that gap between required disclosure and available data is the compliance task for 2026.

FCA CP26/6 and PRA CP2/26: Securitisation Framework Reforms: Published 17 February, Closing 18 May 2026

HIGH RISK · Sectors: Asset Management, Banking, Private Credit

On 17 February 2026, the FCA published CP26/6 and the PRA published CP2/26, the joint consultation on major reforms to the UK securitisation framework. For UK asset managers this is a significant competitiveness reform. The consultation closes on 18 May 2026, with implementation expected in Q2 2027.

  • Principle-based due diligence: The PRA proposes replacing prescriptive due diligence requirements with a principle-based approach requiring investors to assess securitisation risks proportionate to transaction complexity and risk profile. This removes formulaic compliance checklist requirements.
  • Non-UK originator risk retention verification: The PRA proposes removal of the requirement that PRA-regulated investors verify non-UK originator risk retention compliance. This is the change that matters most: it opens access to US CLO structures for the first time. The removal recognises that investor due diligence on US CLOs has matured sufficiently that third-party verification of US originator compliance is redundant. For credit fund managers, this could materially change US allocation decisions.
  • Framework alignment: The proposals align PRA and FCA requirements, reducing duplication and harmonising definitions. Single regulatory framework for securitisation across prudential and conduct dimensions.
  • Market disclosure and exemptions: Simplified market disclosure requirements and exemptions for certain securitisation structures, particularly single-loan securitisations and resecuritisation structures. The goal is to reduce compliance burden for market-standard structures while maintaining investor protection for complex risks.

The removal of non-UK originator risk retention verification is a competitiveness move: the UK is diverging from EU frameworks to ease cross-border capital allocation. For asset managers running global credit strategies, it could be the biggest change to capital access this year. Compliance teams running US CLO reviews should be modelling the impact on portfolio construction now.

Bank of England MPC Holds Rate at 3.75%: 4 February 2026, Split Vote 5-4

MEDIUM RISK · Sectors: All Regulated Firms

On 4 February 2026, the Bank of England's Monetary Policy Committee voted 5-4 to hold the base rate at 3.75%. Five members preferred to hold, citing the need for further disinflation evidence. Four members preferred a 0.25% cut, indicating that near-term rate reductions remain a genuine policy option.

  • Forward guidance: The split vote points to uncertainty about the timing of rate cuts. Market expectations for Q2 cuts have been tempered, though not eliminated.
  • Implications for fund strategies: For funds with rate-sensitive positioning, the hold reinforces the case for dynamic interest rate hedging rather than static directional positioning. The 5-4 split is closer than some expected, creating elevated volatility risk in fixed income markets.

FCA Regulatory Priorities Framework: New Sector-Specific Reports Launch 24 February 2026

INFO · Sectors: All Regulated Firms

On 24 February 2026 (just outside the formal period but signalling the new supervisory framework), the FCA launched its Regulatory Priorities webpage, replacing the Dear CEO and portfolio letter model that characterised FCA communications since 2020. The new model publishes sector-specific Regulatory Priorities reports at the start of the supervisory year, telling firms exactly which workstreams will receive attention.

  • Scope: The FCA plans nine sector-specific reports covering consumer investments, pensions, retail banking, mortgages, consumer finance, wholesale markets, insurance, payments, and digital assets.
  • Shift in accountability: Under the old model, the FCA told firms what it had found (portfolio letters). Under the new model, it tells firms what it will find. This shifts accountability: firms can no longer claim they did not know what the regulator was examining.

The shift from portfolio letters to Regulatory Priorities reports changes the supervisory model, not just how the FCA communicates. CCOs planning their 2026 compliance monitoring programmes must map each report against their business activities within 30 days of publication. For boards, the question is no longer whether they responded to the portfolio letter, but whether their governance framework aligns to the priorities the FCA has said it will examine this year.

The BNPL rules bring an unregulated market inside through conduct requirements rather than the consumer credit rulebook, and the FCA will reuse that template for the next markets it regulates.
Asad Bukhory

PRA Developments

PRA CP2/26: Securitisation Framework Reforms: Joint Consultation with FCA, Closing 18 May 2026

HIGH RISK · Sectors: Banking, Asset Management

Published on 17 February 2026 alongside FCA CP26/6, the PRA's CP2/26 consultation sets out detailed proposals for major reforms to the UK securitisation framework. It is a banking and credit regulation reform with material implications for cross-border capital flows.

  • Single risk approach: The PRA proposes consolidating two separate risk assessment modalities (CRR modelled approach and standardised approach) into a single risk approach for securitisations. This simplification reduces compliance burden for firms managing securitisation portfolios.
  • Simpler market disclosure: Proposals for simpler disclosure requirements, reducing repetitive market disclosure while maintaining investor protection.
  • Descoping single loan securitisations: The PRA proposes exempting single loan securitisations from certain detailed disclosure requirements, reflecting their lower complexity and more transparent underlying assets.
  • Resecuritisation exemptions: Two resecuritisation structures would be exempted from the ban on resecuritisations under certain conditions, allowing greater flexibility for structured credit markets.
  • Mortgage Guarantee Scheme capital treatment: New capital treatment for loans underlying the Government's Mortgage Guarantee Scheme, reflecting their lower risk profile post-government guarantee.
  • Consultation closes: 18 May 2026. Implementation expected Q2 2027.

The removal of non-UK originator risk retention verification requirements is the most consequential change here for asset managers. It opens access to US CLO structures that have been difficult to access without third-party verification of US originator compliance. For credit fund managers, it is one of the more important competitiveness reforms of 2026. Allocation teams should start modelling the impact now.

PRA CP3/26: Rule Changes for HM Treasury Overseas Prudential Requirements Regime

INFO · Sectors: Banking

Published on 19 February 2026 (just outside period), the PRA's CP3/26 consultation sets out rule changes to accommodate HM Treasury's new regulatory regime for overseas firms. This is technical rule-harmonisation work reflecting the new permissions framework for cross-border banking activity.

Fund Launches

Tycho Capital Launches European Equity Long-Short UCITS Fund

INFO · Sectors: Asset Management

On 16 February 2026 (just outside period), Tycho Capital, an emerging alternative asset manager, launched a European equity long-short UCITS fund, adding to the growing range of hedge fund strategies available through regulated UCITS wrappers. The fund targets European equity markets with gross exposure flexibility up to 200%.

UK Fund Flows: February 2026 Trends Show Continued Shift to Bond and Money Market Strategies

INFO · Sectors: Asset Management, Wealth Management

February 2026 fund flow data shows continued strong inflows into fixed income and money market strategies, with Vanguard FTSE UK Equity Income Index entering the top 10 most-bought funds alongside Artemis Global Income. The flow data reflects institutional and retail allocation shifts away from equities toward bond and money market exposures, responding to interest rate uncertainty and elevated geopolitical risk.

Enforcement

Richard John Howson (Carillion): £237,700 Fine: 16 February 2026: Recklessness and Material Risk Escalation Failure

HIGH RISK · Sectors: Listed Companies, All Regulated Firms

On 16 February 2026, the FCA published its enforcement decision against Richard John Howson, former Group Chief Executive of Carillion PLC. Howson was fined £237,700 for breaches of MAR Article 15, Listing Rule 1.3.3R, and Listing Principles 1 and 2. This case completes the Carillion enforcement trilogy (Adam Shaheen and Giles Kronin were each fined in January 2026). The penalty is modest; the case matters for what it reveals about governance failure at board level.

  • The core conduct: In October 2016, Howson was aware that Carillion faced a £173 million likely exposure in major projects based on a significant CCS assessment. Despite this material exposure, he did not alert the board or adjust financial targets. Revenue and profit were materially overstated for three consecutive reporting periods (2016, 2017, and H1 2018).
  • The legal finding: The FCA found Howson acted recklessly in breaches of MAR Article 15 (insiders must refrain from disclosing inside information except in normal course of duty or for legitimate interests). The finding was not dishonesty. It was recklessness: knowing about material risk and failing to disclose or escalate it.
  • Corporate penalty foregone: Carillion would have faced a penalty of £37,910,000, but the company is in liquidation. Individual accountability replaced corporate accountability.
  • Lessons for governance: The case shows that enforcement focus has shifted from technical financial reporting to governance culture. Howson was not accused of cooking the books. He was accused of failing to escalate known material risk to the board. If your firm's board risk escalation process relies on individual judgment rather than defined triggers, this case applies to your governance framework.

The Carillion case is about governance rather than financial reporting. Three years of board packs built on overstated financial data means three years of governance failure at board level. Every board should ask whether, if its chief executive became aware of material risk that had not been escalated, its governance framework would detect it. If the answer depends on individual integrity rather than specific control architecture, the gap is real. The FCA is now enforcing on boards' ability to detect and respond to escalation failures by individuals in position to know.

FCA Targets Annex 1 Companies in Expanded AML Enforcement Drive: February 2026

MEDIUM RISK · Sectors: Financial Crime, All Regulated Firms

In February 2026, the FCA signalled an expanded focus on AML enforcement targeting firms listed in Annex 1 of the Money Laundering Regulations (casinos, art dealers, precious metals dealers, and other non-bank financial institutions). It broadens the FCA's enforcement footprint beyond traditional regulated financial services.

  • Scope: Annex 1 firms face increased supervisory scrutiny for AML/CFT controls, beneficial ownership verification, transaction monitoring, and sanctions screening. The FCA is expanding enforcement resources to this population.
  • Implication: For boards of firms in the Annex 1 population, the enforcement signal reinforces that AML/CFT controls are not optional or regulatory overhead. They are substantive compliance obligations with enforcement consequences.

Market Developments

Sidley UK-EU Investment Management Update: February 2026 Regulatory Developments

INFO · Sectors: Asset Management

Sidley Austin's investment management team published an update on UK-EU regulatory developments in February 2026, covering FCA fund tokenisation consultations, short selling regime updates, and IFPR capital requirements. The update highlights continued regulatory divergence between UK and EU frameworks post-Brexit, requiring UK asset managers to maintain dual-jurisdiction compliance strategies.

FCA Insurance Outlook 2026: Clifford Chance Analysis of FCA Priorities

INFO · Sectors: Insurance

Clifford Chance published analysis of the FCA's 2026 insurance regulatory priorities, including Consumer Duty implementation, ESG obligations, and operational resilience. For insurance boards, the analysis provides a practical roadmap for anticipated supervisory engagement across conduct and prudential dimensions.

Apollo-Schroders Partnership: US-Focused Collective Investment Trust Launch Q2 2026

INFO · Sectors: Asset Management, Private Credit

In February 2026, Apollo and Schroders announced a partnership to launch a US-focused Collective Investment Trust targeting UK institutional investors, with launch expected in Q2 2026. The partnership points to growing appetite for UK-US cross-border asset management collaboration, particularly in credit strategies.

Question of the Week

The Carillion enforcement concluded with a fine against a former CEO who knew about a £173 million exposure in major projects but failed to tell the board. If your firm's chief executive were aware of a material risk that had not been escalated to the board, would your governance framework detect it - or would it rely on that individual choosing to disclose?

We'd welcome your perspective. The best responses may feature in a future edition.

The FCA's BNPL regulation is a template for how the regulator will bring unregulated markets into the perimeter. The pattern is clear: proportionate rules designed for a market structure that differs materially from traditional consumer credit; a temporary permissions regime letting firms build compliance infrastructure before full authorisation; phased implementation requiring coordination across product development, credit policy, systems, and governance. When cryptoasset regulation takes effect in October 2027, the same playbook will apply. When unregulated investment advisers come under the perimeter, the same approach will govern. For fund managers running credit strategies or operating in adjacent markets, this template is worth studying for future perimeter expansions.

The securitisation reforms announced on 17 February are a different kind of structural change: the UK is diverging from EU frameworks to ease cross-border capital flows. The removal of the requirement that PRA-regulated investors verify non-UK originator risk retention is potentially transformative for US CLO investment. The divergence is deliberate: competitiveness policy pursued through technical rule-making. For asset managers running credit strategies, access to US CLO structures without cross-border compliance friction could materially change capital allocation decisions. For boards, the reforms carry a strategic point: UK divergence from the EU creates both competitive opportunities and governance risks. Firms operating across both jurisdictions need compliance frameworks that accommodate rule differences explicitly, rather than assuming approximate equivalence.

Two enforcement cases in the period carry governance implications: Richard John Howson's £237,700 fine for awareness of material risk at Carillion, and the FCA's expanded AML enforcement focus on Annex 1 firms. Howson was not accused of dishonesty. He was accused of recklessness: knowing about a £173 million exposure in October 2016 but failing to alter board reporting or financial targets. Dishonesty is harder to anticipate; recklessness, the failure to escalate a known risk, is a governance failure. If your board's risk escalation protocols require individual judgment rather than defined triggers, the Carillion model applies to your firm.

Asad Bukhory | Founder, Artizan Governance

Regulatory Calendar

February 2026 (Remaining)

  • 17 Feb FCA CP26/6 and PRA CP2/26 (Securitisation Framework Reforms) published
  • 24 Feb FCA Regulatory Priorities webpage launched, replacing portfolio letter model

March 2026

  • 4 Mar FCA Consumer Investments Regulatory Priorities report published
  • 12 Mar FCA CP26/4 (Cryptoasset) consultation closes
  • 20 Mar FCA CP26/5 (Sustainability Disclosures) consultation closes
  • 19–20 Mar Bank of England MPC decision

April – June 2026

  • 6 Apr FCA PS25/20 (Consumer Complaints Investigation) regime takes effect
  • 24 Apr PRA CP4/26 (Solvency II Own Funds) consultation closes
  • 18 May FCA CP26/6 and PRA CP2/26 (Securitisation Reforms) consultations close
  • 15 May–1 Jul BNPL Temporary Permissions Regime window (authorisation deadline 1 July 2026)

Key Dates Later in 2026

  • 15 Jul BNPL Regulation Day – final rules effective, unauthorised DPC providers must cease
  • 1 Sep NFM rules effective
  • Autumn 2026 FCA CP26/5 (UK Sustainability Reporting Standards) policy statement expected
  • 1 Jan 2027 UK SRS mandatory for listed issuers; Basel 3.1 implementation; Operational Resilience rules effective
  • Oct 2027 FCA Cryptoasset Regime takes effect

To receive our bi-weekly regulatory insights directly in your inbox