Wholesale banks supervision - Insights 3 (Autumn 2026)
AI Analysis
The FCA’s Autumn 2026 wholesale-banks supervision insights report identifies recurring control weaknesses in data lineage and completeness, communications surveillance, technology-asset inventories, algorithmic trading, data-loss prevention, operational-resilience evidence, AI governance, financial-crime controls and prime-broker client-risk assessments. Although the publication is non-binding supervisory guidance, independent market commentary reads the FCA’s multi-firm findings as a practical indicator of expanding supervisory scrutiny and likely expectations for demonstrable, board-level control effectiveness, particularly where failures could cause market abuse, financial-crime, operational or client harm.
Key dates
- 2026-09-30
- The FCA’s application window for the new UK cryptoasset regime opened.
- 2026-10-01
- The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.
- 2026-11-02
- The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).
- 2026-11-30 Deadline
- The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.
- 2027-02-28 Deadline
- FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.
- 2027-10-25
- The new UK cryptoasset regime comes into force.
Suggested considerations
- Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
- Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
- Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
- Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
- Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
- Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
- Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
- Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.
What changed
The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques. Operational-resilience self-assessments should link granular evidence to impact tolerances, vulnerabilities, remediation, testing and Board reporting, and should consider the effect of T+1 settlement on settlement-related important business services. The FCA also si
Compliance impact
The publication signals supervisory escalation through evidence-led reviews rather than a new rulebook: deficiencies that remain undetected, especially in financial-crime controls, surveillance, algorithmic trading, resilience or AI governance, may lead to material operational losses, market or client harm, restrictions on activity, remediation demands and potential enforcement. Its practical sign
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original FCA source before acting. Full disclaimer.
What the FCA said
Our further learnings gained from supervisory work we’ve undertaken, risks we’ve seen crystallise and findings from internal audit functions.
Published by FCA . Read the full notice at the source for the authoritative text.