TRW & Co · Funds & Financial Services
Financial Services Regulation Solicitors in London
Financial services regulatory lawyers London firms rely on help them decide whether they need permission, meet FCA and PRA rules once authorised, and respond when the regulator calls. 2026 brings SM&CR reform, motor finance redress, BNPL regulation, new safeguarding rules and the cryptoasset application window, so getting the analysis right now is critical.
Key pointCarrying on a regulated activity without permission is a criminal offence and can make customer agreements unenforceable, so a written perimeter analysis before launch, refreshed whenever the product changes, is the single most valuable regulatory document a new business can hold.
At a glance
Core statute
FSMA 2000 prohibits unauthorised regulated activity under section 19, restricts financial promotions under section 21 and sets threshold conditions in Schedule 6.
Two main regulators
The FCA regulates conduct for all firms; the Bank of England's PRA supervises banks, insurers and major investment firms prudentially.
Consumer Duty
In force for open products since 31 July 2023 and closed products since 31 July 2024, requiring firms to evidence good retail customer outcomes.
Crypto regime timetable
The FSMA (Cryptoassets) Regulations 2026 bring cryptoasset activities into authorisation from 25 October 2027, with applications opening in autumn 2026.
Motor finance redress
FCA PS26/3 created two section 404 redress schemes covering motor finance agreements from 2007 to 2024, with deadlines running into 2027.
Swipe or scroll →
What financial services regulatory lawyers London firms instruct cover
Financial services regulatory lawyers London firms, fintechs and investors instruct answer three recurring questions: do we need permission for what we plan to do, what rules apply once we have it, and how do we respond when the regulator asks questions? The answers determine whether a business can launch, how much its compliance costs and how exposed its senior managers are personally.
Regulation reaches far beyond banks and insurers. Wealth managers, brokers, fund managers, consumer lenders, payment and e-money firms, cryptoasset businesses, insurance intermediaries, platforms and their technology suppliers are all affected. Non-financial businesses meet it too, when they offer credit, take payments, promote investments or acquire a regulated firm.
The rulebook is also moving quickly. In 2026 firms are dealing with reform of the senior managers regime, a statutory redress scheme for motor finance, new safeguarding rules for payment firms, regulation of buy-now-pay-later, a new cryptoasset regime with an application window opening this autumn and proposed changes to how alternative fund managers are regulated.
The legal and regulatory framework
The Financial Services and Markets Act 2000 (FSMA) is the backbone. Section 19 prohibits carrying on a regulated activity by way of business in the UK unless authorised or exempt; section 21 restricts financial promotions; Part 4A sets out how permissions are granted; and Schedule 6 contains the threshold conditions every firm must meet continuously. The activities themselves are listed in the Regulated Activities Order 2001.
The Financial Services and Markets Act 2023 began the process of revoking assimilated EU financial services law and replacing it with regulator rules, and gave the FCA and PRA a secondary objective to facilitate the international competitiveness and growth of the UK economy. Much of the 2025–26 reform agenda flows from that shift.
Alongside FSMA
- The Money Laundering Regulations 2017, which apply to regulated firms and to registered cryptoasset businesses.
- The Payment Services Regulations 2017 and Electronic Money Regulations 2011, which have their own authorisation and safeguarding regimes.
- The Consumer Credit Act 1974, still central to consumer lending despite planned reform.
The regulators
The FCA regulates conduct for all firms and prudential matters for most. The Bank of England's Prudential Regulation Authority supervises banks, building societies, insurers and major investment firms for safety and soundness. The Payment Systems Regulator oversees payment systems; HM Treasury has confirmed it will fold the PSR into the FCA, subject to primary legislation. Disputes with consumers go to the Financial Ombudsman Service, the Financial Services Compensation Scheme pays out when firms fail, and contested FCA and PRA decisions can be referred to the Upper Tribunal. FSMA applies across the UK, but consumer contract and insolvency law differ in Scotland and Northern Ireland.
The perimeter: which regime applies to you
The first task for financial services regulatory lawyers London businesses consult is mapping the perimeter. Getting it wrong is serious: carrying on a regulated activity without permission is a criminal offence, and agreements made in breach may be unenforceable against customers.
| Regime | Who needs it | Regulator | Key point |
|---|---|---|---|
| Part 4A FSMA permission | Banks, insurers, investment firms, fund managers, brokers, consumer credit firms | FCA (and PRA for dual-regulated firms) | Statutory deadline of six months for complete applications |
| Payment institution / e-money institution | Payment service providers and e-money issuers | FCA | Separate regimes with capital and safeguarding requirements |
| MLR registration | Cryptoasset exchange and custodian businesses (until the new regime) | FCA | Anti-money laundering registration, not full authorisation |
| Cryptoasset authorisation | Firms carrying on the new cryptoasset activities | FCA | Regime goes live 25 October 2027; application window opened 30 September 2026 |
| Deferred payment credit (BNPL) | Third-party buy-now-pay-later lenders | FCA | Regulated from 15 July 2026, with a temporary permissions regime |
| Appointed representative | Firms acting under an authorised principal | Principal (FCA supervises the principal) | Principal is responsible for the AR's regulated activities |
Overseas firms can sometimes rely on the overseas persons exclusion or deal only with professional clients from abroad, but the exclusions are narrow. Our FCA authorisation page explains the application process in detail, and our payments and e-money and cryptoassets teams advise on the specialist regimes.
Conduct, governance and accountability
The Principles for Businesses
Every authorised firm is bound by the FCA's Principles for Businesses, which include integrity, skill and care, adequate financial resources, treating customers fairly and dealing with regulators openly and cooperatively. Principle 12, added with the Consumer Duty, sits above the more detailed rules for retail business. The FCA can and does take enforcement action for breach of a Principle alone, so financial services regulatory lawyers London firms consult tend to test novel products against the Principles first and the detailed rules second.
The Consumer Duty
The Consumer Duty requires firms to act to deliver good outcomes for retail customers. It applies to open products since 31 July 2023 and to closed products since 31 July 2024. It is outcome-focused: firms must evidence fair value, consumer understanding, appropriate support and products that meet target market needs. See our guide to the FCA Consumer Duty.
The Senior Managers and Certification Regime
SM&CR makes named individuals accountable for specific responsibilities. The first reform changes took effect in 2026, including longer validity for criminal records checks, more time for directory updates and higher thresholds for "enhanced" firms. A more fundamental second phase, including HM Treasury's proposal to remove the certification regime from legislation, requires amendments to FSMA and has no fixed timetable. Our article on SM&CR reform explains what has changed.
Financial promotions, resilience and safeguarding
Financial promotions must be fair, clear and not misleading, and since 2024 authorised firms approving promotions for unauthorised firms need specific permission to do so. Operational resilience rules require firms to remain within impact tolerances for important business services. For payments and e-money firms, the FCA's enhanced safeguarding rules took effect on 7 May 2026, adding reconciliation, monthly reporting and audit obligations.
Under the Consumer Duty, the question is no longer only "did we follow the rule?" but "can we show the customer got a good outcome?"
Live regulatory issues in 2026
Several developments are dominating the agendas financial services regulatory lawyers London boards are bringing to us this year.
- Motor finance redress. The FCA's PS26/3, made under section 404 of FSMA, sets up two redress schemes covering motor finance agreements from 2007 to 2024, with staged deadlines for complainants and an opt-in route for non-complainants through 2027. See our motor finance redress scheme guide.
- Cryptoassets. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset trading, custody, staking and stablecoin issuance into FSMA authorisation from 25 October 2027.
- Buy-now-pay-later. Deferred payment credit offered by third-party lenders became regulated on 15 July 2026.
- Fund managers. The FCA's CP26/28 proposes a new tiered AIFM regime envisaged for 2028.
- Retail disclosure. The Consumer Composite Investments regime is replacing PRIIPs-style documents, fully in force from June 2027.
- Authorisation speed. The FCA has set itself faster targets and the Government has consulted on shorter statutory deadlines.
Payments, fraud and consumer credit
Payments regulation has become a focus in its own right. Mandatory reimbursement of authorised push payment fraud for Faster Payments has applied since October 2024, the new safeguarding rules took effect in May 2026, and the PSR's functions are due to move into the FCA. Consumer credit firms face Consumer Credit Act reform, the BNPL regime and continuing scrutiny of affordability and forbearance. Our consumer credit team advises lenders and brokers on each of these.
For many firms the practical challenge is sequencing. Financial services regulatory lawyers London boards work with can help prioritise the changes that carry hard deadlines or personal accountability, and phase the rest into an achievable plan.
Supervision, investigations and enforcement
Most regulatory risk is managed in supervision, not enforcement. The FCA uses information requirements under section 165 of FSMA, skilled person reviews under section 166, and requirements or restrictions on permission. Many issues are resolved through remediation, voluntary requirements or past-business reviews without a formal investigation.
Formal investigations are opened by appointing investigators under section 167 or 168. Cases can end with no action, a private warning, or a statutory notice process leading to a fine, public censure, prohibition or restitution. Firms and individuals can contest decisions before the Upper Tribunal. Our FCA enforcement team handles investigations, and our article on responding to an FCA investigation sets out the first steps; where advocacy in the higher courts or the tribunal is required, we instruct specialist counsel.
Customer redress and private claims
Regulatory breaches also create civil exposure. Eligible complainants can take complaints to the Financial Ombudsman Service, which decides what is fair and reasonable rather than applying strict legal rights, and can award compensation up to a binding limit. Private persons who suffer loss from breach of certain FCA rules can sue under section 138D of FSMA. Where many customers are affected, the FCA can require a consumer redress scheme, as it has done for motor finance, or firms may run voluntary past-business reviews.
A practical regulatory change programme
- Horizon scan. Track policy statements, consultation papers and Dear CEO letters relevant to your permissions and products.
- Gap analysis. Map each new requirement against current policies, systems, contracts and customer journeys.
- Accountability. Assign ownership to a senior manager and update the statement of responsibilities and management responsibilities map.
- Implementation. Change documents, systems, training and controls; update customer terms and disclosures where needed.
- Evidence. Produce board papers, management information and testing that demonstrate compliance, particularly for the Consumer Duty.
- Attestation and review. Report to the board, complete any required attestations and schedule post-implementation reviews.
Documents and evidence regulators expect
Whether you are applying, being supervised or under investigation, the regulator will expect to see a consistent paper trail:
- Regulatory business plan, financial projections and capital and liquidity assessments.
- Governance map, terms of reference, board and committee minutes.
- Statements of responsibilities and the management responsibilities map.
- Compliance monitoring plan, risk register and breach log.
- Consumer Duty fair value assessments, outcomes monitoring and annual board report.
- Financial crime policies, customer risk assessment and suspicious activity reporting records.
- Outsourcing and third-party agreements, including cloud and critical service providers.
- Complaints data and root-cause analysis.
Consistency across these documents matters as much as their content. Supervisors compare what the business plan says with what the governance map, the board minutes and the customer-facing terms say. Gaps between them, such as a senior manager whose statement of responsibilities does not cover an activity the firm actually performs, are among the first issues a supervisor or skilled person will raise. Review the set together at least annually and whenever the business model changes.
Firms should also keep a regulatory correspondence log recording every material communication with the FCA or PRA, what was promised and by when. It protects the firm if staff change and makes it far easier to answer the regulator's follow-up questions accurately.
When the FCA writes with a request, the first response sets the tone of the relationship. Check the legal basis of the request, agree a realistic timetable early, consider privilege before producing internal reviews, and make sure answers are accurate and consistent with what the firm has said before. Inaccurate or incomplete responses can themselves become a breach of Principle 11.
Risks and common mistakes
Assuming an activity is outside the perimeter
Many businesses assume their model is unregulated because it is technology-led, business-to-business or offered from abroad. The Regulated Activities Order is broad, and the exclusions are narrow and technical. Arranging deals, making introductions, holding client money or providing credit can each trigger regulation. Take a written perimeter analysis before launch and revisit it whenever the product changes. A short opinion is far cheaper than unwinding unenforceable agreements or responding to a perimeter investigation.
Treating the Consumer Duty as a documentation exercise
Firms that produced Consumer Duty policies but did not change products, pricing or customer journeys are now exposed. The FCA expects outcomes data, testing and action where customers are not getting fair value or support, especially for vulnerable customers. Boards must sign off an annual report. Make sure management information shows actual outcomes and that issues found are fixed, documented and escalated.
Weak oversight of appointed representatives
Principals are responsible for their appointed representatives' regulated activities. The FCA has strengthened its expectations on onboarding, oversight, annual review and termination. Firms that host many ARs, or ARs with complex models, attract attention. Due diligence, clear contracts, monitoring and adequate resource are essential, and failures can lead to redress obligations for the principal.
Changing control without approval
Acquiring or increasing control of an authorised firm without prior approval is a criminal offence under FSMA. Investors, including private equity funds and their managers, sometimes overlook indirect controllers or the thresholds that trigger approval. Build regulatory approval into transaction timetables, file complete notices and avoid completing until approval is received.
Underestimating personal accountability
Under SM&CR senior managers can be held personally accountable for failures in their areas of responsibility if they did not take reasonable steps. Even with the 2026 reforms, the duty of responsibility remains. Senior managers should keep their statements of responsibilities accurate, ensure they receive adequate information and document the steps they take when issues arise.
Cross-border regulation: Bangladesh, the EU, the Gulf and Singapore
Cross-border businesses need regulatory analysis in each market they serve. UK firms lost EU passporting rights after Brexit, so serving EU clients depends on local licences, reverse solicitation or national regimes, and the EU has tightened rules on third-country branches. Equivalence decisions cover only limited areas.
For Bangladesh, banking and payments are regulated by Bangladesh Bank, capital markets by the Bangladesh Securities and Exchange Commission and insurance by the Insurance Development and Regulatory Authority. Remittance corridors between the UK and Bangladesh involve both UK payment services regulation and Bangladesh's foreign exchange rules, and Bangladeshi institutions with UK operations must satisfy UK authorisation and AML requirements. Our UK–Bangladesh trade and finance team works on these matters with our Dhaka office.
Financial services regulatory lawyers London groups instruct for international expansion usually start by deciding where each regulated activity will actually be carried on, because that determines which licences are needed. In the Gulf, the DIFC and ADGM have their own financial regulators, separate from onshore UAE regulation. Singapore's Monetary Authority of Singapore runs a distinct licensing regime. TRW & Co's offices in Dubai and Singapore help coordinate multi-jurisdiction licensing strategies.
How TRW & Co's financial services regulatory lawyers London team helps
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. We advise authorised firms, applicants, investors and their boards on the full regulatory life-cycle.
Perimeter and permissions
We analyse whether activities are regulated, advise on exclusions and exemptions, and prepare authorisation, variation and registration applications.
Conduct and Consumer Duty
We review products, customer journeys, terms and promotions, and help boards evidence fair value and good outcomes.
Governance and SM&CR
We draft responsibilities maps, statements of responsibilities and governance frameworks, and advise senior managers on their personal position.
Transactions
We conduct regulatory due diligence, manage change in control approvals and advise on regulatory warranties in acquisitions of regulated firms.
Supervision and investigations
We manage information requests, skilled person reviews and remediation, and act in enforcement investigations.
Redress and disputes
We advise on redress schemes, past-business reviews and complaints, working with our banking and financial disputes colleagues.
Explore related services on our practices page.
Checklist for boards and senior managers
- Do we have a current written perimeter analysis for every product and market?
- Are our permissions, including any approval permissions for promotions, aligned with what we actually do?
- Can we evidence good outcomes and fair value under the Consumer Duty?
- Are SM&CR documents accurate following the 2026 changes?
- Have we assessed exposure to the motor finance redress scheme, BNPL regulation or the cryptoasset regime where relevant?
- Are our appointed representatives and outsourcing arrangements properly overseen?
- Do we have a protocol for responding to regulator requests, including privilege?
- Are transactions involving changes in control built around regulatory approval timelines?
To speak to financial services regulatory lawyers London based at TRW & Co, contact us at info@trw.co or +880 1779 127165, or visit Holborn Gate, 330 High Holborn, London WC1V 7QH.
Frequently asked questions
01How do I know whether my business needs FCA authorisation?
Start by identifying every activity the business carries on and comparing it with the Regulated Activities Order and the specialist regimes for payments, e-money, consumer credit and cryptoassets. Then check whether any exclusion or exemption applies, including those for overseas persons and group activities. The FCA's Perimeter Guidance Manual is a helpful reference, but a written legal analysis is advisable because the exclusions are narrow and the consequences of error include criminal liability and unenforceable agreements.
02What does the Consumer Duty require in practice?
The Consumer Duty requires firms to act to deliver good outcomes for retail customers, avoid foreseeable harm and support customers in pursuing their financial objectives. In practice firms must assess products and services against four outcomes: products and services, price and value, consumer understanding and consumer support. They need data showing actual outcomes, act on problems found, pay particular attention to vulnerable customers and produce an annual board report. It applies across distribution chains, not only to the firm that faces the customer.
03What changed in the SM&CR in 2026?
The FCA and PRA made a first set of changes in 2026, including extending the validity of criminal records checks, giving firms more time to update the directory and submit replacement senior manager applications, shortening the deadline for regulatory references and raising the thresholds for enhanced firms. HM Treasury has proposed more fundamental changes, including removing the certification regime from legislation, but those require amendments to FSMA and have no fixed timetable. Firms should update their documents and procedures for the changes already in force.
04What happens if the FCA opens an investigation?
The FCA appoints investigators and sends a notice setting out the scope of the investigation. It may require documents and compelled interviews. Firms should preserve documents, consider privilege, manage internal communications carefully and ensure responses are accurate. At the end, the FCA may close the case, issue a private warning or start the statutory notice process. Contested cases go to the Regulatory Decisions Committee and may be referred to the Upper Tribunal. Early specialist advice helps shape the outcome.
05Can an overseas firm serve UK clients without authorisation?
Sometimes. The overseas persons exclusion allows certain activities with or through UK authorised firms, or following legitimate approaches by UK clients, without authorisation. Financial promotion restrictions apply separately and can be triggered by communications into the UK. The exclusions are technical and differ by activity, so firms should obtain advice before targeting UK clients. Where a sustained UK business is planned, a UK authorised subsidiary or branch is often the more reliable route.
06Does buying a stake in a regulated firm need approval?
Yes, if the acquisition creates or increases control above the statutory thresholds. The acquirer must notify the FCA (and PRA where relevant) and obtain approval before completing. The FCA has up to 60 working days to assess a complete notification, which can be extended if it requests further information. Completing without approval is a criminal offence. Indirect controllers, such as fund managers and ultimate parents, may also need approval, so the regulatory analysis should start when the deal is first structured.
Sources and official materials
- Financial Services and Markets Act 2000 — General prohibition, permissions and enforcement
- Financial Services and Markets Act 2023 — Revocation of assimilated EU law and growth objective
- Regulated Activities Order 2001 — List of regulated activities and exclusions
- FCA: Consumer Duty — Rules and guidance for retail customer outcomes
- FCA PS26/3: Motor finance consumer redress scheme — Final rules for motor finance redress
- Bank of England: Prudential regulation — PRA supervision of banks and insurers
- FCA PS25/12: Safeguarding regime — Payments and e-money safeguarding changes
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.