The GRC Navigator

Executive Summary

On 22 October 2026, the FCA and the PRA published CP26/37 and CP14/26, the second phase of the review of the Senior Managers and Certification Regime. Subject to the Financial Services and Markets Bill, they would remove the Certification Regime, which tracks around 139,000 individuals, retire the Directory, end routine submission of Statements of Responsibilities, raise the Enhanced threshold for asset managers from £65bn to £100bn, and report most staff breaches only at final written warning or dismissal; responses are due by 22 January 2027. On 23 October, the FCA published its multi-firm review of conflicts of interest in private markets, recording recurring weaknesses in continuation transactions, gifts and entertainment and information barriers, and frameworks at UK advisory entities that followed legal form over substance. CP26/38 proposes updates to the Financial Crime Guide and closes on 24 December. FS26/3 commits the FCA to review its high-risk investment categories and the appropriateness test.

In enforcement, Final Notices published on 21 October prohibit Jeffrey Dawkins, found to have knowingly acted as a “regulatory front” for a disqualified director at Vector Wealth, and fine him £269,233 after a Step 4 multiplier of seven, and prohibit Kadir Kanizi from senior management functions. The FCA revoked four prohibitions after LIBOR and EURIBOR convictions were overturned, and announced restrictions on six Annex 1 lenders. On 27 October, the High Court stayed FCA v Huobi Global on undertakings running to 2031. At Mansion House, Nikhil Rathi suggested looking again at the three lines of defence, the day before a review that expects third-line assurance. Across several of these documents, the regulators would receive fewer records and would expect firms to hold more of their own.

Top Story

FCA and PRA propose to remove the Certification Regime for around 139,000 individuals and raise the Enhanced threshold for asset managers to £100bn

MEDIUM RISK · Sectors: All Regulated Firms, Asset Management, Wealth Management, Banking

On 22 October 2026, the FCA published CP26/37, Senior Managers & Certification Regime Review: Phase 2, and the PRA published CP14/26, which between them propose what the PRA describes as the most significant reforms to the Senior Managers and Certification Regime (SM&CR) since its introduction. Both papers are consultations, and most of the package depends on the Financial Services and Markets Bill (the Bill), which would remove prescriptive SM&CR requirements from FSMA and leave the regulators to set them in rules. The Bill has not yet received Royal Assent.

Background. The first phase was completed in April 2026 through PS26/6 and the PRA's PS12/26. The Government's Financial Services Growth and Competitiveness Strategy set a shared ambition to reduce the regulatory burden of the regime by 50% and the number of roles at banks and insurers requiring approval by 40%, and the FCA states that the two packages together will meet it.

What the rules would require. The FCA's proposals for all firms in scope are as follows.

Certification Regime. The regime would be removed completely (paragraph 4.9). Firms would rely on the competent employee rules in SYSC 3.1.6R and SYSC 5.1.1R, under which most firms are expected to assess honesty and competence on appointment and whenever there is reason to reassess (paragraph 4.16). The regime currently tracks around 139,000 individuals performing about 261,000 functions (paragraph 4.7).
Regulatory references. Firms would no longer have to obtain them for previously certified persons (paragraph 4.25), although they remain mandatory for candidates for a Senior Management Function (SMF), whether approved or notified (paragraph 4.27).
Directory. The Directory would be retired, with its reporting and annual attestation (paragraph 4.35).
Conduct Rules. The rules themselves are unchanged and continue to cover around 900,000 individuals. The statutory training duty would give way to an obligation to notify staff of the rules that apply to them and the consequences of breach (paragraph 5.7).
Breach reporting. For staff subject only to the Individual Conduct Rules, the threshold would rise to a final written warning or dismissal, with the final outcome reported within 14 months (paragraphs 5.17 and 5.23). Non-executive directors and others subject to the Senior Manager Conduct Rules would move to a single deadline of seven business days (paragraph 5.28).
Statements of Responsibilities and Management Responsibilities Maps. Form J would end. Firms would keep both documents up to date internally for six years, or ten for some dual-regulated firms, and produce them on request (paragraphs 3.84 to 3.87 and 3.94). No Statement would be needed where one individual performs every SMF role, which the FCA estimates would benefit about 18,800 firms (paragraph 3.89).
Prescribed Responsibilities. Nine would be removed. Responsibilities A (senior managers regime), D (financial crime) and Z (CASS) would remain for Core and Enhanced firms, and J-3 for Enhanced firms (paragraph 3.99). The FCA states that the underlying requirements remain (paragraph 3.102).
Temporary cover. The 12-week rule would become 18 weeks, and the “reasonably unforeseen” test in SUP 10C.3A.6R would be replaced by rules on reasonable use (paragraphs 3.75 and 3.77).

Scope. The changes to Senior Management Functions reach a limited group of firms, because the FCA proposes no change to SMF roles in Core and Limited Scope firms (paragraph 3.11). Notification would replace approval only at dual-regulated and Enhanced firms, for SMF5 and for SMF10 to SMF15, which the FCA expects to remove about 15% of applications from solo-regulated Enhanced firms (paragraphs 3.15 and 3.19). SMF24 stays pre-approved because of frontier AI and cyber risk, subject to a review two years after implementation (paragraph 3.21). SMF18 and SMF22 would go altogether (paragraph 3.36). The Enhanced thresholds would rise, for asset managers from £65bn to £100bn of assets under management, while the CASS Large and mortgage thresholds would stay (paragraphs 3.62 and 3.66), so a wealth manager that is CASS Large remains Enhanced whatever its assets under management. SMF7 at solo-regulated firms would require both significant influence and one of seven listed functions (paragraphs 3.45 and 3.46). The list does not include a chief investment officer, so it would appear that a group chief investment officer with significant influence over a UK asset manager would no longer be an SMF7.

Points of interpretation. The proposals are set out function by function, and their combined effect on one individual is not addressed. It would appear that a head of investments who holds SMF18 at an Enhanced asset manager today would hold no approved or notified function and no certificate, would appear neither on the Financial Services Register as a current senior manager nor on the Directory, and would need no regulatory reference unless moving to an SMF role, while remaining subject to the Individual Conduct Rules. Overall responsibility would pass to another SMF (paragraph 3.38), and the FCA proposes amendments to SYSC 26 and COCON so that delegation and layered reporting can demonstrate accountability (paragraph 3.39). The Duty of Responsibility would therefore attach to fewer people for the same activity. The FCA asks in Question 4 whether these roles should be notified instead.

The interaction with non-financial misconduct is also left open. New guidance would state that a firm need not determine whether misconduct breaches COCON unless it results in reportable disciplinary action, for the purposes of SUP 15.11 (paragraph 5.33), and the reference template would not disclose a first written warning unless the individual held an SMF or similar role (paragraph 5.36). COCON 1.1.7FR, which brought serious harassment at non-bank firms within the conduct rules, has been in force only since 1 September 2026, as we noted in Issue 28. The FCA says only that it is considering a question on non-financial misconduct in the reporting form (paragraph 5.20), and that Principle 11 and SUP 15 notifications are unaffected (paragraph 5.31).

The cost benefit analysis puts annual compliance costs at £434.5m and the saving at £229.0m, of which £133.0m comes from removing certification, £56.8m from training and £34.4m from the breach threshold, against £61.7m of one-off costs. Its unit costs rest on 260 survey responses from 2,500 firms, and the FCA states that the figures reflect “the value of regulatory requirements avoided rather than an unconditional prediction of firms' realised cash or resource savings”, and that the effect on accountability and conduct “cannot be estimated robustly”. In advice on an earlier version, the FCA's Cost Benefit Analysis Panel called the treatment of overall welfare effects “a serious shortcoming”. The FCA states that, following that advice, it explained more clearly the limits of the analysis and the unquantified risks.

Next steps. Responses are due by 22 January 2027. The FCA expects to publish final rules in the first half of 2027 and to implement them about six months later, subject to the Bill, and it will not repeal certification before reaching a final position (paragraph 6.2), so annual certification continues until then. Enhanced and dual-regulated firms would update Statements and Maps at commencement, whereas Core firms could wait for their next change (paragraphs 3.104 and 3.105). If the FCA keeps any part of certification or the Directory, it does not intend to reconsult (paragraph 4.41), and respondents who want a feature retained should therefore say so now.

In my view, the proposal most in need of challenge is the removal of regulatory references for previously certified staff. SYSC 22.2.2R obliges a former employer to provide a reference to a firm that asks; once that falls away for certified staff, a new employer hiring a client-facing adviser or a material risk taker has only what the last employer chooses to put in an employment reference. The FCA itself accepts that firms “might place less emphasis on documenting” fitness assessments (paragraph 4.10). I would answer Questions 16 and 18 and plan to keep a dated assessment for each former certification function whatever the outcome, because SYSC 3.1.6R and SYSC 5.1.1R will still apply and that record is how a firm would show compliance with them.

The FCA would stop receiving many records of individual accountability, while still expecting firms to keep them and produce them on request.

Asad Bukhory

Regulatory Updates

FCA review of private market conflicts finds weaknesses in continuation transactions and questions UK advisory frameworks built on legal form

MEDIUM RISK · Sectors: Private Equity, Private Credit, Asset Management

On 23 October 2026, the FCA published Conflicts of interest and fair customer treatment in private markets, the findings of a two-phase multi-firm review of firms managing funds or providing portfolio management or advisory services in the UK in private equity, private credit and real estate. A multi-firm review makes no rules, and the report does not state how many firms were sampled, but it sets out expectations by reference to SYSC 10, COLL 8.5.7R, COBS 2.3A.8R, COBS 11.7 and COBS 11.7A, and the FCA says that it will carry out targeted follow-up work where appropriate.

The FCA reports that many firms showed effective governance but that standards “varied considerably”, and that the firms with the greatest inherent risk were not always the most effective at managing it. It identifies recurring weaknesses in three areas.

Cross-fund transfers and continuation transactions. Weaker firms relied on existing governance, disclosure or investor consent, and buy-side and sell-side funds often used the same independent valuation and a committee of largely the same composition. The FCA saw limited evidence that a third-party valuation would manage the conflict where decision-making was not separated. One firm received external interest in an asset but sold it to an internal fund at NAV, and could not explain why it had not pursued that interest or how it concluded that NAV was in the selling fund's best interests.
Gifts and entertainment. The FCA observed value and types of hospitality greater than it typically sees in public markets, including air travel and high-value sporting events, and anticipates further discussions with firms. Its principal concern is whether firms can show that their arrangements operated effectively, and it adds that assessing each event in isolation may miss repeated hospitality from the same provider.
Information barriers. Weaker arrangements relied on training, informal zoning and little monitoring, which the FCA considers particularly relevant where a firm runs strategies across the capital stack.

The finding of widest legal interest concerns UK entities characterised as advisers because formal investment decisions are taken overseas. The FCA accepts that such models may be legitimate, but it found frameworks that reflected legal form more closely than substance although UK staff took part in key stages of the investment lifecycle, and it describes a framework reflecting substance as “good practice”. That label reflects a limit in the rule text. SYSC 10.1.1R applies to a firm providing services to its clients, and SYSC 10.1.3R addresses conflicts between the firm and a client and between one client and another. Where a UK adviser's client is a group entity and not the funds or their investors, it is not obvious that the rule reaches a conflict between two funds, and the report does not explain how its expectation maps onto the rule.

The report also limits reliance on investors as a control. It treats disclosure as supplementary to managing a conflict, which is consistent with SYSC 10.1.8R, under which disclosure applies where arrangements are not sufficient to prevent the risk of damage. It observes that typically only the largest limited partners sit on Limited Partner Advisory Committees, that some firms consult them only when legally obliged to, and that newer structures may have no such body, and it says that firms should not rely on consulting a subset of investors as the primary means of managing material conflicts. Only 52% of firms in the first phase said that internal audit had a role in reviewing the conflicts framework.

The FCA expects firms to identify gaps against the findings and sets no deadline. Its press release adds that it is separately examining governance and conflicts concerns relating to the use of private credit to fund consumer litigation claims, which were outside the review.

I would expect the follow-up work to start with continuation and cross-fund transactions, since that is where the report records a transaction the firm could not explain. A firm in this sector may wish to pull the file for its last three such transactions and check whether it names separate buy-side and sell-side decision-makers, shows how the price was tested other than by one shared valuation, and records why any external interest was not pursued. A UK adviser to an overseas group should run the same test on the decisions in which its own staff took part, whatever SYSC 10 strictly requires of it, because the FCA has now said what it regards as good practice.

FCA proposes to rewrite the Financial Crime Guide on fraud and sanctions, with poor-practice examples for private markets managers

MEDIUM RISK · Sectors: All Regulated Firms, Financial Crime, Asset Management

On 23 October 2026, the FCA published CP26/38, Financial Crime Guide Updates, proposing amendments to the Financial Crime Guide (the Guide). The Guide is guidance: the FCA states that it “does not contain rules nor impose any new requirements”, while expecting firms to have read and considered it (paragraph 1.5).

Chapter 4 would gain a new section on authorised push payment fraud and money mules, organised around onboarding, monitoring and reporting, into which the existing guidance on investment fraud would be folded; Question 1 asks whether investment fraud needs more, citing UK Finance data showing a 26% rise in cases and a 40% rise in losses between 2024 and 2025. Chapter 7 would cover trade sanctions alongside financial sanctions, set out the respective roles of the Office of Financial Sanctions Implementation, the Office of Trade Sanctions Implementation, HMRC and the FCA, address vendor-configured settings in third-party screening tools, and encourage monitoring beyond name screening. Cryptoasset firms would receive examples on enhanced due diligence triggers, blockchain analytics and the Travel Rule. The draft also addresses proliferation financing, data security, Banking as a Service, and the use of AI and other third-party tools, which firms must govern, test and validate (paragraph 2.27), and reflects the amendments to the Money Laundering Regulations that came into force in June 2026.

The paper's summary does not mention asset managers, but Appendix 1 includes, among its examples of poor practice, a manager active in private markets with “no formal Ultimate Beneficial Owner verification process for multi-layered or offshore structures”, a manager whose risk assessments do not adequately cover financial crime risk, and a manager that outsources customer due diligence without maintaining oversight. These appear to draw on the FCA's July review of financial crime controls in asset management and alternatives, to which Sarah Pritchard referred on 20 October, although the paper does not say so. Prescribed Responsibility D, for financial crime, is one of those that CP26/37 would retain, so the holder would remain answerable for these controls.

The MLRO of a private markets manager can check both points now, by checking whether the firm's verification procedure deals expressly with multi-layered and offshore structures and whether its outsourcing file shows monitoring of the provider. Comments are due by 24 December 2026, and the FCA will publish final text in a policy statement.

FCA will review high-risk investment categories and the appropriateness test, and leaves Financial Promotion Order self-certification with HM Treasury

LOW RISK · Sectors: Retail Distribution, Wealth Management, Asset Management

On 16 October 2026, the FCA published FS26/3, Expanding consumer access to investments, its feedback to discussion paper DP25/3. A feedback statement makes no rules; it reports what respondents said and what the FCA intends to do. The FCA states that it will not take forward every potential reform at once and sets three priorities.

High-risk investment categories. The FCA will begin a review of its financial promotion categories, assessing with firms and consumer groups the harm from any inconsistency. Most respondents called the current categories inconsistently applied, too prescriptive and too broad, and some objected to long-term asset funds sitting in the restricted mass market category. The FCA says that there was less evidence of how these inconsistencies affect consumer choices (paragraph 2.40), and it has decided that peer-to-peer agreements should remain in that category (paragraph 2.42).
Risk information. The FCA plans to consult on rules and guidance for mainstream investments, supported by consumer research. Paragraph 1.13 gives the timing as early 2027 and paragraph 2.45 as the first half of 2027.
Appropriateness. The FCA regards the assessment as central to non-advised sales of complex and high-risk investments (paragraph 2.65), but will review how it works in practice before proposing policy. Respondents said that online access to AI could defeat its purpose (paragraph 2.63).

On self-certification under the Financial Promotion Order, the FCA says that legislative change is required and that it lacks the powers to address the harm (paragraph 2.10), reporting that 16% of participants in its experiment could legitimately self-certify and 53% of the control group did so. The matter therefore remains with HM Treasury. The statement also confirms that the multi-firm review of model portfolio services will report by the first quarter of 2027, that final rules on CP26/24 should follow by the end of 2026, and that the Consumer Composite Investment regime comes into full force on 8 June 2027.

I think it unlikely that long-term asset funds will leave the restricted mass market category before 2028. The FCA has committed only to assess harm, has given no date for proposals, and says that it has less evidence of how the present classification affects consumer choices. An authorised fund manager planning retail distribution of a long-term asset fund should continue to build for COBS 4.12A as it stands.

FCA consults on cryptoasset exclusions and DeFi guidance, with final text due after the application period closes on 28 February 2027

MEDIUM RISK · Sectors: Digital Assets, Investment Firms

On 21 October 2026, the FCA published CP26/36, Cryptoasset Perimeter Guidance, and GC26/7, draft non-Handbook guidance on decentralised finance (DeFi), and both consultations close on 18 November 2026. Each is draft guidance on a regime already legislated, and neither changes the scope of the regulated activities.

CP26/36 follows PS26/18, which we covered in Issue 29. The Government laid the Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 on the day before that statement, adding exclusions for temporary settlement arrangements, temporary stablecoin holdings for payments, backing assets, certain proprietary trading and technical services that merely give access to a third party or a decentralised protocol. The draft amends PERG 18 accordingly and adds guidance on decentralisation. The FCA's position is that the perimeter is technology neutral: software, smart contracts or distributed governance do not determine whether a person carries on a regulated activity, the “by way of business” test applies separately to each participant, and overseas elements do not by themselves take an activity outside the UK.

GC26/7 then addresses firms that use or interact with DeFi, including, the FCA suggests, firms engaging with tokenised assets. It applies SYSC 15A and the financial crime expectations to smart contract, oracle and key-management risks, and records that decentralised exchanges accounted for about 14% to 19% of global cryptoasset spot volume between January and August 2026, and that more than US$12bn has reportedly been lost through DeFi and bridge hacks since 2016.

The timetable leaves one practical gap. The application period closes on 28 February 2027, whereas the FCA expects to finalise CP26/36 in spring 2027 and GC26/7 in the first quarter of 2027. A firm relying on one of the new exclusions, or on a decentralised structure, will therefore have to decide whether to apply before the final perimeter guidance is available, and would be prudent to record its analysis against the draft. The FCA states that it expects to determine applications submitted in the period before the regime begins on 25 October 2027, and that firms registered under the Money Laundering Regulations which apply in the period can continue under the savings provisions until their applications are determined (paragraph 1.16).

FCA publishes good and poor practice on AI; joint survey reports that 86% of respondents use AI and about half monitor it after deployment

INFO · Sectors: All Regulated Firms, Banking, Insurance

On 19 October 2026, the FCA published good and poor practice on AI in financial services, and on 26 October the Bank of England and the FCA published Artificial intelligence in UK financial services - 2026, the fourth joint survey, based on 196 responses. The first states that its examples “do not create new requirements”; the second reports what respondents said, and its percentages are of respondents and not of the sector.

The practice publication applies the Consumer Duty, senior manager accountability and the operational resilience rules to AI. Among the areas for improvement, the FCA records firms building a tool without establishing the consumer need, and firms excluding consumers with vulnerability indicators from AI-supported services by default without another route to support. Among common features of good governance it lists senior managers who are accountable for AI systems and for taking reasonable steps to mitigate risks. In a speech on the same day, Jessica Rusu said that firms retrofitting governance after deployment have it “the wrong way around”, and that incident reporting “must extend to significant AI failures and near-misses”. A speech does not amend SUP 15, and she did not say how the existing rules would reach near-misses.

The survey reports that 86% of respondents use AI, up from 75% in 2024, and that 80% have agents in production for decision support while 2% have deployed agents with broad autonomy. Its findings on control are of more interest to a board. Human approval, pre-deployment review and vendor due diligence were each reported by more than 90% of respondents, whereas ongoing monitoring, leakage testing and periodic review were each reported by about half. Third-party systems accounted for 39% of reported systems but 53% of high-materiality systems, and for those systems 81% of respondents relied on vendor assurance and contractual arrangements, with 24% relying on deep knowledge of the system.

CP26/37 would retain pre-approval of SMF24 on the stated ground of frontier AI and cyber risk. The accountability point can be checked by identifying which Senior Manager's Statement of Responsibilities covers each high-materiality AI system and whether that person receives post-deployment monitoring results, since those controls are the least common in the survey. The FCA says that it will update the publication as the technology evolves.

Bank of England & PRA

PRA would make almost half of its Senior Management Functions notifiable and add an integrity limb to the competent employee rule

MEDIUM RISK · Sectors: Banking, Insurance

On 22 October 2026, the PRA published CP14/26, its parallel consultation to CP26/37, which we analyse in the Top Story above; this note is limited to where the PRA's proposals differ. CP14/26 is a consultation, and significant elements depend on Parliament enacting the Financial Services and Markets Bill (the Bill) substantially in its current form (paragraph 1.8).

The PRA would make almost half of its Senior Management Functions notifiable, expecting pre-approval applications to fall by about 43% (paragraph 6.33). SMF5, SMF6, SMF10, SMF11, SMF12, SMF14, SMF20 and SMF20a are among those to be notified, while SMF1, SMF2, SMF4, SMF9, SMF24 and others stay pre-approved (Table 1). The FCA and the PRA diverge in four respects that matter to a dual-regulated firm.

Group functions. The PRA would split SMF7 into an approved SMF7 and a notified SMF7a (paragraph 3.12), whereas individuals meeting only the significant influence limb at a solo-regulated firm would not be SMFs under the FCA's proposal.
Competence. The PRA would extend its competent employee rule for CRR and Solvency II firms to personal characteristics, including integrity and honesty, for those formerly certified (paragraph 4.5). The FCA relies on its existing rules and would extend its guidance to insurers.
Breach reporting. The PRA would raise the threshold for roles formerly certified to a final written warning, but suspension, dismissal and reduction or recovery of remuneration would stay reportable, on Form L within seven business days (paragraphs 5.3 and 5.4). The FCA's route for most staff is final written warning or dismissal within 14 months.
Temporary cover. The FCA states that the PRA proposes to keep the “reasonably unforeseen” test for dual-regulated firms, which would leave two standards in one firm, and it asks whether its own change should be limited to solo-regulated firms (CP26/37, paragraphs 3.78 and 3.79).

The PRA expects a reduction in quantified compliance costs of between £4.8m and £24.9m a year, with a central estimate of £11.5m (paragraph 6.32), and about 7,700 individuals fall within its Certification Regime (paragraph 1.4). Responses are due by 22 January 2027, with implementation expected in the second half of 2027, dependent on the Bill and HM Treasury's commencement powers (paragraph 2.22).

Bank of England consults on expectations for CCPs accepting tokenised collateral and states that the existing framework is not a barrier

LOW RISK · Sectors: Wholesale Markets, Digital Assets

On 29 October 2026, the Bank of England published a consultation on draft supervisory expectations for central counterparties (CCPs) seeking to accept tokenised versions of collateral that is already eligible under the proposed CCP Rulebook. The draft supervisory statement creates no separate regime: the Bank states that its initial view is that the existing framework does not prevent acceptance, and that CCPs must still follow the existing approval process for new collateral. It follows the consultation on letters of credit covered in Issue 30.

The Bank states that its considerations are not binary tests and do not imply that tokenised collateral is inherently riskier (paragraphs 3.1 and 3.2). A CCP should demonstrate that it has considered how the arrangement would operate in practice and whether it could transfer and realise the collateral within required timeframes in normal and stressed conditions, using the evidence available at the time of application (paragraph 3.3). The Bank also expects a CCP to understand the end-to-end operational arrangements, including dependencies on changes to a ledger, protocol, smart contract or permissioning arrangement (paragraph 3.17).

The consultation also seeks information on interest in a wider range of tokenised collateral, without proposing to widen eligibility. The Bank expects to publish its policy response and rules on the CCP Rulebook in the fourth quarter of 2026, to take effect once HM Treasury repeals the relevant parts of UK EMIR. Asset managers and funds are likely to be affected only indirectly, as clients of clearing members whose margin arrangements may change. Responses are due by 12 February 2027.

Fund Launches & Capital Raises

Octopus AIM VCT reopens its offer alone, with cost reductions delivered as additional shares paid for by its manager

INFO · Sectors: Asset Management, Retail Distribution

On 26 October 2026, Octopus AIM VCT plc announced that its joint offer with Octopus AIM VCT 2 plc, for up to £30m with an over-allotment facility of up to £30m in the 2025/26 and 2026/27 tax years under a prospectus dated 12 January 2026, is open to new subscriptions in respect of the company only. The offer will not re-open for Octopus AIM VCT 2 plc.

Applications received before 5pm on 16 December 2026 benefit from a 2.5% reduction in offer costs, and existing shareholders of any Octopus-managed VCT receive a 1% loyalty discount for the remainder of the offer. In both cases the reduction takes the form of additional new shares paid for by Octopus Investments Limited, the investment manager. The offer continues under the January prospectus, so the requirement in PRM 10.1.1R to supplement for a significant new factor runs until the offer period closes (PRM 10.1.4R). The announcement attributes the re-opening to the company's continuing investment programme and does not state how much of the offer remains available.

Albion VCTs publish a supplementary prospectus engaging PRM 10.1; M&G Credit Income raises £1.5m under the further-issue exemption

INFO · Sectors: Asset Management, Retail Distribution, Private Credit

On 23 October 2026, Albion Crown VCT PLC, Albion Enterprise VCT PLC and Albion Technology & General VCT PLC published a supplementary prospectus for their offers of up to £40m with over-allotment facilities of up to £20m, which we covered in Issue 27. The trigger, according to the announcement, was the publication of Albion Crown's annual report for the year ended 30 June 2026, and the announcement cites PRM 10.1, part of the prospectus sourcebook in force since 19 January 2026.

PRM 10.1.1R requires a significant new factor, material mistake or material inaccuracy to be mentioned in a supplementary prospectus without undue delay. Under PRM 10.1.14R, an investor who has already agreed to subscribe in an offer of this kind may have a right to withdraw, ordinarily within two working days of publication unless extended, and PRM 10.1.15R requires a prominent statement of that right where it arises. The announcement does not describe any withdrawal right, so an adviser with clients in the offers should read the supplement itself on the National Storage Mechanism.

The position differs for an issue made without a prospectus. On 21 October 2026, M&G Credit Income Investment Trust plc announced that its placing and WRAP retail offer raised gross proceeds of £1.5m through 1,647,581 new ordinary shares at 91.81 pence, a 1.5% premium to the cum-income NAV at 30 September 2026, with admission expected on 23 October. As we explained in Issue 29, that offer relied on the exemption in PRM 1.4.3R(1), and retail investors could not withdraw once an application had been accepted.

Enforcement Watch

FCA prohibits Vector Wealth's former chief executive as a “regulatory front” for a disqualified director and applies a multiplier of seven at Step 4

MEDIUM RISK · Sectors: Wealth Management, Investment Firms, All Regulated Firms

On 21 October 2026, the FCA published Final Notices, dated 16 September 2026, to Jeffrey St. Patrick Dawkins and Kadir Yusuf Kanizi, both former senior managers of Vector Wealth Limited (Vector Wealth). Mr Dawkins is fined £269,233 under section 66 of FSMA and prohibited under section 56 from performing any function in relation to regulated activity. Mr Kanizi is fined £20,000 and prohibited from performing any senior management function. The notices record that no agreement was reached at Stage 1, and neither applies a settlement discount.

The FCA found that a Swiss company owned by Individual A, a director disqualified until 24 August 2026 after an undertaking relating to fraudulent VAT evasion, had bought 95% of the dormant firm by 21 October 2019. Only 19.9% was shown at Companies House, with a signed and undated transfer for a further 75.1%, and internal correspondence records that 19.9% “sits beneath the regulator's requirement for disclosure”. Mr Dawkins stayed on as SMF1, SMF3, SMF16 and SMF17 on £6,000 a year under a contract for one hour a month. Between December 2019 and April 2022, the firm sold three unlisted bonds, classified as speculative illiquid securities, to about 43 investors for over £4.5m. Its promotional material used “regulated” and its derivations 15 times on one page and stated that a security trustee was in place when none was. The FCA's statement of 20 August 2026 on references to security trustees, which we covered in Issue 27, addresses a similar selling point.

The findings against the two men differ in kind. Mr Dawkins is found to have lacked integrity, breaching Statement of Principle 1 and then COCON 2.1.1R between 21 October 2019 and 28 January 2025, by knowingly acting as what the notice defines as a “regulatory front”, misleading the FCA about ownership and control and giving no notice under section 191D of FSMA. The FCA notes that failure to notify is a criminal offence under section 191F; the notice does not record any prosecution. Mr Kanizi, an SMF3 from 6 September 2021, is found to have breached COCON 2.1.2R and 2.1.4R, in part through training materials containing false statements about capital protection. His notice makes no finding of a lack of integrity and treats the breach as negligent or inadvertent.

The penalty calculations, under DEPP 6.5B, turn on Step 4. For Mr Dawkins, relevant income was £57,298, so seriousness level 5 (40%) gave £22,919, and a 25% Step 3 increase for failing to co-operate, including failing to attend a compelled interview in December 2024, gave £28,648. The FCA then applied a multiplier of seven under DEPP 6.5B.4G, reasoning that his salary was nominal because he was only a front, to reach £200,536, rounded to £200,500. For Mr Kanizi, level 3 (20%) of relevant income of £100,120 gave £20,024, and a multiplier of four gave £80,096, reduced to £20,000 for serious financial hardship; the FCA agreed not to enforce it if the same sum is made available to the liquidators. Two figures do not reconcile on the face of the notices. Mr Dawkins's interest on disgorgement is £10,959 at paragraph 6.5 but £11,435 at paragraphs 1.1 and 6.28, and the total of £269,233 uses the higher figure. The share of investor funds used for trading is about 54% in his notice and 27% in Mr Kanizi's. Neither notice explains the difference.

The read-across is to records outside the regulatory file. In November 2020, Mr Dawkins signed a bank mandate adding Individual A as an authorised signatory, and in May 2020 external compliance advice was addressed to Individual A and not to him. A board, or an investor carrying out operational due diligence, can test the same point by comparing the Financial Services Register with the bank mandate, the addressees of compliance advice, and the contracted hours of each senior manager.

My reading of the two notices is that the multiplier of seven answers an obvious defence, since a front paid almost nothing would otherwise attract almost no penalty. The notices do not tell against the CP26/37 proposal to remove Statements of Responsibilities from single-SMF firms, because a Statement here would have recorded the same false position. They do show the limit of a Register entry as evidence of who runs a firm, and an investor relying on one should ask for the records described above.

FCA restricts six Annex 1 lenders at their own request and requires independent reviews of anti-money laundering controls

MEDIUM RISK · Sectors: Financial Crime, Consumer Finance, Banking

On 23 October 2026, the FCA announced restrictions on six unregulated lenders registered as Annex 1 firms under the Money Laundering Regulations, imposed at each firm's request after concerns about anti-money laundering policies, controls and procedures arose while the FCA was assessing their applications. The restrictions are voluntary and the press release records concerns and not findings; it identifies no breach and imposes no penalty. It gives the following dates and terms.

Kingscrown Finance Ltd. Restricted on 21 April 2026, with further restrictions on 25 September 2026 limiting how it may receive payments and requiring an orderly wind-down of its loan book.
MOMSB Ltd and Momentus Capital Ltd. Restricted on 7 October 2026, with no new customers or lending subject to limited exceptions and an independent review of the anti-money laundering framework.
Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd. Restricted on 9 October 2026, on similar terms including an independent review.
Abbital Ltd. Restricted on 15 October 2026, with conditions on new customers, new lending and payments and an independent review.

This continues the increased scrutiny that we covered in Issue 26, and the FCA says that it is still assessing responses to its information request to around 900 registered firms. The point for regulated readers is the reminder that registration under the Money Laundering Regulations is not a substitute for a regulated firm's own due diligence, which the FCA describes as seeking direct confirmation of registration status, checking independently the information provided, and understanding and managing the risks. A bank, fund or wealth manager with a funding line to, or a client relationship with, an Annex 1 lender may wish to confirm that the Financial Services Register entry and any restriction are reflected on the customer file, and that the file shows an independent check as well as the lender's own statement.

FCA revokes four LIBOR and EURIBOR prohibitions and removes the Final Notices after convictions are overturned

INFO · Sectors: Wholesale Markets, Banking

On 16 October 2026, the FCA published a statement that it has revoked the prohibition orders against Colin Bermingham, Philippe Moryoussef, Jonathan Mathew and Christian Bittar and removed the associated Final Notices, after the Court of Appeal overturned their convictions. The FCA will take no further action against them in this matter, which follows its 2025 decision to discontinue proceedings against Tom Hayes and revoke Carlo Palombo's prohibition after the Supreme Court quashed their convictions.

The statement explains that the convictions formed the basis of the FCA's action, and the revocations follow from that. The same dependence exists in the conviction-based notices we covered in Issue 30, although nothing suggests that those convictions are in doubt. The statement makes no finding on the underlying conduct. A firm's vetting records or references will need correcting if they cite one of the four notices, which are no longer available on FCA channels.

Market Developments

Nikhil Rathi suggests looking again at the three lines of defence; Sarah Pritchard says the FCA will act on T+1 readiness

INFO · Sectors: All Regulated Firms, Asset Management

On 22 October 2026, Nikhil Rathi, the FCA's chief executive, gave a speech at the City Dinner at Mansion House, and on 20 October Sarah Pritchard, the deputy chief executive, gave a speech to the Investment Association Annual Dinner. Speeches are not policy, and each drafted text may differ from what was delivered, but both contain statements that are new.

Mr Rathi said that the FCA's reforms will not be fully felt unless “tickbox compliance” ends, citing duplicative assurance in the form of data packs, risk reports and internal audit, and that Ms Pritchard will engage with firms to “consider if it's time to look again at the 3 lines of defence”. He said that it is not enough to ask whether something is within the perimeter, that the FCA should also ask what powers it has to tackle significant harm affecting markets within its remit, and that the FCA may be getting past peak rule making but is not past the peak of intervention. Ms Pritchard told asset managers that the sector is “just past peak rule making”, that with T+1 settlement less than a year away “we will act if you're not” prepared, and that the joint tokenisation roadmap with the Bank of England will be published next month, narrowing the timing given by Jon Relleen in Issue 30.

The remark on the three lines of defence does not sit easily with the FCA's private markets review, published the following day, which expects “strong second-line compliance oversight and periodic third-line assurance reviews”, and with CP26/37, which keeps the Head of Internal Audit as a notified senior manager at firms in scope. Neither speech changes any rule or expectation. Until the engagement Mr Rathi describes produces a published position, the review remains the FCA's published statement of supervisory expectation, and a speech gives no basis for reducing assurance.

Katharine Braddick announces a five-year PRA strategy, a new cyber resilience directorate and a joint supervisory statement by the end of the year

INFO · Sectors: Banking, Insurance

On 22 October 2026, Katharine Braddick, Deputy Governor for Prudential Regulation and Chief Executive of the PRA, gave her first Mansion House speech. It is a speech and does not set policy, but it contains several specific commitments. The PRA will publish its first five-year strategy next year, around four priorities of resilience, growth, innovation and transparency, and it will create a new directorate reporting to her as a centre of excellence for operational and cyber resilience. It will consult jointly with the FCA on a new supervisory statement on those subjects by the end of the year.

On internal models for residential mortgages, which she acknowledged as a source of particular difficulty for many firms, the PRA will consult in spring 2027 on material policy changes to improve access to a modelled approach, subject to challenge by an independent panel, and will commission an independent review of the implementation of hybrid mortgage model requirements. The supervisory statement is the item for readers beyond banks, because the reference to joint consultation suggests that it will extend to FCA firms, although she did not state its scope.

High Court stays FCA v Huobi Global on undertakings to October 2031; Upper Tribunal extends the motor finance hearing to 3 March 2027

INFO · Sectors: Digital Assets, Consumer Finance

On 27 October 2026, in FCA v Huobi Global S.A. and Others (Claim No. FS-2025-000015), Deputy Master Holden made a Tomlin order staying the proceedings on the terms of a confidential settlement agreement dated 16 October 2026, with no order as to costs. The FCA announced the outcome on 29 October. A Tomlin order stays a claim on agreed terms without any determination of the issues, and the FCA states that the settlement is not an admission of liability. It concludes the claim that we followed in Issue 27 and Issue 30.

Huobi Global has undertaken to the court until 21 October 2031 that it will not knowingly, directly or indirectly, communicate or cause to be communicated any financial promotion in contravention of section 21 of FSMA, including on the HTX website, applications and social media. The FCA states that HTX is no longer active in the UK. Because there is no judgment, the case gives no authority on when an overseas platform's promotions are “capable of having an effect in the United Kingdom” under section 21(3), and the FCA's statement that being based overseas does not put a firm beyond the reach of UK law is its own position, unsupported by a ruling in this case. The undertakings bind the first defendant, and the word “knowingly” would appear to set the threshold for any later application to enforce them.

Separately, the FCA's statement on the motor finance scheme was updated on 26 October: the Upper Tribunal has extended the hearing to 16 February to 3 March 2027, replacing the dates in Issue 30. The FCA expects lenders to plan for the possibility that the scheme or parts of it are quashed, to make the necessary financial provisions and to engage with their auditors.

Chancellor's remit asks the FPC to consider risks in private markets and re-confirms the 2% inflation target for the MPC

INFO · Sectors: Banking, Private Credit, Asset Management

On 28 October 2026, with the Budget, the Chancellor sent the Governor the annual remit and recommendations for the Financial Policy Committee (FPC) and the remit for the Monetary Policy Committee (MPC). These are statutory letters: the FPC recommendations are made under section 9E of the Bank of England Act 1998, and the FPC must respond, either setting out what it will do or explaining why it will not act. The MPC letter re-confirms the 2% inflation target and changes nothing for readers.

The FPC remit tells the Committee to continue to prioritise resilience in non-bank financial institutions and, as part of its work on market-based finance, to consider risks in private markets and build on its private markets System-Wide Exploratory Scenario. It also asks the Committee to focus on gilt and gilt repo resilience following last July's discussion paper, and to monitor how AI may affect cyber and operational risk. On banks, it welcomes the Committee's proposed reforms to the leverage framework and capital buffers and expects further proposals to address overlaps in capital requirements related to domestic exposures.

The remit imposes nothing on any firm. Private markets now appear in the FPC's recommendations, five days after the FCA's conflicts review, although the two documents address different risks: financial stability in the first and the treatment of investors in the second.

Regulatory Calendar

October–November 2026

2 Nov Annex B of the Fund Reporting for Asset Management Entities Instrument 2026 (FCA 2026/68) in force: certain fund manager applications and notifications move to Gateway.
5 Nov MPC Bank Rate decision and November Monetary Policy Report.
6 Nov FCA CP26/34 on transaction reporting guidance and transitional provisions closes.
Nov Joint FCA and Bank of England tokenisation roadmap (Pritchard speech, 20 October).
18 Nov FCA CP26/36 (cryptoasset perimeter guidance) and GC26/7 (DeFi guidance) close.
19 Nov FCA Board meeting (Handbook Notice 145).
26 Nov Bank of England Financial Stability Report and FPC Record.

December 2026

10 Dec FCA Board meeting; sentencing of Kerry Nelson and Jacqueline Stephens at Portsmouth Crown Court.
11 Dec FCA CP26/35 on redemption terms for NURS investing in inherently illiquid assets closes.
16 Dec Last day for the 2.5% cost reduction on the Octopus AIM VCT offer (5pm).
17 Dec FCA CP26/39 on consolidated tape income sharing closes. MPC announcement and minutes.
24 Dec FCA CP26/38 on the Financial Crime Guide closes.
End 2026 PRA and FCA consultation on a supervisory statement on operational and cyber resilience (Braddick speech); FCA final rules on CP26/24 (FS26/3); Bank of England policy response and CCP Rulebook (2026 Q4).

January 2027

1 Jan UK CRR References (Amendment) Instrument 2026 (FCA 2026/67) and UK Listing Rules (Sustainability Reporting Standards Disclosure) Instrument 2026 (FCA 2026/56) in force.
15 Jan Bank of England consultation on CCP acceptance of letters of credit closes.
22 Jan FCA CP26/37 and PRA CP14/26 on SM&CR Phase 2 close.
28 Jan FCA Board meeting (Handbook Notice 145).

Key dates later in 2027 and beyond

1 Feb 2027 Remainder of FCA 2026/68 in force; COLL liquidity management rules (FCA 2026/54, PS26/17) in force.
7 Feb 2027 PRA CP13/26 on automatic indexation of thresholds closes.
12 Feb 2027 Bank of England consultation on tokenised collateral at CCPs closes.
16 Feb to 3 Mar 2027 Upper Tribunal hearing of the challenges to the FCA's motor finance compensation scheme (dates extended on 26 October).
28 Feb 2027 Cryptoasset application period closes.
Q1 2027 FCA final DeFi guidance (GC26/7); findings of the multi-firm review of model portfolio services (FS26/3).
Spring 2027 FCA final perimeter guidance (CP26/36); PRA consultation on access to modelled approaches for residential mortgages (Braddick speech).
H1 2027 SM&CR Phase 2 policy statements expected; FCA consultation on risk information for mainstream investments (FS26/3).
8 Jun 2027 Consumer Composite Investment regime in full force.
H2 2027 SM&CR Phase 2 implementation expected, subject to the Financial Services and Markets Bill.
25 Oct 2027 UK cryptoasset regime commences.
3 Apr 2028 MAR 13, 14 and 15 transaction reporting rules (FCA 2026/52) in force.

Question of the Week

When the Certification Regime ends, which record will show that each person now performing a certification function at your firm has been assessed for honesty and competence under SYSC 3.1.6R or SYSC 5.1.1R, who will hold that record, and what event will cause the assessment to be repeated, given that no annual certificate, Directory entry or regulatory reference would then prompt it?

We’d welcome your perspective. The best responses may feature in a future edition.

Insight

The documents of this fortnight take records out of the regulators' hands and leave them on the firm's own file. CP26/37 would end Form J, the routine submission of Management Responsibilities Maps, the Directory and the annual certificate, and would keep the Statement of Responsibilities and the Map only as documents to be produced on request. The private markets review asks firms to demonstrate how a conflicted decision was reached. The Financial Crime Guide update and the AI examples state in terms that they impose no new requirements, and the DeFi guidance is non-Handbook.

Whether that approach works depends on the quality of those records, and the fortnight's evidence is mixed. The joint AI survey reports human approval and pre-deployment review at more than 90% of respondents and ongoing monitoring at about half. Only 52% of the private markets firms in the first phase of the FCA's review said that internal audit had a role in reviewing conflicts, and Mr Rathi has suggested looking again at the three lines of defence. The Vector Wealth notices show the limit of a formal record: the Register named a chief executive who held four functions and was contracted for one hour a month, and the first supervisory notice is dated 16 February 2022, more than two years after the sale.

I would expect the FCA to rely more heavily on after-the-event requests for these records once the regime changes, because it will hold fewer of them in advance and has said that firms must produce them on request. Given the legislative timetable, the first such requests under the new rules are unlikely before the second half of 2027. The practical step I would take before 22 January 2027 is to list each record that the firm now submits or certifies only because a rule requires it, name who will keep it after commencement, and decide whether the firm would be content to produce it in its present form.

Asad Bukhory | Founder, Artizan Governance