Find out about the supervisory work we’ve undertaken, risks we’ve seen crystallise and findings from wholesale banks’ internal audit functions.
About our findings
We set out our learnings against the areas of focus in the Regulatory Priorities report for wholesale markets[1], bringing more detailed observations and findings together in one place to make it easier for firms.
We’re doing this to:
- Help firms benchmark and use practical examples to achieve regulatory outcomes more efficiently.
- Provide data and insights not typically available to firms such as aggregated information from firms’ regulatory reports.
- Highlight where the market is performing well and where improvements are needed.
We are not being prescriptive in our findings. We describe what we’ve seen and bring it together in one place to make it easier for you to consider the impact on your business and any actions you may wish to take. We will continue to share our learnings with firms.
We also describe the services we offer to wholesale banks to support innovation, opportunity and growth, and encourage greater take-up.
1. Improving the resilience of firms and markets
Third parties
We continue to see third party-related incidents, like the AWS outage in October 2025, causing operational disruptions.
We’ve also observed weaknesses in how third parties are overseen. One bank’s internal audit function identified that there wasn’t a rigorous approach to validating third-party providers’ information security controls over the firm’s data.
For material or high-risk services, the firm relied on a questionnaire and reviewing independent attestation reports rather than validating assertions from the third-party, such as how it controls its employees’ access to the firm’s data.
As part of future work, we may ask firms to show how they validate their resilience strategies, such as including key third parties in scenario testing and reviewing exit plans from key third parties. We remind firms of PS26/2: Operational Incident and Third Party Reporting[2].
Cyber
Cyber attacks are becoming more frequent and more sophisticated. Banks have invested significantly in cyber security capabilities. Along with the PRA, we’ve published our observations on further improvements:
- Effective practices: cyber response and recovery capabilities[3]
- Operational resilience: insights and observations one year on[4]
- 2025 CBEST thematic[5]
Data management
We’ve seen risks crystallising across a range of areas where the root cause was linked to weaknesses in data management. These weaknesses undermined key controls firms relied on to mitigate financial crime and market conduct for periods of time.
In one case, due to incomplete restricted list data, nearly 1,000 trades took place in securities that were on a firm’s restricted list. In a further incident, incomplete data feeds meant some counterparties were not subject to adverse ongoing media or screening controls for a sustained period.
Issues typically went undetected for 5 to 10 months. Once identified, firms generally acted promptly. The lack of detection highlights the challenge of managing complex, high volume data environments and the need for strong data monitoring and governance.
These incidents typically exhibited at least one of the following underlying features:
Based on our findings, firms can consider these questions:
- Visibility of data dependencies: does the firm maintain clear and accurate documentation, mapping which controls rely on what data feeds and databases, including downstream dependencies?
- Risk-based oversight and prioritisation: does the firm prioritise the oversight of data feeds – and its incident response – according to the criticality of the controls that depend on them, and does it periodically reassess that prioritisation?
- Monitoring, lineage and completeness: does the firm have management information (MI) and automated lineage / completeness controls that reliably detect missing, stale, incomplete or anomalous data early enough to prevent prolonged control failures?
- Robust testing for change, migration and go-lives: are the firm’s migration, ‘go live’ and broader change management testing methodologies sufficiently comprehensive to confirm end-to-end data integrity, downstream impacts and control logic behaviour?
- Root cause and read across: when incidents occur, does the firm establish the full underlying root cause, assess whether similar risks exist elsewhere and embed lessons learned across the firm?
2. Enhancing efficient, competitive and innovative markets
Share buyback disclosures
Following our 2025 multi-firm review[6] of share buybacks, we found firms had made changes to their client facing materials such as clearer descriptions of structured buyback options, improved graphical illustrations of performance under different market conditions and greater discussion of potential outcomes depending on the trading of the underlying shares.
The feedback we received as part of the multi-firm review also led us, following consultation, to reduce the frequency of UK Listing Rules share buyback disclosures to lower administrative burden without compromising market transparency.
These changes came into effect in February 2026[7] and are already being used by issuers.
Innovation support for wholesale banks
We have a strong track record in supporting innovation. We are providing wholesale banks with details on the innovation services that we offer.
We would like to see more wholesale banks use those services as they are under-represented relative to others. We encourage wholesale banks to consider whether any of the innovation services are relevant to planned or emerging initiatives.
See our Innovation Hub[8] to find out more about these services and events we host. For example, our upcoming Synthetic Data AML Solution Sprint[9] designed to accelerate the development of cutting-edge Anti-Money Laundering Technologies (apply before 26 April to participate).
Diagram showing FCA innovation services available to fintech firms at different stages of their lifecycle, from idea generation to scaling.
Our innovation services: from idea to scale
| AI Lab | Supports targeted testing of AI‑enabled financial services to generate regulatory evidence. |
|---|---|
| Smart Data Accelerator | Supports focused experimentation using smart data to improve financial services outcomes. |
| TechSprints | Aims to advance open finance and smart data adoption in the UK. |
| Digital Sandbox | Supports early‑stage experimentation using shared data and tools in a safe environment. |
| Supercharged Sandbox | Provides enhanced Digital Sandbox support using shared data and AI tools. |
| Innovation Pathways | Provides early regulatory engagement to help firms understand how rules apply to new models. |
| Regulatory Sandbox | Supports live market testing of innovative products under regulatory oversight. |
| Scale-up Unit | Provides tailored support for authorised firms as they scale in the UK and internationally. |
3. Preventing financial crime and market abuse
Market soundings
We reviewed market data on the impact of market soundings on market quality. We found some impact on liquidity during the market sounding period but other market quality metrics were not significantly impacted. We also identified some transactions involving relatively large sounding exercises which may increase the risk of information leakage.
Annex 1 firms
On 20 March 2026, we reminded firms to carry out proper checks[11] when dealing with unregulated lenders, safe custody providers, money brokers and financial leasing companies, also known as 'Annex 1' firms. We raised concerns about AML standards directly with the Annex 1 businesses in a letter to CEOs in 2024[12].
We’ve seen banks not taking sufficient steps to understand the scope of work undertaken by the auditor of an Annex 1 firm. We’ve also seen due diligence and ongoing monitoring that’s not tailored to the particular Annex 1 activity. When dealing with Annex 1 firms, regulated firms must do their due diligence to understand the firm’s business, in accordance with legislative requirements.
Information access and insider list controls
We saw multiple IT employees at one firm with access to folders containing inside information, but who were not tracked by the control room. To understand whether the issues were more systemic, we followed up with 7 wholesale banks on their processes for controlling access to documents containing inside information.
Approaches were broadly consistent across the sample, with firms using network drives and secure folders to manage inside information. However, at 4 firms, IT staff had access to files containing inside information but were not included on insider lists. At one firm, this was nearly 50 individuals. This is disappointing given we wrote about this risk in August 2025.
Examples of good practice included controlling technical support access to restricted folders through dedicated logins and specific access requests. Firms that had implemented technology solutions such as integrating their secure document management system into their client relationship management platform had more accurate insider lists.
Weak information classification and access control is a longstanding operational risk for firms. Enterprise-wide search and AI-enabled tools can make this worse by allowing misclassified or overly accessible information to be more discoverable than traditional navigation or search methods. In one case, confidential data stored in an internal library with permissive default access settings was accidentally presented to an unauthorised user via an enterprise search tool. Firms may want to reassess these risks and the effectiveness of their controls.
Market abuse – 'pump and dump'
We’ve observed an increase in suspicious trading consistent with the manipulation typology known as 'pump and dump'.
Attackers use phishing-enabled account takeovers to access clients’ brokerage accounts, liquidate existing holdings and concentrate purchases into a single targeted stock. This artificially inflates the price before the attackers offload their own positions for profit.
Evolving scam techniques include the use of deceptive social media groups, deepfakes and online promotional content designed to steer retail investors toward illiquid stocks.
We encourage firms (particularly brokers, platforms, and wholesale banks) to strengthen their prevention and detection controls and remain vigilant to coordinated activity that might suggest 'pump and dump' behaviour.
See relevant work from 2025
4. Ensuring firms effectively manage conflicts of interest and conduct oversight
Conduct breaches (REP008)
We reviewed wholesale banks’ annual REP008 returns on conduct rule breaches by individuals who were not in senior management functions (SMFs) but were subject to the conduct rules at the time of the breach, and where the firm had taken disciplinary action.
Over the last 3 years, the number of firms reporting at least one breach, and the total number of breaches reported, have remained broadly consistent year-on-year.
Total number of breaches, number of individuals reported and number of firms submitting REP008 over 2023 – 2025 by wholesale banks.
| Breaches reported | Individuals | Submitting firms | |
|---|---|---|---|
| 2023 | 195 | 166 | 44 |
| 2024 | 207 | 173 | 52 |
| 2025 | 203 | 175 | 50 |
- 6 – average number of breaches reported by large wholesale banks.
- 2 – average number of breaches reported by smaller wholesale banks.
If an individual breached more than one conduct rule, we count each breach separately.
Following the Transforming Data Collection programme, which focused on reporting efficiencies, firms don’t need to submit nil returns. 31 firms submitted nil returns in 2025 when they didn’t need to.
Whistleblowing
We saw an example where an individual was not correctly identified as a whistleblower when they raised concerns through internal escalation routes rather than dedicated confidential whistleblowing lines.
We remind firms that it’s important to have appropriate arrangements for individuals to raise concerns and that these are handled effectively, with appropriate controls for confidentiality and escalation.
See relevant work from 2025
5. Other learnings
Risk management
The risk and control assessment process (RCSA), or equivalent, is an important tool for identifying and managing the firm’s operational risks.
Although the business has primary responsibility and process ownership, it should consider changes requested by the second line and third line through challenge.
One firm’s internal audit function noted that high-risk audit issues were not properly reflected in the RCSAs. It also found that some residual risks were underestimated due to inaccuracies in overall control ratings, such as assessing a control environment as strong despite at least one control being flagged as partially effective or ineffective.
Communication with us
We’ve seen recent instances of banks either being slow to notify us of material events or have not done so at all. These include operational outages and trading incidents. We need to receive information on material incidents in a timely way to quickly understand the impact, what a firm is doing to resolve the problem and to decide if we need to take steps in response.
