Regulatory Update - July 2025

FCA Regulatory Changes

This article takes you through the regulatory updates over the course of this month, trying to focus on the areas not otherwise reported.

FCA Motor Finance Review

The pause on complaints outcomes for customers complaining about motor finance agreements – both those involving Discretionary Commission Arrangements and not involving DCAs – remains until 4 December 2025. The Court of Appeal’s decision, published in October 2024, is being appealed and the Supreme Court’s decision is likely to be published in or just after July 2025.

The FCA will need to take that decision into account before it makes a final verdict on whether and how to build a redress scheme.

The FCA has already published a statement setting out what it plans to consider if it sees fit to introduce a redress scheme. It has confirmed it would still need to consult on an industry-wide consumer redress scheme, but that they may decide to have a shorter than normal consultation window (6 weeks was the example).

Two potential options are:

• An opt in scheme. Customers would have to confirm to their firm by a certain date that they wish to be included. This approach would be challenging, as some consumers may be unsure which firms they had agreements with.

• An opt-out scheme. Customers are automatically included. This is likely to be simpler for consumers and could reduce speculative claims. For firms, it could be more expensive and take longer to implement, particularly if customers have changed address.

Redress calculation hasn’t yet been narrowed down to potential options, but the FCA have suggested they will take a broad view, considering all their gathered evidence, the Supreme Court judgement and may or may not be based on calculations in Financial Ombudsman decisions.

The FCA has made it clear that ensuring the integrity of the motor finance market is a priority, and that if many firms were to go out of business, this could ultimately make it more expensive for consumers to borrow money to buy a car. Once the Supreme Court judgement has been published, the regulator will confirm within 6 weeks whether they are proposing to introduce a redress scheme.

The FCA is welcoming views on the pre-consultation to a dedicated email address: motorfinance@fca.org.uk.

Data Decommissioning: Removing reporting and notification requirements

Published on 27^th June 2025, Policy Statement 25/7 sets out the removal of two regular data returns, a notification requirement and outdated Handbook content. Any late return fees that would have been applied during the shortened consultation period have been waived.

95% of the 31 respondents “expressed full support for the proposed changes”.

The following data collections will be immediately removed:

FSA039 – Client money and client assets

RMA-F – Section of the Retail Mediation Activities Return (RMAR)

Form G – an event driven adviser complaints notification.

Affected firms (insurance intermediaries, mortgage intermediaries and retail investment intermediaries, MIFIDPRU investment firms, securities and futures firms, investment management firms, collective portfolio management firms and peer-to-peer lenders) will not need to take any action. The returns will be removed from the reporting schedule immediately and will be switched off in RegData on 11 July 2025.

Risk management and wind down planning at e-money and payments firms – multi-firm review

The latest regulator multi-firm review highlights the importance of well-developed risk management frameworks in a growing sector, based on a good understanding of the potential harm it could generate. Importantly, none of the firms the FCA reviewed fully met their expectations, strongly suggesting that it is likely that most firms should aim to review the operability of their RMFs and Wind-down plans.

The FCA had previously found that risk management frameworks and wind-down plans in e-money and payments firms remain underdeveloped. There are 3 main areas of improvement:

Enterprise-wide risk management frameworks

Staff in operational roles received limited oversight and challenge. Risk appetites were not clear and were not always based on the activities of the business. Financial resources levels were determined using judgement instead of quantitative methods such as stress testing. Several firms did not identify and assess all material risks relevant to their business model, articulate a risk appetite or hold adequate resources.

Liquidity risk management

Weaknesses in identifying and assessing the impact of stress events. Firms rely on cash balances to mitigate liquidity risk without appropriate analysis such as stress testing to see whether they have sufficient resources.

Consideration of group risk

Group risk arises from the relationships and interlinkages between entities, affecting financial and non-financial resources available to the regulated firm. Firms should identify all material sources of group risk and tailor risk management policies accordingly.

Good practices noted include:

• Risk management frameworks that are commensurate with the complexity and scope of activities, enabling firms to identify and document material risks specific to the business model.

• Establishing a risk appetite agreed at board level, reviewed at least annually, with quantitative elements calibrated through risk assessment and stress-testing.

• Including all available information about the liquidity position in the stress testing, for example, the amount of credit facilities extended to customers to cover margin calls should be captured in the stress testing.

• Wind-down plans should have sufficient detail and consider all material activities, making them operable.

In line with previous multi-firm reviews, the FCA highlights the lack of development in the content of documents and plans, saying they are “often incomplete, high-level and not aligned with the risk management framework, with inadequate triggers and links between financial resources held and resources required for wind-down.”

Although the review applies to e-money and payments firms, the findings are likely to be of use for regulated firms auditing their risk management frameworks and wind-down plans.

In assessing their wind-down plans, all firms should pay due regard to FG 20/1 Assessing adequate financial resources.

Royal Assent for the Data (Use and Access) Act 2025

After much to-ing and fro-ing, the new Act offers clarifying updates to the UK GDPR.

The ICO say:

“Changes to the law include: clarifying how personal information can be used for research; lifting restrictions on some automated decision making; setting out how to use some cookies without consent; allowing charities to send people electronic mail marketing without consent in certain circumstances; requiring organisations to have a data protection complaints procedure and introducing a new lawful basis of recognised legitimate interests.”

The new set of ‘recognised legitimate interests' removes the requirement to undertake a balancing assessment in these circumstances. This offers some clarity for firms, particularly where there have been concerns that sharing personal data with the police or emergency services would breach the law.

There is also clarity on Subject Access Requests; firms only need to undertake ‘reasonable and proportionate searches’ and a ‘stop the clock’ provision is introduced. Firms can pause the response time if they need to ask the customer for more information or to refine the request, with the response time continuing once the information is received.

Most of the changes don’t require any proactive work by firms, instead allowing flexibility that can be introduced when firms are ready.

There are two new requirements, however:

• If the firm provides an online service that is likely to be used by children, then their needs must be taken into account when the firm decides how to use their personal information. The ICO note that firms should already satisfy the requirement if they conform to their Age Appropriate Design Code (AADC).

• If the firm does not already do so, they must now take steps to help people who want to make complaints about the use of their data, for example by providing an electronic complaints form. Complaints must be acknowledged within 30 days, and should be investigated and responded to “without undue delay”.

The ICO aims to provide more guidance in due course.

Our Compliance Consultancy website includes a range of Consumer Duty tools, designed to support your compliance.

Our online training courses introduce new staff to regulatory requirements, key legislation and process, and offer excellent refresher training for established staff, with up-to-date scenarios and soft skills training. Our full range of e-learning courses are available online: Online Compliance Training | RB Compliance Consultancy