Welcome to the UKGI weekly regulation update service for Aviva ABC brokers

Context

The FCA has published Quarterly Consultation Paper no. 53, CP26/32.  Once a quarter, the FCA consults on proposed miscellaneous amendments to its Handbook. These tend to be minor changes, but the FCA welcomes feedback on its proposals.  There is only one update of interest to the insurance distribution sector, one of interest to the claims management sector, but none of interest to the consumer credit or funeral planning sectors.

Key points to note and next actions

The proposals of interest are:

• To remove data point DISP 1.10.1I R (2) (a), which is a data point on claims management fee cap redress erroneously duplicated in the Consumer Credit Reporting return (CCR).
• To remove reference to the 2-stage complaints process for the Society of Lloyd’s in DISP 1.11.8G.

The remaining proposals relate to banking and savings, investments, payments, e-money, and cryptoassets.

Context

In what seems to be an intention to assist firms in considering their resilience to a ‘hostile attack’, the FCA has published ‘lessons for firms’ from its Defence, Security and Resilience Lab.  The FCA brought together around 120 leaders from financial services, government and defence for the Lab.  The findings are to share firms’ views on systemic risk, on the FCA’s work on strengthening resilience, and on how firms can assess their own exposure.

Key points to note and next actions

The headline findings are:

• Firms felt less confident about spotting shared risks
• Firms want clearer signals before committing capital
• International dependencies need to be considered when planning for resilience
• There are multiple shared dependencies between firms
• Some risks can’t be solved alone

The FCA plans to further investigate how it can support intelligence sharing with the financial sector, whether more focus is needed on back-up, ‘fail-safe’ technologies that can be used when disruption hits, and exploring access to banking and finance frictions.

The FCA has posed some questions to help firms assess their risk and support UK resilience:

1. Have you mapped your firm’s systemic vulnerabilities: are they internal, external or supply chain dependencies? For example, if you rely on public sector databases, cloud services or payment infrastructures operating outside your business, how are your vulnerabilities spread across the technology, service providers, locations and people within your firm?
2. Have you tested whether your back-up systems would be resilient if a disruption also affected other firms relying on the same back-up provider or infrastructure?
3. Have you considered how your firm’s crisis communications would need to change if disruption or conflict-related events were affecting multiple firms, or the whole sector, simultaneously, rather than just you? How would you sustain your communications over a longer period?
4. Does your firm provide a single point of failure, and if so, how quickly could your disruption impact others?
5. Can your firm access defence sector expertise to support defence and dual-use clients’ access to finance?
6. (For investors) Do you ask investee companies about their resilience measures?

Context

The FSRC has published the transcript of the oral evidence session attended by David Geale, FCA Executive Director of Consumers, Payments and Competition, and Chris Knight, FCA Director of Insurance.  Geale responded to most of the Committee’s questions, given how new Chris Knight is in his position.  The FSRC launched this inquiry to find out if the insurance market is working for the many people who buy home and travel insurance. The Committee wants to find out whether the current regulations are effective, whether they are properly enforced, and whether there is anything that the regulators and Government need to do differently.  The Committee welcomes evidence and views from anyone with expertise or interest in this area.

Key points to note and next actions

• The FCA was under early pressure by not being able to answer how many people at the FCA work on home and travel insurance (understandable as the FCA is not set up along product lines), but Geale did refer to the six Enforcement cases involving insurance and the Consumer Duty (indicating that a number of people are working on that).
• When asked about the success or otherwise of the Consumer Duty, Geale referred to the GAP intervention, and the six Enforcement cases again.  Knight spoke about the ongoing work on trying to standardise across the industry definitions of storms and ‘wear and tear’.
• Geale provided Supervision statistics (without mentioning the relevant time period):
  • 241 communications directly to firms,
  • 41 Section 165 information requests,
  • 26 VREQs,
  • a “number” of Section 166 skilled person reports requests; and
  • 11 instances of customer redress.
• The Lords brought up Consumer Understanding as a significant issue, which Chris Knight acknowledged and said it manifests in terms of lots of complaints, claims that are rejected, underinsurance, etc., all of which firms should then react to under the Consumer Duty.
• In relation to AI, the Committee indicated that they found it useful and wondered why the FCA didn’t regulate ChatGPT like they do price comparison warehouses (PCWs).  Geale struggled to explain the regulatory perimeter and the ‘by way of business’ test to them, but also commented that it is something that the FCA will continue to monitor, and that customers need to be aware that AI isn’t always correct.
• There was a debate on detailed rules versus the broader principles of the Consumer Duty, with Geale saying that he preferred outcomes to rules, liking the flexibility of the Consumer Duty.  Geale used premium finance as an example (citing the FCA’s fair value review work, including what firms were charging, and the FCA’s challenges to a number of firms).
• There was discussion around outsourced claims handling and whether this was effectively overseen by the FCA.  The FCA put forward its stance that this is the insurers’ responsibility, and the FCA holds them responsible. The FCA did agree about the low claims acceptance rates in home insurance, which is something that it is reviewing as part of its own work. Chris Knight gave some more granular information in that only 31% of storm claims are accepted.
• The Committee pressed the FCA on PCWs and that, although they show the price, there is no information on claims outcomes, and asked how there could be more data provided on this.  The FCA’s response was limited to its ongoing post-implementation review of the value measures data.  

Context

The FSRC has published the transcript of the oral evidence session attended by James Dipple-Johnstone, FOS Chief Ombudsman, and Rachel Lam, FOS Interim Ombudsman Managing Director.  The FOS representatives spent time explaining the role of FOS role and what it does, which is about adjudicating on individual cases, but stated that FOS and the FCA share data, and that FOS publishes data and case-studies for the industry to use.

Key points to note and next actions

• FOS receives around 200,000 cases a year, of which 45,000 relate to insurance; of those,14,000 are for travel and home insurance (the focus of this inquiry and oral evidence session). Most of these are about claims and or the claims experience.
• When asked about changes the Consumer Duty had made to the FOS caseload, Dipple-Johnstone said that it is probably too early to see any definitive longitudinal trend coming through in terms of the Duty.
• When asked about whether there were serious market failings, FOS responded that their 45,000 cases are only a subset of the complaints to the insurers, which themselves are only a subset of their overall claims, and so it is difficult for FOS to comment. Dipple-Johnstone added, though, that In terms of travel insurance FOS changes the outcome for the consumer in about one in three declined claims cases.  In terms of home insurance, in around one in four cases feature an outcome change.

Context

The Rt Hon Lucy Rigby LC MP gave a speech at UK Finance on 8 September 2026.

Key points to note and next actions

• Digitalisation is becoming more prevalent – the UK’s wholesale financial markets are entering a major transition from electronic to fully digital infrastructure, with digital representation of assets or rights expected to become a defining feature of future markets.
• The UK aims to lead globally. The government sees digitalisation as a national benefit, requiring close collaboration between government, regulators and industry to maintain the UK’s competitiveness and drive economic growth.
• The main challenge is coordination, not technology – the technology already exists; the priorities are ensuring common operational standards, maintaining liquidity, suitable platform integration, coordination between firms, and building enough confidence to move from pilots to large-scale adoption.
• Government and regulators are using the framework already. Initiatives such as the Digital Securities Sandbox are helping firms test and deploy digital solutions, while the government plans further legal and regulatory changes to support digital markets beyond the sandbox.
• These major initiatives mean the UK is entering a critical delivery phase with the ambition to make the country a global leader in digital financial markets.

Context

On 8 September the FCDO announced that the Iran (Sanctions) (Amendment) Regulations 2026 (The Iran (Sanctions) (Amendment) Regulations 2026) was laid in Parliament.  The legislation, which comes into force on 29 September, imposes (previously announced) further sectoral sanctions on Iran, broadly corresponding to measures lifted by the UK and partners as part of the Joint Comprehensive Plan of Action.

Key points to note and next actions

• New legislation includes financial measures to reduce the ability of the Government of Iran to access the UK financial systems.
• It will also bring forward trade prohibitions targeting significant industries advancing Iran’s nuclear escalation, including the energy, metals, gold, and software sectors, and related activities such as shipping, insurance and banking.
• FCDO is also expanding its powers to target Iranian vessels which enable and facilitate Iran’s nuclear programme and malign activity.

Like all sanctions measures the legislation includes carefully designed mitigations. This will include general licensing to enable the continued operation of the Shah Deniz gas field in Azerbaijan, which provides critical energy supplies to the UK’s European partners. It is a continuation of long-standing policy that aligns the UK with the EU and US, who have similar carveouts for activities related to Shah Deniz.

Key resources relating to the new legislation:

• Written Ministerial Statement: Iran Sanctions, 8 September 2026 – GOV.UK
• OTSI General Licence Update – Subject to parliamentary approval, certain trade activities related to Shah Deniz will be permitted via a new OTSI general licence. The prospective licence can be found on GOV.UK https://www.gov.uk/government/publications/general-trade-licence-services-necessary-for-the-continu…, and will come into force on 29 September.
• OFSI General Licence Updates – OFSI will also update an existing licence https://www.gov.uk/government/publications/ofsi-general-licence-int20257363752 permitting certain financial activities related to Shah Deniz, which will both be published and enter into force publishing on 29 September.
• Statutory guidance for the Iran 2019 regulations and the Iran 2023 regulations.

Context

The NCSC has published a blog post considering why staff use unapproved AI tools and how this is key to managing the security challenges this can create.

Key points to note and next actions

• Shadow AI is the use of AI tools that have not been approved or incorporated into an organisation’s official systems and processes. The NCSC states its use is widespread, with one study finding 71% of employees had used unapproved AI tools at work.
• AI offers significant benefits, including faster task completion, improved decision-making, potential cost savings and increased productivity. However, organisational policies and security controls have often failed to keep pace with rapid AI adoption.
• The NCSC notes that shadow AI creates cybersecurity risks, particularly through exposure of sensitive or proprietary information. There may be a loss of organisational control over data leading to regulatory breaches, and new vulnerabilities that attackers could exploit through AI agents.
• Organisations should therefore focus on reducing rather than eliminating shadow AI. They should promote an open cybersecurity culture and understand the risks where employees may use an unapproved AI tool. Secure, approved AI alternatives should be considered, with AI being integrated into the workplace alongside awareness of the associated risks, so that deployment can be managed safely.

Context

The IUA has published annual Treaty Insurance premiums for the London Company Market, stating that survey data reflects the pursuit of disciplined underwriting policies.

Key points to note and next actions

• Treaty reinsurance written in the London company market fell 6% last year.  Total premiums of £11.27bn were recorded by the sector in 2025, compared to £11.985bn the previous year.
• The trend reflects a disciplined underwriting approach reported by many firms as global non-life premiums reach a cyclical low point.
• Just over one quarter (26%) of premiums written in London in 2025 were treaty reinsurance, with direct and facultative contracts making up the remaining 74%. These proportions are almost unchanged from the previous year and consolidate a steady increase in the relative importance of treaty business over recent years.

This year’s London Company Market Statistics Report is due to be published later this month, analysing all premium income for IUA members by placement type, class of business and geographical origin