Welcome to the UKGI weekly regulation update service for Aviva ABC brokers

Context

The FCA has published a blog by Sarah Montgomery, FCA Head of Department, Cross-cutting Policy and Strategy, about the “not-so-fine print: making consumer contracts fair”.  It has also updated its Unfair Contract Terms web page with detail on complying with Principle 12 (the Consumer Duty) and the FCA’s role under the Digital Markets, Competition and Consumers Act 2024 (DMCCA).

Key points to note and next actions

• Contracts hold the detail that shapes everyone’s financial life, whether taking out a loan, insuring a holiday, or signing up for a crypto wallet.
• All firms are responsible for making sure that terms in their consumer contracts comply with the fairness and transparency requirements of the Consumer Rights Act (CRA) 2015. When those terms do not comply, the FCA’s Consumer Contracts team has powers to challenge firms directly.
• The blog addresses what the FCA does when it needs to take action (e.g., amend or delete the relevant terms so that the contract is fair and transparent, or pay redress to consumers if the firm’s use of the terms has caused harm). There are examples of cases the FCA has tackled, and what the FCA expects of firms e.g., avoid surprises by making important terms easy to spot, review contracts regularly to stay compliant with the latest requirements, and test whether customers actually understand key terms.

Context

The FCA has published a new web page outlining insights and observations which are aimed at helping firms strengthen their next operational resilience self-assessment.  The key messages are that firms should focus on what they can deliver now, how they manage disruption, and how they support conclusions with evidence.  The FCA’s operational resilience rules do not apply to ‘Core’ SM&CR firms, and these observations are not new requirements, but firms may find them useful when considering their operational resilience arrangements and self-assessments.

Key points to note and next actions

• Firms have made good progress since the operational resilience transition period ended in March 2025, and the FCA continues to see strong governance, mapping, testing and remediation arrangements across the sector.
• Firms face evolving threats, such as cyberattacks, technology failures, third party outages, data integrity issues and broader geopolitical events. At the same time, an increased reliance on shared infrastructure, digital service providers and emerging technologies could all change the nature, speed and impact of disruption.
• The FCA’s latest findings from its review of firms’ 2025 to 2026 operational resilience self-assessments suggest that firms could do more to demonstrate what they can deliver now during severe but plausible disruption, rather than relying on planned remediation, transformation programmes or future investment.

The stronger self-assessments the FCA reviewed explain:

• What vulnerabilities remain, and how disruption could cause harm.
• What evidence supports the firm’s resilience position.
• How Boards and senior management are using this information to make decisions, and how recovery priorities could be affected if multiple services, firms or market participants are disrupted simultaneously.

Based on these latest findings, the main area for development is improving the quality of evidence.  Stronger self-assessments are more likely to include sufficient evidence to demonstrate that they can:

• Respond to severe cyber disruption and manage risks from material third party dependencies.
• Reduce the impact of disruptions to their important business services to avoid intolerable consumer harm and reduce threats to market integrity even if they cannot fully recover within the impact tolerance.
• Explain and support their current resilience position and the assumptions behind it.  
• Identify, explain and manage any residual risks and capability gaps, and the actions being taken to improve resilience.

Examples of good and poor practice are set out under a number of headings:

• Important Business Services (IBSs), impact tolerances and maintaining delivery during disruption
• Mapping resources and dependency risk
• Scenario testing and demonstrating resilience in practice
• Vulnerability identification, remediation and validation
• Communication plans and strategy
• Governance, assurance and accountability

The report includes suggested next steps for firms, and a glossary outlining the definitions of ‘Operational resilience rules’, ‘Board/ governing body’, ‘Impact tolerance’, and ‘Important business service’.

Context

The FCA has published its responses to the questions raised at its Annual Public Meeting, which were not answered on the day.

Key points to note and next actions

• The answers are set out in a 95-page document, which is broken down into 36 topics.
• The topics include accountability, AI, ARs, authorisations, enforcement cases, financial crime, FOS, insurance, NFM, sanctions, SM&CR, supervision, and whistleblowing.

Context

The FCA has published the details of how many S.166 Skilled Persons reviews it commissioned in the first quarter of the 2026/27 financial year (so 1^st April to 30 June 2026).  Eight skilled person reviews were commissioned.

Key points to note and next actions

• None of the reviews were in the insurance sector – the first time this has happened since January to March 2025.  At least one Skilled Persons report was commissioned in the insurance sector in every quarter of the 2025/26 financial year, but the total of seven was lower than the previous two years.
• Of the eight Q1 2026/27 reports that were commissioned, only one was for a ‘Dedicated Supervision’ firm (in relation to trade and transaction reporting), with financial crime being the reason for three of the other seven (‘Portfolio Supervision’ firm) reports, and market abuse the reason for two of them.
• The sectors involved were consumer investments (seven) and ‘wholesale sell-side’ (one).

Context

FSCS has announced, alongside a statement from its Chief Executive Martin Beauchamp, the publication of its November 2026 Outlook update.  The November Outlook is where the FSCS provides its latest update on compensation and the levy for the current financial year, as well as an early view of the levy for the coming financial year. This forecast, which will be updated in the spring, supports industry planning and provides visibility of emerging levy requirements.

Key points to note and next actions

• The 2026/27 levy remains unchanged at £247m, with no additional levy anticipated this year. The FSCS compensation forecast has increased by £25m since May, but its work to ensure strong recoveries, effective use of available surpluses and disciplined cost management means it has been able to maintain the levy position.
• Total compensation costs are now forecast at £292m. The increase since earlier this year reflects what FSCS is seeing across investment, self-invested personal pensions (SIPPs) and insurance claims, alongside higher Special Administration Regime costs.
• FSCS now forecasts £43m in recoveries by the end of the year — 30% higher than in May — with the majority helping to offset future levies and reduce the amount firms need to pay.
  • Green Realisations 123 Ltd (formerly known as MCE Insurance Company Ltd) is a good example of this in practice. So far this financial year FSCS has recovered approximately £29m from the firm, bringing total recoveries to £70m since it entered administration in 2021.
• The early levy forecast for 2027/28 is £360m, a significant increase compared to the 2026/27 levy of £247m (an increase of just under 46%). This is principally driven by lower surplus balances available to offset the levy, with no significant change anticipated in costs related to compensating customers.
• In recent years FSCS has used available surpluses to reduce the amount firms need to pay. By the end of 2026/27, these surpluses will have largely been utilised, with surplus balances expected to be over £100m lower. Alongside this, compensation for 2027/28 is currently forecast to be broadly similar to 2026/27, with a substantial proportion relating to SIPP advice and general investment claims, as well as insurance-related claims.
• Although the compensation costs for the ‘general insurance distribution’ class have increased compared with May’s Outlook, there will be no change in levy requirement for 2026/27.  The increased costs reflect higher-than-expected compensation following the failure of Lonsdale Insurance Brokers Ltd, which was declared in default in March 2026. Compensation payments relating to this failure are expected to be higher in value than the class average, which is typically less than £5,000 per claim. As a result of the increased compensation costs, available surpluses are now expected to be fully utilised during the year, resulting in a deficit (£2.2m). This will be carried forward to 2027/28.

Context

The right of access is a fundamental right that allows people to access and obtain a copy of their personal information. People are increasingly using AI to help them make Subject Access Requests (SARs), and the ICO has issued guidance on how to handle SARs generated using AI.

Key points to note and next actions

• The ICO sets out that AI can help people to make a SAR but notes that the result may be difficult to understand, particularly if the AI generates a request which is unclear, or is too wide in its scope, or is inaccurate.
• AI-generated SARs must be treated in the same way as any other SAR and firms are able to seek any clarification around the request in the same way as now. There is no change to the time limit for responding to the SAR even if it was AI-generated.
• If the AI SAR causes practical difficulties in responding to it, firms can consider if the request is complex, which allows an extension of the time limit for responding.
• Firms must still undertake a reasonable and proportionate search for the information which has been requested. An AI-assisted SAR might state any specific searches the person wishes to be carried out, so firms should consider searching particular datasets, information held on specific platforms, as well as CCTV, call logs or other records.
• Staff should be trained so they understand how to respond to a SAR and can encourage the requester to review any AI-generated material before the request is made, such as checking correspondence addresses are correct, or to remove any irrelevant or unclear details (in the same way as AI material would be checked for clarity before relying on it).

Context

The ICO has highlighted its Data Protection Essentials training, which is a free online training and self assessment programme for small and medium sized organisations, their employees, and sole traders.

Key points to note and next actions

The ICO has commented that the training gives clear guidance and practical knowledge to apply data protection principles in firms’ day to day work. The training is accessible, and is intended to help firms develop good data protection habits to help them thrive.

• Firms can put data protection into action and strengthen their everyday practices
• It helps to protect people and their information more proactively, and spot and avoid risks before they become problems
• Shows how to use personal information confidently to build trust, improve customer relationships and make the best use of new opportunities

The training provides a digital certificate for firms once the training is completed, and firms can then be listed on the ICO’s Data Protection Essentials Public Register. There is an online demo of the training on 17 November and firms can register here if they would like to attend.