The GRC Navigator

The FCA's rule on non-financial misconduct at non-bank firms, COCON 1.1.7FR, came into force on 1 September 2026, together with the guidance in the Non-Financial Misconduct (No 2) Instrument 2025 (FCA 2025/60), published with PS25/23 on 12 December 2025. The FCA confirmed the rule on 2 July 2025 in CP25/18, which also consulted on the guidance; the original proposals were in CP23/20.

COCON 1.1.7FR is a rule. For SMCR firms other than banks it extends the conduct rules to unwanted conduct towards colleagues, people who perform functions for or provide services to the firm or its group, and their staff, where the conduct has the purpose or effect of violating the person's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment, or is violent. Conduct relating only to a part of the business with no SMCR financial activities stays outside (COCON 1.1.7FR(5)); PS25/23 explains that conduct is in scope if either the person responsible or the person affected deals with the financial services business. Banks already had the wider scope, and the new COCON 4.3 guidance applies to them too (COCON 4.3.5G).

The conduct must be serious (COCON 4.3.7G), judged on factors that include repetition, duration, impact, the seniority gap and whether the individual controls the other person's career, and whether the individual had been warned or had undertaken not to repeat the behaviour (COCON 4.3.8G). A single incident can qualify (COCON 4.3.17G), and so can the effect on a witness (COCON 4.3.16G). Individual Conduct Rule 1 is breached only where there is intention, recklessness or turning a blind eye (COCON 4.3.19G), although an unreasonable belief that the conduct was justified can itself show a lack of integrity (COCON 4.3.21G); conduct short of that may breach Rule 2 (COCON 4.3.23G).

Between CP25/18 and the final guidance the FCA made several changes, most in firms' favour:

• it withdrew a proposed seriousness factor about the "specific characteristics or vulnerabilities" of the person affected;
• it limited managers' accountability to what they knew or should reasonably have known and had authority to act on (COCON 4.1.8-BG);
• it deleted a sentence implying that unproven allegations should be reported to the FCA, keeping only the cross-reference to SUP 10C.14.18R;
• it told firms they need not investigate trivial or implausible allegations about private life (FIT 1.3.20G) or apply the FCA's statutory objectives as a self-standing fitness test (FIT 1.3.12G(3)).

The rule is not retrospective. Conduct before 1 September 2026 is judged under the rules then in force, and the FCA does not expect a back-book review, though a firm that finds it wrongly determined a past breach should correct its SUP 15 notification. The rule covers sexual harassment but does not bring discrimination or victimisation within COCON at non-banks. Territorial scope is unchanged, so COCON 1.1.10R still limits how the rules reach UK firms' staff overseas. And the FCA's statement that it will treat a firm's reasonable judgement on seriousness as compliant sits in the policy statement, not in a Handbook provision.

By now a non-bank should have a disciplinary policy that maps outcomes to COCON 1.1.7FR, conduct rules training under s.64B that covers the new rule, and a SYSC 22 regulatory reference process that records substantiated cases. What it cannot yet settle is when a case must be reported: only formal disciplinary action (a written warning, suspension or dismissal, or a reduction or recovery of pay) triggers notification under s.64C FSMA, and the breach-reporting thresholds consulted on in CP25/21 are still under consideration.

A research note published by the FCA's Economics Department on 3 September 2026, The UK alternative investment fund market: evidence from regulatory reporting, is the first FCA publication to present market-wide statistics on the sector from AIFMD returns. Research notes carry a disclaimer that they may not represent the FCA's position, but this one says it informed the calibration of CP26/28 on the UK AIFM regime and sets a baseline to help evaluate the reforms. We covered CP26/26, CP26/27 and CP26/28 in Issue 25.

The headline figures, at year-end 2025:

• AIFs available to UK investors had a combined NAV of £5.1tn, up 30% since 2021; UK AIFMs managed £1.8tn, up from £1.5tn. Managers marketing under the National Private Placement Regime accounted for 65% of NAV.
• Private credit NAV rose from £147bn to £335bn and the number of funds from 381 to 786. UK-managed private credit was £25.5bn across 111 funds.
• Excluding hedge funds, aggregate adjusted leverage stayed between 99% and 114% of NAV from 2016 to 2025. Among UK-managed funds, around 12% of private credit funds have run above three times NAV since 2020, the threshold the note aligns with AIFMD "significant leverage".
• Retail investors held 20% of UK-managed NAV (£366.9bn), concentrated in funds of funds and the "other" category, which includes most investment trusts.

The note also records the weaknesses in the data. AIF002 does not say whether a fund is open-ended or closed-ended, so the FCA inferred structure from the redemption fields. Legal Entity Identifiers are neither mandatory for all funds nor used consistently, which limits master-feeder matching. The gross and commitment leverage figures were inconsistent enough that the FCA built its own adjusted measure. About 3,000 funds, 25% of NAV, sit in the "other" category, and private credit funds had to be identified using name and strategy rules, manual review, machine learning and large language models. On liquidity the note finds no aggregate mismatch but a concentration in real estate, where 10% of NAV can be redeemed within 30 days against 7% of assets that can be sold in that time, and it warns that the measure relies on managers' own assessment of asset liquidity, "which may be overoptimistic".

These are the gaps CP26/26 (FRAME) is meant to close. CP26/26 and the main CP26/28 chapters now close on 22 October 2026, after extensions announced in late August; the non-prudential CP26/28 discussion chapters close on 18 September.

The FCA's multi-firm review Frontier AI and cyber resilience, published on 2 September 2026, reports how firms are using, testing and preparing for frontier AI models with cyber capabilities. It summarises what firms told the FCA and states that it "does not introduce new rules, guidance or regulatory expectations". It follows the joint statement by the FCA, the Bank of England and HM Treasury in May 2026, which described these models as a step-change in capability and also disclaimed new expectations.

Firms reported that models find vulnerabilities faster than they can be validated and fixed, so the constraint moves to triage, engineering capacity, patch testing and change control. Models can also chain several low-rated flaws into a route to compromise, which undermines remediation queues ordered by severity rating alone, and firms described moving to prioritisation by exploitability and by the effect on important business services. They said a model's value depends on the environment built around it (the "harness") and on human review, and that supplier preparedness and software supply chain dependencies are becoming more prominent. Some firms are using targeted deployments to test whether their triage and remediation processes can cope before scaling up, and the review suggests risk committees and senior leaders may need clearer visibility of how the models affect vulnerability registers, remediation and supplier dependencies.

The review changes no obligation, and which obligations apply depends on the firm. SYSC 15A (operational resilience) applies to enhanced scope SMCR firms, banks, designated investment firms, building societies, Solvency II firms and payment and e-money firms, among others (SYSC 15A.1.1R). Those firms must identify their important business services (SYSC 15A.2.1R), set impact tolerances (SYSC 15A.2.5R) and be able to remain within them in a severe but plausible disruption (SYSC 15A.2.9R). A core SMCR asset manager is outside SYSC 15A; its cyber obligations run through the general governance requirement in SYSC 4.1.1R and, for a common platform firm, the outsourcing rules in SYSC 8.1.1R. The review says it is written particularly for small and medium-sized firms, many of which are core SMCR firms in the second group.

For those firms the review's own questions make a fair test of the vulnerability register: which open findings affect a service clients rely on, how long each has been open, which depend on a supplier's fix, and who has authority to accept the risk. A register organised around severity ratings and patch dates cannot answer them unless it also records the business service and supplier behind each finding.

The FCA published CP26/32, its 53rd quarterly consultation, on 4 September 2026, with comments on chapters 2 to 8 due by 12 October 2026. Two chapters matter to fund managers: chapter 7 on money market fund (MMF) reporting and chapter 8 on the Consumer Composite Investments (CCI) disclosure rules.

UK MMFs currently report fund details and holdings quarterly under the UK Money Market Funds Regulation and NAV information daily under Article 29(5). Overseas MMFs marketed in the UK are subject to the same reporting in law, but the FCA says it has chosen not to enforce it. Chapter 7 changes both:

• quarterly reporting would move into the FRAME framework proposed in CP26/26, using selected FRAME modules plus the MMF type, due 30 days after the period end;
• daily NAV reporting would give way to a weekly report, with daily values for some metrics, including NAV, liquidity buffers and, for LVNAV and public debt CNAV funds, NAV per unit and constant NAV per unit, and end-of-week figures for others, including maturity measures, the liquidity profile, the share held by the five largest investors and net flows;
• both would apply to managers of UK MMFs and of overseas MMFs marketed into the UK.

The FCA intends to make its wider MMF rules, in a new MMFS sourcebook, by the end of 2026 and bring them into force in Q3 2027, when the UK MMFR would be revoked and weekly reporting would begin. Until FRAME is fully implemented, which the FCA aims for in 2028, UK MMFs would file interim quarterly returns under draft MMFS 8 in an almost unchanged format, still in euros, without the stress-testing data. The Bank of England will also use the data. No cost benefit analysis was prepared, under the exemption in s.138L(3) FSMA.

Chapter 8 corrects the CCI rules made in PS25/20. The DISC rules have applied since 6 April 2026 under a transitional period that ends on 7 June 2027 (DISC TP 2.1R). Beyond typographical fixes, the chapter proposes three changes of substance:

• CCIs closed to new business but still taking top-ups from existing investors would have until 8 June 2028, 12 months longer; products closed to both remain outside the regime;
• Enterprise Investment Scheme funds would be excluded from the past-performance line graph in DISC 7.2, because a single graph for a cohort-based umbrella fund would not match any investor's experience;
• the past-performance periods for financial promotions in COBS 4.6.2R and COBS 4.5A.10R would move from five years to ten, to match DISC 7.1.1R.

The FCA also confirms that funds in the temporary marketing permissions regime, which HM Treasury plans to extend beyond 2026 for MMFs, need not produce a product summary until June 2027.

On 14 September 2026 the FCA published FS26/1, its feedback statement on the joint FCA and Bank of England call for input of May 2026 on tokenisation in wholesale markets, and a separate call for input on tokenised gold, which closes on 23 October 2026. Neither changes any rule. FS26/1 reports 123 responses and commits the FCA and the Bank to a Tokenisation Roadmap with target dates "later this year".

For asset managers the feedback is mostly about collateral. Respondents named it as by far the most frequent use case, and buy-side firms raised tokenised money market funds repeatedly, because a tokenised MMF unit could be posted as collateral without being redeemed. The authorities accept that collateral mobility is the near-term benefit, and the Bank will consult later this year on a supervisory statement and a discussion paper on tokenised collateral at central counterparties. On custody of relevant specified investment cryptoassets (tokenised securities), most respondents preferred the CASS 6 custody rules, with overlays for risks such as private key management, to the crypto safeguarding chapter, CASS 17, which comes into force on 25 October 2027; the FCA will consult in the first half of 2027. It restated two positions: every regulated activity needs an identifiable, accountable regulated person, and for traditional investments it "cannot accept solutions where customers have no recourse when assets are lost or stolen".

The gold paper is narrower and goes further into the law. It asks when tokens backed by physical gold are collective investment schemes or AIFs. The FCA's view is that a token giving direct, allocated ownership of a commercially tradeable bar, with no pooling or management, is more likely to fall outside both definitions, while fractional interests in a bar that is managed or disposed of collectively indicate pooling, in which case the CIS and AIF framework may be the right home. A UCITS cannot be dedicated to gold, so a gold CIS may be an unregulated scheme with restricted marketing. Industry has argued that co-ownership in undivided shares of goods keeps fractional tokens outside the perimeter; the FCA asks to hear why such structures would not still meet every element of the definitions. Its options run from guidance to a targeted exemption made with HM Treasury, which would come with 12 conditions covering, among other things, custody and reconciliation, independent audit, governance, dealing, disclosure and wind-down. The paper notes that the Treasury's July 2026 consultation proposes to clarify the legislative definition of an AIF.

The FCA says the lessons may inform its thinking on other tokenised commodities. In my reading the chapter 5 analysis reaches further, to any token backed by real assets, because it turns on a question every such structure has to answer: does the holder own an identified asset, or a share of a managed pool?

The Bank of England's Frontier AI Information Sharing Forum published Frontier AI: Harness engineering on 2 September 2026, a note on the tools, workflows and controls firms build around a frontier model used for cyber defence. The Bank presents it as a summary of discussion themes that sets no supervisory expectations or policy and gives no guidance. The PRA itself published no consultation paper, policy statement or supervisory statement between 1 and 15 September.

Firms can build harnesses in-house, take them from the model vendor, use managed services or assemble open-source components, and the Bank reports that no single approach is yet complete. Vendor harnesses fit their own model closely but give less context and less control over validation; internal and open-source tools give flexibility at the cost of engineering, documentation and assurance. An orchestration layer that routes work between several tools and models reduces early dependence on one supplier. The Bank treats data access as a central risk management question: the model is more useful with source code, asset inventories and architecture material, and each addition increases the exposure if the model or harness is compromised. Direct deployment into production networks is "generally regarded as higher risk", so firms are working in sandboxed or production-like environments and building controls into the harness itself, such as use-case restrictions, network isolation, approval workflows and rules of engagement.

For PRA-regulated firms the existing frame remains SS1/21 on impact tolerances for important business services and SS2/21 on outsourcing and third party risk management; the note adds nothing to either. It is most useful as a checklist for the approval paper a risk committee should see before a frontier model is pointed at the firm's estate: which repositories and environments are in scope and which are excluded, where the model runs, which actions need human approval, and who owns findings the remediation teams cannot absorb. The Bank also notes that smaller suppliers may lack the engineering capacity to fix what AI-assisted testing finds in their products, which puts supplier remediation capacity into due diligence.

Four venture capital trusts published prospectuses for new share offers between 1 and 15 September 2026: Triple Point Venture VCT on 1 September (£10m, or £20m if oversubscribed), Blackfinch Spring VCT on 8 September (up to £20m plus a £20m over-allotment), Pembroke VCT on 14 September (up to £40m of B shares plus £20m) and Guinness VCT on 15 September (up to £10m plus £5m). Molten Ventures VCT announced on 10 September an intended offer of up to £30m, with an offer document due in early October.

Each manager, or a company in its group, is promoter and is paid by the VCT: up to 5.5% of the money raised at Triple Point and Blackfinch, and at Guinness and Pembroke 3% for advised investors against 5.5% (Guinness) or 5.0% (Pembroke) for direct or non-advised investors. All four announcements treat the agreement as a related party transaction and follow the procedure described for Albion's offers in Issue 27 (UKLR 11.5.4R and UKLR 8.2.1R): approval by the directors without a conflict, a sponsor's written confirmation that the terms are fair and reasonable, and an announcement.

The sponsor's test in UKLR 8.2.1R(3) is fairness to the company's existing security holders. At Guinness the fee is applied to each application through the offer's pricing formula, which puts the cost on the incoming subscriber, so an adviser recommending the offer still has to judge that cost for the new investor.

Kelso Group Holdings plc announced on 10 September 2026 a placing and subscription to raise £3.0m at 3.3p a share, its NAV per share and a 5.7% discount to the previous day's closing mid-price, plus a retail offer of up to £1.0m at the same price through RetailBook, due to close on 16 September. Certain existing shareholders have committed up to £3.0m to cover any shortfall; admission is expected on 21 September. Kelso calls itself a Main Market listed investment vehicle holding about ten UK-listed small and mid-cap companies; its 2 September update reported NAV per share up about 43% in the eight months to 31 August 2026 and 33% gearing, with gross investments of about £23.0m on net assets of £15.2m.

The new shares are to be admitted to the equity shares (commercial companies) category. UKLR 11 applies only to closed-ended investment funds listed in the closed-ended investment funds category (UKLR 11.1.1R), so the requirement to publish and keep an investment policy covering asset allocation, risk diversification and gearing, with maximum exposures (UKLR 11.2.8R and UKLR 11.4.4R), does not attach to Kelso. Kelso says the fundraise needs no prospectus: the placing is limited to qualified investors under the Public Offers and Admissions to Trading Regulations 2024, and the retail offer runs on a financial promotion approved under s.21 FSMA by RetailBook Limited. Gearing is the first comparison for a retail investor weighing Kelso against a listed investment trust: a listed fund must publish its maximum, and Kelso, geared at 33%, has no listing-rule duty to publish one.

On 15 September 2026 Carolyn Wilkins, a member of the Financial Policy Committee, gave a speech at Queen's University Belfast on stablecoins and the international role of the US dollar. She said the views were her own rather than the FPC's.

On timing, she said the Bank's framework for systemic sterling-denominated stablecoins, published as a policy statement and draft rules in June 2026, "will be finalised at the end of this year". On calibration, she described it as more restrictive on reserve assets than the US framework she discussed and as giving more weight to liquidity contingency planning, payment-system access and arrangements for failure, while allowing for central bank liquidity under appropriate conditions; an overseas issuer of a systemic sterling stablecoin would have to establish a UK entity and keep key safeguarding arrangements in the UK. She also compared the way redemptions force issuers to sell reserve assets with the 2022 LDI episode in gilts, and said the sector is not currently large enough to pose a material financial stability risk in the UK.

She also addressed where stablecoin money comes from. If investors move from a government money market fund into a stablecoin whose issuer buys the same bills, net demand for safe assets barely changes; if the money comes from bank deposits, bank funding and credit can be affected. She put stablecoins in the same category as deposits and money market fund units: demandable claims that holders can redeem quickly.

Huw Pill, a member of the Monetary Policy Committee, set out his case for a higher Bank Rate in remarks to an Edinburgh Chamber of Commerce roundtable, published by the Bank on 3 September 2026. They are one member's views, not the Committee's. The MPC has held Bank Rate at 3.75% since March; Mr Pill has voted to raise it to 4% at recent meetings, and the remarks explain why ahead of the next decision on 17 September. As he describes it, the majority has judged 3.75%, together with tighter broader financial conditions including an upward-sloping money market curve, sufficient to contain the inflation risk from higher energy prices.

He describes the energy shock from the Gulf conflict as something closer to Knightian uncertainty, which will not resolve meeting by meeting, so waiting for clarity risks a bias towards the status quo. Relying on that curve to do the tightening carries what he calls "wrong-way risk": the market may ease conditions just when the MPC needs them tighter. He cites staff analysis showing that the three scenarios in the April Monetary Policy Report implied a two-peaked distribution for Bank Rate a year ahead, one near 3.75% and the other towards around 5%, while the July scenarios produced a single peak with a higher mean. He sees no de-anchoring of longer-term inflation expectations; his concern is "catch-up" dynamics as firms, households and government respond to the relative price shock. A prompt rise, he says, "need not be the start of a prolonged and aggressive series of increases".

For leveraged funds the remarks bear on stress-test design. Managers with floating-rate borrowers or fund-level facilities should record in their liquidity and valuation papers which rate path they assume, and why. A real estate or private credit fund whose rate stress stops at 4% covers Mr Pill's preferred path and leaves out the upper peak of the April distribution.