Forecasting Change in 2026

As a mid‑year update to our Emerging Themes in Financial Regulation & Disputes 2026 outlook, these developments confirm – and refine – the trajectory identified at the start of the year: a move towards a more flexible, growth‑oriented and regulator‑led framework, driven by the interplay of politics, people and technology.

While much of the architecture was already visible through earlier consultations, firms now have something they have lacked throughout much of the process: certainty.

As crypto moves from the margins to the mainstream of the UK financial system, regulatory uncertainty is giving way to structured supervision, authorisation and enforcement.

It is official - the Senior Managers and Certification Regime (“SM&CR”) is changing. The 2026 Phase 1 reforms — delivered through two policy statements published by the Financial Conduct Authority (“FCA”) and the Prudential Regulation Authority (“PRA”) on 22 April 2026 — are framed around efficiency and proportionality. Indeed, the unprecedented speed with which the first tranche of changes have been brought into force (just two days after publication) – and the prioritisation of the Phase 2 reforms in the 2026/27 parliamentary session that starts on 13 May 2026 – are a clear sign of a strong desire on the part of the government to get things moving.

Financial services sit at the heart of the UK government’s modern Industrial Strategy. Designated as one of eight “growth-driving sectors”, it is expected to play a central role in supporting economic growth – yet it faces intensifying global competition from alternative financial centres worldwide.  

Consistent with patterns from past administrations, we expect U.S. securities enforcement to accelerate modestly in 2026. The SEC and FINRA will likely focus increasingly on cases about foreign actors, artificial intelligence (AI), and other emerging technologies, alongside traditional areas of enforcement with an emphasis on addressing investor harm. 

With the FCA’s new non-financial misconduct rules taking effect in less than nine months, firms should begin planning now. Here are some key areas to consider as part of your preparation.

Cyber incidents are increasingly giving rise to complex, long‑tail litigation risk, particularly for financial services firms. As regulators place growing emphasis on operational resilience, outsourcing governance and accountability, the same regulatory findings may be repurposed to support civil follow‑on claims long after incidents occur.

To stay ahead of disruption, firms should use 2026 to complete the following essential actions.

The FCA has significantly reduced the number of formal enforcement actions that it takes. Instead, the FCA is changing strategy, with more emphasis on exercising its supervisory tools. Although this may sound less intimidating than enforcement, supervisory actions can have equally serious consequences for firms and carry fewer procedural safeguards.

The direction of travel is clear: transparency is now an embedded feature of the enforcement landscape.

Early Account Schemes (EAS), implemented by the Prudential Regulation Authority (PRA) and now contemplated by the Office for Financial Sanctions Implementation (OFSI), allow firms to self-investigate and report misconduct in exchange for the opportunity of enhanced settlement discounts, quicker resolution, and greater visibility and control over the process.

The FCA has released new guidance to help cryptoasset firms prepare for the UK’s incoming regulatory framework - another step in the FCA Crypto Roadmap and a major marker on the path to full crypto regulation.

UK regulators have not yet fully exercised the breadth of their powers to address shortcomings in organisational cyber‑security measures—but that restraint is unlikely to continue. The policy statements published on 18 March 2026 by the FCA, PRA and Bank of England, introducing a new single regime for operational incident and third‑party reporting, signal the direction of travel. The framework—under which firms must report serious cyber and operational incidents through a unified portal and provide structured information on their critical third party (CTP) dependencies—reflects the UK regulators’ sharpened focus on digital risk, system resilience, and their recognition of the vulnerabilities inherent in  complex technological supply chains.

We consider some of the key aspects of the proposed changes and highlight some significant issues that must be considered before the proposals are implemented.

This landmark reform expands the scope of credit regulation to cover digital lending models such as Buy-Now-Pay-Later and microcredit, reinforcing transparency and affordability as central pillars of consumer protection.

With only 12 months until CRD VI starts to reshape cross-border lending, non-EEA banks face a fundamental question: how—and whether—they can continue serving European clients.

On 12 December 2025, the FCA published its long-awaited Policy Statement PS25/23: Tackling non-financial misconduct in financial services, finalising its formal Handbook guidance on non-financial misconduct.

Rather than starting from scratch, the FCA has adapted the existing Prudential Sourcebook for MiFID Investment Firms framework to the cryptoasset context. The aim is to reflect the unique risks associated with cryptoassets while maintaining proportionality and consistency with established investment firm regulation.

The FCA’s CP25/41 sets out proposals for two interlinked regimes: the Admissions & Disclosures (A&D) regime and the Market Abuse Regime for Cryptoassets (MARC).

The UK is rewriting the rulebook for cryptoassets.

The UK financial services sector stands at a pivotal moment in its AI journey. What began as cautious pilots has matured into widespread deployment, prompting regulators to sharpen their focus on governance and risk. 

Paid advertising continues to underpin the commercial model of major search and social media platforms.