In 2026 the FCA set out its supervisory priorities in nine annual Regulatory Priorities reports, which replaced portfolio letters. Supervisory priorities are not a reading exercise. They tell a firm where the questions will come from, what evidence will be requested, and which weaknesses will be treated as serious rather than technical. This is a practitioner view of the themes that should be on the board agenda through 2026/27, and what each one means in operational terms.
| Report | Published |
|---|---|
| Insurance | 24 February 2026 |
| Consumer investments | 4 March 2026 |
| Pensions | 10 March 2026 |
| Retail banking | 12 March 2026 |
| Mortgages | 12 March 2026 |
| Consumer finance | 17 March 2026 |
| Wholesale buy side | 19 March 2026 |
| Wholesale markets | 19 March 2026 |
| Payments | 25 March 2026 |
There is no report for cryptoasset firms, because the new UK cryptoasset regime starts on 25 October 2027.
Theme one: safeguarding of relevant funds
CASS 15, introduced by PS25/12 and in force since 7 May 2026, is the most consequential change for payment institutions and e-money institutions in several years. The FCA's Payments report said it expects a possible short-term rise in adverse safeguarding audit opinions. It raises the standard on records and accounts, on internal and external reconciliation, and on the identification and resolution of discrepancies, and it makes weak processes visible through the annual safeguarding audit.
Boards should be able to evidence the following.
- A complete relevant funds record capable of reproducing the position at any historic date.
- Internal and external reconciliation performed at the required frequency, with shortfalls funded and excesses withdrawn as required.
- An exception log with investigation, escalation and resolution recorded for each item.
- A safeguarding audit engagement in place, with findings tracked to closure.
Our PS25/12 safeguarding compliance checklist and CASS 15 reconciliation guidance cover the detail.
Theme two: financial crime effectiveness
The supervisory question has shifted from whether a firm has a financial crime framework to whether that framework detects what it is supposed to detect.
| Control | What supervision now tests |
|---|---|
| Business-wide risk assessment | Whether it reflects actual customer, product and geographic exposure, and whether it drives control calibration |
| Customer due diligence | Whether risk ratings are applied consistently and reviewed on trigger events |
| Transaction monitoring | Rule calibration, false positive rates, alert closure quality and tuning evidence |
| Sanctions screening | List coverage, fuzzy matching thresholds, testing of screening effectiveness |
| Reporting | SAR quality and timeliness, and the substance of the annual MLRO report |
Our guide to FCA financial crime compliance sets out the framework in full.
Theme three: Consumer Duty outcomes
The implementation phase is complete. The supervisory phase tests outcomes. The annual board report should present evidence that customers in each segment, including vulnerable customers, are receiving the outcomes the Duty requires, supported by data rather than process description.
Weak reports describe activity. Strong reports present outcome metrics with trend analysis, identify where outcomes differ between customer groups, and record the action taken where a difference is not justified.
Theme four: operational resilience and third parties
Firms are expected to have identified important business services, set impact tolerances, mapped the resources supporting each service and tested their ability to remain within tolerance in severe but plausible scenarios. Third-party and intragroup dependencies are a particular focus, as is the concentration risk created by a small number of critical technology providers. New incident and third-party reporting rules under PS26/2 apply from 18 March 2027.
Theme five: prudential soundness and wind-down
Wind-down planning remains a persistent weakness in payments, e-money and smaller investment firms. A credible plan requires a realistic trigger framework, funding for the wind-down period, an operational sequence for returning customer funds, and evidence that the plan has been tested rather than drafted.
Theme six: data quality in returns and MI
Late, incomplete or inconsistent regulatory returns generate supervisory contact out of proportion to the underlying issue, because they undermine confidence in everything else the firm reports. Firms should have an owner for each return, a review step before submission, and a reconciliation between regulatory returns and internal management information.
Sector-specific overlays
Payments and e-money. The Payments report adds pricing transparency for international payments, treatment of vulnerable customers, authorised push payment fraud, and preparation for stablecoin payments and agentic AI payments.
Cryptoasset firms. Financial crime controls, financial promotions compliance and authorisation under the new regime starting 25 October 2027. The application window runs from 30 September 2026 to 28 February 2027.
Consumer credit. Affordability, treatment of customers in financial difficulty, and the handling of historic redress exposure.
Insurers and intermediaries. Product oversight and governance, fair value assessments and distribution chain oversight.
Investment firms. ICARA quality, the internal capital and liquidity adequacy assessment, and market conduct controls.
Turning priorities into a plan
For each theme, a board should be able to name four things: the accountable senior manager, the control that addresses it, the monitoring test that proves the control works, and the reporting line that brings the result to the board. Where any of those four is missing, that theme is an exposure.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
We help boards convert supervisory priorities into tested controls, including thematic gap assessments, compliance monitoring programme design, safeguarding and financial crime reviews, Consumer Duty outcomes testing, wind-down plan development and regulatory reporting assurance.
Contact our regulatory team at info@regulatorycounsel.co.uk for a written proposal.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently asked questions
The dominant themes are safeguarding of relevant funds under CASS 15, financial crime control effectiveness, Consumer Duty outcomes evidence, operational resilience and third-party risk, wind-down planning, and the quality of regulatory reporting and management information.
By mapping each priority to a named senior manager, an identified control, a monitoring test that evidences the control is effective, and a defined board reporting line, then tracking gaps to closure.
Compliance with CASS 15, the safeguarding regime introduced by PS25/12 and in force since 7 May 2026, which raises the evidential standard on records, reconciliation, discrepancy resolution and the annual safeguarding audit.
Inaccurate or late regulatory returns undermine supervisory confidence in all of a firm’s reporting, and frequently trigger information requests that expand into wider reviews of governance and control.
It means evidencing that a control produces the intended result in practice, through testing, outcome data and monitoring output, rather than evidencing only that a policy or procedure exists.
Insurance, consumer investments, pensions, retail banking, mortgages, consumer finance, wholesale buy side, wholesale markets and payments, published between 24 February and 25 March 2026.
No. The FCA has not produced one because the new cryptoasset regime starts on 25 October 2027. Cryptoasset firms should follow the authorisation application window, which runs from 30 September 2026 to 28 February 2027.
Safeguarding under CASS 15, financial crime and fraud including authorised push payment fraud, the Consumer Duty with a focus on international payment pricing and vulnerable customers, operational resilience, wind-down planning, and preparation for open banking, stablecoins and agentic AI payments.
Definitive guides on this topic
The permanent reference pages this article relates to.