Clarqo United Kingdom

UK insurers' net bond buying rises; US peers' falls

2026-10-21T16:04:51.000Z

A Bank of England staff study published on 9 October estimates that UK life insurers' cumulative net purchases of sterling corporate bonds rose after unexpected increases in long-term gilt yields, while US life insurers' net buying of dollar bonds from UK issuers fell.

The opposite responses matter because both groups are substantial holders of UK corporate debt. A view confined to domestic insurers could overstate how much their buying cushions the market after a UK monetary shock. It would also miss the overseas adjustment taking place in another currency segment of the same issuers' funding market.

The study does not say that a rate rise automatically produces a net gain or loss of demand across all British company bonds. It measures separate estimated responses in sterling and dollar debt, over different periods after a surprise. Those results cannot simply be subtracted to produce a market-wide total.

What the transaction data show

The authors combined UK transaction reports and US regulatory data for 72 UK and 550 US life insurers trading 2,436 bonds from 619 UK corporate issuers between January 2018 and December 2022. They compared bond purchases with unexpected movements in ten-year gilt yields around Monetary Policy Committee announcements, using those narrow-window surprises to isolate the policy-related part of a yield change.

For an illustrative one-percentage-point rise in the ten-year gilt yield attributed to such a surprise, the paper estimates that UK life insurers' cumulative net purchases of sterling bonds rose by about 2.5 percentage points of the bonds' outstanding amounts after 14 months. It estimates that US life insurers' cumulative net purchases of dollar-denominated UK corporate bonds fell by about one percentage point of outstanding amounts after a year. These purchase responses are measured as shares of bonds outstanding; they are not changes in bond yields, prices or borrowing costs.

The UK buying response becomes statistically distinguishable from zero after roughly a month in the authors' main analysis. The decline in US net buying is statistically significant between four and 14 months after the UK shock. A separate comparison within issuers finds a significant difference between the two investor groups. The results therefore rest on more than two visually different lines, although the size and timing of each estimate remain uncertain.

The researchers also examine surprises in US long-term rates. In their estimates, a one-percentage-point rise in the ten-year US Treasury yield is followed by about 1.2 percentage points more UK insurer purchases of sterling bonds after a year and about 0.5 percentage points fewer US insurer purchases of dollar bonds over the same period. That mirror pattern suggests an international investor channel, rather than a response confined to decisions taken in Threadneedle Street.

Why home currency changes the picture

The two groups do not own the same mix of securities. At the end of 2019, UK life insurers held roughly £130 billion of UK corporate bonds and US life insurers about £33 billion, the paper reports. UK insurers held about 19 per cent of outstanding sterling-denominated bonds from UK firms, but only around one per cent of their dollar bonds. US insurers held about 11 per cent of the outstanding dollar-denominated UK corporate bonds.

Those are 2019 holdings, not current market shares. Their value here is to show why an overseas insurer can matter to a British issuer without buying sterling debt. A company that borrows in dollars may meet a different pool of insurers and a different response to the same UK rate shock.

The authors identify several plausible reasons for the divergence, rather than a single proven cause. UK life insurers often need long-lived assets against long-lived liabilities. When long-term rates rise, changes in the relative value and duration of their liabilities can leave more room to buy longer-maturity sterling corporate bonds. The UK matching-adjustment framework also makes eligible, currency-matched assets useful to some insurers' balance sheets.

That does not mean the matching adjustment itself loosens whenever rates rise. The authors' tests do not support a dynamic capital release through that adjustment after a monetary shock. They describe it as a structural feature that helps shape which assets UK insurers hold and are ready to buy. For US insurers, global portfolio alternatives, dollar liabilities and different policyholder behaviour may carry more weight. The paper finds that translating transactions into dollars does not remove the broad contrast, weakening a simple exchange-rate explanation.

The limit of the finding

This staff working paper describes research in progress and was published to invite debate. Its authors' views are not Bank of England policy. The analysis links identified monetary surprises to insurer transactions; it does not directly measure how much a particular company paid to issue a bond because of the opposing flows.

Its shared UK and US transaction sample ends in 2022, a period that includes the pandemic and the UK liability-driven investment crisis. The authors extend the UK insurer data to August 2025 and report a broadly similar sterling buying pattern, but they do not have a matching US extension. The estimates should therefore not be presented as a forecast of what insurers will do after the next rate decision.

The practical lesson is narrower and more useful. Anyone assessing how monetary policy reaches British companies through bond markets needs to look at who holds the debt and the currency in which it was issued. Domestic insurers' net buying may rise after a rate shock while foreign insurers' net buying may decline. The balance between those flows remains an empirical question for each market and period.

FCA Finds Most Respondents Levy Matched CFD Funding Fees

2026-10-20T08:15:00.000Z

The Financial Conduct Authority has returned to the price of holding retail contracts for difference overnight. Its 15 October follow-up says most firms had made or planned changes after its earlier review, particularly to assessments and communications. Only 12% said they had changed any charges. For a client holding equal buy and sell trades on the same market, clearer disclosure leaves a practical question: what does keeping both positions open cost?

The FCA asked 81 CFD firms in May whether they had acted on its November 2025 findings. Its report does not give an exact respondent count behind the 12% figure. Some firms did not have retail offerings. The examples behind that figure include actions taken and actions still planned, so it is not a measured market-wide price cut.

Most firms had made or planned improvements to websites, applications or other communications. Only a minority had added an annual percentage rate alongside the implied daily cost of overnight financing. Even deal tickets showing overnight charges do not always show a projected annual percentage. That is a disclosure finding, separate from the charge level or a customer's outcome.

The matched-position bill

Suppose a retail client opens a £20,000 long position and a £20,000 short position on a UK 100 cash index CFD, then holds both for 30 calendar funding days. Assume the index stays at an illustrative 10,000 points and funding rates stay fixed. For dealing, use IG's one-point daytime spread and Capital.com's two-point spread displayed in a direct page check at 20:25 UTC on 15 October. Assume each spread is unchanged at exit. These are modelling assumptions, not live trade quotes.

On IG's FTSE 100 cash CFD schedule, one mini contract is £2 per point and the spread is one point during the stated 08:00 to 16:30 dealing window. At 10,000 points, each leg has £20,000 of notional exposure. IG's index funding formula applies SONIA plus a 3% annual administration margin to the long, and SONIA less that margin to the short. If SONIA were 4% purely for this illustration, the long would cost about £3.84 per calendar funding day and the short would earn about £0.55. The net is £3.29 a day, or £98.63 over 30 days. The benchmark cancels across the matched legs, leaving 6% a year on one leg's notional at a constant price.

Capital.com's UK 100 page displayed a two-point spread at that check. Two £1-per-point contracts give the modelled £20,000 exposure per leg at 10,000 points, using the provider's contract example. Its UK fee schedule sets the sterling-index administration component at 4% a year, or about 0.01096% daily, on top of the benchmark. Its hedging-mode guidance matters: the benchmark adjustment applies to each side, but the administration component is charged on only one side of an equal hedge on its standard platform. At the same assumed SONIA rate, the long's benchmark debit and the short's benchmark credit cancel. One £20,000 administration charge remains: about £2.19 a calendar funding day, or £65.75 over 30 days. The provider says MT4 positions receive the full charge on both sides, so this example applies to its standard hedging mode.

At IG, a one-point spread costs £2 per £2-per-point leg for a complete round trip, or £4 for the pair. At Capital.com, the observed two-point spread costs £4 per leg, or £8 for the pair, if unchanged at exit. Modelled 30-day funding plus round-trip spread is £102.63 at IG and £73.75 at Capital.com. Prices and rates can move; dividend adjustments, slippage and optional stop fees are excluded. Neither figure is a trade quote or a judgement on either service.

The decision before the trade

For an already-open pair, the original entry spread is sunk. Closing both legs now costs about £2 at IG's assumed one-point quote or £4 at Capital.com's observed two-point quote. Reopening the pair later would add the same amounts, making close-and-reopen costs £4 and £8 respectively if spreads were unchanged. Keeping the pair open instead incurs the modelled £98.63 or £65.75 in funding over 30 days. A later final close would cost both strategies a spread, so it does not change that incremental comparison. The trader must still weigh separate entry prices, the option to lift one side and when each leg's profit or loss is realised.

At 5% initial margin, a £20,000 leg requires £1,000 under both providers' public terms. Capital.com says an equal hedge uses margin on one side. IG's public pages do not establish the combined margin for this matched account. Funding is calculated on notional exposure, not merely margin cash. IG's CFD agreement says it does not normally pay interest on client money. Capital.com's terms make any interest discretionary. The comparison excludes the account-specific opportunity cost of committed cash.

The public pages show formulas, contract sizes, margin rules and, at Capital.com, an indicative daily market rate. IG gives an annual funding margin and benchmark information; Capital.com publishes a daily rate and annual administration component. A client can model costs before trading but must check the live quote and account-specific treatment. We did not inspect logged-in deal tickets.

The FCA's 2025 review warned that funding on both sides of matched positions could create substantial ongoing charges. Its new follow-up says most respondents still charge on matched trades and most use the same full funding spread as on directional positions. Firms cited administration and, in the earlier review, platform or counterparty arrangements; the newer report does not determine whether a given firm's costs justify its price. It asks firms to explain the pros and cons of holding a hedge versus closing it. For a retail trader, the usable test is the full round-trip spread plus projected funding and cash cost over the intended holding period, set against the reason for keeping two contracts alive.

FCA to Cut 13 Fields From UK Transaction Reports

2026-10-15T08:15:00.000Z

The Financial Conduct Authority has put a precise price on simplifying transaction reporting. It estimates that the final rules will cut the industry's annual bill from about £493 million to £385 million, a net saving of £108 million. The required report will shrink from 65 fields to 52 when the new regime takes effect on 3 April 2028.

The saving is measurable. The surveillance result is not yet. Transaction reports are the data the FCA uses every day to monitor markets, investigate market abuse and supervise firms. Cutting low-value reporting can make that dataset cleaner as well as cheaper, but only if the remaining fields, validation rules and firms' own controls continue to expose inaccurate or missing trades.

The next technical publication has now arrived. On 2 October the FCA published draft schema files and validation rules, alongside consultation CP26/34. Firms can map the changed data and comment by 6 November. The FCA has not yet said when the draft will be available in its industry test environment, and it plans to consult separately on a Transaction Reporting User Pack in early 2027. Publication of technical specifications is not evidence that a particular surveillance control will work in practice.

The largest savings come from scope

The final policy statement does more than shorten the report. It removes reporting obligations for about 7 million instruments that are tradeable only on European Union venues. The FCA puts the annual saving from that change at roughly £32 million.

Foreign-exchange derivatives will also leave the UK MiFIR reporting perimeter, reducing costs for more than 400 firms. The default period for correcting historical reporting errors will fall from five years to three, which the regulator expects to cut the volume of reports requiring resubmission by one third. Most corporate actions will be exempted, and trading venues will populate fewer fields in reports concerning international firms accessing UK markets.

Those changes remove volume at several points in the reporting chain. They also increase the importance of firms' scope logic. A control must distinguish an EU-only instrument or excluded FX derivative from a reportable trade that was accidentally omitted. A lower count is not evidence of better reporting unless the firm can explain why each excluded transaction sits outside the new perimeter.

That is already part of the control baseline. Article 15 of RTS 22 requires mechanisms both to avoid reporting transactions where no obligation exists and to identify reportable transactions that were not submitted. It also requires firms to test their reporting process and regularly reconcile front-office trading records against samples of the reports held by the regulator.

The final rules preserve that principle. From 3 April 2028, new Handbook rule MAR 14.15.1 will require regular testing and reconciliation of firms' transaction records against samples submitted to the FCA. Where an error or omission is found, firms must cancel and replace an inaccurate report or submit the missing one. The correction window will be shorter, but the obligation to detect problems will remain.

Validation cannot carry the control alone

The FCA's own supervisory work explains why the schema matters. In Market Watch 81, it said poorly designed reconciliations can exclude source data or specific flows, and that checking only selected fields or reconciling irregularly may fail to identify all errors and omissions. The regulator has also warned that firms should not rely on FCA or approved reporting mechanism validation rules to find every defect.

Validation tests whether a submission conforms to specified rules. It cannot prove that a report was required but never created, or that a plausible value accurately reflects the trade recorded in the front office. Those questions require an independent population check and a field-level comparison back to source systems.

The new draft XML schema reflects a change in PS26/15: separate Boolean client indicators for the buyer and seller replace the old branch-country fields, which the FCA said suffered persistent data-quality problems. Other removed transaction-level fields include option type, option exercise style, delivery type, maturity date, a second notional currency and five indicators covering waivers, short sales, over-the-counter post-trade activity, commodity derivatives and securities financing. The FCA says some information can be drawn from instrument reference data or classification codes, while the indicator fields had limited supervisory value. The shorter report therefore shifts part of the control burden to reference-data quality and correct population of the retained fields.

Firms will need to revise reportability engines, lineage maps, exception queues and reconciliation coverage. They should be able to show that instruments removed from scope are excluded for the right reason, that retained fields are populated from controlled sources, and that rejected or missing reports re-enter the process promptly. The published draft validation rules specify checks at the submission gate, but validation cannot reveal a report that was never sent. CP26/34 proposes examples for the new client indicator and other complex cases; the final User Pack is due by April 2027. Claims that the narrower report is equally effective or materially weaker would still run ahead of the evidence.

The implementation period is a control test

The October draft gives firms about 18 months for implementation before 3 April 2028. It is not yet available for testing in the FCA's industry test environment. The regulator is also taking a flexible supervisory approach in selected areas before the start date. That flexibility is not a general release from data-quality duties. The policy statement tells firms to assess governance, ownership, data lineage and controls across internal systems, venues, approved reporting mechanisms and vendors.

The most useful preparation is scenario testing. Firms can map trading flows against the revised perimeter, identify which reports fall away, and trace the remaining data from execution through submission and back into reconciliation extracts from the FCA's Market Data Processor portal. That work should reveal whether the saving comes from deleting genuinely low-value steps or from weakening a control that nobody has replaced.

The FCA's £108 million estimate gives ministers and firms a clear measure of the reform's economic benefit. Market integrity will need a different scorecard: fewer unexplained omissions, accurate retained fields, prompt correction of defects and reconciliation that covers the whole trading population. A smaller report can be a better report, but only if the control system around it becomes sharper.

Sources

38 Firms Joined SIMEX26. Recovery Times Remain Undisclosed

2026-10-14T08:15:00.000Z

The Bank of England's account of SIMEX26 says 38 large, systemically important banks and market infrastructure operators worked with the authorities on 8 October. It does not say how many services remained available in the scenario, how quickly any service recovered, or whether a cloud provider took part. Those omissions limit what the public can conclude about recovery capability.

SIMEX26 was the biennial exercise of the Cross-Market Operational Resilience Group, or CMORG. The Bank and UK Finance chair the group. Before the event, CMORG described simulated initial worldwide unavailability of a cloud provider's services, followed by recovery in some regions while some UK and western European services remained unavailable for three to five days or longer. That duration was a scenario assumption, not an observed recovery time. The exercise included a live meeting of the Bank-chaired Cross Market Business Continuity Group, which directs the sector's collective response to systemic incidents. The Bank expects firms to act on the exercise, but has published no participant-level results, pass rate or account of tested failover. The release does not disclose whether participants operated their own systems under simulated loss of cloud capacity or discussed decisions around a scenario.

That distinction matters because a coordinated response can help contain an incident even when underlying services cannot yet be restored. Regulators and firms need to decide who declares an incident, who communicates with customers and markets, and which services get priority. SIMEX26 appears designed to rehearse that collective machinery: the Bank's description of CMORG's Sector Response Framework calls it a key component of the exercise. Public evidence that the machinery was convened is useful, but it cannot quantify the continuity of a payment, trading or clearing service during a severe cloud outage.

The timing also invites a second, legally separate question. HM Treasury designated four cloud businesses as critical third parties from 13 July: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The Bank, Prudential Regulation Authority and Financial Conduct Authority now jointly oversee the resilience of the systemic services these legal entities supply to UK financial firms. The regulators' July announcement says oversight began on 13 July. It does not say any of the four joined SIMEX26. The Bank's October release names none of them as a participant.

Under the final critical-third-party policy, each designated provider must scenario-test its ability to continue providing each systemic third-party service within its appropriate maximum tolerable level of disruption under a severe but plausible event. Paragraph 2.156 says these tests should occur at least annually. A different requirement asks the provider to run an incident-management playbook exercise with a representative sample of its financial-firm customers. That exercise examines how effectively the provider communicates with and supports them during a simulated operational incident. Paragraph 2.167 requires the first within twelve months of designation and further exercises at least every two years. Firm participation is not mandatory under the final policy, although providers should open the exercise to all customers receiving systemic services.

SIMEX26 is CMORG's sector exercise. The public releases provide no basis to count it as any provider's annual scenario test or customer playbook exercise. Nor does the October announcement establish that any provider has missed a rule. The policy's interim self-assessment provisions require an initial diagnostic submission to regulators within three months of designation. The regulators expressly removed a requirement to share that interim assessment with customer firms. Later annual self-assessments must be shared with those receiving systemic services, subject to appropriate redactions. The exercise release and July designation announcement do not report whether an interim assessment was submitted or accepted. Those documents therefore establish neither compliance nor a breach.

For a bank, direct supervision of a cloud supplier does not transfer responsibility for its own services. The PRA's outsourcing statement expects a firm with a material outsourcing arrangement to maintain and test business-continuity and exit plans, including a stressed exit. For material cloud outsourcing, the firm should assess the resilience needed for its service and data, then choose suitable options such as multiple regions, a backup vendor, hybrid capacity or a route back on premises. The regulator does not prescribe one universal design. The FCA's operational-resilience guidance likewise requires firms in scope to identify important business services, set maximum tolerable disruption, map dependencies, test severe scenarios and maintain communications plans. Its guidance says third-party failure within a service remains the firm's responsibility.

A clearing house provides a sharper practical test. Under the Bank's currently effective statement for central counterparties, a CCP's business-continuity plan should enable it to resume operations within two hours after an outage and complete settlement by the end of the day even in extreme circumstances. For critical cloud outsourcing, the CCP is expected to assess recovery time and recovery point objectives, choose a suitable resilience design, maintain crisis communications and document a stressed exit. These are expectations for the clearing house's service, not a claimed SIMEX26 result or a blanket recovery guarantee from a provider. A cloud scenario only tests this obligation meaningfully for a particular CCP if it can show what happened to the clearing service against its own tolerance.

That leaves a specific evidence request for each bank or market operator after the drill: which important services depended on which cloud components and subcontractors; what maximum disruption and data-loss thresholds applied; whether fallback or restoration was actually exercised; when the provider, authorities and affected customers would be told; and who owns each fix, with a completion date. The FCA's 2026 review of firms' self-assessments identifies weak evidence of sufficiently severe testing, gaps in alternative communications, and remediation plans without clear owners or target dates. Those are sector-wide supervisory observations, not findings about SIMEX26 participants.

The Bank could narrow the public evidence gap by publishing an exercise method and an aggregate account of continuity against tolerances, communication delays, recovery choices and actions assigned, without exposing sensitive firm systems. Bank policymaker Liz Oakes said in May that a post-exercise report would summarise findings for industry. The related cloud-scenario CORST stress test is due to yield thematic findings in summer 2027. Until then, the supported conclusion is that the sector practised a shared crisis response. Whether vital services could recover within their own limits remains undisclosed.

UK Banks Report Higher Senior Debt Share

2026-10-12T08:15:00.000Z

UK banks reported that senior unsecured debt took a larger share of wholesale issuance this summer while the underlying supply of corporate deposits weakened. Together, the responses raise a question about banks' funding mix, but do not show what senior debt replaced. Bank of England cash data show that UK non-financial businesses placed more money with banks over the survey's three-month period than they withdrew.

A bank that replaces deposits with dearer long-term debt could face a higher cost of funding new credit. But the Bank of England's third-quarter Bank Liabilities Survey does not show that replacement, and its predicted rise in internal funding prices has yet to become an observed rise in lending margins.

What the survey actually measures

In the three months to the end of August, the survey recorded a -10.7 net balance for a change in the supply of deposits from private non-financial corporations (PNFCs) unrelated to the rates or other terms banks offered. The balance for rates paid relative to the cost of other liabilities was +27.1. A separate balance for the proportion of wholesale issuance made up of senior unsecured debt was +48.1, up from +0.2 in the preceding quarter. The balance for long-term rather than short-term wholesale issuance was +15.5. All four figures are in Annex 2 of the survey.

These are not percentage changes in pounds, quoted interest rates or the actual share of debt in banks' funding. Each balance nets lenders' responses, weighted by market share and scaled from -100 to +100. A positive relative-rate balance means that factor supported deposit volumes. It does not measure how many basis points a bank added to its offer. Likewise, +48.1 describes the direction of senior debt's share of wholesale issuance, not its cash value or what it replaced.

Nor does the deposit-supply balance describe total corporate deposit flows. The survey isolates a factor excluding prices and non-price terms. Banks reported positive balances for market-share objectives (+23.6) and funding-structure objectives (+27.1) as contributors to PNFC deposit volumes. That is consistent with competition for deposits while independent depositor supply weakens. It cannot establish a sector-wide deposit loss. Annex 2 does not disclose lender-level responses to show whether a few large banks drove the result.

Deposits and debt did not move as the simple story predicts

The Bank's monthly Money and Credit releases report that UK non-financial businesses deposited £24.4 billion in June, withdrew £9.2 billion in July and deposited £6.6 billion in August. That is a net £21.8 billion inflow. The monthly series covers non-financial businesses in all currencies, while the survey asks about PNFC funding and a specific supply factor. It cannot refute each bank's response, but it rules out presenting the balance as a measured collapse in corporate deposits.

The rate series is similarly restrained. The effective rate on new PNFC time deposits was 3.46% in July and 3.47% in August, with the rate on outstanding sight deposits at 1.97% in both months, according to the August release. A stronger survey balance for relative rates should not be rewritten as evidence that the aggregate deposit rate jumped.

Public debt records show issuance, but no bridge from deposits to debt. Lloyds Banking Group lists two $1.25 billion senior unsecured tranches dated 17 August. Its half-year fixed-income presentation had set out £5.5 billion of completed holding-company senior issuance against guidance of up to £7 billion for 2026. The group cited refinancing maturities and balance-sheet growth as purposes of its wholesale programme. It reported commercial banking deposits up £5.2 billion in the second quarter.

Lloyds is one issuer, not a readout of the survey panel. Its August tranches confirm market access; its programme and growing deposits give no basis to say those bonds replaced lost corporate cash. Coupon rates across currencies and maturities cannot be compared directly with sterling deposit rates to infer a funding premium. The Bank's August capital-issuance release says gross bond issuance by all UK resident sectors fell to £27.3 billion from £44.2 billion in July, with monetary financial institutions among the sectors whose gross issuance fell. This broader series is not a senior bank-debt total.

The loan-price test has not been met

The survey has already offered one useful check on forecasts. In the second quarter, lenders expected the spread on "other" funding relative to reference rates to rise in the next three months, a +14.5 balance. In the third quarter they instead reported -19.7, indicating a fall. They now expect a rise in the fourth quarter, at +20.8. For the marginal internal cost of funding new loans, the second-quarter expectation was -11.1; the third-quarter outcome was +4.0, which the Bank classifies as unchanged. The fourth-quarter expectation is +16.2. These balances appear in Annexes 2 and 4. None is a realised customer loan rate.

Evidence for broad pass-through is thin. The Bank's separate third-quarter Credit Conditions Survey says spreads on loans to small, medium-sized and large businesses were unchanged to August. It expects spreads to stay unchanged for small and medium-sized firms and to narrow for large firms. Its approval-proportion balances were +0.4 for small firms, effectively unchanged, and -8.0 for medium-sized firms, a slight decline. These are lender assessments, not proof of a funding-cost effect.

Actual rates moved in different directions. The August Money and Credit release put the effective rate on new PNFC loans at 5.57%, down five basis points from July, while the rate on new SME loans rose two basis points to 6.63%. Newly drawn mortgage rates rose to 4.60% from 4.45%, and purchase approvals fell to 54,900 from 55,900. Changes in reference rates, credit risk, borrower mix and competition can all affect these readings. The aggregate series does not connect any of them to a lender's senior-debt issue.

The next decisive evidence would pair bank-level deposit movements with senior-debt issuance net of maturities, on comparable dates and currencies, then compare new-loan margins after reference-rate moves. The Bank's September money data are scheduled for 29 October; its next liabilities survey is due on 14 January 2027. Until then, a higher fourth-quarter transfer price remains a forecast, and debt issuance remains compatible with refinancing as well as expansion.

The PRA Would Put 128 Thresholds On A One-Way GDP Ratchet

2026-10-10T08:15:00.000Z

The Prudential Regulation Authority wants 128 regulatory thresholds to rise automatically with nominal UK gross domestic product. The plan would make many compliance boundaries more predictable. It would also turn a single economy-wide measure into a common escalator for rules covering banks, insurers, investment firms, credit unions and third-country branches.

The consequential feature is a floor. After an initial three-year period, the PRA would recalculate each threshold every five years, round the indexed value to two significant figures and compare it with the threshold already in force. The higher number would apply. A fall in nominal GDP could freeze a threshold, but never lower it automatically.

This is therefore not a neutral inflation adjustment. It is a proposal for a one-way ratchet across reporting, regime eligibility, governance, prudential methods and firms' freedom to lend or invest. Whether it preserves proportionality will depend on how closely each regulated activity grows with nominal GDP.

The 128 are not one type of boundary

The PRA's consultation paper CP13/26 divides the proposed population into 31 thresholds defining a regulatory perimeter, 52 governing reporting, eight concerning governance, policies and procedures, 25 affecting methodologies and approaches, and 12 affecting lending, funding or investment flexibility. The annexes list 114 Rulebook thresholds and 14 in supervisory statements or statements of policy.

The endpoints show the breadth. The largest amount, £320 billion of total assets, appears repeatedly in the Capital+ reporting rules. It is one limb used to determine detailed capital reporting by large firms. The smallest, £7,500, appears in credit-union lending and large-exposure rules, including amounts owed by an individual or another credit union.

Between them sit the £20 billion total-assets criteria for the Small Domestic Deposit Takers regime, £15 billion thresholds used for some international-bank, investment-firm and insurance boundaries, insurer premium and technical-provision tests, mortgage valuation amounts, and granular exposure limits.

Most increases would let a firm remain below a reporting or regime boundary for longer, retain a simpler method, or gain more balance-sheet flexibility. The PRA says fewer than 10% work in the other direction. Raising some UK Solvency II Standard Formula thresholds could increase an insurer's capital requirement. Raising the £300,000 income and £3 million net-assets tests for high-net-worth buy-to-let borrowers could reduce lenders' flexibility to take wealth into account in affordability assessments.

That distinction rules out calling the package deregulation as a whole.

The first update can be modelled, not forecast

The proposed formula multiplies each base amount by nominal GDP in the reference year divided by nominal GDP in the fixed 2026 base year. The result is rounded to two significant figures, then subjected to the non-decrease floor.

The first update would use growth from 2026 to 2029. The PRA would take the latest Office for National Statistics series available on 1 October 2030, announce the results by 31 December 2030 and make them effective on 1 July 2031. Later ONS revisions would not reopen that round, but would feed into the next calculation because every update returns to the 2026 base.

The eventual uplift is unknowable today. As an illustration, the Office for Budget Responsibility's March 2026 forecast has nominal GDP growing 3.6% in 2027, 3.5% in 2028 and 3.4% in 2029. Compounded, that is 10.9%.

Under that scenario, two-significant-figure rounding would move £320 billion to £350 billion, £50 billion to £55 billion, £20 billion to £22 billion, £5 billion to £5.5 billion and £7,500 to £8,300. These are modelled values, not PRA estimates.

The operating effects are concrete. A bank with £21 billion of assets in 2031 could remain below the indexed £22 billion SDDT ceiling, subject to the regime's other criteria, while it would have crossed a fixed £20 billion boundary. A £23 billion bank would still cross. A firm at £5.3 billion could remain below a modelled £5.5 billion reporting threshold, potentially delaying a template that the PRA estimates can cost about £80,000 a year. At the top end, £335 billion of assets would remain below the indexed Capital+ total-assets limb, though other limbs could still trigger reporting.

For the reverse cases, the same scenario would raise the high-net-worth buy-to-let tests to about £330,000 of income and £3.3 million of net assets. Borrowers between the old and new levels would no longer qualify on that measure.

GDP is representative only in the middle

The PRA's evidence is stronger than a simple assertion that finance follows the economy. It compared cumulative asset growth for 114 banks and 41 life insurers from 2009 to 2024. Nominal GDP grew 85.4% and sat within the central distribution for both groups.

But a central distribution is not a firm-level match. The PRA itself says business models, market conditions and corporate activity drive wide variation. Its comparison does not establish the same fit for credit unions, general insurers, third-country branches or individual exposures. CPI would capture prices but omit real growth; firm counts would miss balance-sheet expansion; sector assets would fit finance more closely but would require several indices and could let an expanding sector lift its own regulatory boundary.

The common GDP index buys simplicity at the cost of precision. Firms growing faster than GDP will still approach and cross rules. Slower-growing firms gain extra headroom even if their sector is shrinking relative to the economy.

The PRA estimates that, if total-asset thresholds stayed fixed, an average of 14 banking entities would cross applicable boundaries over ten years under a historical-growth exercise. It does not say how many would avoid a whole reporting template, nor identify the firms. That is the missing scorecard for the first update: counts by threshold of firms delayed, firms still crossing, templates avoided, capital effects and system-change costs.

The consultation closes on 7 February 2027. Before making the mechanism automatic, the PRA should publish that distributional test. A one-way floor can stop old numbers becoming an accidental brake on growth. It can also keep raising boundaries long after the regulated activity beneath them has stopped following GDP.

Sources

Britain's Bond Tape Counts 1.6 Million Licences, Not Users

2026-10-08T08:15:00.000Z

Britain's new bond consolidated tape has acquired a striking headline number: 1.6 million subscribed licences. The Financial Conduct Authority repeated it in a 5 October speech, three and a half months after the tape launched.

The number shows that distributors can put the data in front of a large installed audience. It does not show that 1.6 million people use the tape, that 1.6 million terminals display it, or that the service has made bonds easier to trade.

The regulator's second set of numbers needs the same care. Much more bond trading is now reported without a long delay, but that change began with transparency rules in December 2025. The tape began consolidating those reports on 22 June 2026. Visibility, consolidation and liquidity are three different outcomes.

More than 50 customers, then a distributor multiplier

The operator supplied the missing shape of the licence count in its first-week update. ETS Connect UK said that more than 50 licences covered users and redistributors onboarded directly with it. More than 1.6 million licences came through redistributors, with the vast majority classed as individual licences.

That is not a criticism of the distribution model. The FCA designed it to extend the tape through the market-data platforms firms already use. Its licensing schedule says an individual licence is limited to one display or login session, an enterprise licence permits unlimited internal access, and a redistributor pays the operator for each licence passed to an end user.

The live fee table makes mass entitlement inexpensive. ETS Connect lists annual real-time and historical fees of one penny each for an individual. Enterprises with revenue below £50 million face the same data fees, while the largest enterprise tier pays £3,600 for real-time data and £900 for historical data. Retail historical access is free.

The 1.6 million figure therefore mixes licence types with very different relationships to use. Public disclosures do not reconcile it to unique people, unique firms, enabled terminals, paid subscriptions, logins, API calls or active viewing. A redistributed entitlement may be valuable access. It is still an entitlement, not an activity measure.

December changed publication; June changed aggregation

The FCA's launch release separates the sequence. New transparency rules took effect on 1 December 2025. The share of corporate-bond trades reported in real time then rose from under 5% to over 75%, while the government-bond share rose from around 30% to about 80%. The consolidated tape launched later and put those reports into one feed.

Those stated levels imply an increase of at least 70 percentage points for corporate bonds and roughly 50 points for government bonds. The October speech instead described a 70% increase for corporate bonds and 30% for government bonds observed in real time. The published pages do not explain how the latter figures were calculated or why the government-bond number differs.

They also do not state the denominator needed to reproduce the comparison: trade count or notional value, the observation dates, the definition of real time, the treatment of deferrals, and the precise instrument set. A June note from LSEG illustrates why that matters. It reported corporate-bond visibility at about 50% in December, 85% of euro credit notional visible within one trading day, and sovereign real-time publication at 16%. Those measures can all be true alongside the FCA's figures because they describe different windows and bases. They cannot be combined without the methodology.

The quality report tests received records, not missing trades

At launch, the FCA said the tape had 98% coverage of in-scope bond trading. Its stated perimeter is post-trade transparency data for bonds admitted to trading on UK venues, excluding exchange-traded notes and commodities. The release does not say whether 98% refers to contributors, trade reports, notional value or another base.

The operator's first data-quality report is encouraging but answers a different question. In July it received 1,069,757 reports and accepted 1,069,742, or 99.9986%. Fifteen were rejected. Among accepted reports, 26,174 were amendments and 21,097 were cancellations. Two records carried an outlier flag.

That shows strong validation and acceptance of records that reached the tape. It does not measure trades that should have arrived but did not, so it cannot independently reproduce 98% market coverage. Nor should accepted report count be read as unique trade count when amendments and cancellations are included.

The downstream path has also mattered. ETS Connect's operational notices record that some emerging-market credit notionals appeared about 100 times too large on Bloomberg in early July. The operator said its own data were correct and located the discrepancy outside its systems. Bloomberg temporarily suspended redistribution and later restored current data while historical records were repaired. Direct-feed accuracy did not guarantee correct display to every redistributed licence.

Liquidity still needs its own test

None of the published measures establishes that the tape narrowed bid-ask spreads, reduced execution costs or increased dealer competition. The licence count measures enabled reach. The quality report measures handling of received records. The real-time percentages measure publication timing under the earlier rules.

A market-quality audit would match bonds before and after 22 June, control for the December regime change and market conditions, and compare spreads, price dispersion, execution shortfall, dealer participation and volume. An access audit would separate direct users from redistributed entitlements, report active use by licence type, and show whether smaller firms and self-directed investors actually consult the data. A cost audit would include the price of the surrounding vendor product, not only the tape's one-penny licence.

The tape may yet improve price discovery and liquidity. Its early record already supports a narrower conclusion: Britain has built a cheap, broadly distributable and technically reliable view of reports it receives. The next proof must come from trading outcomes, not a licence counter.

The Bank Wants Gilt Repo Clearing to Free Dealer Capacity. Margin Could Take It Back.

2026-10-07T08:15:00.000Z

The Bank of England wants a redesign of the gilt repo market to do two jobs at once. More central clearing should let dealers net more exposures and preserve room to finance investors during a shock. More risk-sensitive margining should stop cheap leverage from becoming so large that its unwind overwhelms that room.

That is a more demanding test than making market plumbing safer. In a 1 October speech, financial stability executive Nathanael Benjamin said clearing access, leverage pricing and collateral efficiency should be treated as complements. The Bank plans a comprehensive update, including possible policy proposals, in early 2027.

The package succeeds only if the capacity released by netting remains usable after central counterparties have called margin and default resources. The public evidence shows a potentially meaningful balance-sheet gain. It does not yet show the net liquidity gain under today's positions.

The current footprint is large, but the measures differ

Hedge funds' net gilt repo borrowing stood at about £85 billion on 25 June 2026, according to Sterling Money Market Data. That is a net position across the non-bank sectors classified in the Bank's reporting, not the gross size of the basis trade. The Bank says the classification and dataset coverage remain under review.

A separate estimate says globally active hedge funds accounted for as much as 60% of secondary cash-gilt volume. Its boundary matters: it covers Tradeweb's electronic platform in January and February 2026, rather than every venue or the full year.

The often-paired £5 billion stress figure has a different date again. The Bank's first system-wide exploratory scenario used positions at 31 October 2023 and responses from about 50 firms. A later sensitivity applied a similar rates shock to hedge funds' roughly £50 billion net borrowing as of 14 November 2024. With a simultaneous 10% reduction in bank repo lending, it produced up to £5 billion of additional gilt sales, depending on funds' use of cash buffers. If banks' appetite stayed fixed, those sales would have exhausted the remaining market-making capacity.

That is not a replay at the June 2026 £85 billion footprint. It is evidence of a transmission channel, not a current loss forecast.

The clearing gain comes from a 2020 counterfactual

The capacity case rests on a 2023 Bank staff working paper using transaction-level regulatory data. For the dash for cash, it compared average daily gilt repo from 9 to 18 March 2020 with the prevailing clearing structure. Comprehensive clearing would have increased nettable repo from £472 billion to £553 billion, a gain of £81 billion or 17%.

The dealer balance-sheet calculation used a smaller sample with the necessary regulatory filings. Those firms represented about 75% of repo stock during the stress. Comprehensive clearing reduced the leverage-exposure impact of their gilt repo books by about 40%. The detailed chart reports a 3.8-basis-point aggregate leverage-ratio gain on the 13 March peak day, while the paper's abstract and later Bank summaries round it to 3 basis points.

The maturity experiment was separate. It moved non-overnight repos already expiring in the same week onto the same day. That added about £40 billion of nettable repo, equal to 4% of outstanding repo, beyond comprehensive clearing alone. It cut exposures by a further 20 percentage points and added 2.0 basis points, taking the estimated total reduction to about 60% and the detailed leverage-ratio gain to 5.8 basis points. Later summaries round the combined gain to 5 basis points.

These are material estimates, not a current replay. Respondents to the Bank's 2026 feedback statement argued that maturity transformation and existing interdealer clearing limit further netting. They supplied no quantified estimate and did not establish whether their view applied in calm or stressed markets. The Bank has not published an equivalent calculation using the 2026 book.

Zero haircuts are not one thing

Half of bilateral gilt repo haircuts are routinely set at zero, with zero common in hedge-fund transactions. Some of that can be prudent. Dealers routinely net repo against reverse repo, and portfolio margining can recognise genuine offsets.

But the Bank says formal cross-product margining appears materially available only from a few large dealers to parts of the market. A 2023 PRA review also found competitive pressure influencing near-zero haircuts. A zero applied because collateral elsewhere already covers the risk is different from a zero offered to keep a client.

That distinction makes a flat haircut floor a blunt instrument. Benjamin's speech instead points towards a portfolio approach that recognises defensible offsets while charging for concentrated leverage. Cross-margining could reduce unnecessary collateral, but only where correlations remain reliable in stress and legal and operational arrangements can withstand a default.

Capacity can move rather than appear

Central clearing replaces bilateral exposures with other claims on liquidity. Under the Bank's 2025 discussion paper, LCH recalibrates initial margin at least daily against 99.7% of historical five-day moves and can add charges for concentration and credit risk. Members also contribute to a mutualised fund sized for the simultaneous default of the two largest exposures. Variation margin is exchanged daily in cash.

Sponsored access can leave a bank funding a client's margin and default-fund contribution, or guaranteeing losses beyond the client's prefunded resources. Wider clearing can therefore shrink a leverage-ratio denominator while increasing the cash and contingent resources demanded of the same intermediaries.

The scale of that offset has not been published for gilt repo. Broader UK evidence shows the issue: during March 2020, initial margin at UK clearing houses rose 31% to £58 billion, while average daily variation-margin calls were five times their January and February level. Those figures cover UK CCPs generally, so they cannot be subtracted directly from the repo netting estimate.

Maturity standardisation adds another unresolved trade-off. By construction, moving weekly expiries onto one day increases netting. It also concentrates refinancing dates. The Bank has quantified the first effect, but not the same-day liquidity demand under a current stress.

The right scorecard for early 2027 is therefore not gross clearing adoption. It is dealer exposure released, less cash margin, default resources and refinancing liquidity required under the same scenario. Until the Bank publishes that matched test on current positions, clearing is a credible route to more capacity, not proof that the constraint has disappeared.

Most of 40 Trusts Do Not Use Palantir Waiting-List Tools

2026-10-06T08:15:00.000Z

More than 20 of the 40 NHS trusts behind a national claim about Palantir-powered waiting-list tools no longer use either of the two workflows, according to a Financial Times analysis published on 3 October.

That means at least 21 trusts, or at least 52.5% of the group. It does not mean that 21 trusts abandoned the wider Federated Data Platform. Some stopped one module, some paused an implementation, and others continued to use Palantir software for theatres, referral validation or discharge.

The finding exposes a measurement problem rather than a simple deployment retreat. NHS England's headline number records cumulative activity. It does not show whether a trust retained the workflow that produced it.

The 40-trust denominator is historical

At the end of March 2026, NHS England's uptake page counted 37 trusts using the inpatient waiting-list module, 39 using the inpatient theatre module and 16 using the outpatient tool. There is overlap between those groups.

The same page reported 87,842 inpatient and 218,389 outpatient requests to remove entries from waiting lists. Together that is 306,231 requests. The counters run from the first trust adoption to the reporting cut-off. They do not say how many of the contributing trusts still use the relevant workflow.

The published methodology also draws an important boundary. Each suggested removal adds to the count, but NHS England has no pre-adoption record of removals for comparison. The figures therefore show work performed through the products, not how many removals would otherwise have gone undone.

That distinction matters because waiting-list validation is often a clean-up exercise. Palantir told the FT that the two tools tend to be used most heavily when first installed, as trusts correct historic data errors. Lower later use can be consistent with a product completing its initial task. It can also reflect migration to a local system or failure to become part of routine work. The cumulative counter cannot distinguish those outcomes.

One product contains separable workflows

NHS England's data protection assessment for Inpatient CCS shows why the withdrawal count cannot be treated as a platform exit. The product contains two waiting-list modules, called Waiting List Overview and Elective Alerts, alongside Patients and Booking Management and Theatre Session Management.

A trust can stop using the waiting-list view and keep scheduling theatres on the same platform. It can also retain an FDP instance while using a separate application for referral-to-treatment validation, cancer pathways or discharge.

Ashford and St Peter's Hospitals illustrates a different category. Its 2026 freedom of information response says RTT and Inpatient CCS were live. NHS England had supplied a go-live date for Outpatient CCS, but the trust said it did not recognise that product as ever having entered live operational use. Implementation had been paused while it waited for a newer version with capacity and room-booking functions.

That is not a terminated platform deployment. It is a national rollout record colliding with a trust's narrower definition of live use.

Other cases go further. East Suffolk and North Essex told an FOI requester in February that its FDP instance was inactive after the trust changed electronic patient record system on 2 October 2025, with no plan to restore the data flows. University Hospitals of Derby and Burton listed four FDP products, including RTT, in 2025, then listed three in January 2026 without RTT. One is wider technical withdrawal. The other is module retirement while the platform remains.

The outcome comparison is still missing

No published evidence located for this audit compares referral-to-treatment lists, long-wait cohorts, theatre use or administrative hours before and after the affected trusts stopped a waiting-list module.

NHS England does publish adoption comparisons. Its theatre measure subtracts a pre-adoption weekly average from cases recorded after adoption. But the methodology now states that other variables were not controlled and cause and effect cannot be inferred.

The Office for Statistics Regulation said in July that NHS England had added that caveat on 6 June. It asked for clearer public wording, trust-level results, consideration of control groups and an independent evaluation focused first on Inpatient CCS and the OPTICA discharge product.

Until that work supplies an exit cohort, neither side can use module retirement as an outcome verdict. A trust leaving the tool after cleaning its list may be evidence of completion. A trust returning to an older system because the workflow added little would indicate weak retention. The current public metrics do not separate them.

Central capacity does not remove local cost

The commercial exposure is national. NHS England said the platform would cost at least £25.6 million in its first year and up to £330 million across seven years. Its contract explainer says only the first three years are committed, through March 2027, with later extensions available. The service is funded for up to 240 NHS organisations.

Public documents do not identify a per-module credit when a local workflow stops. Inactivity at one trust therefore does not establish that the national payment falls. Nor is nationally funded software costless to deploy. Barnsley Hospital's January FOI response identified about £22,000 locally: roughly £10,000 for technical resource, £2,000 for training and £10,000 for virtual-server and networking infrastructure. It created no additional roles.

The audit result is narrower than a backlash headline. More than half of a 40-trust benefit group had moved away from the waiting-list workflows by the FT's October snapshot. The platform may still carry other useful work at many of those trusts. What NHS England has not yet published is the retention measure needed to tell successful completion, migration and abandonment apart.

Sources

FCA’s 97.9% Score Hides Five Weak Authorisation Areas

2026-10-05T08:15:00.000Z

The Financial Conduct Authority’s headline is accurate, but only after reading its denominator correctly. In the three months to June, 5,886 of 6,014 unique cases were determined within the applicable deadline. That is 97.87%, which rounds to the reported 97.9%.

The result does not mean that every part of the authorisation system ran close to 98%. Five of the 12 published category rows were below the FCA’s green band. A simple average of the 12 percentages is 93.1%, but that gives a nine-case money-laundering category the same weight as a 1,652-case payment-services-agent category.

The case-weighted figure is the better aggregate. It is also dominated by high-volume work that performed well, while smaller and more consequential entry routes carried most of the visible weakness.

The denominator needs one adjustment

Adding all 12 rows in the FCA’s Q1 table would produce 6,066 cases and a 97.8% on-time rate. That would double-count 52 adjacent variations of permission. The adjacent row is a subset of the broader 416-case variation-of-permission row, not a separate case population.

Removing that overlap leaves 6,014 cases and 128 deadline misses. The scale effect is large: approved-person applications and payment-services-agent notifications together supplied 4,335 cases, or 72.1% of the denominator. Their three rows scored 98.3%, 97.7% and 100%.

The five below-green rows comprised 454 cases, 7.5% of the unique total, but recorded 55 deadline misses. They therefore generated 43% of all misses despite their small share of volume.

Category	On time	Cases	Late	Median days	Upper quartile days
New firm authorisation	92.0%	287	23	131	190
Adjacent variation of permission	94.2%	52	3	44	69
3/4MLD registration	69.1%	68	21	75	91
5MLD registration	88.9%	9	1	236	297
Payment services and e-money authorisation	81.6%	38	7	219	268

A threshold change moved two rows to green

The current traffic lights count seven green, two amber and three red rows. Since the third quarter of 2025/26, green has started at 95%, down from 98%. Amber covers 90% to below 95%, while results below 90% are red. Change in Control remains an exception and must score 100% to be green.

Applying the former 98% line to the current results would produce five green, four amber and three red. Approved Person applications linked to appointed representatives, at 97.7%, and the main Variation of Permission category, at 97.4%, are the only rows whose colour changes. Change in Control stays green because all 277 cases met its 60-working-day deadline.

That makes the presentation more favourable, but it does not change a single applicant’s wait. Nor does it explain the three red categories, all of which would have been red under either threshold.

The AML correction is small in aggregate and large within the categories

The more substantive revision concerns the clock. The FCA said it had previously calculated completion dates for 3/4MLD and 5MLD registrations using working days rather than calendar days. Its 2025/26 annual metrics page removed both rows pending correction. The Q1 release then restated data back to the second quarter of 2025/26.

For 3/4MLD, the originally published results for those three quarters were 100%, 98.4% and 98.3%, with two misses among 192 cases. The corrected record is 85.7%, 87.5% and 84.5%, with 27 misses. That reclassifies 25 cases as late.

For 5MLD, three successive 100% results became 66.7%, 66.7% and 71.4%. Four of 13 cases were reclassified as late. Together, the correction adds 29 misses among 205 AML decisions. That is only 0.14% of the 20,305 authorisation cases closed across the same three quarters, but it materially changes what an AML applicant would infer from the category history.

The current elapsed times add applicant context, but they are not a direct test of statutory compliance. The 45-day 3/4MLD and three-month 5MLD clocks apply to complete applications. By contrast, the published quartiles run from receipt to determination and include an undisclosed mix of complete and incomplete files. They show that 3/4MLD applicants waited 75 days at the median and 91 at the upper quartile, while 5MLD applicants waited 236 and 297 days. Those are long end-to-end waits, but the table cannot show whether the typical complete application missed its statutory clock. The 5MLD sample is also only nine cases, so it cannot establish system-wide friction.

Three weak rows use faster voluntary standards

The other weak rows need a different reading. The FCA began working voluntarily towards faster targets ahead of legislation. New firm applications are now measured at four months when complete and 10 months when incomplete, rather than the previous six and 12 months. Adjacent variations use an expressly voluntary three or six-month target. The payment and e-money row uses three months for complete applications and 10 months for incomplete ones, tightening the previous 12-month outer limit for incomplete cases.

The published medians combine complete and incomplete applications, so they cannot show whether a typical complete applicant breached the shorter limb. Adjacent variations look least alarming: their 44-day median and 69-day upper quartile both sat inside the tighter three-month target. New firms took 131 days at the median and 190 at the upper quartile. Payment and e-money applicants took 219 and 268 days respectively, but the mix of complete and incomplete files is not disclosed.

The scorecard therefore identifies concentrated friction, not a blocked UK entry system. Its strongest warning is in the corrected AML categories, where compliance rates are weak and end-to-end waits are long, although the quartiles cannot identify the typical complete case. Elsewhere, the traffic lights partly record the FCA choosing a harder voluntary benchmark. For applicants, the useful questions are not whether the aggregate is green, but which clock applies, whether the file is complete and how long comparable cases actually took.

Sources

Nscale's 23,040 GPUs Are Due in 2027. Power May Wait

2026-10-03T08:15:00.000Z

Nscale's Loughton AI campus now carries two incompatible clocks. Its published plan calls for an initial 50 MW of AI capacity, scalable to 90 MW, with 23,040 Nvidia GB300 GPUs delivered in the first quarter of 2027. The company says the facility will support Microsoft Azure services in the UK.

The power timetable is much less firm. The Guardian reported that UK Power Networks had told Nscale sufficient supply might not be available until the early to mid-2030s. UK Power Networks declined to discuss the individual project. Nscale said it remained committed and was examining on-site generation and a faster connection.

That distinction matters. No UK Power Networks offer is public, so there is no independently verifiable contractual energisation date for Loughton. The early to mid-2030s range is a reported estimate, not a published connection document. Public Nscale material supports an initial 50 MW design and an expansion path to 90 MW. It does not establish whether an accepted connection offer covers 50 MW, 90 MW or a phased amount. Customers therefore cannot yet map the chip delivery to an in-service date.

A partial connection would mean a partial machine

Phasing can narrow the gap only if meaningful power arrives before the full connection. On Nscale's published ratio, each 10 MW tranche represents one-fifth of the initial 50 MW configuration, equivalent to about 4,608 of the planned 23,040 GPUs if compute, cooling and networking scale evenly. A 20 MW phase would imply about 9,216 GPUs. Nscale has not disclosed an interim megawatt allocation or a date for one.

On-site generation has the same disclosure problem. Nscale is investigating it, but no signed supplier, generating capacity, fuel arrangement, planning route or commissioning date has been announced. A bridge described only as an option cannot yet carry a 2027 delivery promise.

Battery storage is not a substitute for a continuing energy source. A constant 50 MW load consumes 50 MWh each hour and 1.2 GWh in a day. At 90 MW, one day requires 2.16 GWh. Those figures follow directly from Nscale's stated 50 MW and 90 MW capacities. Storage could smooth peaks or cover interruptions, but it cannot sustain the campus through a multi-year grid wait without generation or a separate supply that recharges it.

Temporary UK hosting is more plausible, but the disclosed numbers are smaller. Nscale and BT announced up to 14 MW across three existing UK sites in April 2026. Even if all of that capacity were technically suitable and diverted to the Microsoft deployment, it would equal 28% of Loughton's initial 50 MW and about 6,451 GPUs on the same linear ratio. Neither company has said that the BT capacity is available for Loughton hardware. Nscale also lists a partner-run site at Hayes, but publishes no capacity or availability figure for it.

Moving the GPUs abroad could protect a wider Microsoft contract while failing the UK outcome. Nscale's expanded Microsoft programme includes 12,600 GB300 GPUs at Sines in Portugal from the first quarter of 2026, alongside much larger deployments in other countries. Those sites are already assigned to customer programmes, and no spare capacity has been disclosed. More importantly, a foreign deployment would not provide the UK-based Azure capacity promised for Loughton.

The queue numbers measure different things

Loughton sits inside a much larger connection problem, but the figures need clean denominators. Ofgem's consultation says contracted demand offers rose from 41 GW in November 2024 to 125 GW in June 2025. It identifies about 73 GW of the 125 GW queue as data centres. The same document counts 315 data-centre projects.

Ofgem's accompanying release separately says data-centre projects accounted for at least 80 GW of the growth in demand applications. That growth measure is not the same as the 73 GW stock of data-centre capacity in the queue. The figures should not be added or treated as competing estimates of one total.

The regulator's proposed tests would favour projects that can prove delivery. Its milestone framework would apply from 10 MW of rated IT load and asks for evidence of a credible compute customer, long-lead electrical procurement, and financial and technical capability. Nscale's published 50 MW capacity suggests Loughton could fall within scope, but the disclosure does not identify rated IT load. Microsoft supplies a named customer. Epping Forest's planning register says application EPF/0404/26 approved the reserved matters of appearance and landscaping. But there is no public Ofgem or network-operator finding that Loughton has met every proposed milestone, and no disclosed evidence yet fixes the power schedule.

The proposed commitment fee is also conditional. Ofgem proposes applying it at 40 MW or more to transmission-connected projects and distribution projects with a transmission impact, at £237,500 to £712,500 per MW. If 50 MW were the applicable capacity, the illustrative security would be £11.875 million to £35.625 million. At 90 MW it would be £21.375 million to £64.125 million. The consultation is closed and awaiting a decision, so neither range is a bill owed by Nscale. The applicable capacity, final rule and any exemption still have to be established.

The customer test comes next

The government has acknowledged that grid delays are a major barrier and says it is working with Ofgem and the National Energy System Operator to prioritise viable projects. Its 16 September parliamentary answer did not provide a Loughton date or bridge supply.

That leaves a precise test for the project. Nscale needs to publish enough 2027 power to support a useful first phase, or identify another UK site with an available megawatt figure and a Microsoft service date. Until then, a delayed Loughton building is not automatically delayed Azure capacity, because GPUs can move. Nor does one site prove Britain's AI infrastructure strategy has failed. It does show that announcements measured in chips are not delivery plans until the power is measured in megawatts and tied to a date.

Sources

CMA Proposes Android Search Choice for AI Assistants

2026-10-01T08:15:00.000Z

Britain's competition regulator has proposed a change that could put an AI assistant where Google Search sits today: behind the address bar, home-screen widget and search app used by millions of people.

The Competition and Markets Authority's revised user-choice consultation would let services such as ChatGPT or Perplexity qualify for the search-choice screens on Android devices and Google's Chrome browser. Its technology-neutral test would not disqualify an AI interface that can perform the work of a general search engine.

That is still a proposal, not an obligation. The consultation closes at 5pm on 9 October 2026 and the CMA expects a final decision by the end of the year. No user-choice conduct requirement has yet been imposed. If it is imposed in the form proposed, the eligibility process would start within one month and the rest of the requirement would take effect within six months.

A default that reaches beyond the browser

The architecture is broader than a one-off menu on a new phone. A new qualifying Android device would show a non-skippable screen at first use or set-up. New desktop and iOS Chrome installations would do the same, while existing users would see it with the first major browser update after the requirement took effect.

The chosen provider would become the default across the relevant access points. In Chrome that means the address bar. On Android it also covers the default search application and home-screen widget.

Google would also have to show a small, skippable annual notification leading back to the choice screen, unless the user had deliberately selected or changed a default in the preceding six months. The full provider list would remain reachable through browser and device settings.

The screen itself would carry no more than 12 providers. If 12 or fewer qualified, all would appear. If more qualified, five places would go to the most popular services and seven would be selected at random. For the first six months, popularity could be measured through a reasonable metric such as Google Play downloads. It would then be based on selections as a proportion of appearances on the screen. The 12 displayed services would be put in a fully random order, users would have to scroll through them before confirming, and a link would expose every other eligible provider.

There is also a trial mechanism. A user could make another service the default for a short period, which the CMA says should last at least a week, before receiving a skippable route back to the default settings. That matters because the regulator's qualitative research found that a trial option prompted some people to examine unfamiliar services more closely, although many did not initially understand what the trial would change.

AI assistants would have to behave like search

An applicant would have to satisfy three tests. It must address the full range of general-search uses across a wide range of subjects, including by searching the web. It must work technically across the relevant access points, meet minimum security requirements and show it can serve a potentially growing user base. A meaningful proportion of its UK users must also regard or use it as a general search service. The CMA says that need not be a majority.

The interpretative notes make the first test demanding. A provider must handle navigational, transactional, simple and complex informational queries, and supply up-to-date information. It may rely on a syndicated index.

For publishers, the operative language sits here rather than in a free-standing duty on AI companies. Any generative AI summaries would need to be configured so that web content is attributed clearly and accurately and users have a clear means of reaching the source. Providers could choose how to achieve that result. In other words, attribution and link access would become conditions of admission to the screen if the proposal is adopted, not a general statutory rule covering every AI answer in Britain.

The enforcement route also runs through Google. It would decide applications every six months, using only the stated criteria, and issue decisions within two months of a window opening. It would give the CMA every decision and detailed reasons for rejections. If Google failed to operate the process as required, the CMA could investigate it, order a remedy and, in principle, impose a fixed penalty of up to 10 per cent of worldwide turnover under the digital-markets regime. The proposal does not give the CMA the same direct route against an assistant provider.

A large screen with modest switching evidence

The addressable base is substantial. The CMA's workings assume about 30 million UK Android devices, excluding very old models, and an estimated 15 million to 35 million desktop and iOS devices using Chrome. It expects 5 million to 10 million non-skippable screens on new Android devices each year, plus an initial 15 million to 35 million on desktop and iOS Chrome. Those are device estimates, not unique people.

Demand has moved ahead of distribution. A government survey found that 56 per cent of UK adults had recently used AI that generates text or speech in response to queries, while 54 per cent had used natural-language digital assistants. Ofcom says Google Search still reaches 82 per cent of adults, but ChatGPT recorded 1.8 billion UK visits in the first eight months of 2025.

Choice screens are no guarantee of mass defection. The CMA cites switching of roughly 1 per cent in prior evidence. One field experiment found 1.1 per cent switched from Google to Bing after an active choice, while research on European screens estimated a 0.5 to 1.5 percentage-point fall in Google's share. The CMA's own interviews found limited appetite to leave the familiar default, even though the appearance of AI services made some participants pause and compare.

That makes eligibility the real competitive test. Google would still specify evolving minimum security standards, assess whether an assistant covers the required queries and decide what counts as a meaningful share of its users. Six-monthly application rounds could also make a fast-moving market wait. Reporting each rejection to the CMA, randomising seven of 12 slots and measuring later popularity by selection rather than installation all constrain that discretion, but they do not remove it.

The proposal could create a genuine new route to distribution for AI assistants and a pressure point for publisher attribution. Whether it changes the market will depend less on the neutral wording than on how quickly the CMA challenges Google when the company operating the gate also decides who may pass through it.

Britain Offers £0 Satellite Liability Limit Without Findings

2026-09-28T08:15:00.000Z

Britain will let a standard satellite operator reduce its licensed liability limit from £50 million to zero by satisfying two published evidence criteria: participation in funded security assessments and access to current sustainability information. The criteria do not require disclosure of audit findings, proof that identified weaknesses were fixed or evidence that voluntary standards shaped the mission.

That is the central trade-off in the Government's space regulatory financial tools package, updated on 8 September. It describes the policy as a reward for responsible behaviour. The reward is tied more directly to evidence of process than to evidence that the process reduced risk.

For orbital operations licence applications submitted on or after 1 December 2026, the present €60 million limit for a standard mission will be replaced by three sterling tiers. £50 million is the default. Satisfying one of two voluntary criteria reduces the limit to £20 million. Satisfying both takes it to £0. The change applies only to new applications, under either the Space Industry Act 2018 or the Outer Space Act 1986. Existing licences will not be reassessed through this route.

The security criterion stops at the audit

The first criterion asks whether an operator has registered an interest in, and had an audit conducted under, both UK Space Agency-funded initiatives covering cyber and physical security.

The cyber programme offers consultancy support or a Cyber Essentials or Cyber Essentials Plus assessment and certification route. The physical programme uses penetration testing and assessment to identify vulnerabilities and produce an improvement plan. Both assessments are funded. Any remediation is paid for by the company.

The distinction is explicit. An applicant is not expected to submit the audit reports or demonstrate what it did in response to the recommendations. Even an applicant waiting for an assessment, or one that is ineligible but has enquired about taking it, may have that fact considered.

The criterion can therefore show that an operator has exposed its arrangements to a structured review. It cannot, on the evidence demanded for the liability reduction, show whether a critical finding remained open when the licence was granted.

Sustainability can mean access, not adoption

The second criterion asks an operator to demonstrate access to the latest sustainability information. The Government lists copies of ISO 24113 and the British Standards Institution's Flex 1969 framework, and paid access to Earth and Space Sustainability Initiative updates and its standards database, as relevant evidence.

Applicants will also be invited to outline which measures they adopted, but that disclosure is voluntary and will inform policy rather than determine the liability assessment. The package says operators do not need to have followed the guidelines and standards in their mission design unless the Civil Aviation Authority separately requires it.

This makes the incentive a test of informed access, not verified implementation. The distinction does not make the underlying standards worthless. It means the financial concession, as currently published, is not calibrated to the number or seriousness of controls adopted.

A technical framework due before 1 December is meant to add detail to both criteria and explain how evidence can be reused in later applications. That document could tighten the connection between a lower limit and completed remediation. Until it does, the public rule is the lighter one.

Zero transfers exposure, but does not erase regulation

A £0 limit is not just a cheaper insurance number. It changes who carries qualifying losses.

For licences under the Space Industry Act, Sections 34 to 36 form the relevant statutory chain. Section 34 gives people a strict-liability route for specified injury or damage in the UK, its territorial sea and aircraft above them. A claimant does not have to prove negligence. Section 35 requires the Secretary of State to indemnify the claimant for the difference between the operator's capped liability and what it would have been without the cap. For a qualifying Section 34 claim, a £0 operator cap leaves the Section 35 difference with the Secretary of State.

Section 36 separately requires an operator to indemnify the Government and specified public bodies against claims connected with its activities. That obligation is also subject to the limit written into the licence. The policy says a £0 tier removes the third-party liability insurance requirement for the licensed orbital activity.

The Outer Space Act route is separate. Section 10 of the 1986 Act requires a licensee to indemnify the UK Government against claims for damage or loss arising from its activities, subject to any limit specified in the licence. Sections 34 and 35 do not govern that route.

There are important boundaries under the Space Industry Act. Regulation 219 removes the Section 36 cap on the operator's indemnity to government. Regulation 220 requires the licence's Section 34 and other third-party liability cap not to apply. Regulation 221 causes the Secretary of State's Section 35 indemnity duty not to arise. Each rule covers gross negligence, wilful misconduct, or damage caused by non-compliance with the Act, regulations or licence conditions.

Nor does a zero limit remove the licence. Current CAA guidance requires evidence that risks have been reduced to as low as reasonably practicable and that the operation presents an acceptable overall level of risk. It calls for mission-specific controls, examines whether mitigations have been implemented or effectively planned, and requires sustainable orbital activity. The CAA says it will continue monitoring, inspections and enforcement after a licence is granted.

Those duties matter, but they are a separate control system. Their existence does not turn participation in an audit into proof that its findings were fixed.

A separate automatic waiver targets novel missions

The evidence-based route should not be confused with an automatic concession for orbital licences issued from 1 December for in-orbit servicing, assembly and manufacturing, and for lunar missions planned to launch before the end of 2030. Liability and insurance requirements still apply when procuring the launch. The Government plans to review this waiver in 2029.

The insurance answer is still unfinished

The consultation record says ministers retained a default insured market after insurers warned that capacity could disappear if orbital third-party liability requirements were abolished across the board. A possible state-backed "Space Re" model remains exploratory, with no commitment to establish or support it.

The variable system preserves a default insured market while offering large reductions to applicants that clear two simple evidence gates. That may cut costs and draw operators into useful assessments. The unanswered question is whether the size of the public exposure should depend on attendance and access, rather than proof that the risks identified by those processes were actually reduced.

UK Firms Offboarded 238,396 Suspected Money Mules

2026-09-26T08:15:00.000Z

UK financial firms reported offboarding 238,396 suspected money mules in 2025. Only 15.3% of those customers were also filed to the National Fraud Database.

The gap does not show that firms failed to report 84.7% of proven criminals. Closing an account and placing a fraud marker against a person are different decisions with different evidence thresholds. It does, however, expose a practical question: when one provider closes an account on suspicion, how quickly can another provider learn enough to stop the same identity or linked account being used elsewhere?

The Financial Conduct Authority's new review does not supply a market-wide answer. It shows that several sharing routes exist. It also shows why none can yet be treated as a complete, measured substitute for a National Fraud Database filing.

The 84.7% is not unreported crime

The FCA surveyed 35 retail banks, building societies, challenger banks, payment institutions and electronic money institutions. They reported 184,935 suspected-mule offboardings in 2023, 233,269 in 2024 and 238,396 in 2025. Across the three years, the firms made 113,655 National Fraud Database filings. The filing share fell from 17.4% in 2024 to 15.3% in 2025.

Those figures compare customers offboarded on suspicion with cases meeting Cifas filing rules. A money-mule filing requires reasonable grounds to believe fraud or financial crime was committed or attempted, backed by clear, relevant and rigorous evidence. An account provider can end a relationship at a lower suspicion threshold.

The series also changes definition. Cifas recorded money-mule cases within the broader misuse-of-facility category in 2023 and 2024. It introduced a dedicated "funds received for money muling" category, revised criteria and guidance in 2025. The FCA explicitly says the 2025 filing data are not directly comparable with the previous two years.

That is why subtracting 15.3% from 100% produces heat, not information. It mixes suspicion with an evidentially supported fraud marker. The relevant control question is what happens in the space between them.

The substitute signals do different jobs

The National Fraud Database is broad once a case enters it. Cifas says its data are shared online in real time among a membership spanning banking, insurance, telecoms, retail and the public sector. Members can search identities and use a marker to trigger enhanced checks rather than an automatic refusal.

Its limit is the filing gate. The FCA said in a 2025 review of 13 firms that only confirmed fraud cases could be filed, leaving suspected mules outside that wider channel. Only one firm in that review was checking existing customers against the database in real time after onboarding. In one case, a new marker went undetected for more than two years.

The Economic Crime and Corporate Transparency Act offers a lower-friction legal route, not a universal alert. Since January 2024, regulated firms have been able to share customer information directly, or through eligible intermediaries, to prevent, detect or investigate economic crime. The government guidance makes the scheme voluntary. A warning can follow a decision to close, refuse or restrict a customer's service, but direct sharing still goes to an identified recipient. The government does not prescribe a common technical system, and the published guidance gives no adoption rate, coverage measure or median time from offboarding to warning.

Payment-network tracing solves a different problem. A commercially available tool reviewed by the FCA traces suspected proceeds across Faster Payments, sends regular alerts and shows how funds move between accounts. Providers holding alerted accounts can investigate. Yet firms treated the alerts as leads requiring corroboration, not proof. Most investigated first-generation alerts; they were less responsive at later generations, sometimes because an internal value threshold was not met.

Direct bank-to-bank enquiries can supply evidence needed for a Cifas filing, but the same FCA review recorded delayed or absent responses from the firm that sent the funds. Suspicious Activity Reports inform the National Crime Agency and law enforcement. They do not place a reusable private-sector marker in another provider's onboarding or customer-monitoring system, and firms must observe tipping-off rules.

The channels therefore complement one another. They do not establish that every suspected identity becomes visible across banks, payment firms and EMIs before it reappears.

The cash-out window is short

The operational cost of that uncertainty appears in the FCA's second exercise. A public-private cell of 22 firms traced the highest-value payment in 140 cases across seven fraud types. Cash-out activity was concentrated from the second to the fifth account in a chain, and was highest at the second.

This was a selected case cell, not a representative estimate of all UK mule activity. It cannot establish an incidence rate or prove that a particular firm's control failed. It does show that a warning that arrives several hops later may be accurate and still be too late.

Two other FCA figures need the same restraint. EMI offboarding rose 164.6% in 2025, but the regulator says higher volumes can reflect customer growth and better detection as well as greater exposure. Separately, 114,984 accounts were closed within their first year, 47.1% of the account-tenure return. That return counts accounts, can count more than one account per offboarded customer and does not reveal when mule use began.

The Home Office's 2026 to 2029 Fraud Strategy promises data and metrics to drive financial-sector accountability. Money-mule sharing now needs that treatment. The useful measures are the median time from closure to an actionable warning, the proportion of account providers reached, the proportion of existing customers re-screened, and the response time at the second through fifth accounts in a traced chain.

The FCA is working with the National Economic Crime Centre on a further alert to relevant firms. That can spread the cell's typologies. The harder task is to demonstrate that identity-level and linked-account signals travel far enough, fast enough, before another account becomes the cash-out route.

Sources

Bank of England Model Finds a 32% Offset to Capital Relief

2026-09-25T08:15:00.000Z

Cutting bank capital requirements may lower funding costs without delivering the full benefit that a conventional model would predict. A new Bank of England staff study finds that the same relief could weaken investment in cloud services, leaving more legacy technology in place and absorbing about 32% of the direct gain to depositors.

That is a modelled trade-off, not an observed result of a UK capital-policy change. The study simulates a one-percentage-point reduction in effective capital requirements for every institution in its deposit-market model. Its result is also not an official Bank position: staff working papers represent their authors, not the Bank or its policy committees.

For policymakers and bank technology chiefs, the point is narrower. Capital affects more than funding costs. By changing the value placed on future profits, it may influence whether a difficult modernisation programme is funded now or deferred.

What the 32% measures

The Bank staff working paper, published on 14 August 2026 and written by Alvaro Contreras, Peter Eccles and Paolo Siciliani, combines confidential outsourcing contracts with regulatory balance-sheet data.

Its starting dataset has 3,443 material outsourcing contracts involving 90 UK domestic banks over two decades. The authors identify 457 external cloud-service contracts, worth £1.57 billion a year across 72 banks, then merge contract start dates with the Historical Banking Regulatory Database. The main bank-quarter panel runs from the first quarter of 2010 to the first quarter of 2024.

There is a selection limit. The researchers observe contracts that were still in place in 2024, not those that had ended or were not renewed earlier. The study therefore cannot offer a complete history of failed migrations or abandoned suppliers.

In the reduced-form results, a one-percentage-point increase in capital requirements is associated with about 4.2% more cloud-service-provider spending, but that pooled coefficient is significant only at the 10% level. In the interacted specification, the capital response is highly significant for large institutions and statistically insignificant for small and medium banks and building societies. Separately, a 10% increase in cloud spending is associated with roughly 1.2% lower non-interest expenses, 1% lower staff expenses and 0.3% more deposits. Those cost and deposit associations are also concentrated among large institutions. None of these associations proves causation.

The paper interprets the pattern through a charter-value channel. A better-capitalised bank may be more likely to survive and realise future returns, giving it a stronger incentive to absorb the upfront disruption of replacing legacy systems. Other explanations remain possible. Supervisory attention, existing modernisation plans or a bank's financial condition could affect both its capital requirement and its technology budget.

The 32% figure comes from the next stage, a structural model of deposit competition. Across 56 quarters from 2010Q1 to 2023Q4, the direct funding-cost effect of a one-point capital reduction raises the model's depositor-welfare measure by 0.57 basis points. The predicted fall in cloud investment subtracts 0.18 basis points, leaving a positive net effect of about 0.38 basis points. In the model's aggregate equilibrium, average quarterly depositor welfare still rises by £0.24 billion, or 2.53%. The exercise maps the interacted reduced-form estimates into predicted cloud spending. The paper does not report alternative supplier-pricing, switching-cost, outage or capital-response sensitivities for this counterfactual.

Capital relief still wins in that exercise. It just wins by less.

Large-bank evidence, smaller-bank benefit

The distribution is as important as the total. The observed links between cloud spending, costs and deposits are strongest at large institutions. In the baseline structural demand model, the cloud effect is small and statistically insignificant for large institutions, but positive and significant for small and medium banks and building societies. With standard errors clustered by bank, the small and medium bank coefficient remains positive and significant at the 10% level. The building-society coefficient stays positive but becomes statistically imprecise.

The authors reconcile the split by arguing that large banks use cloud chiefly to reorganise internal operations, while smaller lenders use it to close service-quality gaps. When the model freezes cloud spending at 2015 levels, average inside-market concentration rises by 132 points on the Herfindahl-Hirschman Index and depositor welfare falls by 11.2%. The proportional losses are greatest at smaller banks and building societies.

That result should interest a building-society strategist, but it is not a promise that buying more cloud capacity will win deposits. Small and medium building societies had adopted cloud less intensively in the descriptive data, even while the model assigns them the largest marginal demand benefit. Governance, execution and the choice of workload still stand between potential and outcome.

The cloud market is not a neutral input

The model treats cloud spending as a bank characteristic that can improve depositor demand. It does not model the full dynamic investment decision or place internal cost savings from legacy replacement directly into the deposit-franchise profit calculation.

It also stops short of pricing the structure of the cloud-supplier market. The Competition and Markets Authority's final decision of 31 July 2025 found that Microsoft and Amazon Web Services each held 30% to 40% of UK and European Economic Area infrastructure-as-a-service supply in 2024. Fewer than 1% of customers switched provider each year. The CMA found that egress fees and technical differences impeded switching and use of multiple providers, particularly for smaller customers. It said committed-spend agreements were widespread, although it did not find that they harmed competition in their current form.

The position has since moved. On 31 March 2026, the CMA said Microsoft and Amazon had set out material steps to lower egress fees and improve interoperability. It also said further work was needed on multi-cloud and switching, and planned to review progress after six months.

Those frictions do not overturn the Bank paper's result. They narrow what it can establish. A migration may lower a bank's fixed technology costs while increasing dependence on one supplier, adding exit expense or concentrating outage exposure. A depositor-welfare measure based on rates and perceived service quality is not a complete measure of those operational risks.

For a prudential policy lead, the next test is a sensitivity exercise: vary the capital-to-cloud response, supplier pricing, switching costs and disruption assumptions before using 32% in a policy case. For a bank chief information officer, the practical task is to separate programmes that remove legacy cost from feature spending that can be paused, then map both against capital scenarios and supplier-exit plans.

The paper does not show that lower capital requirements are a mistake. It shows why funding relief cannot be evaluated on funding costs alone. If lighter capital makes long-horizon technology investment easier to defer, part of today's gain may arrive with tomorrow's legacy system still attached.

UK Parliament Drafts Incident Clocks; Ofcom Lacks AI Test

2026-09-24T08:15:00.000Z

A security tool at a UK data centre flags an unusual sequence of network activity. Its machine-learning model gives the event a risk score, but an analyst initially decides that the evidence is too weak to escalate. Hours later, more signals arrive and the incident is confirmed.

Under the Cyber Security and Resilience Bill, the time of first awareness would matter. The latest parliamentary text would give an in-scope operator 24 hours from that point for an initial notification and 72 hours for a full notification. Yet Ofcom, the proposed regulator for data centres, has not said when the output of a probabilistic defence tool should become reliable enough to inform that judgement.

That is the gap between two pieces of work now moving on different timetables. Parliament is writing incident clocks into law. Ofcom has opened an autumn engagement on AI in cyber defence and expects to publish findings in early 2027. The regulator has asked about trust, assurance, accountability and compliance, but it has not proposed a model-specific test, audit method or documentation standard.

The gap does not make defensive AI unusable. It does make evidence around its use a supervisory issue, especially when an alert influences whether a statutory clock has started.

The bill sets the perimeter and the clocks

The current bill, dated 7 September and amended in Lords Grand Committee, would add data infrastructure to the Network and Information Systems regime. It names the Office of Communications as the competent authority and treats qualifying data-centre services as essential services.

The threshold is a rated IT load of at least 1 megawatt for a commercial data centre and at least 10 megawatts for one provided on an enterprise basis. The bill defines rated IT load as the maximum electrical power available to operate the IT equipment housed in the facility.

This is proposed law, not a duty already in force. The bill has completed Lords committee stage, with report stage scheduled for 26 October. The government's implementation factsheet says data-centre and incident-reporting measures would commence through secondary legislation after Royal Assent, following further technical work.

The reporting scope is deliberately wider than an outage. The text defines a data-centre incident to include one that could have had, has had, is having or is likely to have a significant impact on the security or operation of the relevant systems, on service continuity, or another significant impact in the UK.

Once the operator is first aware that such an incident has occurred or is occurring, the proposed clocks run in parallel. The initial notification, containing the operator's name, the affected service and brief details, is due within 24 hours. The fuller notice is due within 72 hours and, so far as known, must cover timing, duration, whether the event is continuing, its nature and its actual or potential impact. A copy goes to the national computer security incident response team at the same time as it goes to the regulator.

A model score is not a legal conclusion

The bill does not say that every automated alert creates organisational awareness. Nor does it excuse an operator that configures its systems or escalation process so poorly that significant signals are routinely ignored. The boundary between those positions will matter.

Probabilistic tools can rank anomalies, connect weak signals and accelerate investigation. They can also produce false positives, miss unfamiliar attacks, drift as network conditions change, or behave differently after a vendor updates a model. A score without its operating context cannot show whether an incident was significant or when a responsible decision-maker had enough information to recognise it.

Ofcom's 15 September engagement acknowledges the problem at a high level. It says AI works differently from many other security technologies because of its probabilistic nature. It will hold discussions with regulated companies, technical experts and vendors during the autumn, looking at both the benefits and the questions around trust, assurance, accountability and existing cyber-security requirements.

Its 2026/27 AI strategy goes a little further. Ofcom says strong oversight and understanding of a security control affect confidence in AI, and envisages work on vendors and third-party assurance with the Department for Science, Innovation and Technology and the AI Security Institute. It still does not prescribe an assurance threshold.

The evidence an operator will need

There is already useful government guidance, but it does not answer the regulatory question on its own. In April, Ofcom told existing operators of essential services to assess frontier-AI risks, implement appropriate measures aligned with the NCSC Cyber Assessment Framework and follow relevant NCSC advice.

The NCSC's secure AI development guidance calls for documented models, data, prompts, limitations and failure modes. Its deployment guidance recommends high-quality audit logs, incident procedures, benchmarking and red-team evaluation.

Those controls point towards a practical evidence file. A data-centre operator using AI in detection or triage should be able to show which model and version produced an alert, what data it observed, how its performance was validated in the operator's environment, and what thresholds routed an event to human review. Records should preserve changes to the model, prompts and configuration, the analyst's decision, later evidence and any override.

Performance should be measured against the task that affects reporting, rather than a vendor's general benchmark. For a detection tool, that means false negatives as well as false positives, time to escalation, results on unfamiliar attack patterns and behaviour after material changes. A fallback is also necessary when the model or its supplier becomes unavailable.

These are inferences from the proposed reporting duties and existing security guidance, not requirements Ofcom has yet published for AI-enabled defence. They would, however, let an operator reconstruct why it treated a signal as an incident at a particular time. They would also let the regulator test whether human oversight was real or merely a label attached to automated triage.

Assurance must meet the reporting timetable

Ofcom does not need to certify every model before operators can use AI. A single pass-fail test would age quickly and could encourage firms to treat assurance as a procurement event. The more durable approach is evidence tied to the control's role, followed by monitoring as the system and threat environment change.

But the regulator will need to be more specific than its opening engagement if AI is to influence statutory incident decisions. Operators need to know what proof Ofcom will accept for detection performance, vendor claims, model changes, auditability and human escalation. They also need clarity on how a regulator will examine a delayed notification when the earliest signal came from a tool with an uncertain output.

The bill's clocks are visible. The assurance test is not. Before the data-centre duties commence, those two strands need to meet in guidance that makes faster defence compatible with accountable reporting.

Sources

Nine Firms Hold Targeted Support Permissions. The FCA Has Not Published Their Reach.

2026-09-23T08:15:00.000Z

The Financial Conduct Authority has put a number on the supply side of Britain's new investment-support market. Nine firms have been authorised to provide Targeted Support, its director of consumer investments said on 18 September. It has not put a comparable number on reach.

That distinction matters because the competing channel is already in people's hands. An FCA survey published in August said four in five less-experienced investors had used artificial intelligence for help with investing. Yet the regulator has not published the denominator for that subgroup, a questionnaire or tables showing whether “help” meant decoding jargon, researching a company, asking for a recommendation or completing a trade.

Permissions and survey responses therefore cannot be placed on opposite sides of a market-share chart. What can be tested is whether the regulated channel has become visible, usable and measurable since its April launch.

The AI figure has a narrow selection boundary

The FCA conducted the survey via the Attest platform on 24 July. Its 666 respondents were UK residents aged 18 to 40 who either owned investments or would consider buying them within 12 months. It was not a survey of all UK adults or even all people in that age band.

Within that selected sample, 56% said they trusted AI tools. Some 44% thought AI-generated financial information was regulated, 38% considered it acceptable to make an investment decision solely from AI output, and 32% thought the Financial Services Compensation Scheme or Financial Ombudsman Service would compensate them if AI advice went wrong.

Those findings expose confusion about protection. They do not establish that four fifths received a product recommendation, acted on one or funded an account. The unpublished subgroup size also prevents readers from converting the headline ratio into a reliable count. Until the FCA releases the questionnaire and cross-tabs, the survey is evidence of use and mistaken expectations among a selected group, not a census of chatbot-led investing.

Four clear launches, no market total

Targeted Support took effect on 6 April. Under COBS 9B, an authorised firm can use limited information to align a customer with a predefined segment and deliver a ready-made suggestion designed for that group. It is less individualised than full advice, but it sits inside the regulatory perimeter and alongside the Consumer Duty.

The FCA estimates that about 23 million consumers are underserved by existing advice and guidance markets. Its latest count of nine permissions is progress, not proof that support has reached those people.

A review of firms' public material finds at least four clearly launched consumer propositions. Royal London launched an app-based Targeted Support ISA service on 20 April. Quilter launched through Quilter Invest on 1 June. Vanguard now offers new clients an investment suggestion. The FCA says Monzo launched a Targeted Support journey earlier this year.

Other firms have announced permissions, planned roll-outs or use cases. Those announcements do not reveal active users. Nor has the FCA published a current list separating permission holders from live services, or aggregate figures for completed journeys, funded accounts, balances, complaints and investment outcomes.

Monzo's early result illustrates the problem. The FCA said customers receiving an investment recommendation were 33% more likely to open an investment account than comparable customers who did not. That is a relative uplift. The 18 September speech did not disclose either group's absolute conversion rate, sample size, selection method, balances, persistence, complaints or returns. A movement from 3% to 4% and one from 30% to 40% both produce roughly the same relative claim while describing very different reach.

A chatbot's features do not settle its regulatory status

The FCA's 2026 perimeter report says general-purpose large language models are outside its remit, while a model deployed specifically to provide financial advice would likely fall inside. The purpose and substance of the service matter more than whether its interface looks like a chat window.

Retrieving source documents or explaining jargon does not by itself create regulated advice. Adding personal prompts can make an answer more tailored, but is not a protection label. An affiliate link can bring financial-promotion rules into play if the surrounding words invite or induce investment activity, yet an approved promotion is still not the same thing as advice. A tool embedded by an authorised firm may be subject to that firm's conduct obligations, but customers still need to know whether they are receiving information, Targeted Support or a personal recommendation, and whether the firm holds the relevant permission.

The protection boundary is concrete. A customer unhappy with regulated Targeted Support can complain to the firm and then take an unresolved case to the Financial Ombudsman. If an authorised provider fails, eligible Targeted Support claims may receive FSCS protection up to £85,000 per person, per firm. General-purpose chatbot output carries neither route merely because it cites sources, remembers preferences or links to a platform.

The next test is disclosure

The FCA said in its policy statement that it would assess firm numbers, customer uptake and suggested actions within two years of opening the gateway, with outcomes examined later. That timetable is too slow for basic launch transparency.

A quarterly dashboard could name permission holders, distinguish live from planned services and report completed journeys, funded accounts, opt-outs, complaints and broad outcome measures. Firms could also publish absolute conversion rates beside relative uplifts.

Britain has built a protected middle tier between generic information and full advice. It has not yet shown how much of the market that tier reaches. Without comparable denominators, the honest finding is neither that chatbots have won nor that Targeted Support has closed the advice gap. It is that one channel is being measured by a loosely defined survey response and the other by permissions.

A 27.3 Million-Trade Audit Finds an 11.8 Basis-Point Gap in Short-Term Dollar Forwards

2026-09-22T08:15:00.000Z

The price of raising dollars through the foreign-exchange market depends partly on which dealer handles the trade and which side of that dealer's book the customer occupies, according to a new Bank of England staff study of 27.3 million outright forwards.

That is an execution-quality finding, not evidence that dealers have charged abusive prices. The study finds meaningful price dispersion after placing trades into narrow comparison groups, but it cannot fully separate market power from relationship services, collateral terms, bargaining and customer choice.

The distinction matters for corporate treasurers, asset managers and insurers that use forwards to obtain or hedge dollars. An aggregate market curve may be a useful reference, but it is not necessarily the price available to a particular customer.

From 178.5 million reports to 27.3 million trades

The Bank staff working paper, by Marco Grotteria and Alex Kontoghiorghes, uses confidential UK transaction reports from January 2021 to October 2025. The authors began with 178,473,017 UK EMIR reports for FX forwards.

They restricted the data to six dollar pairs involving the Australian dollar, Canadian dollar, Swiss franc, euro, sterling and yen. That left 46.7 million reports. Quote-orientation and price filters reduced the population to 45.7 million, requiring at least one observed G15 dealer parent cut it to 38.4 million, and excluding trades between entities in the same banking group produced the final 27,291,457 arm's-length forwards.

The cleaning is material. Raw reporting data can include amendments, cancellations, valuation updates and daily state reports for one contract. The researchers reconstructed those lifecycles and retained one record for each economic transaction. Fourteen G15 parent groups appeared across the six pairs and 58 months.

For the central comparison, trades had to share a currency pair, a half-hour execution window and a ten-day maturity bucket. These controls remove the common forward curve and much of the market-wide movement around execution. The resulting dealer "wedges" are relative price estimates around that common component, not standalone quotes or a measure of the total cost of synthetic dollar funding.

Dispersion survives the first controls

The monthly dealer wedges had standard deviations of 4.4 annualised basis points when a dealer bought foreign currency forward and 3.9 when it sold foreign currency. The distance between the 10th and 90th percentiles was roughly seven basis points.

The dispersion was not simply a permanent league table of cheap and expensive dealers. After the authors removed both common month effects and fixed dealer effects, standard deviations of 3.4 and 3.1 basis points remained. Weighting the results by notional did not materially change the pattern, which argues against tiny dealer-month samples driving the averages.

The second finding is directional. The paper defines a dealer selling foreign currency as buying dollars at maturity. On that side, the average estimated wedge was 2.15 annualised basis points, compared with minus 0.38 basis points when the dealer bought foreign currency. The difference was 2.52 basis points.

It became much larger at the front end. For maturities up to one month, the difference between the two sides was 11.82 annualised basis points. It fell to 4.10 basis points between one and three months and 2.07 basis points beyond three months.

Annualisation is crucial. An 11.82 basis-point annualised difference on a 30-day contract is roughly 0.97 basis points over that term. On $100 million of notional, that is about $9,700 before allowing for the precise contract convention and currency conversion. It is an illustration of scale, not an estimate of a customer's all-in saving from switching dealer.

Relationships explain some of the level, not the asymmetry

The authors tested whether different dealers merely serve different customers. They added fixed effects for each client-dealer relationship, then allowed those effects to vary by currency pair. They also controlled for trade size, electronic versus bilateral execution and whether the pair was among the three most liquid in the sample.

The directional gap stayed between 2.23 and 2.66 basis points across those specifications. By contrast, the sum of the two directional wedges, which the paper uses to test for different relative dollar-funding conditions across dealers, fell from 1.78 basis points to as little as 0.20 and was no longer statistically distinguishable from zero.

That split disciplines the interpretation. Observable transaction characteristics and persistent client relationships account for much of the average level. They do not remove the difference between the two sides of dealers' books. The result is consistent with a mixture of intermediation costs and residual customer demand, rather than a clean estimate of dealer markup.

Nor does the dataset show whether a customer requested competing quotes, could move its collateral arrangement or valued balance-sheet access and operational reliability enough to accept a different price. Those are central to any claim about pricing power. A relationship can create switching friction and still provide a service that a half-hour price comparison does not capture.

The practical test is a better execution record

For an FX execution lead, the paper suggests that transaction-cost analysis should segment trades by dealer, direction and maturity, rather than compare every fill with one market midpoint. The useful internal record would preserve the request-for-quote set, executable alternatives, timestamp, collateral terms, size, venue and reason for dealer selection.

For treasury and market-risk teams, the maturity conversion should be explicit. Annualised basis points make contracts of different tenors comparable, but budgets and realised funding costs are paid over the contract term. A large annualised short-dated gap can be economically relevant when notionals are large or positions roll frequently without being the same as an annual charge on the full amount.

The Bank for International Settlements estimated that non-banks outside the United States had $26 trillion of off-balance-sheet dollar obligations in FX swaps, forwards and currency swaps at mid-2022, while non-US banks had $39 trillion. That establishes why short-term synthetic dollar funding matters. It does not justify applying the paper's price gaps to those global stocks, which cover different instruments, entities, jurisdictions and dates.

This is Staff Working Paper No. 1,207, not an official finding of the Bank or its policy committees. Its sharper contribution is narrower: comparable dollar forwards did not clear at one observable transaction price, and the largest difference appeared where maturities were shortest. The next question is whether customers with auditable access to several executable quotes face the same pattern.

The FCA Is Preparing for 60,000 AML Firms. Fifty-Six Million Daily Records Do Not Prove Enforcement.

2026-09-21T08:15:00.000Z

The Financial Conduct Authority says it will begin taking responsibility for the anti-money laundering supervision of about 60,000 legal, accountancy and trust or company-service providers at the end of 2028. Its case for readiness includes a striking figure: the regulator's intelligence systems can process more than 56 million records a day and flag high-risk firms earlier.

That is evidence of computing capacity, not yet of supervisory effectiveness.

The FCA's 17 September speech does not identify the record types, say how many are duplicates, disclose the number of alerts produced, or show how often a flag becomes an inspection, remediation order or enforcement case. It says the FCA is exploring the potential for agentic supervision while keeping human judgement decisive. It does not say that an agentic system is deployed, which decisions it may recommend, or whether it could execute any of them.

Those omissions matter because the transfer is not simply a database migration. It is an operating test of whether centralisation can turn information into faster, more consistent action.

Three numbers describe the present system

The supervisor counts can sound contradictory because official sources use different frames. The UK's latest Treasury supervision report refers to 25 UK AML supervisors in total: the FCA, HM Revenue and Customs, the Gambling Commission and 22 legal and accountancy professional body supervisors.

The government's 2025 reform response counts 23 supervisors of professional-services firms: those 22 professional body supervisors plus HMRC. The current OPBAS landing page uses a separate 25-body administrative count, saying it supervises 25 professional body supervisors. Neither source reconciles the additional three bodies in OPBAS's wording with Treasury's 22-body count, so they should not be treated as the same measure.

The new remit is different again. It moves firms currently overseen by those professional bodies, together with accountancy and trust or company-service providers supervised by HMRC, under the FCA for AML purposes. Their professional conduct regulators will remain in place. That distinction creates a continuing need to share information and co-ordinate cases even after the headline consolidation.

The 2028 date is a target, not a statutory guarantee

The legal machinery is moving. The Financial Services and Markets Bill completed its Lords stages and received its first reading in the Commons on 15 September. A date for Commons second reading had not been announced by 18 September.

The bill expands the Treasury's power to provide for co-operation and information sharing between AML supervisors and other regulators. The government's June 2026 consultation response says the arrangements will be taken forward through primary legislation and detailed through secondary legislation amending the Money Laundering Regulations during implementation.

Important operating choices therefore remain outside the current headline. The FCA's ongoing supervisory costs are intended to be recovered from firms through fees, with a separate FCA consultation still to set the structure. The Treasury and FCA are also still developing the transition and implementation plans. The FCA's end-2028 statement is the clearest timetable yet, but Parliament has not enacted a fixed handover date.

The baseline is measurable, but incomplete

The existing system provides a starting scorecard. In 2024/25, the 22 professional body supervisors had 229.65 full-time equivalent staff dedicated to AML supervision and spent an estimated £22 million. They conducted 3,255 desk-based reviews and 1,632 onsite visits, putting about 12% of their supervised population through direct supervisory activity, up from 10% a year earlier.

Among assessments completed in the year, accountancy supervisors classified 17% of firms as non-compliant and legal supervisors classified 26% that way. The bodies issued 338 AML fines worth more than £2 million, cancelled 33 memberships for AML reasons, and recorded 697 formal and 915 informal actions.

Those figures are not a complete performance measure. Supervisors use different methods and risk classifications. The latest OPBAS assessment also found that some bodies gave firms repeated opportunities or excessive time to correct failures before referring cases for enforcement. Yet neither the Treasury report nor the FCA's new speech supplies a comparable system-wide measure for the time from first concern to closure, the proportion of remediation completed by deadline, or the share of sanctions upheld on challenge.

Centralisation should make those gaps easier to close. It should not erase the baseline.

Fifty-six million records need a conversion rate

A useful technology metric would connect inputs to decisions. For every alerting system, the FCA could publish the number of unique records ingested, alerts generated, alerts closed as false positives, firms escalated, supervisory interventions opened and cases passed to enforcement. It could then report median and upper-quartile time from flag to action.

Agentic supervision needs an equally clear boundary. A system that assembles evidence for a human is different from one that selects a firm for inspection, drafts a statutory notice or recommends a penalty. Each step raises different questions about audit trails, legal privilege, data quality, human review and appeal. Saying that human judgement remains decisive does not reveal where that judgement enters the process.

Before the transfer, the FCA and Treasury should publish a scorecard covering inspection rates by sector and risk band, alert-to-intervention conversion, remediation timeliness, repeat non-compliance, case duration, sanctions and successful appeals. The 2024/25 figures offer the comparison point.

One regulator can still inherit fragmented data, slow cases and inconsistent enforcement. If the FCA reports only how much information it processes, the reform will have changed the supervising logo. If it shows that credible cases are found earlier, resolved faster and followed by proportionate sanctions, the 60,000-firm transfer will have proved its point.

UK Health AI Could Face Checks After Approval, but the Rules Are Not Yet Binding

2026-09-20T08:15:00.000Z

Approval would no longer be the final regulatory test for some healthcare AI under a blueprint published in the UK on 10 September. An expert commission wants performance checked in real use, software versions traceable in patient records and problems escalated before they become reportable incidents.

That is the proposed direction, not the law. The National Commission into the Regulation of AI in Healthcare is an independent, non-statutory advisory body established by the Medicines and Healthcare products Regulatory Agency. Its 44 recommendations, published on 10 September, do not bind ministers, the MHRA, the NHS or manufacturers. The report leaves implementation to a separate cross-government response.

The distinction matters because the report describes a different regulatory bargain. Some promising systems could reach patients through temporary, closely controlled authorisations. Under the proposal, manufacturers and healthcare providers would have to keep producing evidence after deployment. Faster access would come with a longer regulatory shadow.

Approval becomes a checkpoint

The commission's starting point is that AI software can change or perform differently after it enters a new hospital, workflow or patient population. A one-off assessment before sale may therefore say less about later performance than it would for a static device.

Recommendation 17 asks the MHRA to use a menu of proportionate post-market requirements. These include real-world data plans assessed when a device is authorised, post-market studies where needed, more regular performance reporting and escalation when performance deteriorates even if no reportable incident has occurred. Recommendation 20 would add device identification and version control, potentially recording a unique device identifier in the patient record.

This is not a proposal to watch every algorithm continuously in real time. The report repeatedly says oversight should vary with risk, benefit and uncertainty. The material change is that evidence after approval would become part of the planned assurance case, rather than relying mainly on reactive incident reports.

Britain already has post-market law. Requirements that took effect on 16 June 2025 oblige manufacturers to maintain surveillance plans and periodic reports, analyse benefit and risk, and record corrective action. The commission explicitly presents its proposals as a further AI-specific layer on those reforms. It wants more frequent performance evidence, better links between deployment sites and the regulator, and action on degradation before harm crosses an incident threshold.

Earlier access would carry conditions

Recommendation 14 proposes staged authorisations. A system could enter a controlled deployment with extra risk controls and evidence gathering, then progress towards full authorisation if real-world results justify it. The commission says the pathway should be temporary, transparent to patients and paired with a clear route to full market access.

The MHRA's announcement compared the model with learner-driver plates. The useful detail is not the analogy. It is that a provider would need enough staff, governance and monitoring capacity to host the controlled deployment. A shortage of prepared NHS sites could become the practical limit on faster access.

The enforcement recommendation would add teeth only if implemented. Recommendation 22 calls for earlier public sharing of safety signals and financial penalties for manufacturers that breach legal requirements and put patients at risk. The MHRA already has enforcement powers against breaches of current medical-device law, including notices, recalls and prosecution routes. The advisory blueprint creates no new breach or penalty by itself. Ministers would first need to turn the relevant recommendation into a binding duty and specify how it is enforced.

Responsibility moves into the contract

The report also rejects the idea that safety belongs to the vendor alone. Manufacturers would specify the operational conditions required for safe use, including cyber security, training, local monitoring and institutional readiness. Contracts between a manufacturer and healthcare provider would allocate each risk control, so a duty such as supplying performance data could not quietly fall between them.

DHSC and the devolved health administrations would be asked to clarify responsibility across vendors, providers, professionals and regulators. That four-nation work matters because health delivery is devolved, while medical device rules also differ at the border: Northern Ireland continues to apply EU medical device law under the Windsor Framework.

This allocation is not a settlement of liability. The commission says wider legal reform may be needed and could take time. Its immediate answer is operational: make clear who can prevent a risk, who has the information and how patients obtain evidence and redress when care falls below the expected standard.

The implementation clock has started, not finished

There is a route beyond the report, but not yet a completed policy. The MHRA's published economic-growth goals committed it to respond to the commission by September, begin operationalising an updated framework and aim for full implementation in 2027, subject to any legislation required.

Some work can start through guidance, sandboxes, reporting systems and coordination under existing responsibilities. Other elements need Parliament. Draft pre-market regulations published in May would make unique device identifiers compulsory. Separately, Health Bill amendments tabled on 1 September would create enabling powers for a future MHRA licensing regime, but the government says they make no immediate regulatory change and any new system would still require policy work, consultation, impact assessment and scrutiny.

The commission does not map every recommendation to a power or a Bill. It also states that it made no decisions about public funding, grants or MHRA allocations. The report therefore leaves two questions for the government's response: which obligations can be introduced through guidance or existing regulations, and who pays for the regulatory and NHS capability needed to monitor AI after approval.

The report is a serious design for lifecycle regulation, not a new compliance duty. Its test will be whether ministers turn continuous assurance from a principle into funded requirements that manufacturers and hospitals can actually operate.

UK Financial Firms Can Rephase Conformity Work, Not AI Controls

2026-09-19T08:15:00.000Z

Regulation (EU) 2026/1744, the AI Omnibus, was published on 24 July and entered into force on 27 July. It moved the main high-risk requirements for standalone systems covered by Annex III of the EU AI Act from 2 August 2026 to 2 December 2027. EU-facing teams gained 16 months, but the extension did not suspend duties that already apply.

For finance, Annex III covers AI used to evaluate the creditworthiness of natural persons or establish a credit score, except systems used to detect financial fraud. It also covers AI used to assess risk and price life and health insurance. Annex I systems moved from 2 August 2027 to 2 August 2028, but that is a defined product-safety route, not a later date for loans or policies simply because they are regulated. Article 50 transparency duties have applied since 2 August 2026, subject to the limited grace period for specified pre-existing marking systems.

The UK decision starts with overlap, not equivalence

Clarqo's analysis is that the extension changes programme sequencing, not the minimum control base. That is a budgeting conclusion drawn from the gap between the delayed EU conformity timetable and UK supervisory frameworks that remain in force. It is not a claim that every UK bank had built a deadline-specific programme around 2 August 2026.

The EU exposure can still arise from Britain. The Act's territorial scope includes providers and deployers established in a third country when the output produced by their AI system is used in the EU. A UK-headquartered group therefore needs to identify which models serve EU businesses, customers or decisions before deciding which work can move.

In Britain, the FCA says it does not plan an additional AI rulebook. It applies existing frameworks, including the Consumer Duty and senior-management accountability, when firms use AI. The PRA's SS1/23 model-risk principles apply to regulated UK-incorporated banks, building societies and PRA-designated investment firms with internal-model approval for regulatory capital calculations.

Those regimes do not convert every EU AI Act control into a direct UK requirement. They do mean that several disciplines overlap with UK supervisory expectations. Model identification, accountable ownership, independent validation and monitoring of customer outcomes remain useful even when an EU conformity deadline moves.

Keep now: the reusable control spine

UK financial groups should keep funding four parts of the programme.

Inventory and classification. Maintain one map of models, owners, uses, customers and jurisdictions. Mark whether each system is UK-only, produces outputs used in the EU, or supports an Annex III use case. Revisit financial-crime tools rather than treating all of them as high-risk, because the creditworthiness category expressly excludes fraud detection.
Ownership and accountability. Keep named business and risk owners, approval records and escalation routes. These are the mechanisms through which a firm can show who accepted a model's limits and who must act when customer outcomes deteriorate.
Validation and outcomes testing. Continue independent challenge, performance thresholds, drift monitoring and testing for harmful customer effects. This work supports risk management under PRA and FCA frameworks even where no EU conformity assessment is yet due.
Incident, change and supplier handling. Preserve logging, material-change gates, third-party evidence, incident escalation and customer-remediation routes. Deferring those controls would create operating risk now, not merely compliance risk in 2027.

Public disclosures show why the distinction matters. Lloyds Banking Group says its AI Assurance Framework covers internal and external systems across their lifecycle and aligns, where relevant, with the EU AI Act, UK AI assurance guidance and ISO 42001. That supports the existence of reusable controls. It does not prove Lloyds, or UK finance generally, budgeted a programme against the old Annex III date.

HSBC Continental Europe's 2025 annual report says more sophisticated AI modelling creates model risk that must be managed in compliance with the EU AI Act. That establishes an EU operating exposure within a UK-headquartered group. It does not establish a deadline-specific UK budget. The evidence supports maintaining a control spine, not inventing a sector-wide sunk-cost figure.

Rephase the standard-dependent finish

The extension has value where technical specifications remain unsettled. A group acting as an AI provider can rephase final standards mapping, standard-dependent technical documentation and execution of conformity-assessment work tied specifically to the delayed high-risk requirements. A deployer can re-sequence final supplier-evidence gates and contract changes that depend on the same specifications. Scoping, ownership and evidence collection should continue, so the programme does not face a compressed rebuild in 2027.

Programme leaders should divide spending into three tranches:

Duties already live: fund applicable prohibited-practice, general-purpose AI and Article 50 work to the current timetable.
Reusable UK and EU controls: keep inventories, governance, validation, monitoring and incident handling in delivery now.
Delayed Annex III conformity tasks: rephase only the work whose content or timing depends on final standards, guidance or the December 2027 legal date.

The boundary should be recorded model by model. A customer-facing chatbot may already need an Article 50 disclosure while a credit-scoring engine has longer for the full high-risk regime. A fraud-detection model may fall outside the specific creditworthiness classification but still require controls under financial-services rules and the firm's own risk framework.

The European Banking Authority found that the AI Act is complementary to existing banking and payments law, with no significant contradictions, while noting that firms must integrate the frameworks. Moving one EU layer therefore does not move the sectoral obligations beneath it.

The practical UK decision is not whether to stop or continue an undifferentiated AI Act project. It is which deliverables still reduce present risk and which are premature attempts to finish a conformity package. Firms that keep the control spine and move only the standard-dependent finish can use the 16 months without weakening accountability on either side of the Channel.

Britain's Banks Flag AI Risk Twice. The Loan Terms Remain Unquantified.

2026-09-18T12:00:00.000Z

Britain's lenders have now raised the same concern twice. The Bank of England's July report said banks had less appetite to lend to firms at risk of revenue erosion from artificial intelligence. Its September report repeated the warning.

That repetition makes AI exposure a real credit question. It does not yet show how much a borrower pays for it.

The clearest public evidence that concern has changed a decision comes from outside Britain. Goldman Sachs Private Credit said it passed on its first software deal because of AI concerns in October 2023. That is one attributable denial. Goldman did not identify the borrower, proposed facility, spread, leverage, covenants or the size of a wider rejected pool.

The distinction matters to bank credit officers, software-company finance chiefs and private-credit investors. A warning can change questions in a credit memo before it produces a measurable premium in a term sheet.

A selective market is still a competitive market

The Bank's two Agents' summaries are qualitative intelligence from business contacts, not a statistical survey of credit decisions. July said credit conditions were broadly unchanged and borrowing appetite was weaker than supply. It also said firms exposed to AI-driven revenue erosion had to rely on second-tier funding, alongside smaller companies and borrowers in construction and hospitality with weaker lender demand.

September retained the AI warning while describing an increasingly competitive market. Credit supply continued to outstrip demand, the gap broadened modestly across company sizes and distressed borrower levels remained low. Tier-one lenders were competing mainly on price for viable borrowers. The same update said acquisition finance was readily available and competition was encouraging some early refinancing.

Those statements can coexist. Banks may compete hard for businesses that clear their underwriting tests while steering a narrower group towards faster or more risk-tolerant funders. What the release does not show is how many borrowers were placed in the AI-risk group, how lenders defined revenue erosion, or whether those borrowers paid more after moving to a second-tier provider.

The Bank's July Financial Stability Report takes the evidence one step further, but no further than the decision process. It says some financial firms already assess AI's potential impact on businesses as part of loan-level decisions. It does not name the firms or sectors and gives no approval rate, spread, maturity, covenant, advance rate or denial count.

This is evidence of a new underwriting variable, not evidence of a new market price.

One rejection clears a low evidence bar

Goldman's disclosure supplies the missing behavioural example. The manager said it introduced an internal framework for AI disruption risk in early 2025. For new software investments since January of that year, it reported an average Rule of 40 score of 55.7%, entry loan-to-value of 33.7% and EBITDA of $192 million.

Those figures describe the companies Goldman accepted. They do not establish that the framework caused tighter leverage, stronger covenants or wider spreads. There is no before-and-after series, no score for rejected borrowers and no allocation of the one reported denial between revenue risk and other weaknesses.

Goldman also reported clear differentiation in traded debt. In March 2026, broadly syndicated senior-secured loans for the best-performing software names were down only 0.625%, while names perceived to face higher AI disruption risk traded at least 15% lower. That is a secondary-market price signal. It is not an origination spread or a bank loan term, and it should not be presented as one.

Private credit supplies the counterweight

The broadest loan-level test points away from an AI premium. A Bank for International Settlements study examined business development companies, US vehicles that originate about one fifth of direct loans. It counted about $115 billion of lending to software firms, roughly one fifth of BDC lending and more than 80% of their technology portfolios.

Using 152,116 spread observations involving 208 BDCs and 2,302 borrowers from 2015 through the end of 2025, the authors found no systematic spread difference between software and other technology loans after controlling for timing, lender, investment type, tenor, accrual status and principal size. Newly issued spreads had fallen faster than those on existing loans. Fewer than 1% of software loans were behind on payments.

The study stops before the most recent Bank warning and covers US private credit, not British banks. It therefore cannot disprove selective tightening in the UK. It does show why the two Bank reports cannot support a claim that lenders already charge a general AI premium.

More recent fund disclosures do not close the gap. Blackstone Private Credit Fund said selected software investments were marked down in the second quarter because of wider spreads and company-specific fundamentals. It reported about 510 basis points of spread and 39% loan-to-value for private debt investments in new portfolio companies during the quarter, but did not isolate software or AI-exposed deals. Blue Owl Technology Income Corp said market dislocation was beginning to create opportunities at improved terms, while reporting a 35% loan-to-value for its existing technology portfolio and a $400 million asset sale at 99.6% of par. It did not quantify new terms by deal or AI-risk band.

The term sheet is the next disclosure test

A bank credit officer now has reason to test whether a borrower's revenue depends on narrow software features, easily replicated workflows or weak switching costs. A software-company finance chief should be ready to show retention, pricing power, proprietary data and the cost of adapting the product. A private-credit investor should ask managers for acceptance rates and terms by AI-risk band, not settle for portfolio averages.

The useful next data point is not a third warning. It is a matched comparison: similar borrowers, separated by assessed AI exposure, with their approvals, spreads, leverage, maturities and covenant packages disclosed over time.

For now, Britain's banks have identified the question twice. One global private-credit manager has documented a rejection. Public evidence still does not put a price on the risk.

Ofcom's Deepfake Control Can Find a Known Image. A New One Is Harder.

2026-09-17T08:15:00.000Z

Ofcom has opened an enforcement programme before its new control for non-consensual intimate images takes effect. The regulator wants high-risk services to use automated hash matching from 30 September, or show that another system curbs the spread of the same illegal content just as effectively.

That sounds like a deepfake detector. It is more precisely a recirculation control.

A hash is a digital fingerprint made from an image or video that has already been identified and added to a database. A platform compares content against that set and acts on a match. The method can stop the same abusive file, and perceptual hashing can catch some altered versions. A newly generated image with no corresponding fingerprint is outside that first line of detection until somebody finds it and adds its hash.

Ofcom's test, therefore, is not whether platforms can claim to have bought a tool. It is whether the tool covers the risky services, scans the right content, adds newly discovered abuse quickly and produces decisions accurate enough to justify removal.

A legal duty, with a choice of control

The enforcement programme opened on 9 September under sections 10(2) and 10(3) of the Online Safety Act 2023. Those provisions require regulated user-to-user services to prevent people encountering priority illegal content, manage the risk of their service being used for priority offences, and remove such content swiftly once aware of it.

Ofcom's amended codes recommend hash matching as the compliance route. The user-to-user measure, ICU C14, applies to services that enable visual user content and meet specified risk and scale tests. These include high-risk pornography, file-storage and file-sharing services, high-risk services with more than 700,000 monthly UK users, and large services assessed at medium or high risk. A parallel measure covers large general search services.

The code is a recommended route, not the only possible technical design. Ofcom says a firm without hash matching must prove that its systems and processes are equally effective. Where it finds a breach of the statutory safety duties, Ofcom can impose a penalty of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

The initial enforcement focus is narrower than the full code. Ofcom names adult and instant-messaging services as particularly high risk and says it has written to some relevant providers. It has not disclosed their names, how many received letters, or what share of UK users their services cover.

What the evidence shows

There is real deployment evidence behind the policy. Ofcom's May decision statement identifies StopNCII.org as the leading public third-party database. It lists Facebook, Instagram, TikTok, Reddit, OnlyFans, Pornhub, X and Snap among its partners. The database had received more than one million image hashes over three years.

Ofcom also cites Microsoft's report that a Bing pilot identified and acted on 268,899 images returned in image-search results. Google had announced its own partnership with the operator of StopNCII. For implementation effort, Ofcom records evidence that OnlyFans integrated the database in under 80 hours, with four to five hours of maintenance a month.

These numbers establish that the mechanism can operate at scale. They do not establish compliance across the services now in scope. A partner list does not show what proportion of uploads is scanned, whether old content has been covered, how quickly matches are handled, or whether every partner uses the same database across all relevant products.

Ofcom's programme promises to identify risky services, assess their measures and open formal investigations where potential non-compliance appears. It does not yet name an investigation or publish a coverage denominator. The enforcement programme began on 9 September. The 30 September date is when the amended code measures take effect and the compliance milestone arrives, not evidence that the market has completed implementation.

The known-image boundary

The limits are explicit in Ofcom's technical account. Cryptographic hashing detects exact matches, so small changes can defeat it. Perceptual hashing compares similarity and can recognise modified versions, but its threshold creates a trade-off: prioritising recall catches more possible matches and raises the risk of false positives, while prioritising precision can miss more abuse.

Most importantly, both approaches depend on a reference set. Ofcom describes hash matching as a way to detect content previously identified as illegal or otherwise prohibited. It says known AI-generated deepfakes can be detected. That does not mean the system recognises every synthetic intimate image as synthetic or non-consensual. The first unseen output still needs another route into the moderation system, such as a report, sampling, or a separate detection tool. Once confirmed and hashed, matching can stop repeated circulation.

The database itself also presents an accuracy problem. StopNCII lets a person create hashes on their own device, so the image does not leave their possession, but the submitted image is not viewed or independently verified by the database. Ofcom acknowledges that consensual or non-intimate images could be submitted, including maliciously.

That is why the code couples automation with review. A first match against an unverified hash should be reviewed, and providers should run continuing quality assurance. Ofcom's final human-review guidance sets no universal percentage. It tells firms to base review resources on documented performance, observed errors and the harm caused by both missed abuse and incorrect removal.

The useful disclosure after 30 September will be operational: which services were assessed, what share of relevant content was scanned, how many matches were confirmed, how many were overturned, and how quickly new hashes entered the system. Without those measures, compliance risks becoming a list of tools rather than evidence of outcomes.

Hash matching can make an important promise to victims: an image already known to the system should be harder to spread again. It cannot promise that a fresh deepfake will be recognised before anybody reports or otherwise detects it. Ofcom's enforcement programme will matter if it measures both halves of that sentence.

Sources

Computer Programming Added 0.12 Points to UK Growth. ONS Cannot Isolate AI.

2026-09-16T08:15:00.000Z

Britain's computer-programming industry made a measurable contribution to growth in July. The amount attributable to artificial intelligence did not.

The Office for National Statistics estimated that monthly gross domestic product rose by 0.4% in July 2026. Within services, computer programming, consultancy and related activities grew by 3.5%, adding 0.14 percentage points to services output and 0.12 percentage points to real GDP.

The ONS also found that many of the businesses reporting the largest turnover in computer programming and information services were involved in AI and cloud computing. Its next sentence supplies the essential limit: the nature of the data collection makes the exact impact of those activities difficult to quantify.

The 0.12-point figure should therefore be read as a contribution from a broad computer-programming industry classification. It is not an estimate of AI output, AI adoption or AI-driven productivity.

What the contribution measures

Monthly GDP is an early estimate of changes in real economic output. The 0.12-point contribution describes how much the movement in computer programming, consultancy and related activities added to the change in economy-wide output in July, after weighting the industry within GDP.

That is useful evidence. It shows the industry's rise was large enough to matter to the monthly total, rather than merely reflecting enthusiasm around a small group of technology companies. The ONS also reports that information and communication output as a whole rose by 2.4% on the month.

But the precision has limits. The headline GDP and industry growth rates are rounded to one decimal place, while contributions are rounded to two decimal places. The ONS warns that components may not sum to the total because of rounding. Treating 0.12 as a precise share of the rounded 0.4% headline would imply more certainty than the release provides.

The monthly and three-month measures must also remain separate. Over the three months to July, GDP grew by 0.4% and services by 0.6%, while production and construction each fell by 0.5%. Computer programming grew by 4.4% over that period. Those figures describe a services-led economy with weakness elsewhere. They do not show that AI lifted productivity across the whole economy.

Why AI remains inside the industry total

The current collection is designed to measure industries, not to produce a product-level account for AI. A business associated with AI or cloud computing can also earn turnover from conventional software development, consultancy, infrastructure migration, support and other digital services. The bulletin identifies the activities of large reporters, but it does not divide their July turnover between those lines.

There is a second measurement issue. The Monthly Business Survey covered 43.3% of the services sector by industry weight, with an 84.6% turnover response rate for July at this stage of reporting. More responses are expected and can feed into later estimates.

For most industries, the ONS says monthly estimates use deflated turnover or volume as a proxy for gross value added. Gross value added is output minus the goods and services consumed in producing it, but intermediate consumption is collected annually rather than monthly. A rise in turnover-based output can therefore establish neither how much was produced by AI nor whether AI allowed firms to produce it with fewer inputs.

That distinction is the gap between an output claim and a productivity claim. Productivity requires relating output to an input such as hours worked or capital used. The July GDP bulletin does not perform that calculation for AI.

Two releases will test the number in different ways

The first test is methodological. On 21 September, the ONS is due to publish its approach to an AI thematic account. The confirmed release is intended to explain the account, the approach to compiling it and how it could help measure AI's impact on the UK economy.

A thematic account could place an economic boundary around AI activity that crosses established industry classifications. The questions to watch are whether it distinguishes AI production from adoption, separates AI from cloud and other software activity, and connects output to the inputs needed to produce it. The announcement does not promise a revised attribution for July or say that the 0.12-point contribution will be decomposed.

The second test is revision. The July time-series release identifies the data as an early monthly estimate, while the bulletin says the entire series will reopen in the 15 October monthly release. That update will include Blue Book 2026 revisions. An indicative monthly path is due with the quarterly national accounts on 30 September.

Blue Book will incorporate newer survey and administrative information and methodological improvements. It will also estimate 2024 for the first time using annual supply and use tables, where output and intermediate consumption are measured together. The July industry contribution may survive unchanged, rise or fall. Until the revised series arrives, 0.12 remains a first estimate.

A signal, not a verdict on AI

Technology operators and investors can use the July figure as evidence of strong activity in a broad UK programming market. They cannot use it to infer the sales, output or productivity of an individual cloud or AI company. Nor can policymakers claim that AI generated 0.12 percentage points of UK growth.

The stronger conclusion is narrower. Computer programming was a material contributor to July's expansion, and some of the largest turnover reporters work in AI and cloud. The official statistics cannot yet say which activity delivered how much. The 21 September methods release will show whether the ONS has a credible route to closing that gap; the autumn GDP revisions will show how stable the starting number is.

8.4% of UK Mortgage Advances Exceed 90% LTV. Arrears Are Still Falling.

2026-09-15T08:15:00.000Z

Britain's newest mortgage lending is carrying more exposure to property values, even as distress in the existing loan book recedes. Mortgages above 90% loan-to-value accounted for 8.4% of gross advances in the second quarter of 2026, their highest share since the second quarter of 2008. Yet outstanding balances in arrears fell to £19.7 billion, 7.3% lower than a year earlier.

Those facts are not contradictory. The first measures the flow of loans completed during one quarter. The second measures trouble across a stock of mortgages written over many years. Reading either as a verdict on the whole market obscures the more useful question: are lenders extending access while pricing and controlling the added risk?

More lending is entering at higher LTVs

The move is broader than the narrowest deposit band. Advances above 75% LTV reached 47.5% of the quarter's total, the highest share since the fourth quarter of 2007. Loans above 95% LTV remained just 0.5% of advances. Most of the change therefore sits below that extreme edge, including borrowers bringing deposits of roughly 5% to 25%.

The above-90% share was 0.4 percentage points higher than in the previous quarter and 1.4 points higher than a year earlier. Because it is a share of advances, it can rise through faster growth in high-LTV completions, slower activity in lower bands, or both. The aggregate tables do not publish application or rejection rates that would separate those routes.

LTV is an exposure measure, not a probability of default. A higher ratio leaves the borrower with less equity and gives the lender a smaller cushion if house prices fall and a possession ends in a sale. It does not reveal the applicant's credit record, income stability, affordability buffer or payment behaviour.

The volume backdrop also needs care. Gross advances rose to £77.4 billion, up 11.1% from the previous quarter and 31.7% from a year earlier. New commitments, lending agreed for coming months, were £79.2 billion, only 1.4% higher over the quarter and 1.3% higher over the year. Advances and commitments refer to different stages of the pipeline, so the gap between them is not evidence that completed lending will rise or fall next quarter. The FCA also labels the series as not seasonally adjusted.

Borrower mix does not settle the explanation

A first-time-buyer surge would be an intuitive explanation for more high-LTV lending, but the aggregate mix does not show one. First-time-buyer advances were 27.3% of gross lending, 0.1 percentage points lower than both the previous quarter and a year earlier. Home movers accounted for 28.8%, down 1.5 points over the quarter but 0.1 points higher over the year. Owner-occupier remortgages, meanwhile, rose to 31.2% of advances, 2.2 points higher than a year earlier.

Income multiples provide a second signal. The share of lending that the FCA classifies as high loan-to-income reached 46.0%, up 4.6 percentage points over the year. In this release, that means at least four times income for a single applicant or at least three times joint income. It is not proof that affordability checks weakened, but it makes the higher-LTV move harder to dismiss as property-price arithmetic alone.

The purpose and borrower shares are reported separately from the LTV distribution. A flat first-time-buyer share across all lending therefore cannot rule out a shift towards smaller deposits within that group. Nor can it show whether remortgagers released more equity. The release identifies a composition question but does not resolve it.

The public MLAR tables cannot identify which lender wrote each loan or tag advances supported by a government guarantee. The permanent Mortgage Guarantee Scheme has been available since July 2025 to sustain 91% to 95% LTV mortgages for eligible first-time buyers and home movers, with the Treasury absorbing part of a participating lender's potential loss. That may support product availability, but the aggregate FCA release cannot show how much of the latest rise it explains.

The back book is getting cleaner, within a threshold

The arrears measure is narrower than a count of everyone who has missed a payment. MLAR records arrears only when overdue amounts reach at least 1.5% of the borrower's current loan balance. Forbearance for borrowers who are not yet in arrears, or remain below that threshold, may not appear.

Within that definition, balances in arrears represented 1.1% of all outstanding mortgage balances, unchanged over the quarter and 0.1 percentage points lower than a year earlier. Of the £19.7 billion total, £4.2 billion was non-regulated lending, including buy-to-let and other residential loans where the property is not used by the borrower or qualifying dependants. That non-regulated amount fell 12.7% over the year.

New possessions also declined to 2,058 in the quarter, 15.6% fewer than a year earlier. The stock of possessions fell over the quarter but remained 1.7% higher than a year earlier at 8,825, a reminder that improvement is not uniform across every measure.

None of this tells us how the mortgages completed this spring will perform. They have barely begun to season, while today's arrears reflect older borrowing decisions, later refinancing conditions and household income shocks.

The test moves from access to performance

For lenders and supervisors, the next evidence should be more granular: the concentration of high-LTV advances by lender, the use of guarantees, pricing by risk band, stressed affordability results and the later payment performance of the 2026 cohort. Without that link, the MLAR release can show that higher-LTV and higher-income-multiple shares rose, but not why they rose or whether the same borrowers account for both movements.

For borrowers, the immediate trade-off is simpler. A small deposit can bring home ownership within reach, but it also reduces protection against a fall in the property's value and can narrow refinancing options. Falling arrears in the old book are welcome. They are not a promise about the new one.

Britain Built a Stock Market for Private Shares Where the Companies Set the Rules

2026-09-14T08:15:00.000Z

For a decade the complaint about British capital markets has been the same: companies stay private for longer, float later and increasingly choose New York over London when they finally do. The government's answer is not another listing-rules tweak but a genuinely new category of market. It is called PISCES, the Private Intermittent Securities and Capital Exchange System, and by the summer of 2026 four operators had been approved to run one. It is the most novel piece of UK market plumbing in years, and it works by inverting the assumption that a stock market has to be transparent and continuous.

PISCES exists because the Treasury legislated it into being. The Financial Services and Markets Act 2023 (Private Intermittent Securities and Capital Exchange System Sandbox) Regulations 2025 created the framework as a regulatory sandbox, a bounded experiment that runs until 5 June 2030, at which point the Treasury must report to Parliament on whether it is working. The Financial Conduct Authority filled in the detail with its final rules, PS25/6, published in June 2025 and now sitting in a dedicated PISCES sourcebook. The design brief was explicit: bridge the liquidity gap between staying fully private and running a full public listing, and rebuild the pipeline of companies that might one day float in London.

A market that switches on and off

The word doing the work is intermittent. A PISCES venue does not trade continuously the way the main market or AIM does. Instead it hosts occasional, time-limited trading events, and it is the company, not the exchange, that decides when one happens. The company also decides who is allowed to take part, and it can set a floor and a ceiling on the price at which its shares change hands during the window. That is a deliberate reversal of how public markets work. On the London Stock Exchange's main market a listed company cannot switch trading off, pick its buyers or cap the price. On PISCES it can do all three.

The transparency regime is inverted in the same way. Public markets run on disclosure to the world: a listed company's price-sensitive information goes to every investor at once. PISCES runs on private disclosure. Companies must provide a core set of information mandated by the FCA, and platform operators can require more, but that information goes to the participants in the trading event rather than to the public. In effect PISCES trades the openness of a public market for the control of a private one, and asks investors to accept a narrower, bilateral flow of information in return for access.

Who can trade, and the tax that makes it work

Access is restricted by design. The permitted participants are institutional investors, high-net-worth individuals and self-certified sophisticated investors. Ordinary retail investors are largely kept out, and where they are involved they must receive personalised risk warnings through intermediaries. This is a market for insiders and professionals, not a retail venue.

The commercial glue is tax. The Treasury has used secondary legislation to exempt PISCES transactions from stamp duty and stamp duty reserve tax, aligning the treatment with the long-standing exemption for AIM shares. Without that relief a PISCES trade would carry the 0.5 per cent charge that applies to ordinary share transfers, and the venue would struggle to compete. The government has also published a technical note on the tax position of employees selling shares acquired through employee share schemes, which matters because one of the clearest use cases for PISCES is letting the staff and early backers of a fast-growing private company cash out part of their stake without forcing the whole business onto a public market.

The venues are live

This is no longer theoretical. The London Stock Exchange was approved to run its Private Securities Market as the first PISCES operator in August 2025, and JP Jenkins followed in November 2025. By April 2026 Asset Match and Vestd had both been approved, taking the number of live operators to four, and the first trades had taken place on the London Stock Exchange's venue during 2026. The infrastructure the government wanted now exists and is running.

The open question is whether it feeds the pipeline

What no one can yet answer is whether PISCES does the job it was built for. The case for it is that a controlled, intermittent venue gives founders and early investors a pressure valve, some liquidity without the cost, scrutiny and loss of control of an initial public offering, and that companies which can offer that will stay in Britain and eventually list here rather than drifting to private-equity buyouts or overseas markets. The case against is that the same features that make PISCES attractive to companies, the ability to switch trading on and off, to choose the buyers and to keep disclosure private, are the ones that make a genuine, liquid, price-discovering market hard to build. A venue that trades only when the company wants it to, at a price the company can bound, may prove to be a comfortable permanent halfway house rather than a stepping stone to a full listing.

The sandbox structure means the government has built that uncertainty into the design. PISCES has until 2030 to show that it channels companies towards public markets rather than parking them just short of one. The plumbing is in place and the operators are open. Whether the shares actually flow, and whether the flow leads anywhere, is the thing the next four years will decide.

Sources: the Financial Services and Markets Act 2023 (Private Intermittent Securities and Capital Exchange System Sandbox) Regulations 2025 (SI 2025/583), establishing PISCES as a regulatory sandbox running to 5 June 2030 with a Treasury report to Parliament at its close; the FCA's final rules PS25/6 (June 2025) and the PISCES sourcebook, setting the framework for intermittent trading events, company control over timing, participant eligibility and price parameters, core disclosure requirements and restrictions on retail participation; HM Treasury secondary legislation exempting PISCES transactions from stamp duty and stamp duty reserve tax in line with the AIM exemption, and the government technical note on the tax treatment of employees trading shares on PISCES; and FCA approvals of PISCES operators, the London Stock Exchange's Private Securities Market (August 2025), JP Jenkins (November 2025), and Asset Match and Vestd (April 2026), with first trades taking place on the London Stock Exchange's venue during 2026.

A Third of UK Bank Reserves Now Come From Borrowing, Not From Bond Purchases. The Bank of England Calls That the Plan.

2026-09-13T08:15:00.000Z

On 2 September the Bank of England was lending British banks £208.7 billion against government-bond collateral. That is £124.8 billion through the weekly short-term repo and £83.9 billion through the six-month indexed long-term repo, set against a total reserves stock of £643.7 billion. Close to a third of the central bank money in the UK banking system now exists because a commercial bank pledged collateral and asked for it.

None of that is a malfunction. It is the design. What the numbers also show, and what the Monetary Policy Committee will vote on again on 17 September, is that a year of quantitative tightening has changed the composition of the Bank's balance sheet without meaningfully changing its size.

The stock that would not fall

In March, Victoria Saporta, the Bank's executive director for markets, set out where the transition had reached. The most recent survey of banks put the preferred minimum range of reserves, the level below which the system starts to feel scarcity, at £365 billion to £515 billion. Reserves at that point stood at around £640 billion. "Repos now supply around a quarter of reserves," she wrote.

Six months later reserves stand at £643.7 billion. They have not fallen. The repo share has risen to roughly 32 per cent.

That is the whole story in two numbers. Quantitative tightening drains reserves by taking gilts off the Bank's books. The Term Funding Scheme, which peaked at £193 billion in 2021 and is down to £41.8 billion, drains them as banks repay. Both ran through the period. Reserves are flat, because the banking system borrowed back roughly what the two of them removed.

The records were never a stress signal

The weekly repo has produced a run of headlines. Allotments hit £75.65 billion in August 2025, £100.9 billion in January 2026, and £122.9 billion by early June. Each was reported as evidence that liquidity was tightening.

Read the facility's terms and a more precise reading emerges. The short-term repo is full allotment against Level A collateral, meaning any eligible bank that turns up with qualifying gilts gets as much cash as it asks for. It is priced at Bank Rate. Reserves are remunerated at Bank Rate. In pure carry terms, borrowing reserves through the window costs a bank close to nothing.

What a record allotment measures, then, is willingness rather than scarcity. Banks are not paying up for liquidity. They are choosing to hold reserves rather than gilts, at a price that makes the swap almost free, and the Bank is happy to accommodate them because that is precisely the demand-driven system it has spent four years building. More than 30 firms bid in a typical short-term repo. Around 80 use the indexed long-term facility.

The signal in the numbers is not distress. It is that the distribution of reserves, not the aggregate, is what now determines whether the system feels comfortable, and the aggregate is the number the framework still reports.

What the September vote is actually about

The MPC set the current envelope a year ago, voting 7-2 to reduce the stock of gilts held in the Asset Purchase Facility by £70 billion over the twelve months to September 2026, down from £100 billion the year before. About £21 billion of that was to come from active sales. The rest was maturities.

The split matters more than the headline. In the first quarter of 2026, gilt redemptions took £19.8 billion off the pile. In the second, five sale operations removed £6.1 billion. Active selling, the part that draws gilt-market commentary and Treasury Committee questions, is the smaller lever by a wide margin. The Bank's loan to the Asset Purchase Facility stood at £521.8 billion on 2 September, against a path the MPC set toward roughly £488 billion.

The Bank's own Market Participants Survey, published on 31 July, showed respondents expecting the envelope to fall again, to £50 billion for the year to September 2027, with sales weighted 43.3 per cent to the three to seven year bucket, 41.1 per cent to seven to twenty years and 15.6 per cent to longer maturities.

On the framework's own arithmetic there is room. Reserves at £643.7 billion sit about £129 billion above the top of the preferred minimum range. On the composition, the transition is already most of the way done. The committee is choosing a pace for something that has, in practice, already happened.

Tenor, not size

The change worth watching is what the balance sheet is made of. A gilt portfolio is an asset the Bank owns outright, with a maturity profile measured in years and no counterparty. A repo book is a loan that has to be rolled. The short-term facility resets every week.

That shifts the point of failure. Under the old arrangement, reserves existed whether or not banks did anything. Under the new one, they exist because firms turn up on Thursday with collateral and the operational capacity to use it. Saporta's message was blunt about the implication: "in this evolving liquidity environment, resilience hinges on firms maintaining the operational readiness to repo confidently." Firms, she wrote, must remain "ready to repo".

It also changes what the Bank is. Over the QT period it has sold gilts into the market and then lent reserves against gilts pledged back to it. The institution is becoming a secured lender to the banking system on a scale it has not run since before quantitative easing, and it is doing so at a moment when the rate decision itself is contested. Bank Rate has been held at 3.75 per cent through the summer, and the July meeting split 6-3, with three members preferring a rise to 4 per cent after a 7-2 hold in June. The debate on rates is about whether to go higher; the debate on the balance sheet is about what shape it settles in.

Three markers will tell you more than the September envelope. Whether the repo share of reserves passes 40 per cent. Whether the indexed long-term facility, which takes wider collateral for six months, grows faster than the weekly window, because that would signal genuine term funding need rather than convenience. And whether the Bank revises its preferred minimum range again, having already cut it from a £375 billion to £540 billion range down to £365 billion to £515 billion.

The size of the balance sheet is the number in the vote. The tenor is the number that matters.

The Bank of England Decides on a Digital Pound This Year, After Telling Banks to Build the Alternative

2026-09-12T08:15:00.000Z

Some time before the end of this year, the Bank of England and HM Treasury will publish three documents at once: a detailed blueprint for a retail digital pound, a joint assessment of the case for building it, and a decision on next steps. The Bank's most recent progress update, published on 4 March 2026, put it plainly. The design phase ends in 2026, and the blueprint, the assessment and the decision "later this year" come as a package.

That is the moment the project has been travelling towards since the February 2023 consultation paper, which drew more than 50,000 responses, and the joint response the Bank and the Treasury published in January 2024. What has changed in the intervening three years is not the design work, which has proceeded on schedule, but the question the design work is meant to answer.

What the design phase actually produced

The Bank has built the machinery it said it would. The Digital Pound Lab, launched in August 2025, gave firms an experimental platform on which to test use cases and business models rather than argue about them in consultation responses. Phase 1 took four participants: Fluxpay, LINK working with Consult Hyperion, NOBO Finance with Applied Blockchain, and Yotra. Their showcase ran in January 2026. Phase 2 closed for applications on 31 March 2026 and ran through to July.

The blueprint itself is organised around four components: product strategy, scheme and regulation, technology, and operations. The architecture has not moved either. The Bank would run a core ledger; private firms would provide the wallets. Nobody would hold an account at Threadneedle Street. A holding limit would apply, set high enough, the Bank says, for day to day spending.

None of that is a decision to issue. The Bank has been consistent that a decision to proceed would trigger a further public consultation, then primary legislation, then a vote in Parliament. On the Bank's own timetable, the earliest a digital pound could be issued is the second half of this decade.

The Governor's objection

The difficulty is that the most senior sceptic works at the Bank. Speaking at the National Bank of Ukraine's annual research conference in Kyiv on 20 June 2025, Governor Andrew Bailey set out a position he has not retreated from since.

"I remain to be convinced that we need to create new forms of money, such as Central Bank Retail Digital Currency, to achieve this," he said. And more pointedly: "I am not against Central Bank Retail Digital Currency, but I question why it is needed if innovation proceeds as I think it should."

His preferred route was explicit in the same speech. The buzzword, he said, is tokenised deposits, "really it is the application of digital technology to the form of money that we have today", and "I do think commercial banks need to step up to the challenge of digital money provision."

That is a conditional objection rather than a veto, and the condition is now largely satisfied. Which is the awkward part.

The alternative got built first

Sarah Breeden, the deputy governor who leads this work, used a City Week speech in May 2026 to describe the destination as a "multi-money system that promotes competition and choice between robust forms of money", one in which "a pound is a pound, whoever issues it". In that system, households pay with traditional bank deposits, tokenised bank deposits, regulated stablecoins and, she said, "potentially, a retail central bank digital currency". The retail digital pound is the fourth item on a list, and the only one still awaiting a decision.

The other three have infrastructure and dates. RT2, the rebuilt core of the real time gross settlement system, had been live for a year by the time Breeden spoke. Settlement hours are on track to extend from 12 to 16 and a half each working day next year, with consultation under way on something closer to continuous operation. A synchronisation service that lets assets move conditionally against central bank money is targeted for 2028. The Bank now chairs a Retail Payments Infrastructure Board charged with designing the next generation of the rails that carry salaries and online banking. Sixteen firms, among them Euroclear, HSBC and London Stock Exchange Group, are preparing to launch in the Digital Securities Sandbox, which runs until January 2029.

The most consequential piece is the private money rulebook, and it is landing on almost exactly the same timetable as the CBDC decision. On 22 June 2026 the Bank published a policy statement and a draft Code of Practice for sterling systemic stablecoins. Comments close on 22 September 2026, ten days from now. The Bank intends to finalise the Code by the end of 2026, with regulated stablecoins able to operate from 2027.

The draft terms tell you how much residual nervousness there is. Each systemic stablecoin faces a temporary issuance guardrail, initially set at £40bn. Issuers may hold up to 70 per cent of their backing assets in short term UK government debt, with the remaining 30 per cent in central bank deposits. Bailey's own test for private money in Kyiv was that it "must provide assurance of nominal value and pass the test of singleness of money". The guardrail is what that test looks like when it is written down as a rule.

Why the verdict is harder than it looks

Parliamentary scepticism is not new. The Lords Economic Affairs Committee decided in 2022 that it had yet to hear a convincing case for a retail CBDC, and the Commons Treasury Committee thought so little had changed by 2023 that it titled its own report "The digital pound: still a solution in search of a problem?" Both wanted the Bank to keep asking why to do it rather than sliding into why not.

The trap is that the reverse question is now the live one. If tokenised deposits and licensed stablecoins carry a growing share of everyday payments, the singleness of the pound stops being a design assumption and becomes a supervisory workload, enforced coin by coin through caps, reserve rules and branding requirements. A digital pound is one answer to that, an anchor issued by the central bank and available to everyone. The rulebook published in June is a different answer, and a more laborious one.

So a decision to proceed would commit the Bank to years more work for an instrument its Governor has questioned. A decision not to proceed, or to hold the option open without building, leaves the Bank supervising a monetary system in which the anchor for retail payments is a set of conditions imposed on private issuers rather than a liability of the state.

Neither is a comfortable sentence to publish. Both will be in the assessment.

The UK Moved Its Frontier-AI Testers Into the Prime Minister's Office. There Is Still No AI Law for Them to Apply.

2026-09-11T08:15:00.000Z

The AI Security Institute's website still describes it as "a research organisation within the UK government's Department for Science, Innovation and Technology." That department was closed on 21 July 2026. The page was live and unchanged this week.

It is a small thing, and it is also an accurate description of what happened. Britain moved the body that tests frontier AI models from a sponsoring department into the centre of government, gave artificial intelligence a seat at the Cabinet table, and changed nothing whatsoever about what any AI system in the country is legally required to do.

Where everything went

Prime Minister Andy Burnham abolished the Department for Science, Innovation and Technology on 21 July and split its work three ways. Science and innovation went to a new Department for Business, Innovation, Science and Trade. The digital brief, including the Government Digital Service, telecoms and digital identity, went to an enlarged Department for Digital, Culture, Media and Sport. AI strategy, public-sector AI adoption and the AI Security Institute went to the Cabinet Office, inside the Office for the Prime Minister and the Cabinet.

Kanishka Narayan, previously the AI minister at DSIT, became Minister of State for Artificial Intelligence across the Cabinet Office and the new business department, attending Cabinet.

Three days later the government appointed Lord Vallance to chair a new Prime Minister's AI Taskforce, sitting in the same office alongside No 10 and core Cabinet Office functions. The taskforce reports to Cabinet Secretary Antonia Romeo and to Narayan, with Vallance reporting directly to the Prime Minister. The announcement confirmed that "responsibility for the existing AI Security Institute will move to the Office for the Prime Minister and the Cabinet."

"AI is rapidly changing our world and we need to make sure it works for everyone," Burnham said. Vallance said the potential "to transform public services, drive growth and improve people's lives is immense."

The audience changed, not the work

The institute's technical programme is unaffected by any of this. It runs pre-deployment evaluations of frontier models under agreements with the labs, publishes methodology, and funds outside research.

Its Frontier AI Trends Report gives a sense of what that produces. Performance in some measured domains is doubling roughly every eight months. On chemistry and biology benchmarks, models now exceed PhD-level expert baselines by as much as 60 per cent. On cyber tasks, a model first completed work rated at expert level, meaning ten or more years of experience, in 2025, having been at apprentice level in 2023. Success on hour-long software engineering tasks rose from under 5 per cent in late 2023 to above 40 per cent. Self-replication success rates went from 5 per cent to 60 per cent over the same period. Universal jailbreaks were found for every system tested, though some providers had raised the expert effort needed to breach safeguards fortyfold in six months.

That is capability measurement. It is not compliance measurement, because there is nothing to comply with. The UK has no AI Act. As of the middle of this year no AI Bill sat before Parliament. Testing happens because companies agree to it.

So the question of where the institute sits is not administrative. Evaluation output is an input to a decision, and the location determines whose decision. Inside DSIT it informed a department writing technology policy and sponsoring regulators. Inside the Office for the Prime Minister and the Cabinet it informs the centre, next to national security assessment and public-service delivery. The same cyber capability finding lands on a different desk and gets used for a different purpose.

Where Britain does legislate, it legislates by framework

The counterexample is in the Lords. The Cyber Security and Resilience (Network and Information Systems) Bill, which updates the 2018 NIS Regulations, reached committee stage on 1 September after clearing the Commons and completing second reading on 14 July. Royal Assent is expected late this year.

The duties are not. The Bill brings managed service providers, data centres and designated critical suppliers into scope for the first time, sets a 24-hour initial incident notification with a fuller report at 72 hours, and carries penalties of up to £17 million or 4 per cent of global turnover. But the thresholds, the definitions and most of the substance sit in secondary legislation that follows a government implementation consultation, with practical effect not expected until around 2028.

The Lords Delegated Powers and Regulatory Reform Committee took a view on that approach in its seventh report of the session, published on 21 July. It drew attention to powers allowing ministers to amend the Bill itself by statutory instrument, including a power over the procedure for issuing codes of practice, recommended that one such power be removed altogether and that another be narrowed so it could not be used to amend Acts passed in future sessions. On an early clause it concluded that ministers were seeking a power before either the problem or the required policy response had been identified, and recommended its removal.

Two instruments, one pattern. Where Britain regulates technology, it passes a frame and fills it later by regulation. Where it does not regulate, it builds institutions and moves them.

What it means for firms

The practical consequence is a split between capability and authority. The bodies that can fine you over an AI system are the sector regulators: the Financial Conduct Authority, which has been explicit that it will supervise AI through existing rules rather than write new ones, plus Ofcom and the Information Commissioner. The body that can characterise what a model is actually able to do now sits with the Prime Minister's office. No statute connects them.

The Institute for Government, writing on 24 July, warned that the split risks losing focus, expertise and coordination, noting that three departments now have to work out their respective roles and that the change largely reverts to the arrangements that existed before 2023. Machinery-of-government changes are not free.

Three things to watch. Whether an AI Bill appears in the next King's Speech, which would finally give the evaluations a statutory hook. Whether the institute keeps publishing openly now that it reports through the centre rather than a department. And whether the cyber bill's secondary legislation slips further, having changed sponsoring department halfway through its passage.

Until then, the most consequential AI oversight capability in British government is a research team with no rulebook, a new address and an out-of-date job description.

Britain's Cyber Agency Told Firms to Treat AI Agents Like Untrusted Insiders, Not Tools

2026-09-10T08:15:00.000Z

Britain has no law that tells a company how to deploy an autonomous AI agent. Its cyber security authority has, over the course of 2026, written the controls anyway, and the instruction underneath them is blunt: treat the agent as something that will, at some point, do something nobody asked it to.

That is the through-line of a cluster of guidance from the National Cyber Security Centre, the defensive arm of GCHQ. On 20 August the NCSC published a technical blog, Managing the cyber risk of agentic AI, setting out how organisations should contain systems that can access data, make decisions, use tools and take actions towards a goal without a human in the loop for every step. It followed a 15 May post, Thinking carefully before adopting agentic AI, and a joint international guide, Careful Adoption of Agentic AI Services, that the NCSC co-signed on 1 May alongside cyber agencies in the United States, Australia, Canada and New Zealand.

Controls built for an insider you do not trust

The August guidance is not written in the language of AI ethics or model safety. It is written in the language of network defence, and the controls it names are the ones a security team would apply to a privileged account it did not fully trust.

Least privilege comes first: an agent should hold only the permissions it needs, and no more. Scope should be constrained to the resources required for the task, with monitoring for any attempt to reach wider access. Credentials should carry "the shortest possible lifetime", so a compromised or misbehaving agent cannot keep acting on stale authority. The default network posture the NCSC recommends is to deny all inbound and outbound traffic to the agent's environment and open only what is needed. And then the line that reframes the whole exercise: agentic activity "should be treated as a form of user activity" and folded into 24/7 security monitoring and incident response, with early experiments run during office hours when a human is watching.

Put together, that is not a description of a tool. It is the profile a security team builds for an insider whose behaviour it cannot fully predict. The named risks make the point explicit: unsanctioned or unintended actions, escape from a sandbox through a misconfiguration, data access beyond the intended scope, and goals pursued in ways the operator did not mean because the instruction was read too literally.

A deployment gate, not a checklist

The May post supplies the governance rule the controls hang from. Its message is that firms should "walk before they run", starting with tightly bounded pilots on low-risk tasks, and its sharpest sentence functions as a veto: if you cannot understand, monitor or contain an agent's actions, it is not ready to deploy. Accountability for the decision to deploy, for the access an agent is granted, and for the consequences of its actions stays with a human. None of it can be handed to the model or the vendor.

That is where security guidance quietly becomes governance. The United Kingdom has chosen not to legislate a bespoke AI regime, preferring principles and existing law to a rulebook. The European Union went the other way, classifying AI used in areas such as credit and insurance as high-risk under its AI Act, though it has since pushed the hardest of those obligations back to December 2027. In the gap the UK has left, the operative constraints on how an autonomous agent may be let loose inside a corporate network are the ones the NCSC has written, and because six national agencies published a common version of them, they carry the weight of an emerging international standard rather than one country's advice.

The NCSC's leadership has been raising the temperature in parallel. In a 4 August statement responding to incidents in which frontier models took unsanctioned actions during evaluations, and showed what it called human-like deceptive behaviour, chief technology officer Ollie Whitehouse warned that "relying on detection alone after the fact of an incident will not be enough". The controls, in other words, are meant to sit in front of the agent, not behind it.

Why this lands on boards, not just security teams

For UK firms, the practical shift is in where the accountability sits. An organisation that treats agent adoption as an IT productivity decision is reading it in the wrong department. The NCSC's framing pulls the choice up to the level of risk ownership, and for regulated firms that ownership already has a name. Under the Senior Managers and Certification Regime, a named individual owns the function an agent would operate inside, and cannot delegate that responsibility to software. The Consumer Duty asks firms to evidence good outcomes however a decision is reached. Data protection law attaches to whatever the agent touches. The security guidance does not create those duties, but it describes, in operational terms, what discharging them now looks like when the actor is autonomous.

The complicating factor is that much agent use will not be sanctioned at all. The NCSC's own guidance on shadow IT, refreshed in 2026 to cover what it calls shadow AI, warns that staff routinely reach for unapproved tools when the sanctioned ones fall short, turning an unmanaged tool into an unmanaged risk. An agent wired into a corporate mailbox or code repository without least privilege, short-lived credentials or monitoring is precisely the profile the August controls are meant to prevent, and precisely the one a productivity-first rollout produces.

What to watch

The signal to track is whether this guidance hardens, as supervisory expectations tend to, into something firms are effectively audited against: in procurement questionnaires, in insurers' underwriting, in the assurance a board's own risk committee demands before an agent is switched on. The NCSC has pointed firms towards ETSI EN 304 223, a baseline security standard for AI systems, as the technical floor. None of it is law. But a firm that deploys an agent it cannot contain, after the country's cyber authority has spelled out how to contain it, will find that "the guidance was not mandatory" is a weak defence when the agent does the thing nobody asked.

The FCA Will Judge Firms' Live AI in 2027 Without a Single New AI Rule

2026-09-09T08:15:00.000Z

Britain's financial regulator has eight firms running live artificial intelligence inside real UK markets, and it has told them there will be no AI rulebook to follow.

The Financial Conduct Authority opened the second cohort of its AI Live Testing programme to applications between 19 January and 24 March 2026, and testing began in April. The participants are a deliberate mix of incumbents and challengers: Barclays, Lloyds Banking Group through its Scottish Widows arm, UBS and the credit-data group Experian, alongside the payments firm GoCardless and the smaller technology names Aereve, Coadjute and Palindrome. Their tests run to the end of 2026, and the FCA will publish an evaluation report in the first quarter of 2027.

AI Live Testing sits inside the FCA's AI Lab and answers the government's AI Opportunities Action Plan, published in January 2025. The idea, set out in an engagement paper on 29 April 2025 and confirmed in feedback statement FS25/5, is that firms can put a model into live use with customers or markets while working directly alongside the regulator's supervisory and technical teams. The FCA has brought in an outside specialist, the London assurance firm Advai, to help stress-test the systems. A first cohort was assembled after applications closed on 15 September 2025.

The rulebook that is not being written

The striking part is not the sandbox. It is what the FCA has decided to do instead of legislating. In its response to the Prime Minister's letter to regulators on growth, the FCA said it would avoid additional rules for AI and rely on the frameworks it already has. There is no draft AI chapter of the Handbook, no risk-tiering of models, no registration duty for high-stakes systems.

That is a genuine choice, and it is worth naming what carries the weight instead. Two existing regimes do the work. The Consumer Duty, live since 2023, already requires firms to evidence good outcomes for retail customers rather than merely follow a process, which means an AI pricing or advice tool has to be shown to produce fair results, not just to exist. The Senior Managers and Certification Regime supplies the accountability: a named individual owns the function an AI system sits in, and cannot outsource that responsibility to a vendor or an algorithm. Add the FCA's technology-agnostic starting point, that a rule about treating customers fairly applies however the decision is made, and the regulator's claim is that it does not need new law to reach AI.

An evidentiary obligation, not a prohibition

For firms, this shifts the nature of the obligation. The European Union has taken the opposite path. Under the EU AI Act, AI used for credit-scoring and insurance pricing is classified as high-risk and saddled with prescriptive controls, an obligation the bloc's Digital Omnibus package has now pushed back to 2 December 2027 but has not removed. A European lender knows in advance which box its model falls into.

A UK firm gets no such label. What it gets is a standard it must satisfy on results, tested in the open. The message the FCA is sending through Live Testing, and which its supervisors have put bluntly to the banks, is that firms will have to prove their AI works with evidence rather than assurances. That is a lighter touch at the point of deployment and a heavier one afterwards, because the burden of showing that a model is fair, explainable and controlled sits with the firm, continuously, and can be examined at any supervisory visit.

The FCA is also building expectations without a consultation. It has promised a good and poor practice report for AI in financial services later in 2026, on top of the Live Testing evaluation in early 2027. Those documents will not be rules, but they will function as them. A firm that ignores a practice the regulator has publicly branded as poor will struggle to argue it acted reasonably, and supervisory expectation, once written down, tends to harden into a de facto standard that never passed through the formal rule-making the industry can contest.

What to watch

The approach has clear attractions. It is fast, it avoids freezing a fast-moving technology into a static rulebook, and it plays to a genuine strength: the FCA reports a 49 per cent year-on-year rise in applications to its Regulatory Sandbox and Innovation Pathways, evidence that firms want a supervised route to market. For a government chasing growth, a regulator that says yes with conditions is more useful than one that says wait.

The risks sit on the other side of the same coin. Standards set through practice reports and case-by-case supervision are less transparent and less challengeable than rules, and they can drift. Firms operating on both sides of the Channel face two regimes at once: a prescriptive EU classification and a principles-based UK expectation, with no guarantee the two will judge the same model the same way. And the whole design leans on the Consumer Duty and the senior-manager regime bearing weight they were not built to carry for autonomous systems.

The test of the strategy is not the eight firms now inside the sandbox. It is whether, when the evaluation lands in early 2027, the FCA can show that principles plus evidence caught the problems a rulebook would have. Until then, the UK has made a bet that supervision can do the job of legislation. The bill for getting it wrong would be paid in the consumer harm the existing rules were meant to prevent.

Open Banking Won 19 Million Users on Rails the Banks Were Never Paid to Build

2026-09-08T08:15:00.000Z

Open Banking is usually filed under disappointment, a good idea that never quite scaled. The usage figures say something else. By June 2026 Open Banking Limited counted more than 19 million active user connections and more than 40 million open banking payments a month, and over the whole of 2025 payment volumes reached 351 million, up 57 per cent on the year. That is not a plateau. What plateaued was the business case for the banks that were ordered to build the rails in the first place. The government now wants to extend that same model across the economy, and the interesting question is whether it has fixed the thing that actually went wrong.

Open Banking exists because the Competition and Markets Authority told it to. Its 2017 retail banking order required the nine largest current-account providers, the group known as the CMA9, to build and fund a common set of open interfaces so that authorised third parties could read account data and initiate payments on a customer's instruction. The aim was competition: let challengers and fintechs plug into incumbent banks and win customers on service. It worked on its own terms. There are now around 145 third-party providers live in the market, and open banking payments run at roughly one in every thirteen Faster Payments.

The plateau was never in the usage

The problem was who paid. The CMA9 built a piece of shared national infrastructure on their own balance sheets and were given no way to charge for access to it. Every marginal improvement, every new interface, every uplift in reliability was a cost with no revenue attached, so banks had little reason to invest beyond the mandated minimum. The most commercially promising feature, variable recurring payments, shows the strain. Sweeping VRPs, which move a customer's money between their own accounts, are mandated and free, and their volumes nearly doubled over the year to account for around 13 per cent of open banking payments. The non-sweeping, commercial VRPs that could actually replace card payments at the checkout have crawled, because there was no agreed framework to price them. The Joint Regulatory Oversight Committee, run by the Financial Conduct Authority and the Payment Systems Regulator, spent years trying to design a commercial model and a long-term operator to succeed the CMA's temporary arrangements. Open Banking scaled in spite of its economics, not because of them.

What Smart Data actually changes

This is the backdrop to the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. Part 1 of the Act gives the Secretary of State and the Treasury the power, by secondary regulation, to establish Smart Data schemes: to designate the data holders in a sector, and to compel them to share customer data and business data with the customer or with authorised third parties. In finance, the Treasury can empower the FCA to write and enforce the scheme rules. Crucially, the Act does more than repeat the Open Banking compulsion. It provides for scheme operators, for standards bodies, and for the funding of a scheme, including the power to charge fees and levies. In other words it supplies the commercial and governance scaffolding that the CMA order never had. That is the whole bet: mandated participation, but this time with an economic framework attached.

The government set out where it wants to take this in its Smart Data 2035 strategy, published on 2 April 2026. It names ten candidate sectors, from banking and finance to energy, property, telecoms, transport and retail, and targets five or more live schemes by 2030 and twenty or more by 2035, backed by around 36 million pounds of public investment. The four it is pushing hardest, banking, finance, energy and property, are the ones the government reckons could add 9.6 billion pounds a year to output by 2043. For finance, the roadmap points to Open Finance, extending data sharing beyond current accounts into savings, mortgages, pensions and consumer credit. Consultations in banking, energy and property are expected across 2026, with the first regulations likely in 2027 and 2028. Open Finance, in short, is not arriving on its own; it is one lane of a wider Smart Data build-out, and it will be legislated the same way the others are.

What a bank has to do differently

For a bank, this is not a rerun of the free-API compliance project. Three decisions follow. The first is scope: sharing will reach products that have never been exposed through an interface before, from savings and mortgage data to pension and credit information, each with its own consent, liability and data-quality questions. The second is the scheme itself: rather than a regulator-imposed minimum, a bank will sit inside a designated scheme with an operator, agreed standards and, potentially, fees and levies to fund it. The third is strategic: whether to treat Smart Data as a cost of doing business, opening data because the law says so, or as a two-way opportunity, becoming a data user that builds savings, lending and advice propositions on top of rivals' data as well as its own.

That third choice is where the economics finally bite. If the secondary regulations give banks a genuine commercial return, through paid premium interfaces or cost recovery, the rails become an asset worth investing in rather than a compliance line item. If they do not, banks will do the minimum again, and Open Finance will inherit Open Banking's central weakness at a larger scale. The legal power to compel data sharing is now settled. Whether the compulsion produces more than a tick-box exercise depends on the detail of rules that have not yet been written, and the 2026 consultations are where we will find out whether the Treasury has learned from the rails it built the first time.

Sources: Data (Use and Access) Act 2025, Royal Assent 19 June 2025, Part 1 framework empowering the Secretary of State and HM Treasury to establish Smart Data schemes by regulation, designate data holders, and provide for scheme operators, standards and funding, with the Treasury able to empower the FCA to make and enforce financial-sector scheme rules; the government's Smart Data 2035 strategy, published 2 April 2026, naming ten candidate sectors, a target of five or more live schemes by 2030 and twenty or more by 2035, around 36 million pounds of backing, and an estimated 9.6 billion pounds a year of output by 2043 from the priority banking, finance, energy and property schemes; Open Banking Limited figures for June 2026 of more than 19 million active user connections and more than 40 million monthly open banking payments, and 2025 full-year payment volumes of 351 million, up 57 per cent, with sweeping variable recurring payments near 13 per cent of the total and around 145 live third-party providers; the Competition and Markets Authority's 2017 retail banking market investigation order requiring the CMA9 to build and fund open banking interfaces; and the Joint Regulatory Oversight Committee, run by the FCA and the Payment Systems Regulator, on the commercial variable recurring payments framework and the long-term operator for open banking.

Cash-Access Rules Have Opened 230 Banking Hubs and Owe 120 More. What They Guarantee Is Cash, Not a Bank.

2026-09-07T08:15:00.000Z

The rules that were meant to stop Britain running out of cash points will be two years old this month, and by the government's own yardstick they are working: more than 95 per cent of the population now lives within the distances ministers set for reaching cash. The harder question, as the branch network keeps shrinking, is what exactly those rules guarantee. The answer is notes and coins. It is not a bank.

Since 18 September 2024, when the Financial Conduct Authority's access-to-cash regime came into force under powers in the Financial Services and Markets Act 2023, banks and building societies have had to assess the impact before they close a branch or an ATM and, where a significant gap opens up, plug it. In practice that has meant a fast-growing network of shared "banking hubs", run for the industry by Cash Access UK and staffed over the counter by the Post Office, with community bankers from the high-street lenders rotating through by day of the week.

The numbers are real. In the regime's first year, the FCA counted 121 banking hubs opened and 93 new cash deposit services, delivered through ATMs and Post Office counters. Twenty of those hubs came not from a bank closure at all but from communities using the rules to request one. By the House of Commons Library's count there were around 225 hubs operational in March 2026, and by the spring more than 230 were open, with over 275 recommended. The industry and the government have committed to 350 by the end of this parliament. That leaves roughly 120 still to build, and a lengthening list of towns waiting.

That gap between recommended and open is where the promise frays. LINK, the network operator that assesses each community against distance and travel-time criteria, can recommend a hub within weeks of a branch closure being announced. Opening one, finding premises, fitting them out and staffing them, routinely takes many months more. A town can lose its last bank and then wait the better part of a year for the shared counter that is supposed to replace it. For a small business banking its daily takings, or a pensioner who budgets in cash, that interval is not a rounding error.

And what arrives at the end of it is deliberately narrower than what left. A banking hub is not a branch. The Post Office counter handles deposits, withdrawals and balance enquiries; the community banker who can talk through a specific lender's products is typically present one or two days a week, on a rota shared between the banks. There is no mortgage adviser, no business relationship manager, no in-person route through a fraud case or a bereavement. The regime was designed around one measurable thing, access to cash, and it has hit that target. The slower erosion of face-to-face banking that sits alongside it is largely outside the rules.

It is also a floor being poured under a receding tide. LINK's own figures show its network dispensed £76.7 billion across roughly 1.3 billion transactions from about 44,000 ATMs in 2025, both down on the year before as card and mobile payments keep taking share. The FCA reckons about five million people still rely on cash or cannot use digital alternatives, and it is that group, not the national average, that the hubs exist to protect. The uncomfortable read is that Britain is building physical cash infrastructure at pace precisely as the volume flowing through it falls, because the cost of stranding the minority who depend on it is judged too high. That is a defensible policy choice. It is not the same as a healthy branch network, and it should not be mistaken for one.

The criteria themselves invite argument. LINK's assessments lean on distance and travel-time thresholds, which means a community that loses its only bank can still fall short of qualifying for a hub if a branch or a Post Office sits a prescribed distance away, however awkward the journey. MPs have pressed the point through the spring in a run of parliamentary questions and debates on banking hubs and on access to banking services more broadly, and the Treasury has leaned on the 350 commitment as the answer. Whether 350 is the right number, or merely the number that was promised before anyone counted how fast branches would keep going, is a question the rollout has not yet had to confront.

For now the trajectory is set. The Post Office has signed a five-year deal with Cash Access UK to keep running the hubs, which puts the operating model on a durable footing and signals that this parallel network is meant to last, not to bridge a gap until something better appears. That permanence cuts both ways. It guarantees that cash will stay reachable for the people who need it, which is no small thing. It also quietly concedes that the full-service branch, for most of the places that have lost one, is not coming back, and that the shared counter with a banker who visits on Tuesdays is now the settled shape of physical banking across much of the country.

Two years in, the cash-access rules have done the specific job Parliament wrote for them. The mistake would be to read the rising hub count as a sign that Britain's banking presence is recovering. It is a measure of how carefully the state has chosen to manage the decline.

Britain's pension reform can force poor funds to move savers out, but the test and the teeth are still unwritten

2026-09-06T08:15:00.000Z

Britain's biggest pension reform in a decade is now law. The Pension Schemes Act 2026 received Royal Assent in April, after a long passage through the Lords and four rounds of parliamentary ping pong, and the coverage has settled on one word: megafund. The Act pushes the country's defined contribution (DC) savings into a smaller number of vast default funds, on the theory that scale buys lower costs and access to private markets. It is a genuine structural change. It is also not the part of the Act most likely to decide whether a given saver ends up in a good scheme or a bad one.

That question turns on a quieter mechanism, the Value for Money (VFM) framework, and the framework is still being built. Its detailed shape was put out for consultation on 13 July 2026 by the Department for Work and Pensions and the Financial Conduct Authority, and that consultation closed on 1 September. Read alongside the megafund rules, the VFM framework is where the Act grows teeth: the power to rate a workplace pension on value and, if it fails, to close it to new money and move savers out.

Three levers, one Act

The Act rewrites DC pensions around three levers. The first is scale. To keep receiving automatic-enrolment contributions, a DC multi-employer scheme must hold at least £25bn in its main-scale default arrangement by 2030, or £10bn with an approved transition plan to reach £25bn by 2035. The second is value: the VFM framework, which forces schemes to publish standardised metrics on cost, net investment performance and service quality, and to carry a public rating. The third sits on the defined benefit (DB) side, where sponsors of well-funded schemes will find it easier to extract surplus, with the release threshold lowered from the cost of a full insurance buyout to the softer low-dependency funding level.

The megafund lever is the loudest, and the most contested. The Pensions Policy Institute has warned that scale alone does not guarantee better returns, and that herding large funds into similar assets could dampen outcomes rather than lift them. But scale is a blunt instrument. The VFM framework is the precise one, because it is the mechanism that actually judges a fund and can compel it to stop.

What a red rating does

Under the framework, providers and trustees must assess each default arrangement and publish a rating. The design has moved on from a simple traffic light. The latest consultation sets out a four-point scale, from dark green and light green through amber to red. Red is reserved for arrangements whose poor value cannot realistically be improved.

The consequences are the point. A red rating, and in some cases amber, can trigger mandatory action: an improvement plan, closure to new business, and ultimately the transfer of members into a better-value scheme. That last step relies on the new contractual-override powers the Act provides, which let a provider move savers out of a failing default without collecting each individual's consent. This is the enforcement teeth the megafund narrative obscures. It is also a significant shift in the relationship between a saver and their pension, and it is being calibrated in secondary legislation rather than settled in the Act itself.

The teeth are real, but deferred

Here the sceptical reading begins. The power to force underperformers out is real, but it does not bite for years. On the current timetable, master trusts, large single-employer trusts and the biggest contract-based schemes complete their first full assessments in 2028, with all in-scope schemes following from 2029. The consultation is explicit that no formal consequences apply in 2028: closure measures take effect only from the second assessment cycle. A default rated red in its first assessment therefore keeps taking money for a further cycle before the framework can compel it to shut.

Nor is the test settled. The FCA expects to publish its final rules in the first quarter of 2027, with the DWP's response and regulations by January 2027. The metric definitions, the thresholds that separate amber from red, and the weighting between cost, performance and service are precisely what the July consultation reopened. So the honest answer to who gets forced to wind up, and on whose test, is that the test is not yet written, and the first forced exits are years away.

Whose test, and what it rewards

The design choices carry their own risk. A framework that leans heavily on past net investment performance can punish a scheme for a weak recent run and reward one that took on more risk in a rising market, which is not the same as rewarding value. It can also encourage the very herding the PPI cautioned against, as schemes converge on whatever asset mix scores well. The FCA's addition of two green tiers, dark and light, is partly an attempt to stop green being read as a simple pass and to preserve some gradation of quality. Whether four boxes can carry that much judgement is an open question.

The DB surplus lever, meanwhile, is smaller than it looks. The government's own assessment expects only about £8.4bn of surplus to be released over ten years, with half of that going to members through benefit enhancements, leaving roughly £4.2bn for sponsors. It is a useful loosening for well-funded schemes, not a wall of cash.

The Act, then, has set the direction. But the instrument that will decide which savers are protected, and which providers are pushed out, is still on the drawing board, and will not draw blood until the end of the decade.

Primary sources: Pension Schemes Act 2026 (Royal Assent April 2026, UK Parliament, Bill 3982); DWP and FCA joint consultation CP26/25, "The Value for Money Framework" (13 July 2026, closed 1 September 2026); FCA CP26/1, "The Value for Money Framework: Response to consultation, further consultation and discussion paper" (8 January 2026), introducing the four-tier rating; Pensions Policy Institute analysis on megafund scale and returns (2026).

The FCA's Conduct Rules Used to Police Client Money. Now They Reach How You Treat a Colleague.

2026-09-05T08:15:00.000Z

For most of its life, the Financial Conduct Authority's Code of Conduct did a narrow job. It set out how the people who work in regulated firms must handle client money, treat customers, manage conflicts and deal straight with the regulator. From 1 September 2026 it does something the industry has spent a year bracing for: it also governs how you treat the person at the next desk.

The change arrives through a single new rule, COCON 1.1.7FR, confirmed in the FCA's policy statement PS25/23, published on 12 December 2025. It makes explicit that serious bullying, harassment and violence toward a colleague are a matter of regulatory concern at every firm inside the Senior Managers and Certification Regime, not only the banks that were already covered. For the large population of non-bank SM&CR firms, from asset managers and insurers to advisers, brokers and payment businesses, that is a genuine expansion of the perimeter rather than a restatement of existing duties.

From employment law to personal accountability

The temptation is to read this as the regulator wading into workplace culture, and much of the early commentary has framed it that way. That misses what actually moved. Bullying and harassment were already unlawful under employment and equality law, enforced through tribunals and internal grievance procedures. What PS25/23 does is pull that conduct into a prudential-style accountability framework built for a different purpose.

Under the new rule, serious non-financial misconduct can now engage the FCA Conduct Rules directly, feed the fitness and propriety assessment that decides whether an individual can hold a regulated role, trigger conduct-breach reporting to the regulator, and surface in the regulatory reference that follows a person from firm to firm. A tribunal deals with an employer and an employee. The SM&CR machinery deals with an individual's standing to work in financial services at all, and it is portable across the industry.

That is the structural story. A financial regulator has annexed territory that used to sit squarely in employment law and wired it into the same personal-accountability plumbing it uses for mis-selling and market abuse. The question of whether someone is "fit and proper" now has a behavioural dimension that a poor reference can carry from one employer to the next.

Where the line sits, and where it blurs

The scope is not unlimited, and the boundaries are where the practical difficulty lives. The rule bites where there is a sufficient connection to the person's work, and, for non-banks, where either the individual accused or the individual affected works in the part of the business that deals with financial services. It captures serious bullying, harassment and violence toward colleagues. It does not, for non-banks, sweep in the full range of Equality Act conduct such as discrimination or victimisation in the way the regime already does for banks, leaving a deliberate asymmetry between the two populations.

Two words carry a lot of weight: "sufficient" and "serious". A regulator that used to draw bright lines around client-asset segregation is now asking firms, and ultimately itself, to decide where ordinary workplace friction ends and reportable misconduct begins. The FCA has published guidance alongside the rule precisely because that judgment is hard, and the industry asked for it: of the small pool of respondents to the consultation, an overwhelming majority wanted more detail before the switch flipped. Firms that get the threshold wrong risk two opposite failures, over-reporting minor disputes into someone's permanent regulatory record, or under-reporting conduct that later resurfaces in an enforcement case.

What firms have to build

The compliance task is not a new poster in the staff kitchen. It is a set of connected processes that most non-bank firms have never had to run for this kind of conduct. They need a way to decide when a workplace incident crosses into a Conduct Rule breach, a route to report certified and senior staff breaches to the FCA, a fitness and propriety process that can weigh non-financial matters without collapsing into either leniency or overreach, and reference-writing practices that capture the new ground truthfully without inviting defamation claims.

For firms that already operate to the banking standard, the marginal change is modest. For the far larger group of solo-regulated firms that have treated conduct rules as a client-facing discipline, this is a cultural and operational shift landing at the same time as a stack of other 2026 obligations. It also raises a governance question for boards: senior managers carry personal responsibility for the areas they run, and a persistent failure to deal with bullying in a team is now something a supervisor can ask a named individual to account for.

The perimeter question

The broader significance is about direction of travel. The FCA has spent recent years pushing personal accountability deeper into the firms it oversees, from the Senior Managers regime to the Consumer Duty's demand that outcomes, not processes, be evidenced. Extending conduct rules to how staff treat each other is of a piece with that. It treats internal culture as a supervisory signal rather than a private employment matter, on the theory that firms which tolerate abusive behaviour internally are likelier to cut corners with customers and markets.

Whether that theory holds will not be visible for some time. There is no published data yet on how many non-financial-misconduct breaches the wider population will report, how consistently firms will apply the "serious" threshold, or how often the new ground will actually change a fitness decision. What is already clear is that a line has moved. From this month, the conduct that can cost a financial-services professional their ability to work in the industry is no longer only about the money. It is also about the people they work alongside.

Basel 3.1 Reaches UK Banks in January 2027 on Terms the US and EU No Longer Share

2026-09-04T08:15:00.000Z

The capital framework that was supposed to make big banks look the same the world over is, in Britain at least, now settled. In January 2026 the Prudential Regulation Authority published its final Basel 3.1 rules, policy statement PS1/26, confirming a start date of 1 January 2027 for the last major tranche of the reforms built after the 2008 crisis. The date matters less than the company Britain now keeps. On the two questions that decide how much capital a bank must hold against its loans and its trading positions, the United Kingdom, the United States and the European Union have stopped moving in step.

Basel 3.1 is the closing instalment of the standards drawn up in Switzerland by the Basel Committee, the club of banking supervisors that sets the global baseline. Its purpose is to stop banks using their own internal models to flatter their capital requirements, and to make risk weights, the figures that translate a loan into a capital charge, more consistent from one bank and one country to the next. That was always the point: a level field, so that a mortgage or a corporate loan attracted broadly the same capital in London, New York and Frankfurt. Three years of political weather have pulled that ambition apart.

What Britain has actually signed up to

The centrepiece is the output floor. It sets a hard limit on how far a bank's own models can cut its capital requirement below the level the standardised rules would produce. The PRA has kept the floor at its fully loaded 72.5 per cent, phased in over a transitional period that runs to the end of the decade, so that from 2030 no bank using internal models may calculate a requirement lower than 72.5 per cent of the standardised figure. Around that sit reworked credit-risk rules that reset the risk weights on mortgages, corporate lending and other exposures, including a loan-splitting method for residential property that ties the charge more closely to the loan-to-value ratio.

One piece has been held back. Firms will not be allowed to use their own models for market risk, the trading-book regime known as the Fundamental Review of the Trading Book, until 1 January 2028, a year after the rest of the package goes live. Until then they fall back on the standardised market-risk approach. And the smallest deposit-takers largely sit outside all of it: the PRA runs a separate, deliberately simpler regime for its Small Domestic Deposit Takers, so the full Basel 3.1 machinery lands on the larger banks and building societies rather than on every firm in the country.

Where Washington went

When American regulators unveiled their version, the so-called Basel III endgame, in July 2023, it was expected to raise capital at the largest US banks sharply. It never survived contact with the industry. After sustained lobbying and a change in the political climate, the proposal was pulled back, and in March 2026 US regulators re-proposed a substantially lighter package. There is still no confirmed implementation date. The country that hosts the world's biggest banks has, in effect, reopened the very question the Basel Committee believed it had closed, and no one can yet say where American capital requirements will land.

Where Brussels blinked

The European Union wrote Basel 3.1 into its CRR III and CRD VI legislation and began phasing the rules in from 2025. But on the trading book it lost its nerve. The European Commission has twice postponed the market-risk rules, most recently to 1 January 2027, and at the end of 2025 it consulted on temporary measures, including a possible multiplier to soften the capital impact, to apply from 2027 to 2029. Its stated reason was candid. With the United States uncertain and the United Kingdom shifting to a 2027 start, imposing full market-risk capital on EU banks first would leave them at a competitive disadvantage on their trading desks. Brussels, in other words, delayed a Basel rule explicitly because London and Washington were out of line.

Why the divergence is the story

This is where a technical timetable becomes a strategic one. One framework now runs on three clocks and three calibrations. For the City, a finalised rulebook is genuinely an asset: banks and their investors know what the rules are and when they bite, which is more than can be said in Washington, or, on market risk, in Brussels. Since 2023 the PRA has carried a secondary objective to support the competitiveness and growth of the UK economy, and it has leaned on that to trim some of the harsher edges of the international standard for British circumstances while keeping the aggregate capital impact modest. Certainty, the regulator argues, is itself a form of competitiveness.

The counter-argument is that certainty is worth less when your rivals are holding less capital against the same risks. A global bank operating in all three jurisdictions must now run parallel sets of numbers, reconciling a finalised UK regime, an EU version with a softened trading-book charge, and an American package that does not yet exist. The operational cost of that fragmentation is real, and it falls hardest on exactly the large, internationally active firms Basel 3.1 was written to discipline.

What to watch

The next eighteen months are about readiness and resolve. Through 2026 UK firms have to finish building and testing for a January 2027 switch, with the market-risk models following a year later. The open questions sit abroad: whether the United States ever lands a final rule, and whether the EU's temporary market-risk relief quietly becomes permanent. If Washington stays soft and Brussels keeps extending, Britain could end up the strictest of the three on precisely the parts of Basel 3.1 it chose to implement first. That would be an odd destination for a set of rules whose whole promise was that everyone would arrive at the same place.

Sources: Prudential Regulation Authority policy statement PS1/26, Implementation of Basel 3.1: final rules (January 2026), confirming a 1 January 2027 implementation date and the fully loaded 72.5 per cent output floor phased in to 2030; Bank of England news release announcing the delay of Basel 3.1 implementation to 1 January 2027; PRA near-final policy statement PS9/24 on the output floor, credit risk and disclosure; the PRA's deferral of the market-risk internal models approach to 1 January 2028 and its Small Domestic Deposit Takers regime for smaller firms; the United States Basel III endgame proposal of July 2023 and the re-proposed package of March 2026; European Commission implementation of Basel 3.1 through CRR III and CRD VI, its postponement of the Fundamental Review of the Trading Book market-risk rules to 1 January 2027, and its end-2025 consultation on temporary relief from 2027 to 2029.

Buy Now Pay Later Became Regulated Credit in July, Giving 11 Million UK Users New Protections

2026-09-03T08:15:00.000Z

Britain's largest unregulated corner of consumer lending is regulated now. Since 15 July 2026, any company offering buy-now-pay-later credit in the UK has been operating under the Financial Conduct Authority's consumer-credit rules, and the eleven million people who use the product have acquired a set of statutory protections they did not have before. The change did not come with a bang: there was no single press release, no court filing, no public crisis. There was a registration window, a temporary permissions regime, and a go-live date that has already passed. Weeks into the new era, the framework is live and its mechanics are worth understanding.

BNPL, formally defined in UK legislation as deferred payment credit, grew from a marginal product into a mainstream one over a short period. A market worth around sixty million pounds in 2017 had reached over thirteen billion pounds in outstanding balances by 2024. That growth happened outside the regulatory perimeter that governs traditional consumer credit, which meant that the firms offering it were free of the affordability and disclosure requirements that apply to a personal loan or a credit card, and that borrowers had no right to take a complaint to the Financial Ombudsman Service if something went wrong. That combination drew sustained attention from debt-advice charities, consumer groups and Parliament. The legislation to close the gap was eventually made, and July 2026 was the date set for the FCA to begin supervising the sector.

What the rules now require

The protections that took effect on 15 July map onto the framework that applies to other consumer-credit products. Lenders must give borrowers clear, upfront information about their agreement, setting out when payments fall due, how much each instalment will be, and what happens if a payment is missed. That sounds basic, but it was not a legal requirement before: BNPL providers had wide latitude over how and when they disclosed the terms of an arrangement.

Affordability checks are now compulsory in proportion to the credit being offered. A lender must satisfy itself that a customer can repay before extending credit, and must be able to demonstrate that process to the regulator. The threshold for a proportionate check on a small BNPL transaction at checkout is not the same as for a five-thousand-pound personal loan, but some assessment is required, and the FCA has made clear that a box-ticking exercise will not satisfy the Consumer Duty, the cross-sector standard of consumer outcomes that BNPL firms are now also bound by.

When a borrower gets into difficulty, firms must now offer support and, where appropriate, direct them to free debt advice. That obligation closes a gap that was particularly sharp in BNPL: a product used disproportionately by younger consumers and by people who are already financially stretched, many of whom had no formal channel to raise a complaint or seek help when repayments went wrong.

The most visible new right is access to the Financial Ombudsman Service. Before regulation, a BNPL customer who believed they had been treated unfairly had no statutory ombudsman route; their only options were the firm's internal complaints process or the civil courts. Since 15 July, a complaint that the firm does not resolve to the customer's satisfaction can be referred to the Ombudsman. The FOS has the power to award compensation of up to the relevant consumer-credit limit. That is a meaningful shift in leverage for a borrower in a dispute.

The firms in the new regime

The FCA set a registration window between 15 May and 1 July 2026. Firms that registered before the deadline received temporary permissions, allowing them to continue offering BNPL while they pursue full authorisation. Those that did not register cannot enter new deferred-payment credit agreements. Among those confirmed as operating under temporary permission are Clearpay, one of the largest providers by customer numbers, and a range of smaller lenders. Fifteen firms received temporary permission approval in the initial cohort.

Full authorisation is not a rubber stamp. It requires a firm to meet the FCA's threshold conditions, demonstrate that it has the people, systems and financial resources to operate under the consumer-credit regime, and embed the ongoing obligations of the Consumer Duty into its processes. The deadline for completing that process is approximately six months after go-live, which means that by January 2027, every firm currently operating under temporary permission must have obtained full authorisation or exit the market. That is the harder gate the sector now faces: not the July go-live, which the larger players had been preparing for over several years, but the January authorisation crunch.

What changes for borrowers now

For the eleven million people who use BNPL, the practical changes are less dramatic in the short term than the legal shift might suggest. The most common BNPL transaction, a low-value purchase split into three or four instalments over weeks, will look broadly the same at checkout. The difference is in what happens when it goes wrong. A missed payment that previously triggered an escalating series of automated reminders with no formal complaints route now sits inside a regulated framework in which the lender has a documented duty of care and the borrower has a defined escalation path.

Over time the affordability-check requirement is likely to produce the larger change. As lenders build formal assessment into their checkout flows, the product will become harder to access for borrowers who are already over-extended. That is precisely the regulatory intent. Whether it produces the unintended consequence of pushing financially stretched consumers toward unregulated alternatives is a question the FCA has said it will monitor, and it is the space that consumer groups and debt advisers will be watching most closely as the new regime settles in.

The weeks since 15 July are too short for any verdict on outcomes. But the legal framework is in place, the clock on full authorisation is running, and a sector that spent years operating outside the rules that govern comparable products is now inside them.

Sources: Financial Conduct Authority: Regulating Buy Now Pay Later page (go-live date 15 July 2026; temporary permissions regime; definition of deferred payment credit); FCA press release, New protections confirmed for Buy Now Pay Later borrowers (eleven million users; market growth from sixty million pounds in 2017 to over thirteen billion pounds in 2024; transparency, affordability, support and Financial Ombudsman Service access requirements; registration window 15 May to 1 July 2026; six-month TPR window to approximately January 2027 for full authorisation); Consumer Duty framework applying to BNPL firms from go-live; PKF Littlejohn and Grant Thornton regulatory summaries confirming the firm authorisation and registration timeline.

Britain Sets 11 October 2027 for Next-Day Settlement, Moving in Step With the EU and Switzerland

2026-09-02T08:15:00.000Z

The date is now fixed. On Monday 11 October 2027, the United Kingdom will move its cash equity market to a one-day settlement cycle, known as T+1, so that a trade struck on one business day settles the next rather than two days later. The Financial Conduct Authority, the Bank of England and the Treasury have all endorsed the timetable set out by the industry-led Accelerated Settlement Taskforce, and the same date has been chosen by the European Union and by Switzerland. For once, Britain and its nearest capital markets intend to rewire the plumbing of their financial systems on the same morning.

Settlement is the unglamorous back end of a trade: the point at which cash and securities actually change hands. For decades the standard in most markets was T+2, two working days after the deal. Shortening that window to a single day cuts the time during which each side is exposed to the other going bust, and it reduces the collateral that clearing houses demand to cover that risk. The prize is a market that ties up less cash and carries less counterparty risk. The cost is that everything which currently happens comfortably over two days has to be finished in a matter of hours.

Why the coordination matters

The United States moved to T+1 in May 2024, and the switch was widely judged a success in its own terms. But it also left European firms trading American shares caught between two cycles, forcing them to fund dollar positions and source stock across a timing gap that had not existed before. That experience is precisely what the UK, the EU and Switzerland are trying to avoid among themselves. By naming the same first trading date, the three markets that dominate European securities want to spare cross-border investors the funding and foreign-exchange mismatches that a staggered move would create.

For a City that has spent the years since Brexit adjusting to regulatory distance from Brussels, a jointly chosen go-live date is a notable exception. On the EU side the European Securities and Markets Authority has proposed the 11 October 2027 target and is coordinating the change with the European Central Bank and the European Commission through a dedicated industry committee. Switzerland is aligning to the same day. The UK's own preparations are being run by the Accelerated Settlement Taskforce, whose recommendations the government and regulators have adopted.

A code of conduct, not just a deadline

The Taskforce did more than pick a date. Its plan is built around a code of conduct for market participants that confirms 11 October 2027 as the first UK trading day for cash equities settling on T+1, and sets out the scope, timetable and expected behaviours needed to get there. At its centre is a list of twelve critical operational actions across four business areas that firms must complete for settlement to work sustainably on the shorter cycle, alongside twenty-six further actions the code strongly recommends. The message from the industry group is that meeting the date is necessary but not sufficient: the market has to be genuinely ready, not merely live.

The behavioural commitments point to where the strain will fall. The code presses firms to automate standing settlement instructions, the reference data that tells each party where securities and cash should go, so that trades no longer stall on manual keying. It calls for tighter handling of corporate actions and for faster recalls of stock that has been lent out, because a security on loan cannot be delivered into a same-day settlement. Each of these is a familiar source of failed trades today, tolerable under a two-day cycle but far less so when the margin for error shrinks to hours.

The squeeze on the City's back office

For UK firms the practical challenge is one of time zones and time itself. Post-trade processing that currently spills into a second day will have to be compressed into the afternoon and evening of the trade date. Overseas investors buying London-listed shares will need to source the pounds to pay for them faster, tightening the foreign-exchange leg. Fund managers will have to align the settlement of the assets they buy with the cash flows from investors subscribing to their funds. Custodians, clearing houses and the settlement system operated through Euroclear all have to move in concert, because a single weak link produces failed settlements that carry penalties under existing rules.

None of this is optional, and none of it can be left to 2027. The code sets intermediate milestones through 2026 precisely so that testing and automation are in place well before the switch, and the Taskforce has been explicit that the critical actions should be substantially implemented by the end of 2027 rather than crammed into the final weeks. For the City's operations teams, in other words, the countdown has already begun.

What to watch

The headline risk is not the concept, which the American experience has proved workable, but the coordination. Three jurisdictions changing on the same day multiplies the value of getting ready and the cost of falling behind. If UK, EU and Swiss firms reach October 2027 at different states of readiness, the very fragmentation the shared date was meant to prevent could reappear inside Europe. The date is the easy part. The next two years of automating, testing and rehearsing are where the move to next-day settlement will actually be won or lost.

Sources: Financial Conduct Authority statement welcoming the final report of the Accelerated Settlement Taskforce and the UK market's move to T+1, and the FCA's About T+1 settlement page (confirming government, FCA and Bank of England support for a move by 11 October 2027); the Accelerated Settlement Taskforce implementation plan and code of conduct (11 October 2027 first trading date; twelve critical operational actions across four business areas plus twenty-six highly recommended actions; behavioural commitments on standing settlement instructions, corporate actions and stock-lending recalls); European Securities and Markets Authority proposal to move the EU to T+1 by 11 October 2027, coordinated with the European Central Bank and European Commission and aligned with the UK and Switzerland; United States transition to T+1 in May 2024.

UK Mortgage Approvals Rose in June. A Hawkish Bank of England Keeps a Rate Cut Off the Table.

2026-09-01T08:15:00.000Z

Britain's mortgage market is not weak. It is stuck. The latest run of official data shows demand firming at the margin and house prices still nudging higher, yet the one thing that would ease the squeeze on borrowers, a lower Bank Rate, is further away than the housing numbers alone would suggest.

Start with the credit data. The Bank of England's Money and Credit release for June, published on 29 July, showed net mortgage approvals for house purchase rising to 58,200, up from 56,600 in May. That is a genuine pick-up, but it still sits below the roughly 61,400 monthly average of the previous six months. Approvals are recovering, not booming. Remortgaging approvals edged up to 34,200 from 33,800. Net borrowing of mortgage debt jumped to £7.7bn in June from £3.3bn in May, above the £4.9bn six-month average, though that line is volatile and reflects the timing of completions as much as any surge in appetite. Net consumer credit borrowing ticked up to £1.8bn from £1.7bn, in line with trend. This is a market with a pulse, not a fever.

The cost of borrowing is not falling

The more telling number sits underneath the approvals. The effective interest rate on newly drawn mortgages rose to 4.35% in June. It is not falling. For anyone rolling off a fixed deal struck before 2022, when two-year fixes could be found comfortably below 2%, that is the whole story: refinancing still means a materially higher monthly payment, and the direction of travel this year has been sideways to up, not down. The approvals recovery is happening in spite of the cost of credit, not because of any relief in it.

That is where the rate backdrop matters. On 29 July the Monetary Policy Committee held Bank Rate at 3.75%, but the vote tells you more than the headline. The split was 6-3, with three members, Megan Greene, Huw Pill and Catherine Mann, voting to raise Bank Rate to 4%. A minority of the committee wanted to tighten policy, not loosen it. The MPC pointed to volatile energy prices in the wake of Middle East tensions and to lingering uncertainty about inflation persistence. There is no cut priced in for the near term, and a live faction arguing the opposite case.

For a household hoping the next move is down, that is the uncomfortable read. Lenders price fixed mortgages off swap rates that reflect where markets expect Bank Rate to go, not just where it sits today. A committee that is split between holding and hiking gives swap markets little reason to price in the cuts that would pull fixed rates lower. The mortgage market can firm all it likes; the rate path is not co-operating.

House prices are cooling, not correcting

The housing numbers fit the same picture of a market that is grinding rather than accelerating. Nationwide's House Price Index for July showed annual house price growth slowing to 1.8%, down from 2.2% in June. Prices rose just 0.1% on the month, leaving the average home at £277,542. Growth is positive but decelerating, which is exactly what you would expect when affordability is capped by a mortgage rate that will not come down and incomes that are only slowly catching up.

This is the tension buyers and their brokers now have to sit with. Transaction demand is being sustained by pent-up need, wage growth and the simple fact that life events do not wait for the Bank of England. But the affordability ceiling is real and it is not lifting. Approvals can keep grinding higher while price growth cools, because the marginal buyer is stretched to the limit of what a 4%-plus mortgage will bear.

What to watch

Three things will move this story. First, the July Money and Credit data, due on 1 September, which will show whether June's approvals pick-up was a blip or a trend. Second, Nationwide and Halifax readings for August, which will tell us whether the deceleration in annual price growth is stabilising or continuing. Third, and above all, the tone of the next MPC meeting: whether the hawkish trio grows, shrinks or holds at three is the clearest signal of when, or whether, borrowers get the cut they are waiting for.

The comfortable narrative is that a recovering mortgage market means the worst is over. The data says something more sober. Demand is healing, but it is healing into a rate environment that the Bank of England is in no hurry to soften. Until the vote splits shift, the mortgage market's recovery is capped by the rate path, and borrowers should plan for the cost of money to stay where it is.

Forced refunds cut UK APP fraud by £73m in a year, and moved the bill onto payment firms

2026-08-31T08:15:00.000Z

Britain's experiment in forcing banks to refund fraud victims has completed its first full year, and the regulator now has an independent read on whether the mandate worked. The verdict from the Payment Systems Regulator is that it did, at a price the industry is still absorbing.

The PSR's mandatory reimbursement regime took effect on 7 October 2024. For the first time, anyone tricked into authorising a payment to a criminal, the category known as authorised push payment or APP fraud, has a legal right to be refunded by their bank or payment provider, up to a set limit and typically within five business days. An independent evaluation by Frontier Economics, published this summer, estimates that in-scope fraud losses have fallen by roughly £73m a year since the rules landed, with close to 35,000 fewer scams reaching completion.

Frontier puts the short-term net benefit, after accounting for the higher costs the policy imposes on payment firms, at between £17m and £29m, a figure the consultancy calls conservative. On the regulator's own framing, the mandate has bent the fraud curve. The more useful question, a year in, is how it did so and who is now paying.

The cost moved, then the behaviour followed

The design point of the regime was never simply to compensate victims. It was to change incentives. Reimbursement is split 50/50 between the sending firm and the receiving firm, the first time UK rules have put a price on fraud at the account that takes the money in, not just the account it leaves from. The logic was that once receiving banks and the smaller payment institutions favoured by fraudsters carried half the bill, they would tighten onboarding, monitoring and mule-account controls.

The early data is consistent with that. Claim volumes ran at about 126,000 between October 2024 and June 2025, roughly 15% below the same nine months a year earlier, which points to fewer frauds succeeding rather than simply more generous payouts after the event. The reimbursement rate for in-scope claims has climbed to about 97%, and across all APP claims the share refunded rose from around two thirds in 2023/24 into the high eighties. Over the regime's first 18 months, to the end of March 2026, the PSR says 88% of the money lost to in-scope scams, some £316m, was returned to victims.

So the composition matters. This is not only banks writing larger cheques. Part of the improvement is prevention: fewer cases, caught earlier, which is the outcome the cost-shift was meant to buy.

Where the burden landed, and where it was capped

The burden landed squarely on payment firms, and it landed unevenly. The 50/50 split bites hardest on receiving institutions where they have historically invested least, and the PSR's own materials note that implementation has been inconsistent from firm to firm, so a victim's odds of a fast, full refund still depend partly on which provider they bank with. The regulator has said it will consult on tightening that consistency before the year is out.

The one hard limit on the industry's exposure is the reimbursement cap, and here the PSR softened its stance before the rules even began. Its earlier proposal set the maximum refund at £415,000, mirroring the then Financial Ombudsman award limit. After industry pushback about the risk to smaller firms, the regulator confirmed in September 2024 a far lower cap of £85,000, aligned with the Financial Services Compensation Scheme limit and in force from day one. The PSR argues the lower figure still fully covers 99.8% of scams by volume and about 90% by value. The corollary is that the largest, life-changing frauds, the ones most likely to involve pensions or house deposits, sit only partly inside the safety net.

What the evaluation does not settle

The skeptical reading starts with what the numbers cannot see. The PSR is candid that reported fraud does not tell the whole story: a year-one survey found 71% of victims were unaware the reimbursement right existed and 49% never attempted a claim, so measured losses understate the problem and any fall in them is easy to overstate. Frontier's estimate is explicitly short-term.

Displacement is the other open question. If the regime makes bank-to-bank transfers a harder channel for criminals, the rational response is to move: towards fraud types and rails the policy does not cover, or towards persuading victims to route money in ways that fall outside the in-scope definition. The regulator's data already shows the mix shifting, with impersonation, purchase and delivery scams and charity fraud featuring more prominently, and it has been pointed in saying banks cannot fix this alone. The platforms where scams originate, social media and telecoms, remain largely outside the reimbursement chain and therefore outside its incentives.

For now the headline is genuinely positive: less money stolen, more of it returned, and no sign of the market exits or reckless consumer behaviour that critics predicted. But the £73m is a first-year estimate against a moving target, the cost has been redistributed rather than removed, and the parts of the fraud economy that sit beyond the payment rails have every reason to adapt. One year in, the mandate has proved it can shift both losses and incentives. Whether it can keep doing so, as criminals reprice their own risk, is the test of year two.

Primary sources: PSR, "Payment fraud falls by £73m following PSR reimbursement scheme" (1 July 2026), reporting the Frontier Economics independent evaluation; PSR, "One year on: impact of APP reimbursement on victims" (8 October 2025); PSR policy statement PS24/7, "Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement" (October 2024).