May 2026 - FCA and ICO Regulatory Update

Annual Work Programme 2026/27

The annual work programme for this year is the second of the FCA’s five-year strategy. The priorities are very much in line with those previously set out in the strategy:

• A smarter regulator: Investing in data and technology platforms and services, expanding access to synthetic data and using AI to speed up detection of harm.

• Supporting growth: Carrying out work on pensions, alternative investment funds and capital requirements for investment firms, and identifying barriers to scaling finance for climate solutions.

• Helping consumers navigate their financial lives: Regulating DPC, supporting the Government’s Financial Inclusion Strategy and undertaking a multi-firm project among smaller payment firms on the treatment of consumers with vulnerable characteristics.

• Fighting financial crime: Convening a flagship financial crime conference and using their full range of powers to disrupt, pursue and sanction those committing crimes.

Regulation of Deferred Payment Credit

DPC agreements provided by third-party lenders will fall under the FCA’s remit from 15 July 2026. Firms that want to continue lending will need to be authorised for DPC lending or have a temporary permission under the TPR. Firms should be well on the way to preparing for regulation, working to meet and implement the requirements set out in the Policy Statement and with the standard FCA requirements, including the Principles for Businesses, the Consumer Duty and the Threshold Conditions.

Although some elements of the SM&CR will be disapplied for firms in the TPR, they should be aware that once they are authorised, they will be considered a SM&CR firm and will need to ensure they are able to meet the requirements from their authorisation date.

SM&CR: Policy Statement

Setting out the first phase of the reforms to the SM&CR, the Policy Statement introduces new measures to reduce unnecessary burdens to firms as soon as possible.

From 24^th April 2026, firms will be able to benefit from clarity and changes to some aspects of the SMR and the Certification Regime, including:

• The validity period of criminal records checks is extended to 6 months.

• Firms have 12 weeks to submit a SMF application, rather than the previous 12 weeks to submit and receive approval.

• Firms have up to 6 months to notify the FCA of changes to Statements of Responsibilities and Management Responsibilities Maps.

• Firms have up to 20 working days to update the Directory.

However, the timeframe to respond to regulatory references is reduced from 6 to 4 weeks.

Additional guidance around Prescribed Responsibilities clarifies when it is appropriate to split a PR (it usually shouldn’t be done unless it is appropriate and can be justified – the FCA would accept it where splits occur between more than one SMF so the allocation of responsibility is in line with the split of business and commercial responsibilities, for example). A new annex at SYSC 24 Annex 2 provides some detailed guidance around how to allocate PRs to SMFs in practice.

The FCA also confirms that:

• Certification Regime certificates can be provided digitally (e.g. via email) instead of hardcopy but must be provided to the employee directly.

• It is possible that SMFs might need to be certified when they undertake activities that are ‘distinct and separate’ from their SMF role.

• Firms can embed recertification within existing processes, and they can conduct the certification process proportionately when there are no changes from the previous year.

Review of the financial promotions rules for consumer credit

Consultation Paper 26/15 follows on from the summer 2024 Call for Input and sets out the FCA’s plans to update the financial promotions rules in CONC to avoid overlap and complexity following the implementation of the Consumer Duty.

The changes will:

• Remove some areas of CONC 3 where the rules could be now viewed as unnecessarily prescriptive.

• Require firms to concentrate on “delivering the Duty’s consumer understanding outcome to ensure their communications meet consumers’ information needs and are likely to be understood."

There are also likely to be some changes to APR rules. The FCA say they are unable to give detailed views at this stage on what information requirements will look like for credit products, as in part this will depend on the Government’s review of the Consumer Credit Act, but they do expect that any new regime or rules will be outcomes-focused and give flexibility.

The Consultation sets out the elements of CONC that will be removed or amended. Firms should note that the FCA expects that they still meet their obligations under the Consumer Duty.

The consultation closes on 17^th June.

ICO Updates

The ICO has published more guides to support firms in understanding how to apply the DUAA in practice. The detailed Guide to Lawful Basis defines the new ‘recognised legitimate interests’ and reduces the need for a balancing test in certain circumstances. It also notes where website cookies can be used without consent.

There is also a longform Guide to Legitimate Interests which discusses the legitimate interests lawful basis in detail.

The requirement for firms to have a process for handling data protection complaints will start on 19 June 2026. Guidance is designed to give practical advice to support firms to meet these requirements.

Firms that track regulatory developments carefully are better positioned to protect their business and maintain compliance. A bespoke regulatory update, curated by our in-house experts gives your firm’s Senior Management a clear view of what’s changing and what’s coming next. Instead of reacting to reforms once they’re finalised, our detailed document enables financial services firms to gain an early understanding of the themes, proposals and supervisory priorities most relevant to their activities. Contact Robert Bell to find out more.