Operational Resilience / Outsourcing in United Kingdom

Key dates

2026-11-03

PRA and FCA publish the joint discussion paper and open the feedback period.

2027-03-05 Deadline

Deadline for responses to the discussion paper to be submitted to the PRA and FCA.

Suggested considerations

• Firms should assess the discussion paper against their size, growth trajectory, business model, lending mix, capital methodology, governance arrangements and operational-risk profile.
• Credit unions may wish to submit evidence to the PRA and FCA by 5 March 2027, including quantified costs and benefits of simplified requirements, risk-based capital treatment, revised reporting and any proposed thresholds.
• Compliance and risk teams should map current internal-audit, regulatory-documentation, capital, leverage-ratio, risk-weighted-asset, capital-add-on and stress-testing requirements so that the impact of possible future options can be assessed without assuming that any proposal is yet effective.
• Boards and senior management should consider whether planned growth, aggregator arrangements, mortgage or fixed-rate lending, outsourcing and technology investment are matched by appropriate governance, liquidity, credit-risk, operational-resilience and third-party oversight capabilities.
• Firms considering new products or services should identify statutory, prudential, conduct, systems and outsourcing barriers and document the safeguards that would be needed to support a credible response to the regulators.
• Credit unions should review current wind-down, transfer and restructuring plans and identify legislative or contractual barriers to sale of loan books, transfer of business or conversion to another mutual form.
• Industry bodies and service providers may wish to coordinate submissions on FCA fees, shared-service models, CUSO capability, third-party guidance and the practical consequences of applying Small Domestic Deposit Takers rules.

What changed

This is a discussion paper, not a consultation proposing or committing to specific policy changes, so existing PRA and FCA requirements continue to apply. The regulators are examining whether internal-audit and regulatory-document requirements could be reduced for smaller and simpler credit unions; whether larger or more complex credit unions should move to a risk-based framework with more flexible capital requirements; and whether relevant Small Domestic Deposit Takers rules, including the standardised approach for risk-weighted assets, could replace the current simple leverage-ratio...

Key dates

2026-11-03

PRA publication date for DP2/26 and FCA publication date for the parallel credit-union discussion paper DP26/1.

2027-03-05 Deadline

Deadline for responses to DP2/26, submitted to [email protected].

Suggested considerations

• Firms should consider whether to submit evidence or a response to DP2/26 by 2027-03-05, addressing the questions most relevant to their size, business model, activities and growth plans.
• Compliance teams may wish to map current prudential, reporting, governance and operational-resilience requirements against the proposed distinction between small and simple firms and larger or more complex credit unions.
• Credit unions considering growth should assess whether board expertise, senior-management capacity, capital and liquidity planning, credit-risk controls, member-servicing capability and operational resilience will scale with membership and lending volumes.
• Firms may wish to review governance and controls for aggregator-driven growth, mortgage lending, fixed-rate products, outsourced activities, third-party providers and CUSO relationships, because these are identified as areas where future safeguards or supervisory expectations may develop.
• Boards and senior managers should consider how existing responsibilities under Rule 11.5(3) of the Credit Unions Part of the PRA Rulebook are evidenced, including oversight of regulatory compliance, risk management and business growth.
• Credit unions may wish to evaluate their current solvent-exit and wind-down arrangements, including the feasibility of transferring business, selling a loan book, restructuring or maintaining continuity of member services.
• Trade associations and service organisations may wish to provide data on compliance costs, asset-based thresholds, barriers to permitted activities, common-bond expansion, CUSO use and the practical effects of different prudential models.
• Firms should monitor subsequent PRA and FCA consultations and any legislative proposals; no implementation plan or transition timetable has been established at this stage.

What changed

No rules, thresholds, permissions or supervisory requirements have been amended by DP2/26. The regulators are seeking evidence on six outcomes: proportionate regulation; consumer confidence and protection; competition and innovation; long-term sustainability; operational resilience and risk management; and orderly market exit.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-29

FCA CP26/39 published and consultation opens.

2026-12-17 Deadline

Deadline for responses to CP26/39.

2027-03-18

PS26/2 final rules and guidance on operational incident and material third-party reporting come into force; the CTP-related enhanced reporting framework is expected to apply from this date.

2027-01-01

FCA plans to publish a Feedback Statement confirming the income-sharing metric and percentage for the equity CTP.

2027-04-01

FCA expects to publish its Policy Statement on how shared equity-CTP income is distributed among data contributors during spring 2027.

Suggested considerations

• Trading venues and other potential data contributors should consider modelling how alternative allocation metrics, including data contribution, trading activity, quote quality or coverage measures, could affect their expected income-sharing receipts.
• Prospective equity CTP bidders should consider the proposed distribution methodology, the five-year concession structure and the resulting revenue, accounting, data-governance and contractual controls in procurement and operating models.
• CTPs and firms providing critical technology or data services to CTPs should map operational incidents against the PS26/2 thresholds and assess whether current escalation, evidence retention and regulatory-notification procedures can support reporting as soon as practicable.
• CTPs should consider whether their incident-management playbooks distinguish standard and enhanced reporting, capture significant status changes and support submissions through the FCA’s prescribed reporting channel.
• Affected stakeholders should consider submitting responses to the FCA consultation by 17 December 2026, particularly on allocation fairness, data-contribution measurement, treatment of different contributor classes and the operational burden of enhanced incident reporting.
• Compliance teams may wish to track the early-2027 Feedback Statement on the income metric and percentage, the spring-2027 Policy Statement on distribution rules and the separate final rules on systematic-internaliser quotes.

What changed

The FCA proposes to add Handbook rules and guidance governing how the portion of equity CTP income specified in the five-year concession agreement is allocated among data contributors. The proposed allocation rules would apply regardless of the income metric or percentage ultimately specified in that agreement; the FCA plans to confirm the income-sharing percentage and metric in an early-2027 Feedback Statement and the distribution rules in a spring-2027 Policy Statement.

Key dates

2026-10-29

The Bank of England published the consultation and draft Supervisory Statement on CCP acceptance of tokenised collateral.

2027-02-12 Deadline

Consultation closes; responses on the draft supervisory expectations and wider tokenised-collateral policy are requested by this date.

2028-01-01

Target year for the Bank’s planned RT2 synchronisation capability supporting settlement between digital-asset ledgers and central bank money; this is a stated implementation target, not a compliance deadline.

Suggested considerations

• CCPs and prospective CCP applicants should consider whether tokenised versions of currently accepted or eligible collateral would constitute new collateral requiring notification to, or permission from, the Bank under the existing supervisory and margin-permission processes.
• Compliance, legal and risk teams should consider mapping each proposed tokenised collateral arrangement end to end, including issuance, representation of rights, custody, transfer, settlement finality, redemption, liquidation and default management.
• CCPs should consider preparing evidence on valuation methodology, price reliability, liquidity, conversion between tokenised and conventional forms, repo or outright-sale access, stress-market behaviour and concentration treatment across identical underlying assets.
• CCPs and their service providers should consider legal opinions addressing ownership, enforceability, insolvency treatment, settlement finality under the Settlement Finality Regulations, transfer restrictions and the relationship between ledger records, CSD records and underlying assets.
• Operational-resilience assessments should consider ledger, bridge, smart-contract, custodian, wallet, key-management and other third-party failure scenarios, including alternative access, transfer, liquidation and recovery arrangements.
• CCPs should consider whether proposed arrangements require changes to models, parameters, margining, collateral haircuts, default-management procedures, investment-policy controls, outsourcing oversight or governance approvals.
• Affected firms and infrastructure providers may wish to submit responses to the Bank’s consultation by 2027-02-12, particularly on practical barriers, wider tokenised-asset use cases and whether the proposed expectations remain suitable for future collateral types.
• Firms operating cross-border collateral arrangements should consider the interaction with parallel international developments, including ESMA’s October 2026 call for evidence on tokenised collateral in EU central clearing.

What changed

The Bank proposes to assess tokenised collateral through the existing supervisory process for new collateral, including where a tokenised version has risk characteristics that differ from the approved non-tokenised asset because of its delivery method, credit risk or liquidity profile. The draft Supervisory Statement adopts a technology-neutral, outcomes-focused and proportionate approach: CCPs would need to demonstrate that tokenised collateral can be valued, transferred, controlled and realised within required timeframes in normal and stressed conditions.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Suggested considerations

• Firms should consider conducting a documented effectiveness review of governance arrangements, covering board composition and capability, challenge and decisions, delegation and escalation, management information, conflicts and assurance.
• Boards and management bodies may wish to map collective capability against the administrator's current and emerging risks, including technology, cyber resilience, data management, innovation, methodology, market structure and user needs.
• Compliance teams may wish to test whether board and committee records capture principal challenge, decision rationale, actions, ownership and follow-through, including significant decisions taken between scheduled meetings.
• Firms should consider documenting ownership of key risks, decision rights, escalation routes and the way UK-regulated entity obligations are represented in group governance arrangements.
• Administrators may wish to review whether group reporting and escalation channels remain effective if individuals with multiple roles are unavailable, conflicted or subject to competing priorities.
• Firms should consider whether conflicts frameworks address multiple roles, group relationships, commercial pressures, competing priorities and differing stakeholder interests, and whether identified conflicts, mitigations and decisions are recorded.
• Board reporting owners may wish to distinguish information provided for awareness from matters requiring discussion, decision or escalation, and highlight changes, exceptions, emerging trends, risk movements, mitigation effectiveness and overdue actions.
• Administrators should consider whether between-meeting escalation arrangements provide directors with timely information on significant developments without disconnecting those decisions from formal governance records.

What changed

The FCA has not amended rules, introduced new thresholds or imposed a compliance deadline. Instead, it has set out supervisory observations that benchmark administrators should assess against their own activities, risks, users and operating environments. The FCA will use these observations in supervisory engagement alongside developments in the benchmarks framework.

Key dates

2026-06-30

The FCA opened consultation on the proposed CRYPTOPRU 7 guidance.

2026-07-30

Consultation on the proposed guidance closed.

2026-09-30

The FCA finalised and published FG26/10.

2027-10-25 Deadline

FG26/10 comes into force alongside the FCA's new UK cryptoasset regime.

Suggested considerations

• Firms should map their current CRYPTOPRU 7 overall risk assessment against FG26/10, documenting any gaps in risk identification, stress testing, financial-resource calculations, recovery planning and wind-down analysis.
• Compliance and prudential teams may wish to confirm that the own-funds requirement is calculated as the highest of the permanent minimum requirement, fixed overheads requirement and K-factor requirement, and that the own-funds threshold requirement is not below that amount.
• Firms should consider developing severe-but-plausible scenarios that combine cryptoasset price declines, customer withdrawal surges, counterparty or exchange failure, cyber incidents, private-key compromise, reduced market liquidity, stablecoin de-pegging and infrastructure outages.
• Firms should assess whether collateral, committed facilities, group support, banking arrangements, custody structures and other mitigants are legally, operationally and practically available under stress, rather than relying solely on their accounting treatment.
• Firms should prepare or refresh a stressed 90-day cash-flow forecast covering peak and cumulative liquidity needs, including margin calls, settlement failures, client drawdowns, pre-funding requirements and delayed or unavailable funding.
• Firms should assess their funding profile over the following 12 months, including renewal and rollover risk, withdrawal of facilities, reduced group funding and increased funding costs.
• Firms should establish a contingency funding plan with quantitative internal triggers above regulatory thresholds, credible actions within management control, implementation timelines, impediments and communication arrangements.
• Firms should distinguish recovery actions that management can execute directly from actions dependent on shareholders, banks, counterparties, group entities or buyers, and should consider whether limited recovery capacity requires earlier wind-down triggers.

What changed

FG26/10 does not create a new standalone binding rule or prescribe a single methodology; it explains how firms should evidence compliance with the binding requirements in CRYPTOPRU 7 and should be applied proportionately to the firm's nature, scale and complexity. Firms should begin with their business model, strategy and risk appetite, identify market, leverage, credit, liquidity, operational and concentration risks, assess interactions between those risks, and evaluate whether mitigants remain effective under stress.

Key dates

2026-09-17

The FCA published its findings on payments firms delivering good outcomes for consumers in vulnerable circumstances.

Suggested considerations

• Compliance teams may wish to map the four vulnerability drivers in FG21/1 against the firm’s customer base, products, channels and transaction journeys, including digital-only and automated interactions.
• Firms should consider testing whether vulnerability identification, recording, flagging and information-sharing operate consistently in practice through call listening, complaints analysis, quality assurance, customer research and sample-based file reviews.
• Firms may wish to document how identified needs translate into specific support, such as alternative channels, assisted onboarding, additional time, accessible communications, language support or human intervention, and how those interventions produce good outcomes.
• Management information may need to cover the prevalence and characteristics of vulnerability, support provided, customer outcomes, complaints, failed or delayed payments, access barriers, vulnerable-customer journey performance and trends over time; smaller firms may use proportionate qualitative evidence but should still demonstrate effective oversight.
• Boards and senior management may wish to receive sufficiently frequent reporting to challenge whether arrangements are working, investigate root causes and track whether remedial actions improve outcomes rather than relying solely on annual Consumer Duty reporting or isolated case studies.
• Firms using intermediaries should consider how they assess the intermediary’s identification, training, support, communications, recording and outcomes-monitoring arrangements, and how issues are escalated and remediated.
• When collecting or sharing vulnerability information, firms should consider compliance with UK GDPR, the Data Protection Act 2018 and applicable confidentiality and data-minimisation requirements.
• Smaller firms may wish to record why their systems, controls and management information are proportionate to their business model, customer base and potential harm, while retaining evidence that individual circumstances can be addressed flexibly.

What changed

No new binding requirements or prescribed operating model were introduced. The FCA has nevertheless clarified the evidence it expects firms to maintain under the existing Consumer Duty and its vulnerable-customer guidance, including an understanding of the four vulnerability drivers—health, life events, financial resilience and financial capability—identification and recording across customer journeys, appropriate support and communications, outcome-focused management information, senior-management or board oversight, testing and assurance, intermediary oversight, and continuous improvement.

Key dates

2026-09-14

FCA published the Call for Input on tokenised gold.

2026-10-23 Deadline

Deadline for stakeholders to submit responses to the FCA.

Suggested considerations

• Firms developing or considering tokenised gold may wish to assess whether their proposed token, contractual rights and underlying custody arrangements could constitute a CIS, an AIF, a financial instrument or another regulated product under FSMA 2000 and the Regulated Activities Order.
• Potential issuers and platform operators should consider documenting the legal relationship between the token holder, the bullion custodian and the physical gold, including allocation, segregation, redemption, transfer, lien, insolvency and loss arrangements.
• Wholesale market participants may wish to evaluate specific collateral use cases in securities lending, repo and derivatives, including eligibility, valuation, margining, haircut, settlement finality, enforcement and treatment following a platform or custodian failure.
• Firms should consider whether their governance, outsourcing, operational-resilience, cyber-security, private-key management, ledger-access and business-continuity controls are appropriate for tokenised ownership records and programmable transfers.
• Asset managers and product sponsors may wish to review whether existing disclosures, fund constitutional documents, custody arrangements, valuation policies and investor protections adequately address tokenised gold.
• Industry participants may wish to submit evidence to the FCA by 23 October 2026, addressing practical use cases, barriers, risks, interoperability standards and the effect of CIS and AIF perimeter uncertainty.
• Compliance teams may wish to monitor subsequent FCA policy development, including possible guidance or a bespoke regime, rather than treating the Call for Input as confirmation that any particular tokenised-gold structure is currently permitted or outside regulation.

What changed

No binding rule, authorisation requirement or supervisory obligation has been introduced. The FCA has begun an evidence-gathering exercise that may inform future guidance or a bespoke regime for tokenised gold. The regulator is examining whether digital tokens representing ownership of physical gold can support wholesale collateral, including potential use in securities lending, repo and derivatives transactions, while preserving market integrity, consumer protection and the existing strengths of London's gold-market infrastructure.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2026-12-31 Deadline

AST critical recommendations expected to be implemented, including same-day trade allocation/confirmation and adoption of the FMSB SSI standard

2027-10-11 Deadline

UK T+1 securities settlement cycle begins; transferables securities traded on a UK venue and settled on a UK CSD are expected to settle on T+1 basis

Suggested considerations

• Review whether the firm has completed a T+1 project plan, secured budget and governance, and mapped all required system and process changes.
• Check that trade allocation and confirmation processes can operate by end of trade date, or identify remediation needed to reach that standard.
• Confirm adoption of the FMSB standard for sharing standard settlement instructions and align client outreach to ensure clients use the same standard where relevant.
• Assess whether current settlement performance can be measured clearly, including failure rates and root causes, and whether management information is sufficient to track progress.
• Validate dependencies on custodians, counterparties, clients and third-party providers, and obtain their implementation timelines and testing plans.
• Prepare testing strategy and evidence for testing readiness, including alignment with the UK/EU joint testing plan.
• Consider whether the firm’s fund settlement cycle should move to T+2 before 11 October 2027 to reduce cycle mismatch risk.
• Increase automation where manual processes remain material, particularly in matching, confirmation and settlement instruction workflows.

What changed

This is not a new rule notice, but it is a supervisory signal about expectations for the 11 October 2027 T+1 transition. The FCA expects firms to have completed T+1 project planning, secured budget and governance, and be well into implementation, with system and process changes underway and testing plans finalised by the time the market moves closer to 2027. The FCA highlighted specific implementation priorities drawn from the Accelerated Settlement Taskforce framework, including allocating and confirming trades by the end of trade date, adopting the Financial Markets Standards Board...

Key dates

31 July 2023

- Consumer Duty came into force for open products and services and firms were expected to have outcomes monitoring capability in place from day one

31 July 2024 Deadline

- The final Consumer Duty implementation deadline applied to all in-scope financial services firms

2025

- The FCA reviewed firms’ approaches to outcomes monitoring over the past year and published its findings in this blog and related review material

TBD (ongoing)

- Firms are expected to continue regular monitoring, testing, and evidence-gathering on an ongoing basis under PRIN 2A.9

Suggested considerations

• Firms must establish and maintain a documented outcomes monitoring framework that defines good and poor customer outcomes for each relevant product or service.
• Firms must map metrics to the full customer journey, including product design, communications, customer support, and distribution arrangements.
• Firms must collect MI that can identify poor or potentially poor outcomes, root causes, and emerging risks before harm crystallises.
• Firms must document the rationale for each metric, threshold, and tolerance, including why those measures are appropriate for the customer population and product.
• Firms must maintain a clear audit trail linking MI, governance review, decisions, remediation, and outcome improvement testing.

What changed

• - The FCA expects firms to regularly assess, test, understand, and evidence the outcomes retail customers are receiving under the Consumer Duty.
• Firms should use monitoring to identify whether any group of retail customers is experiencing different outcomes from another group for the same product and understand why those differences exist.
• Monitoring frameworks should define what good outcomes look like in practice and translate those outcomes into measurable indicators tied to the customer journey.
• Firms should not rely on broad or high-level MI alone; they must use information to challenge performance, identify risks, and drive improvements.
• Firms should be able to explain why metrics and tolerances were chosen and whether any actions taken have been tested and shown to reduce harm or friction.

Key dates

14 October 2026 Deadline

- Deadline for submitting responses to PRA Consultation Paper CP10/26 on the deletion of the Continuity of Provision of Services Chapter and related changes to the Ring‑fenced Bodies Part

Suggested considerations

• Assess the current use of the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part within your firm’s ring‑fencing policies, procedures, contracts and governance, and identify all controls that explicitly rely on those rules.
• Prepare and submit a considered response to CP10/26 by 14 October 2026, addressing the practical impact of deleting the Continuity of Provision of Services Chapter, any residual areas of concern, and suggestions for guidance or transitional arrangements.
• Coordinate with group entities acting as permitted suppliers or critical service providers to ensure their OCIR documentation, service catalogues, TSAs and liquidity arrangements remain aligned with the ring‑fenced body’s continuity requirements in the absence of the deleted chapter.
• Monitor for the subsequent PRA policy statement that will follow CP10/26, and be prepared to implement any final rule changes, transitional provisions or clarifications on how ring‑fencing continuity expectations intersect with OCIR and operational resilience regimes.

What changed

• - The PRA proposes to delete in full the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part of the PRA Rulebook, removing the specific ring‑fencing continuity‑of‑services...
• The PRA will make consequential amendments to the Ring‑fenced Bodies Part to remove or adjust cross‑references, defined terms and obligations that are linked to the deleted Continuity of Provision of...
• The proposal effectively retires the bespoke continuity‑of‑services construct that was introduced when ring‑fencing was implemented (including detailed constraints on termination, suspension or...
• The consultation paper explains how the PRA intends to align ring‑fenced bodies’ continuity‑of‑services expectations with existing supervisory statements on operational continuity in resolution (for...
• The PRA invites stakeholders to comment on whether deleting the Continuity of Provision of Services Chapter, and relying on the broader operational continuity regime, still adequately protects the...

Key dates

12 November 2024

- UK regulators publish final policy and supervisory materials setting out the CTP oversight regime, including Fundamental Rules and operational risk and resilience requirements

01 January 2025

- CTP rules and oversight regime take legal effect, but only apply once a provider is designated as a CTP

13 July 2026

- Regulations for CTP oversight come into effect for the first designated CTPs; Bank of England, PRA and FCA formally start supervising AWS EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK as CTPs

Suggested considerations

• Review and update the firm’s operational resilience framework, including impact tolerances and scenario testing, to explicitly incorporate systemic risk arising from reliance on the designated CTPs and potential correlated failures affecting multiple services or regions.
• Re‑assess outsourcing and third‑party risk management policies to ensure they clearly distinguish between obligations placed on regulated firms and those placed directly on CTPs, while maintaining robust due diligence, ongoing monitoring and exit strategies for all CTP‑hosted services.
• Engage with designated CTPs (through account management, risk and security channels) to understand their approach to compliance with the CTP regime, including incident reporting arrangements, resilience testing, communication protocols and any new assurance artifacts they plan to provide.
• Update board and senior management reporting so that reliance on designated CTPs, associated systemic risk and regulatory developments under the CTP regime are regularly monitored and discussed at appropriate governance forums (e.g. risk committee, operational resilience committee).
• Review major incident management and crisis communication playbooks to ensure they include specific escalation paths, contact points and joint incident handling procedures with designated CTPs and relevant regulators.

What changed

• - A new CTP oversight regime becomes operational on 13 July 2026, under which the Bank of England, PRA and FCA will jointly supervise certain technology and service providers whose failure could...
• HM Treasury has made the first formal CTP designations: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.
• Designated CTPs must identify and manage risks to their critical services effectively, including governance, risk management and operational resilience arrangements specifically focused on services...
• CTPs are required to maintain open, timely communication with regulators and with firms that rely on them, particularly during major incidents, implying strengthened incident reporting,...
• The three regulators will jointly oversee CTPs under a proportionate regime focused on resilience of “critical services”, including assessing and mitigating system‑level risks and reducing the risk...

Key dates

10 November 2025

- Bank of England consultation paper issued on the proposed regulatory framework for sterling‑denominated systemic stablecoins and systemic payment system operators

Late 2026

- Bank of England intends to finalise the Code of Practice and supporting materials by the end of 2026, confirming the prudential and structural regime for systemic stablecoins

From 2026

- UK introduces new regulatory authorisation requirements for stablecoin issuers, including FCA authorisation for qualifying issuance and custody activities

10 February 2026

- Consultation period closes for the Bank of England’s systemic stablecoin regime proposals

June 2026

- Bank of England publishes its policy statement and draft Code of Practice for systemic stablecoin issuers, setting out detailed prudential and backing‑asset rules and confirming joint work with the FCA on an end‑to‑end regime

Suggested considerations

• Map all existing and planned sterling‑denominated stablecoin products against the UK’s systemic and non‑systemic regimes and assess whether their intended use in UK payments could trigger HM Treasury systemic recognition.
• Initiate or update FCA authorisation applications for stablecoin issuance and cryptoasset custody activities, ensuring business models, governance and safeguarding arrangements align with CP25/14 and the forthcoming stablecoin regime.
• Design and implement reserve‑management frameworks capable of maintaining backing assets equal to outstanding coins, in the proposed 70/30 mix between short‑term UK government debt and Bank of England deposits, with appropriate stress testing and liquidity risk oversight.
• Establish statutory trust and segregation structures for backing assets and liquid‑asset reserves, including appointing UK‑authorised third‑party custodians and aligning documentation with FCA client‑asset‑style protections and coinholder proprietary claims.
• Develop capital planning processes and ICAAP‑style assessments to meet the Bank of England’s requirements for capital against general business risk and dedicated reserves for financial risk and wind‑down costs.

What changed

• - UK stablecoin issuance will be subject to a dual regulatory regime: non‑systemic stablecoins will be supervised solely by the FCA, while systemic stablecoins used for payments will be jointly...
• Issuing a qualifying sterling‑denominated stablecoin in the UK will become a regulated activity, requiring FCA authorisation for non‑bank issuers and bringing them within the FCA’s prudential,...
• HM Treasury will apply statutory systemic tests under the Banking Act (e.g. scale, interconnectedness, substitutability, impact on confidence in sterling) to decide whether a stablecoin payment...
• Once recognised as systemic, stablecoin issuers and systemic payment system providers will fall under the Bank of England’s remit under the Banking Act 2009, including powers to obtain information,...
• Systemic sterling‑denominated stablecoin issuers will be required to maintain backing reserves equal to all outstanding coins, with backing assets held on statutory trust in the UK and ring‑fenced...

Key dates

15 July 2025

– Payments Vision Delivery Committee agrees the new public‑private model to deliver the next‑generation UK retail payments infrastructure under the National Payments Vision

Late 2026

– HM Treasury and the Bank of England are expected to publish conclusions on whether, and in what form, to proceed with a digital pound, which will influence infrastructure design and multi‑money functionality (date inferred as “later this year”)

25 June 2026

– Retail Payments Infrastructure Board consultation on the design of the future UK retail payments infrastructure is launched

11 September 2026 Deadline

– Deadline for stakeholders to submit responses to the RPIB consultation on the next‑generation retail payments infrastructure

Suggested considerations

• Identify internal stakeholders (payments product, technology, operations, legal, compliance, risk) and establish a formal project to coordinate your firm’s response to the RPIB consultation.
• Perform a gap analysis of your firm’s current use of Faster Payments, Bacs and cheque imaging, focusing on account‑to‑account capabilities, cross‑border flows, fraud and financial crime controls, customer authentication and operational resilience.
• Map and document key payment journeys relevant to your firm (e.g. point‑of‑sale account‑to‑account payments, bill payments, peer‑to‑peer transfers, ecommerce, cross‑border transactions) to enable substantive feedback on user needs and design priorities.
• Assess your firm’s strategic interest in account‑to‑account payments at the point of sale and enhanced cross‑border services, and identify functional requirements (APIs, messaging, reconciliation, chargeback‑like protections) that should be reflected in the consultation response.
• Review emerging regulatory publications under the National Payments Vision and Payments Forward Plan to ensure your consultation input aligns with expected regulatory outcomes on access, competition, resilience and innovation.

What changed

• - The RPIB has opened a consultation to develop a high‑level “blueprint” for the future UK retail payments infrastructure, which will underpin the National Payments Vision and inform the design to be...
• The consultation scope explicitly covers payment journeys, key design choices and priorities for the next‑generation infrastructure, rather than setting immediate prescriptive rules for firms.
• The next‑generation infrastructure is intended to support new payment methods, including account‑to‑account payments at the point of sale (in‑store and online) as a complement to card payments, and...
• Existing retail interbank payment systems (Faster Payments, Bacs, Image Clearing System) operated by Pay.UK will continue to run safely and resiliently during the transition, implying a multi‑year...
• The new infrastructure is being designed to support a multi‑money ecosystem, including existing commercial bank money and emerging forms of digital money (e‑money, tokenised deposits, systemic...

Key dates

2024

- UK Government publishes its National Payments Vision, which provides the policy backdrop for a UK regime on digital money, including stablecoins

10 November 2025

- BoE consultation paper “Proposed regulatory regime for sterling‑denominated systemic stablecoins” is published, setting out the initial framework, including 60% cap on gilts and per‑holder limits

10 November 2025

- BoE Financial Stability Paper on “The role of holding limits for sterling‑denominated systemic stablecoins and a potential digital pound” is published, exploring the macro‑prudential rationale for quantitative limits

End of 2026

- BoE intends to finalise the Code of Practice and supporting rules for systemic sterling‑denominated stablecoins, following the consultation feedback

02 February 2026

- Sarah Breeden speech “Talking ’bout next generation” elaborates on digital money and the proposed stablecoin regime

Suggested considerations

• Conduct a regulatory perimeter and recognition analysis to determine whether any issued or planned sterling‑denominated stablecoin could meet the Banking Act 2009 systemic tests and therefore fall under the BoE systemic stablecoin regime.
• Review and update treasury and investment policies for stablecoin backing assets to ensure the portfolio structure can comply with the revised requirement of up to 70% short‑term UK government debt and the remainder in BoE deposits.
• Perform detailed liquidity and redemption stress‑testing to evidence that central bank deposits and gilt portfolios can support prompt redemption under extreme but plausible scenarios while remaining within the £40 billion issuance guardrail.
• Re‑calibrate business plans and revenue models for systemic stablecoin issuance to reflect the increased allowable share of interest‑bearing gilts, the absence of per‑holder limits, and continued constraints on paying interest to coinholders.
• Design and implement governance and risk‑management frameworks that meet BoE expectations for systemic payment systems, including Board‑level oversight, risk appetite for digital money, and clear accountability for prudential and operational risks.

What changed

• - The Bank of England has published a policy statement “Sterling‑denominated systemic stablecoins” (22 June 2026) and a draft Code of Practice that will constitute the primary rulebook for systemic...
• The regime applies only to systemic sterling‑denominated stablecoins used for UK payments, i.e. stablecoins recognised as systemic under Banking Act 2009 tests where disruption could threaten UK...
• The previous proposal that at least 40% of backing assets be unremunerated central bank deposits and up to 60% in short‑term UK government debt has been revised so that up to 70% of backing assets...
• Backing assets must remain highly liquid and low‑risk, with central bank deposits used explicitly to support prompt redemption in stress, while the expanded gilt component is intended to improve the...
• The BoE has dropped the earlier concept of temporary per‑holder limits (for example, £20,000 per individual and £10 million per business that were consulted on in 2025) and replaced them with a...

Key dates

06 December 2023

– FCA publishes CP23/28 “Updating the regime for Money Market Funds,” consulting on higher liquidity minima (15% DLA and 50% WLA), delinking, enhanced KYC, and broader resilience measures

14 May 2026

– HM Treasury and the FCA publish the joint policy statement “Reforms to Money Market Fund Regulations,” confirming the Government’s intention to replace the UK MMFR with a new framework and that most MMF requirements will be set in FCA rules and guidance, including higher liquidity expectations

15 May 2026

– FCA issues its statement “FCA update on reforms to the UK Money Market Fund Regulation,” setting out updated proposals, including retention of current minimum WLA in rules, the new “adequate resilience” liquidity rule, and supervisory expectations of 40% WLA for stable NAV and 20% WLA for variable NAV MMFs, and indicating that CP23/28 measures such as delinking and enhanced KYC will largely be taken forward

Q4 2026

– The UK’s new MMF regime is expected to be in place, subject to Parliamentary approval of the enabling legislation, after which the detailed FCA rules and guidance (including the new resilience rule and WLA expectations) will apply

TBD (as soon as Parliamentary time allows)

– HM Treasury will lay the statutory instrument replacing the UK MMFR with the new legislative framework under which FCA rules and guidance for MMFs will be made

Suggested considerations

• Conduct a comprehensive gap analysis comparing current MMF liquidity management frameworks (DLA, WLA, and stress‑testing assumptions) against the forthcoming FCA “adequate resilience” rule and the 40% (stable NAV) / 20% (variable NAV) WLA supervisory expectations.
• Update MMF liquidity policies, board‑approved risk appetites, and internal limits to reflect the new WLA expectations, including documentation of when and how funds may temporarily operate below 40%/20% WLA and the governance required to approve such deviations.
• Implement enhancements to liquidity monitoring and MI reporting so that portfolio managers, risk, and compliance have near‑real‑time visibility of DLA and WLA levels, breaches of internal and supervisory thresholds, and redemption‑driven use of liquidity buffers.
• Review and update fund prospectuses, KIIDs/KIDs, and investor disclosures to ensure that descriptions of MMF liquidity management, the availability of liquidity management tools, and the operation of stable NAV structures are accurate under the new FCA regime.
• Revise and strengthen investor KYC procedures for MMFs to capture concentration risks and potential correlated outflows, including segmentation of investor types, monitoring of large holders, and scenario analysis around key client redemption behaviour.

What changed

• - The FCA will introduce a new overarching rule requiring that all UK‑domiciled MMFs must hold sufficient liquidity for “adequate resilience”, explicitly linking fund liquidity to financial stability...
• The FCA will retain the current minimum WLA requirements from the existing UK Money Market Fund Regulation (UK MMFR) in its rules, instead of the previously consulted increases to 50% WLA for all...
• The FCA will issue guidance setting out strong supervisory expectations that stable NAV MMFs should hold 40% WLA and variable NAV MMFs should hold 20% WLA to meet the new resilience requirement,...
• The FCA makes clear that falling below the 40%/20% WLA supervisory expectations should only occur to meet redemption requests or due to factors beyond the manager’s control, and should be rare, with...
• The FCA will retain existing minimum daily liquid asset (DLA) requirements from UK MMFR in rules and does not plan to issue new guidance on DLA levels, but expects DLA and WLA together to be...

Key dates

2024

– The Bank of England and FCA wrote to CCPs, RIEs and RCSDs to request feedback on the effectiveness of cooperation under the MoU based on firms’ interactions during 2024

2025/26

– The authorities conducted the annual joint review of the MoU for FMIs, considering the responses received from supervised entities over the preceding 12 months and assessing the effectiveness of coordination and duplication

Annually (ongoing)

– The Bank of England and FCA will continue to review the MoU each year, including soliciting feedback from FMIs, to confirm that supervisory cooperation remains effective and to identify potential enhancements

Suggested considerations

• Confirm internally that your firm’s regulatory engagement framework recognises the Bank of England–FCA MoU and clearly allocates responsibilities for managing relationships with both authorities in line with their respective roles.
• Review and, where necessary, update internal regulatory communications and escalation procedures to ensure that information relevant to both the Bank of England and FCA can be shared consistently, accurately and on a timely basis, in anticipation of coordinated supervisory expectations.
• Prepare to continue providing structured, constructive feedback during the annual MoU review process by maintaining records of supervisory interactions with each authority, including instances of overlap, gaps, or divergent expectations.
• Align incident management, operational resilience and major change approval processes with the expectation that both authorities may need to be informed and coordinated, and verify that notification playbooks and contact trees reflect this dual‑regulator structure.
• For groups operating multiple FMIs or cross‑border infrastructures, map where other regulators rely on the Bank of England/FCA supervisory cooperation (for example, via substituted compliance or recognition regimes) and integrate this into your global regulatory engagement strategy.

What changed

• - The Bank of England and FCA confirm, following consultation with FMIs over the last 12 months, that the existing MoU framework for supervisory cooperation on financial market infrastructures...
• The authorities explicitly reaffirm their commitment to efficient coordination to enhance the effectiveness of supervision, signalling continued emphasis on timely, accurate and proactive information...
• The statement maintains, rather than revises, the current allocation of responsibilities between the Bank of England (as primary prudential and systemic supervisor for FMIs) and the FCA (as conduct,...
• The authorities confirm the continuation of an annual review process of the MoU, including consultation with supervised FMIs to obtain feedback on how coordination is working in practice, embedding...
• The publication sits alongside the underlying 2025 MoU text (and the broader multi‑regulator MoU framework with FCA, PRA and PSR), reinforcing that FMIs should align their governance, reporting and...

Key dates

Mid‑June 2026 Deadline

– First LIVE submissions using Statistics Taxonomy v1.3.1 become due, covering **end‑May 2026** data; firms must use v1.3.1 for these returns and v1.3.0 instance documents will no longer be valid for submission

02 June 2026 – 12 June 2026

– BEEDS User Acceptance Testing (UAT) window for firms and software houses to test submissions using Statistics Taxonomy v1.3.1 in a non‑production environment, running in parallel with live reporting for some firms and returns

Suggested considerations

• Update internal reporting systems, data integration layers and XBRL engines so that all relevant BoE statistical returns are generated using Statistics Taxonomy v1.3.1 for end‑May 2026 reporting onwards.
• Review and update all XBRL instance document templates and configuration to ensure they reference the correct v1.3.1 entry points and filing indicators (XX.XX.XX format, e.g. FI.01.01).
• Decommission or phase out any dependency on the BoE Statistical Utility tool, and implement an alternative XBRL generation solution (recognised software provider or internal tooling) capable of producing valid v1.3.1 files.
• Conduct a detailed review of the BoE‑published change log, taxonomy package, sample files and XBRL filing manual to understand validation changes, DPM updates and implementation nuances that could cause submission failures.
• Schedule and complete end‑to‑end testing in the BEEDS UAT environment (where available) and in internal test environments to validate that v1.3.1 submissions pass all technical and business validations.

What changed

• - Bank of England Statistics Taxonomy v1.3.1 replaces v1.3.0 for statistical reporting under the BoE Statistics Taxonomy framework.
• The new taxonomy applies to LIVE submissions of end‑May data due from mid‑June 2026, meaning firms must generate those returns using v1.3.1.
• Reporting requirements and published definition documents remain unchanged, with the update limited to technical implementation changes (validation fixes, data point model changes and related...
• Taxonomy v1.3.1 is not backwards compatible with v1.3.0, so XBRL instance documents created under v1.3.0 will not be valid for submission once v1.3.1 is in force.
• Filing indicators are standardised across statistics reporting and now follow the format XX.XX.XX (for example, FI.01.01), requiring alignment of internal mapping and validation rules.

Key dates

Summer 2026

- The Bank plans to run a second consultation on the specific wildlife options to feature on the new series

End of 2026

- The Bank intends to announce the outcome of the consultation and final design direction

03 June 2026

- The Bank of England launches the public consultation on wildlife imagery for the next series of banknotes

03 July 2026

- The consultation closes

TBD (multi

year process; after 2026); - The Bank will complete detailed design, testing, printing, and rollout of the new series, which it says will take several years

Suggested considerations

• Review internal cash and branch readiness plans to account for a future change to the visual appearance of UK banknotes.
• Monitor the Bank of England’s consultation outcomes so denomination-specific handling, ATM, sorting, and authentication procedures can be updated in time.
• Update customer communications and frontline scripts to reflect that the next series will feature wildlife imagery, while retaining the monarch’s portrait.
• Validate that note-recognition, counterfeit-detection, and cash-acceptance systems can accommodate new denomination designs once specifications are released.
• Track the Bank’s second consultation in summer 2026 if your organisation relies on cash logistics, cash processing, or public education materials.

What changed

• - The Bank has opened a consultation on selecting four distinct native wildlife images for the central design of the next series of banknotes, one for each denomination from £5 to £50.
• The eligible imagery is limited to a published shortlist; the Bank is not seeking alternative nominations and will only consider animals on that list.
• The shortlist spans mammals, birds, and amphibians/insects/fish, reflecting the Bank’s intent to represent different UK environments across the banknote set.
• The Bank will select up to two examples from each category in the consultation, but the final selection may not match the highest-voted options.
• The Bank will retain a portrait of the monarch on the next series, alongside additional wildlife and nature elements.

Key dates

End May 2026

– Reference date of the first LIVE reporting period to which Bank of England Statistics Taxonomy v1.3.1 applies (end‑May 2026 data)

25 May 2026

– Last date for software houses to email the BEEDS queries mailbox to request access to the BEEDS UAT environment for this specific UAT window

Mid June 2026 Deadline

– Due date window for LIVE submissions of end‑May 2026 statistical data under Taxonomy v1.3.1 via BEEDS LIVE

02 June 2026

– Opening of BEEDS UAT environment for the June testing window under Taxonomy v1.3.1 FINAL

12 June 2026

– Closing of BEEDS UAT environment for the June testing window

Suggested considerations

• Identify all Bank of England statistical returns in scope of Taxonomy v1.3.1 and confirm that internal reporting calendars and responsibilities reflect the end‑May 2026 effective period and mid‑June 2026 submission deadlines.
• Ensure that all in‑scope statistical reporting firms’ BEEDS LIVE user and firm information are accurate and up to date, so that automatic mirroring into the BEEDS UAT environment creates correct and controlled user profiles.
• Instruct software houses and third‑party vendors supporting Bank of England statistical reporting to request BEEDS UAT access by emailing the BEEDS queries mailbox no later than 25 May 2026 if they intend to participate in this UAT window.
• Coordinate with internal IT and vendors to schedule, prepare, and execute test submissions in BEEDS UAT between 02 June and 12 June 2026, covering all relevant entry points and reporting scenarios under Taxonomy v1.3.1.
• Implement or validate an alternative XBRL generation solution to replace the withdrawn Bank of England Statistical Utility Tool, and complete end‑to‑end testing (source data to BEEDS receipt) ahead of the mid‑June 2026 live submission deadline.

What changed

• - The Bank of England has opened a BEEDS UAT environment specifically for testing statistical submissions under Statistical Taxonomy v1.3.1 FINAL, distinct from the BEEDS LIVE production environment.
• A dedicated UAT window is set from 02 June to 12 June 2026, during which the UAT environment will run in parallel with live reporting for some firms and returns.
• Statistical reporting firms are automatically enabled for BEEDS UAT using their existing BEEDS LIVE firm and user information and do not need to request UAT access.
• Software houses that wish to use this UAT window must request access by emailing the BEEDS queries mailbox by a stated cut‑off date (25 May 2026).
• All principal and additional user details for firms will be mirrored from the BEEDS LIVE environment into BEEDS UAT, with UAT‑specific temporary passwords issued from the designated BEEDS UAT email...

Key dates

Second half of 2017

- Proposed implementation date for superseding SS18/13 (achieved with December 2017 publication)

21 September 2017 Deadline

- PRA consultation deadline for CP9/17 (the consultation paper preceding this statement)

11 December 2017

- SS9/17 first published and became effective

Ongoing Deadline

- Firms must maintain and test recovery plans continuously; the PRA notes this statement "may be revised as recovery planning becomes further embedded in firms' risk management practices"

Suggested considerations

• *Develop comprehensive recovery plans containing all minimum elements specified in the Recovery Planning Part of the PRA Rulebook and detailed in SS9/17
• *Establish governance frameworks documenting how recovery plans are produced, reviewed, approved by the board, and how recovery options would be implemented
• *Conduct fire drill exercises that simulate recovery scenarios, test governance arrangements, and validate management information capabilities
• *Create implementation playbooks (for complex plans) that enable rapid execution by senior management during stress
• *Perform detailed impact analysis for each recovery option, quantifying capital and liquidity impacts with realistic timelines

What changed

SS9/17 introduced several material enhancements to recovery planning requirements: Governance and Integration: Recovery planning must be embedded within firms' risk management frameworks, with board-level oversight and integration with stress testing and ICAAP processes. The PRA expects clear governance documentation showing how plans are produced, reviewed, signed off, and implemented. Fire Drill Exercises: Firms must conduct regular fire drill exercises that simulate recovery scenarios in a live environment, testing governance arrangements, management information systems, and the...

Key dates

December 2024

- CP17/24 consultation published

H1 2026

- Final PRA/FCA rules on operational incident and third-party reporting effective (per industry analysis)

30 working days post

incident resolution; - Submit final incident report update (extendable to 60 working days in complex cases)

Annual

- MTP register reporting (exact date not specified; aligns with notifications)

Suggested considerations

• Identify and notify MTP arrangements via FCA Connect (excluding exemptions); maintain annual register with reduced fields.
• Monitor/assess operational incidents against clarified thresholds (e.g., contagion, reputation); submit single report if met, within specified timelines.
• Update policies per SS1/26 (thresholds) and SS2/21 (MTP identification).
• Align reporting with PRA/FCA/Bank templates; use data for resilience prioritization.
• For insurers: Integrate with ongoing operational resilience post-SS1/21 milestone (31 March 2025).

What changed

• - MTP Reporting: Amended notification rule for clarity; scope excludes credit unions with <£50m assets and all third-country branches; separated register and notification templates with reduced data...
• Operational Incident Reporting: Merged three-phased reports (initial, interim, final) into one simplified, aligned template across PRA/FCA/Bank; removed fields, made more optional; clarified...
• Guidance Enhancements: Updated SS2/21 with MTP identification examples; SS1/26 clarifies threshold interpretation, early-stage assessments, and systemic impact expectations.
• Alignment: Full harmonization with FCA/Bank and international standards (DORA, FSB FIRE). | Aspect | CP17/24 Proposal | PS7/26 Final Policy | |--------|------------------|---------------------| |...

Key dates

18 March 2026

- Publication date of SS1/26

18 March 2027 Deadline

- Effective date; firms must comply with reporting requirements

Within 24 hours

- Expected submission of initial phase report after determining threshold met (as soon as practicable)

Each significant change

- Intermediate phase update(s), including at resolution

Within 30 working days of resolution

- Final phase report (extendable to 60 working days if impracticable)

Suggested considerations

• Assess incidents against PRA thresholds (e.g., risk to stability/soundness/policyholders, considering contagion, disruptions > thresholds, data loss, media impact); report if met, even if internally high-priority.
• Submit phased reports using specified fields: Initial (basic details promptly); Intermediate (updates on changes like impact, strategy shifts, resolution); Final (full details post-resolution).
• Maintain processes for prompt classification, data gathering, and submission while prioritizing resolution; continue ad-hoc supervisory notifications if needed.
• Review internal policies to align severity ratings with PRA thresholds; document assessments.
• For critical third-party (CTP) incidents, both firms and CTPs report uniquely.

What changed

• - Introduces clear reporting thresholds in Regulatory Reporting Rule 24.2: Firms must report if an incident poses risks to UK financial stability, firm safety/soundness, or (for insurers)...
• Mandates a phased reporting approach (Rule 24.1-24.4): Initial report as soon as practicable (expected within 24 hours of threshold determination); intermediate updates for significant changes (e.g.,...
• Excludes near-misses (potential events without disruption/data loss to external users); aligns with but does not replace Fundamental Rule 7 or Notification Part Chapter 2 obligations.
• Specifies reporting via a "Reporting Fields Document"; firms balance reporting with incident resolution.

Key dates

March 17, 2026

- Consultation launch (today)

April 27, 2026

- Consultation closes (three-month window)

September 30, 2026

- Insurance liquidity reporting effective date (parallel reform)

Early 2027 – 2030

- Implementation timeline for final rules (phased approach)

Suggested considerations

• *Immediate (by April 27, 2026):
• Review the full consultation document and impact assessment
• Identify internal stakeholders (Treasury, Risk, Operations, Compliance) for response coordination
• Assess current liquidity stress testing capabilities against proposed weekly timeframe requirement
• *Medium-term (post-consultation, pre-implementation):

What changed

• The consultation proposes four primary regulatory modifications:
• Weekly stress testing requirement: Firms must conduct internal stress tests evaluating rapid outflows within one week, supplementing the existing monthly reporting framework
• Removal of Level 1 asset exemption: Sovereign bonds and other "level 1 assets" will no longer be exempt from annual testing of monetization capability for non-liquid assets, closing a significant...
• Barrier identification mandate: Firms must systematically evaluate their liquidity, identify barriers to asset monetization, and document findings
• Central bank facility preparedness: Regulatory encouragement (not mandate) for operational readiness to access Bank of England facilities during stress Critically, the PRA explicitly states these...

Key dates

July 2025

- Initial public consultation on banknote themes closed

Summer 2026

- Second public consultation to gather views on specific wildlife species (announced as forthcoming)

Future (multi

year process); - Design, testing, and printing of next-generation banknotes with anti-counterfeiting technology

Several years ahead

- Issuance of next generation of banknotes

Suggested considerations

• *Monitor the summer 2026 consultation: Track the announcement of the wildlife expert panel's curated species list and participate in the second consultation if relevant to your operations
• *Plan for authentication updates: Currency handlers and retailers should prepare staff training programs for new security features once designs are finalized
• *Update systems and procedures: Payment processors and financial institutions should plan for gradual transition protocols as new notes enter circulation
• *Engage with BoE communications: Subscribe to Bank of England announcements regarding final design decisions and implementation timelines
• *Prepare customer communications: Financial institutions should develop materials explaining the design change and new security features to customers

What changed

• The Bank of England is implementing the following design changes:
• Theme Selection: Wildlife native to Britain will feature on all denominations (£5, £10, £20, £50) of the next banknote series, replacing historical figures such as William Shakespeare, Winston...
• Monarch Continuity: King Charles' portrait will continue to appear on all notes.
• Security Integration: Wildlife imagery has been selected partly for its effectiveness in developing banknotes with easily recognizable and distinguishable security features.
• Scope Expansion: The design may incorporate additional natural elements including plants and landscapes to complement wildlife imagery.

Key dates

24 October 2025 Deadline

- Consultation response deadline for CP13/25

20 February 2026

- Publication date of PS5/26 (final policy)

~20 August 2026 Deadline

- Implementation deadline for SS2/23 CUSO expectations (six months from PS5/26 publication)

Suggested considerations

• Review and update policies: Credit unions must conduct due diligence/risk assessments before any CUSO investment/use; implement conflict of interest policies, especially for non-credit union partnerships.
• Ensure structural safeguards: Limit liability to investment amount; maintain legal/operational separation between credit union and CUSO; monitor aggregate investments ≤7.5% of capital.
• Governance alignment: Decisions must prioritize member benefits per legislative objects; update internal investment rules to comply with amended PRA Rulebook (Credit Unions Part).
• Implementation planning: Within six months, integrate SS2/23 expectations into operations; non-engaging credit unions need no action but should monitor for opportunities.
• Reporting/oversight: Prepare for PRA supervision on CUSO risks; consider CBA updates if significantly impacting mutuals.

What changed

• - Investment permission and cap increase: Credit unions can now invest in CUSOs using own capital, with the cap raised from 5% to 7.5% of total capital across all CUSOs (clarifications added on...
• Expanded CUSO scope: CUSOs can now serve other UK-regulated mutuals (with Part 4A permission) beyond just credit unions; partnerships with non-credit unions permitted as owners, subject to safeguards.
• Supervisory expectations in SS2/23: New chapter requires due diligence, risk analysis, limited liability to investment amount, legal/operational separation, conflict of interest policies, and...
• Other updates: Chapter 17 of SS2/23 amended due to deletion of SS20/15; six-month implementation window for SS2/23 CUSO expectations.

Key dates

Q1 2026

– Final design of Future Entity expected; live transactions expected through VRP scheme

End of 2026

– FCA expected to consult on Long-Term Regulatory Framework; statutory instrument for Open Banking expected to be laid by HM Treasury

February 2026

– Independent assessment process begins; KPMG commences evaluation of proposals

Before March 2026 Deadline

– FCA's Open Finance roadmap due for publication

Early April 2026

– KPMG delivers final assessment report; FCA publishes on its website

Suggested considerations

• *For industry participants and trade associations:
• *Engage with the assessment process: Participate in the independent assessment by submitting proposals or supporting existing proposals for Future Entity leadership
• *Arrange FCA Q&A sessions: Organizations interested in leading Future Entity establishment should contact the FCA directly to schedule one-hour Q&A sessions ahead of the independent consultancy process launch
• *Coalesce behind proposals: Industry should decide which proposal option should lead the next phase of work, with the FCA commissioning assessment of either multiple proposals or a single industry-supported proposal
• *Prepare for VRP implementation: Ensure systems and processes are ready for live Variable Recurring Payments transactions expected in Q1 2026

What changed

• The regulatory landscape for UK open banking is undergoing fundamental restructuring:
• Transition of regulatory authority: The FCA is becoming the primary regulator for open banking, replacing the Joint Regulatory Oversight Committee (JROC).
• Future Entity establishment: A new standards-setting body will become the primary UK standard-setting organization for open banking APIs, responsible for setting and maintaining common standards for...
• Independent assessment process: KPMG will evaluate competing proposals from industry participants to determine which organization should lead the Future Entity establishment.
• Legislative framework: HM Treasury will introduce legislation granting the FCA new rulemaking powers for open banking under the Data (Use and Access) Act 2025.

Key dates

October 2025

- First cohort began testing (historical reference)

19 January 2026

- Second application window opens

2 March 2026 Deadline

- Application deadline for second cohort

April 2026

- Testing starts for second cohort

Mid

March 2026; - Notification of successful applicants

Suggested considerations

• Review FCA's Terms of Reference (PDF) for eligibility, focusing on mature POCs and enterprise-level AI systems.
• Submit application form via FCA portal by 2 March 2026 if ready for live testing; contact suptech@ fca.org.uk for queries.
• Prepare documentation on AI system components (model, context/risks, governance, human oversight, evaluation, controls) for three-phase process.
• Assess internal governance, data, risk frameworks, and monitoring for AI readiness; consider non-participation but monitor for future FCA expectations.
• Firms not selected should use insights from first cohort (e.g., evaluation frameworks) to strengthen internal AI practices.

What changed

This is not a mandatory regulatory change but a voluntary testing service launched by the FCA; no new enforceable requirements are imposed. Key elements include a holistic focus on the AI system (model + deployment context, risks, governance, human-in-the-loop, evaluation, input/output controls) rather than isolated foundation models. The program features three phases: Discovery, Framework validation, and AI system testing (quantitative/qualitative), emphasizing live monitoring, governance, and risk management. It complements the FCA's Supercharged Sandbox for earlier-stage AI exploration.