Welcome to the UKGI weekly regulation update service for Aviva ABC brokers

Context

As part of its August Regulatory Round-Up communication, the FCA has reminded firms that, from 17 September 2026, RegData will operate every day from 7am until midnight, including weekends and bank holidays.

Key points to note and next actions

Until 17 September, the RegData operating hours will remain:

• Monday to Friday: 7am to 10pm
• Weekends and bank holidays: 8am to 5pm

The longer hours will improve access to the FCA’s digital services and give firms more flexibility.

What isn’t changing?

• Support arrangements remain unchanged and firms should continue to use existing channels for queries relating to submissions or access. Firms do not need to take any action.
• This change applies to RegData operating hours only. There are no changes to firms’ reporting obligations, submission processes or other systems as part of this.
• This change is part of ongoing improvements to the FCA’s digital services and is intended to provide a more consistent and accessible experience for firms.

Context

The FCA has decided to ban three former senior figures at Dolfin Financial (UK) Limited (Dolfin) after finding they ran a scheme that helped clients bypass UK visa rules.

Key points to note and next actions

• Former chief executive Denisz Nagy has been fined £324,800 and former finance director Sanjay Maraj £122,000 for their roles in the scheme. Both have been banned from working in financial services.
• The FCA has also decided to ban Dolfin co-founder, Roman Joukovski, from working in financial services.
• Mr Joukovski has referred his Decision Notice to the Upper Tribunal where he and the FCA will present their cases. Any findings in Mr Joukovski’s Decision Notice are therefore provisional and reflect the FCA’s belief as to what occurred and how it considers his behaviour should be characterised. The proposed action outlined in Mr Joukovski’s Decision Notice will have no effect pending the determination of the reference by the Tribunal whose decision will be made public on its website.
• Between 2016 and 2019, most clients using the scheme paid a fee of £400,000 instead of investing £2m of their own money in UK companies, as required under the Home Office investor visa rules. The FCA found the scheme was deliberately designed to create the false impression that the visa requirements had been met.  
• The scheme enabled at least 99 individuals to obtain investor visas and generated at least £35.5m in fees for Dolfin-connected businesses and the immigration agents that introduced clients.
• On 12 March 2021, the FCA imposed restrictions on Dolfin to prevent it from carrying on any regulated activities, following a range of regulatory concerns, including its operation of the investor visa funding scheme.

Context

The latest FCA quarterly whistleblowing data shows the number of new whistleblowing reports the FCA received between April and June 2026, and existing reports closed during this period.  The data shows how the FCA receives each report, what the report was about, and what level of action the FCA has taken.

Key points to note and next actions

• In this quarter (Q2 2026, April to June), the FCA received 333 new whistleblowing reports.  For the same period in 2025 the team received 315 reports.  In Q1 2026 (January to March), the FCA received 355 reports.
• Most reports continue to be received via the FCA’s online reporting form (177) or by e-mail (99).
• Whistleblowers were happy to provide the FCA with their contact details in just over two thirds of the reports received.
• The 333 reports contained 886 individual allegations, and the FCA’s web page shows a breakdown of the top ten allegations.  The three highest allegations were
  • ‘Consumer Duty’ (197)
  • ‘Leadership and senior managers: behaviour, conduct and integrity’ (153)
  • ‘Systems and controls’ (121)
• The FCA closed 395 whistleblowing reports in the quarter, with significant action taken by the FCA to ‘manage harm’ in 56 of those cases (this may include enforcement action, a section 166 skilled person report, or restricting a firm’s permissions or an individual’s approval).
• Some action was taken in a further 114 cases (which may include writing to or visiting a firm, asking a firm for information, or asking a firm to attest to complying with the FCA’s rules).

Context

The ICO has announced that it has fined The ICO has fined Elderly Aids Ltd (EAL) £190,000 for bombarding people with the very nuisance calls it claimed to protect them from.  The ICO has also published the Monetary Penalty Notice issued to EAL, and has served EAL with an Enforcement Notice.

Key points to note and next actions

• The company deliberately targeted elderly people to promote call-blocking devices, claiming they were trying to protect them from nuisance calls.  
• EAL made 758,053 unsolicited direct marketing calls to people registered with the Telephone Preference Service (TPS) between May 2024 and February 2025, with 20 complaints made to the ICO and TPS during this period.  
• The complaints revealed that EAL’s callers were aggressive, misleading, and often failed to identify themselves. One complainant said: “overcharging for call blocking services that they aren’t authorised to sell – my father was persuaded to sign up to pay £139 upfront and a £6.99 monthly fee.”  
• Throughout the ICO’s investigation, EAL repeatedly ignored requests for information and continued making unsolicited calls which let to further complaints. The company also attempted to strike itself off the Companies House register once it became aware it was under scrutiny and is now registered at a default address.

Context

The UK Parliament FSRC has confirmed that it will hear two oral evidence sessions on Wednesday 2 September, at 10.00am (FCA) and 11.00am (FOS), as part of its ‘Regulation of the consumer insurance market’ inquiry.

Key points to note and next actions

• The FCA representatives will be David Geale (Executive Director of Consumers, Payments and Competition) and Chris Knight (Director of Insurance).
• The FOS representatives will be James Dipple-Johnstone (Chief Ombudsman) and Rachel Lam (Interim Ombudsman Managing Director).
• Previous oral evidence sessions have been attended by insurance industry representatives (insurers, larger price comparison website firms), insurance industry trade bodies, the FCA Financial Services Consumer Panel, and consumer groups.

Context

The UK Home Office has published or updated significant resources on its website in relation to the Terrorism (Protection of Premises) Act 2025 – known as ‘Martyn’s Law’.  This Act is UK legislation designed to ensure the public is better protected from terrorism. It does this by requiring certain public premises and events to be prepared and ready to keep people safe in the event of an attack.  This will impact insurers and insurance intermediaries in relation to the arranging and provision of insurances for such events and premises, and an understanding of the Act and its provisions will be important.

Key points to note and next actions

• The updated guidance includes Statutory guidance, an overarching factsheet, premises scope guidance, a ‘factsheets’ web page, details of the SIA as the relevant regulator, and recent SIA updates.
• BIBA has also published details of industry webinars being delivered by the Home Office in relation to Martyn’s Law, along with links to resources, which are available to BIBA members through the BIBA website.
• BIBA has highlighted that Webinars will cover the same content, so its recommendation is that firms only attend one:
  • Webinar 1 – 13 August 2026, 11:00 – 12:00, joining Link: https://teams.microsoft.com/meet/368288933229190?p=JQbXEK8Ut58RVjNHb2, meeting ID: 368 288 933 229 190, passcode: 4rz6Rg69Webinar 2 – 14 September 2026, 14:00 – 15:00, joining Link: https://teams.microsoft.com/meet/364265772373723?p=Om3zf9Hqq9OkPl33Mf, meeting ID: 364 265 772 373 723, passcode: nk9Rj3ua
  • Webinar 3 -24 September 2026, 15:00 – 16:00, joining link: https://teams.microsoft.com/meet/342290239063327?p=9188KgO2EgFECCUzFq, meeting ID: 342 290 239 063 327, passcode: GB3S8z3H

Context

The blog explains that agentic AI can bring major productivity benefits, such as automating complex workflows and freeing people for higher-value work, however organisations must manage the risks of autonomous systems behaving unexpectedly. It recommends using safeguards, sandboxing, and active oversight to reduce unintended or unauthorised activity, especially given recent incidents involving AI models and agentic systems.

Key points to note and next actions

• Advice and effective practice will continue to evolve as the technology matures and evidence bases are built.
• Firms need to understand built in safeguards and protections, consider additional safeguards and assess how much autonomy is needed.
• Be clear on the level of autonomy, and risk you are willing to tolerate, as this will inform the design of controls.
• Understanding safeguards available, their efficacy and limitations, will enable determination of additional controls that are needed. Irrespective of inbuilt controls, all deployments should be subject to robust observability, operational monitoring and response procedures.
• Identify what could go wrong – Before deployment, carry out threat modelling to identify the failure scenarios during the agent’s activities.
• Prompt carefully – instructions and context given to an agentic AI system and its underlying model will influence the activities it carries out.
• Set the right level of oversight – this should inform your risk tolerance and the potential consequences if the agent behaves unexpectedly.
• Control the AI agent’s environment with a robust sandbox.
• Observability: log, audit and monitor agentic AI activity as part of security operations.
• Make your AI activity easy to attribute – If your AI agent communicates with third-party systems, make it as easy as possible for those organisations to identify that the activity originates from you.
• Emergency shutdown: maintain the ability to ‘pull the plug’.

Further reading: The advice in this blog should form part of a wider approach to securing AI models and systems. Further information is available in:

• The ETSI standard, EN 304 223. Baseline Cyber Security Requirements for AI Models and Systems
• Thinking carefully before adopting agentic AI
• Careful adoption of agentic AI services

Context

The CMA has published a Provisional Decisions document following its Consultation in relation to a Strategic Review of a number of CMA or remedies and Orders, including the Private Motor Insurance Market Investigation Order 2015 (the PMA Order).  All parts of the PMA Order were to be reviewed except for Part 3 (Wide ‘most favoured nation’ (MFN) clauses between insurers and price comparison websites). 

Key points to note and next actions

• The Parts of the Order which are included in this Strategic Review require insurers and price comparison websites (PCWs) to provide specified information to consumers relating to no-claims bonus protection, and insurance intermediaries to pass that information on to its customers. Insurers, insurance intermediaries and PCWs are also required to provide compliance statements to the CMA.
• The proposal following the review is to remove Part 2, Schedule 1a, Schedule 2, Annex 1 of Schedule 3, paragraph 2 of Schedule 3, Part 4, and Article 6.1(b) (all explained below).  All other parts of the Order will be retained:
  • Part 4, and therefore also Article 6.1(b), which the CMA is proposing to remove, is the requirement to submit the annual compliance statement to the CMA.
  • Part 2 of the Order, together with Schedule 1a, relates to the NCB Protection Statement to be provided by PMI Providers, which includes PMI intermediaries).
  • Schedule 2 relates to NCB Protection Information to be provided by PMI Providers.
  • Annex 1 of Schedule 3 is the template PMI Compliance Statement.
  • The second paragraph of Schedule 3, which relates to the Average NCB Discounts listed in Annex 1.
• We understand that the CMA’s final decision is likely to be published in October 2026, which will be in advance of when the next PMI Compliance Statement would be due to be sent to the CMA.