Defence SMEs: access to banking services
AI Analysis
The FCA has published a multi-firm review of banking access for UK defence-sector SMEs, finding that the principal problem is friction and delay rather than widespread exclusion. Although the publication introduces no new rules, it signals supervisory expectations that banks and relevant payment and e-money firms should use proportionate, customer-specific risk assessments, improve management information, and be able to justify restrictions, refusals and closures; industry commentary has linked the issue to disproportionate de-risking of smaller defence businesses, particularly those involved in munitions and dual-use activity.
Key dates
- 2026-10-26
- Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.
- 2028-12-01
- The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.
Suggested considerations
- Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
- Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
- Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
- Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
- Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
- Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
- Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
- Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.
What changed
No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks. Where reputational, ESG or sustainability considerations affect decisions, firms should have clearly defined criteria, consistent application and appropriate governance. Firms should also improve identification of defence customers, including indirect supply-chain and dual-use businesses, and provide senio
Compliance impact
The immediate legal impact is limited because the FCA expressly states that the findings create no new obligations or alter existing requirements. Supervisory impact is nevertheless material for affected banks, building societies and payment or e-money firms: the FCA may monitor responses and intervene where decisions are not reasonable, properly considered, proportionate, risk-based or consistent
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original FCA source before acting. Full disclaimer.
What the FCA said
How SMEs in the defence sector currently experience banking services and whether banks could improve their understanding and decision-making.
Published by FCA . Read the full notice at the source for the authoritative text.