The GRC Navigator

On 15 May 2026, the FCA, the Bank of England and HM Treasury issued a joint statement on frontier AI models and cyber resilience. The cyber capabilities of current frontier AI models, they say, already exceed what a skilled human practitioner can achieve, at greater speed, scale and lower cost. The authorities stress this introduces no new rules; it reinforces existing operational resilience expectations as the threat environment hardens.

• Governance first: Boards and senior management are expected to understand frontier AI risk well enough to set strategy and oversee how control functions respond, including investment in systems no longer covered by vendor support and whether cyber insurance is adequate.
• Six domains of action: The statement covers governance, vulnerability identification and remediation at speed, third-party and supply-chain risk including open-source software, protective controls, and response and recovery, pointing firms back to the cyber resilience practices the authorities published in October 2025.
• Where to look next: Firms are directed to the Cross Market Operational Resilience Group, whose Frontier AI Risk Mitigation Webinar ran on 14 May 2026, and to National Cyber Security Centre guidance on preparing for vulnerability patch waves.

On 13 May 2026, the FCA launched a review of how consumer investment firms support bereaved customers, citing research that fewer than half, 47%, felt they received the support they needed. The review covers platforms, advisers and wealth managers, and examines the full journey from notification of a bereavement to settlement or transfer of investments.

• What is in scope: How firms communicate, how they support vulnerable customers, service standards, and crucially how fees are handled on bereaved accounts. From May 2026 the FCA will contact selected firms, with findings published later this year.
• The framing: Kate Tuckley, head of consumer investments, called bereavement processes "a real test of a firm's culture." The review is a priority under the Consumer Investments Regulatory Priorities and sits within the FCA's broader Consumer Duty work, following similar findings in retail banking and insurance.

Speaking at the FCA's financial crime conference on 14 May 2026, chief executive Nikhil Rathi argued that organising the response to financial crime around institutional boundaries no longer works against networked, technology-enabled criminal groups. He pressed for greater information sharing, smarter use of technology, and an honest acknowledgement that the system cannot defend every threat equally and must prioritise.

• The numbers: The FCA's intelligence infrastructure has now processed over 52 million records, and from June the regulator will begin wider sharing with law enforcement, starting with more than 5,000 records via the Police National Database. Investment fraud victims lose over £25,000 on average.
• Co-ordinated firepower: With the National Crime Agency the FCA has published nine economic crime priorities, and its recent finfluencer week of action saw 17 regulators from 14 countries deliver a guilty plea, nearly 40 warnings and over 100 account takedown requests. The UK assumes the presidency of the Financial Action Task Force from July 2026.

On 6 May 2026, the FCA announced a review of the claims management market, working with the Solicitors Regulation Authority, after continued concern that some claims management companies and law firms are failing consumers through aggressive marketing, misleading advertising, unfair exit fees, and sign-ups without informed consent.

• The scope: The review will test whether consumers receive fair value, whether existing price caps remain fit for purpose where free redress exists, and whether fee and funding structures create conflicts of interest. The FCA may recommend legislative change, including stronger compensation mechanisms where CMCs cause harm.
• Action already taken: The FCA has removed or amended 800 misleading adverts, enabled more than 28,000 consumers to exit contracts free of charge, and secured fee reductions protecting over 500,000 consumers. As of 30 April 2026 the SRA had 109 open investigations into 76 firms. Further detail was promised by mid-May.

On 13 May 2026 the FCA confirmed two permanent appointments. Simon Walls, who joined in 2006 and has led the markets directorate on a temporary basis since 2024, becomes permanent executive director, markets, providing continuity on wholesale markets reform. Johan Sekora, formerly global head of financial crime prevention at Swedish bank SEB, joins as chief operating officer at the start of June, relocating from Stockholm.

• The signal: Nikhil Rathi tied both appointments to the FCA's ambition to be a "smarter regulator." Sekora's background in data, AI and financial crime collaboration reinforces the operational direction set out in the same fortnight's financial crime speech.

Published on 15 May 2026, the PRA's 2025 firm feedback survey reached 814 PRA-regulated firms or groups, nearly double the 2024 exercise, with 439 firms responding, up from 303. The expansion, notably the inclusion of all credit unions for the first time, widened the sample considerably. Average scores were slightly lower than 2024 across most topics, though stripping out credit union responses brought scores close to the prior year.

• What firms valued: The most positive scores went to the PRA's articulation of its regulatory objectives and the effectiveness of supervisory relationships, with firms praising the approachability and professionalism of supervisory teams. Scores on the regulatory framework, rules and policy were lower.
• Four recurring themes: Firms want clearer feedback and transparency on the rationale for supervisory work and data requests, better co-ordination between PRA teams and with the FCA and international regulators, greater proportionality focused on the main risks, and earlier visibility of supervisory workplans.

Published on 1 May 2026, the PRA's April Regulatory Digest consolidates the month's prudential activity. The headline item for governance teams is PS12/26, the Phase 1 policy statement on the Senior Managers and Certification Regime, issued on 22 April alongside a parallel FCA policy statement. Phase 1 trims the regime to operate more proportionately; a more far-reaching Phase 2 consultation will follow, with HM Treasury to bring forward a draft Bill.

• Also in the Digest: CP6/26 on high loan-to-income mortgage lending, CP7/26 on 2026/27 regulated fees, the PRA Business Plan 2026/27, and a PRA statement welcoming HM Treasury's reforms to the risk transformation regime for insurance special purpose vehicles and protected cell company captives.
• Watch the deadline: The Low Impact Amendments Consultation LIAC01/26 on proportional consolidation in the Groups Part of the PRA Rulebook closes on 21 May 2026, with implementation proposed for July 2026.

US alternative investment manager Hamilton Lane received FCA approval, effective 15 May 2026, to launch a Long-Term Asset Fund for the UK market, extending the firm's evergreen private markets platform into the UK's growing semi-liquid wrapper. The approval makes Hamilton Lane one of the latest entrants in a fast-growing segment the FCA itself is watching closely.

• Market context: Per the FCA, LTAF assets grew from £5 billion to £7.5 billion in under a year, across ten managers, 15 umbrella LTAFs and 29 sub-funds, with six new vehicles launched in 2026 before this approval.
• Why it matters: The LTAF is the principal route through which UK defined contribution pension schemes and, increasingly, retail investors gain access to private markets. Each new launch widens the population of investors holding illiquid assets in an open-ended structure, the precise governance challenge the FCA's valuations and liquidity work is built to address.

Hamilton Lane's approval reflects a structural shift the FCA spent this fortnight describing. With ten managers now running LTAFs and assets up 50% in under a year, the vehicle has moved from novelty to mainstream distribution channel for private markets exposure.

• The trajectory: Six LTAFs launched in 2026 before Hamilton Lane, building on a base that did not exist three years ago. The growth is concentrated in private credit and diversified private markets strategies aimed at long-term savers.
• The governance corollary: Every LTAF launch is also a liquidity and valuation commitment. Managers entering the market should expect the FCA's March 2025 valuations expectations, and its live conflicts of interest review, to apply to them from day one, not after the fund scales.

On 6 May 2026, following financial reporting by PayPal Holdings, the FCA confirmed it is investigating Mastercard, PayPal and Visa under Chapter I of the Competition Act 1998, and Mastercard and Visa under Chapter II, for suspected anti-competitive conduct linked to the funding and usage of PayPal's digital wallet. The FCA has reached no conclusions and made no findings.

• The powers: Chapter I prohibits agreements and concerted practices that restrict competition; Chapter II prohibits abuse of a dominant position. The FCA's competition powers are separate from its Financial Services and Markets Act enforcement toolkit, and cases can also be brought by the Competition and Markets Authority.
• What happens next: The FCA is gathering evidence and may issue a statement of objections setting out a provisional view of infringement, though not all cases reach that stage. Addressees would then have the chance to make representations before any final decision.

On 1 and 8 May 2026 the FCA set out further advice on its motor finance compensation scheme after legal challenges sent the scheme rules to the Upper Tribunal. The FCA continues to back an industry-wide scheme as the quickest, fairest route to compensation, but the case is unlikely to be heard before October, and the regulator is now openly preparing firms for the possibility that the scheme, or parts of it, could be quashed.

• Where firms stand: Lenders were asked to submit implementation plans by 12 May 2026, though the FCA dropped the requirement for formal attestations. Complaints have been paused since 11 January 2024, a pause the FCA accepts cannot continue indefinitely.
• The contingency: The FCA told lenders to supervise against a central planning assumption of no scheme, preparing on a precautionary basis to handle complaints under normal statutory timeframes from mid-November 2026. Consumers have already waited over two years, and the FCA repeated that they do not need a claims management company charging over 30% of any award.