Welcome to the UKGI weekly regulation update service for Aviva ABC brokers

Context

To support the safe and responsible adoption of artificial intelligence (AI) in financial services, the FCA has shared good practice and areas for improvement examples from industry engagement, supervisory work and its AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox.  It has also included a link within the report to its AI Update.

This information is relevant to regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance. This includes AI tools developed in-house, supplied by a third party, embedded in another system or used by staff to support decision making.

Key points to note and next actions

• The examples in this publication identify common themes and developing practices which are relevant to a variety of AI use cases, such as those using machine learning, generative AI or agentic AI.  They are illustrative, non-exhaustive and will evolve as practice develops.  They do not create new requirements, prescribe a single model or replace firms’ responsibility for considering what is appropriate and proportionate for their own AI use cases, risks and potential impact.
• There is no one-size-fits-all approach. Firms should respond proportionately to each AI use case, its risks and its potential impact on consumers and markets.
• The report sets out the existing rules and regulatory framework apply to firms’ use of AI:
• Safety, security, robustness: FCA’s Principles for Businesses (PRIN), FCA’s Threshold Conditions (COND), Senior Management Arrangements, Systems and Controls (SYSC), operational resilience, outsourcing and critical third parties regime.
• Fairness, appropriate transparency and explainability: PRIN, Consumer Duty, Guidance for firms on the fair treatment of vulnerable customers, COND, related ICO guidance and Equality Act 2010.
• Accountability and governance: Senior Managers and Certification Regime (SM&CR) among others noted above.
• Contestability and redress: Dispute Resolution: Complaints’ Sourcebook (DISP).
• The report contains links to FCA resources in relation to AI and links to external resources.  It also contains a useful ‘AI Jargon Buster’ section explaining several AI-related terms.
• The report is quite lengthy, and includes commentary split into three main sections:
• Consumer Duty and consumers in vulnerable circumstances – how firms use AI to achieve good consumer outcomes.
• Governance and accountability – how firms oversee and effectively govern across the AI lifecycle.
• Operational resilience – how firms make sure they deploy AI securely and sustainably.
• Each of the three sections contains a key findings summary, examples of good practice, examples of areas for improvement, case studies (there are a total of 20 case studies throughout the report), and several ‘Smaller firms focus’ notes in the Consumer Duty and Governance and Accountability sections of the report.
• We recommend that all firms should read and understand the report, and the FCA is to publish a joint AI survey with the Bank of England next week which shows that 86% of firms now use AI.

Context

The FCA has published a speech given by Jessica Rusu, FCA Chief Data, Information and Intelligence Officer at Bloomberg’s UK Policy Series event.  The speech comments on the Mills Review, putting the customer first, knowing who is accountable, operational resilience, and the FCA becoming an ‘agentic regulator’.

Key points to note and next actions

• The FCA wants the UK to be at the forefront of the safe and responsible adoption of artificial intelligence (AI) in financial services, supporting innovation, productivity and economic growth.
• As AI evolves towards increasingly autonomous systems, firms should put consumers first, maintain clear accountability and plan for when things go wrong.
• The FCA has shared examples of good and poor AI practice to help firms innovate responsibly (see the article above), with a focus on putting consumers first, ensuring clear accountability and planning for failure.
• The FCA is becoming a smarter regulator, using AI in its own work and taking forward the Mills Review through engagement, testing and action.

Context

The FCA has updated its Reporting complaints web page, and has published a data-capture flow diagram for the new complaints reporting return, COM001.

Key points to note and next actions

• The web page has had a section added to outline resources to understand the new return.
• The FCA has published Data Reference Guides for COM001, which include the XML specifications and details of validation rules.  Firms can find these guides on the FCA’s RegData resources page.
• To help you understand which questions to complete and how the return captures information, the FCA has also published a data flow diagram (PDF).
• Once COM001 is ready, you’ll be able to access it in the FCA’s RegData industry test environment.  To register for the test environment, email RegDataTest@fca.org.uk.

Context

The FCA has published complaints data for the first six months of 2026.

Key points to note and next actions

• There were 1.85 million complaints received between January and June 2026, 6.3% more than in the previous 6 months. 
• Current accounts remained the most complained-about product. 
• Of the 1,033,011 complaints which were upheld, firms found in favour of the complainants in just over half of complaints received. 
• Consumers received £240 million in redress payments.
• 44.8% of complaints were closed within three days, 49.7% were closed after three days but within eight weeks, and 5.5% took longer than eight weeks. Overall, 94.5% of complaints were closed within eight weeks.

Context

The FCA has published a speech given by Sarah Pritchard, FCA Deputy Chief Executive, at the Investment Association Annual Dinner 2026.  Pritchard speaks about reform being about more than writing rules, trust being fundamental to success, and she acknowledges the speed at which markets are changing.

Key points to note and next actions

• In an ever-changing environment, the FCA’s strategy is its anchor.  Its priorities – supporting growth, being a smarter regulator, helping consumers and fighting financial crime – help it decide consistently and act for the long term.  
• While the FCA is past the peak of rulemaking, it is still taking a deliberate, strategic approach to reform rather than taking a piecemeal approach.
• The FCA encourages firms to engage with it, and to tell it where the friction lies, so the FCA and the financial services industry can together build a ‘system that works’.

Context

The FCA has banned Jeffrey Dawkins, the former Chief Executive of Vector Wealth Ltd, after he dishonestly acted as a front for a disqualified director using the company to sell high-risk bonds.  Mr Dawkins has also been fined nearly £270,000.

Key points to note and next actions

• In 2019, Mr Dawkins sold Vector Wealth to a disqualified director (who has not been named) who described himself as CEO and wanted to use Vector Wealth’s FCA-authorised status to sell mini-bonds. 
• Mr Dawkins told the FCA he was still in charge, but the new “CEO” was really running the firm. This deception allowed the disqualified director to promote mini-bonds using the legitimacy of the firm to make them appear safer than they were.  
• The disqualified director and Kadir Kanizi, a former senior manager at Vector Wealth, promoted the bonds but investors were not properly warned about the risks. 
• Investors put in £105,000 on average, with one investing £1.1 million. Before seeing the marketing material, they had to confirm they were high net worth or sophisticated investors.  Investors are expected to lose about £4 million. 
• The FCA has banned Mr Kanizi from senior management roles. He was fined for failing to make sure consumers were properly warned about the risks. 

Context

FSCS has confirmed that Verus Financial Services Ltd (Verus) is ‘under investigation’.  Verus has been authorised by the FCA since March 2017, and was an independent financial adviser firm providing investment, pension, mortgage, equity release and insurance advice.

Key points to note and next actions

• Verus had its Permissions varied by the FCA in October 2025, which superseded an earlier VREQ from 2023.
• Verus also had notification requirements (website information), records retention requirements and asset non-disposal requirements imposed on it in October 2025.
• FSCS is now open to customer claims. If customers believe they have a potential compensation claim against Verus, they can apply using the FSCS online claim service.
• FSCS is currently investigating the firm to determine whether claims meet the qualifying conditions for compensation, and this may take some time. FSCS is working closely with the FCA.

Context

FSCS has confirmed that Anthony Jones (U.K.) Ltd is formally ‘under investigation’.  On 11 August 2026, Duncan Beat and Nicholas Simmonds of Quantuma Advisory Ltd were appointed as joint liquidators of AJL. You can read the joint liquidators’ update on their website. 

Key points to note and next actions

• FSCS understands that many customers have confirmed that their insurance cover remains in place. However, some may find that, despite paying for insurance, the policy was not placed with an insurer and so no cover exists.
• FSCS is now open to claims from customers who have paid for insurance through AJL but find themselves without the relevant cover and are unable to recover the premiums paid by other means.
• FSCS has eligibility criteria in respect of the activities and the people who are covered. In general terms, FSCS protection applies to individuals and small companies.
• Although FSCS is accepting claims against AJL, they will not be immediately passed to the claims processing teams for assessment. FSCS is currently investigating the situation to understand more about what has happened., and it will be working closely with the joint liquidators and the FCA. 

Context

The ICO has issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following a ransomware attack. During the attack the personal information of 3,300 people was taken, the majority of whom were children.

Key points to note and next actions

• The attack exploited a test account, known as ‘Test2’, that had existed for more than 12 years and had either remained active since it was created or been inadvertently reactivated before the incident.
• It was found that throughout this period, the ‘Test2’ account was protected by the password ‘Password1’, which, when checked against a third-party password strength tool, was classified as ‘very weak’ and could be compromised in less than a second.
• The ransomware attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB of data being taken from Data Cymru’s systems. The compromised information related to two projects supporting children and families.
• The ICO commented that ‘Password1’ is not an appropriate password, and that it is a “wide-open door to nefarious actors”.

Organisations should:

• Remove accounts that are no longer required: test, dormant and former-user accounts should be routinely identified and deactivated.
• Block weak and commonly used passwords: password controls should prevent easily guessed credentials such as ‘Password1’ from being used.
• Protect remote access: multi-factor authentication should be applied to remote access services by default.
• Audit the whole account environment: reviews should cover all relevant accounts, permissions and security groups, not just a limited subset.
• Avoid shared administrative credentials: privileged accounts should use unique credentials so that one compromised system does not provide access to others.
• Define responsibilities in contracts: agreements with IT providers and sub-processors should clearly explain how security controls will be delivered, monitored and audited, and include all legally mandated provisions.

Context

The ASA has published an Insights article about advertising accident management services.  Accident management companies (AMCs) provide services such as vehicle recovery, repairs and help with insurance claims after a non-fault traffic accident. Consumers typically contact an AMC shortly after an accident has occurred and so are likely to be vulnerable.

Key points to note and next actions

• Ads for these services should make clear the nature of their service, the limitations on those they can assist and should be upfront about the potential costs incurred using such companies.
• The ASA has published several upheld rulings where AMC’s have fallen foul of the ASA’s CAP Code.
• The key headings in the article are:
  • Don’t pretend to be someone you’re not (so don’t imply you’re an insurer).
  • Don’t imply approval or endorsement from a public body.
  • Don’t cross the line into irresponsibility.