Wholesale banks supervision - Insights 3 (Autumn 2026)

Data management

Firms with weak data management processes continue to experience problems. In one case, data was inadvertently not ingested into a financial crime control due to a coding defect. The resulting control gap went undetected for an extended period and was only identified through unrelated activity rather than through data monitoring or completeness controls. 

The incident reinforces a message from our last publication: it’s important that firms assess the design and operating effectiveness of data ingestion at the control implementation stage and track clear data lineage from source to consumption. This includes verifying data completeness during ingestion and processing. 

Incomplete ingestion of communications data and errors in lexicon configuration have also adversely impacted banks’ communication surveillance. In some cases, these weaknesses arose during system changes or involved third-party surveillance providers. We remind banks that they remain responsible for meeting our requirements on recording, monitoring and ensuring communications related to in-scope activities are auditable even when they make use of third parties.

Asset inventory management

One firm’s ability to maintain a complete view of its assets was impaired due to a range of weaknesses:  

• Inadequate controls governing the disposal and redeployment of assets resulting in inventory records not always being updated when devices were disposed of or transferred.
• Asset management processes not applied consistently across business areas and regions. 
• Accountability for end-to-end asset lifecycle management was insufficiently defined.
• Regular stocktakes and reconciliations were not consistently performed. 

As a result, the firm was unable to reliably determine the location, status or disposition of a significant number of technology assets. This included assets that lacked contemporary security controls such as device encryption. 

Algorithmic trading controls

We have seen weaknesses in firms’ algorithmic trading controls. In the most serious instance, a defect in how a firm’s algorithm interacted with its order management component for a stop-loss order led to the unintended accumulation of a very significant intraday position. The defect meant that the algorithm operated with an incorrect view of its executed quantity. 

The defect arose following an enhancement to the algorithm. The pre-implementation testing focused on simulation testing of the change. It did not consider a scenario of near-simultaneous fills in different geographic locations, which would have identified an error in the order management component responsible for communicating fill notifications. This resulted in the order being over-filled. 

The incident illustrates why firms enhancing their trading algorithms should assess the impact of those changes across the entire trading process, including whether the change creates unforeseen interactions with execution venues, data or fill notifications.

More generally, we also remind firms of the regulatory technical standard (RTS) 6 requirements governing algorithmic trading controls. These cover areas including testing, governance and oversight, pre-trade controls, and mechanisms to cancel unexecuted orders where necessary. While developed for algorithmic trading, these types of controls may provide useful considerations for firms when managing the risks associated with AI and other forms of automation.

Data loss prevention framework

An employee at a bank attempted to evade data loss prevention (DLP) controls designed to prevent sensitive information being sent outside the firm by email. The individual adapted their behaviour over time, exploiting limitations in existing controls to reduce the likelihood of detection. This included splitting information across multiple emails to remain below size restrictions, altering document classifications and file formats, embedding information within images and using misleading email subjects. 

Evidencing resilience in practice 

Through our supervisory work we’ve seen that wholesale banks have continued to enhance operational resilience arrangements including governance, important business service identification, impact tolerance setting, mapping and scenario testing. There is still room for improvement in areas such as: 

• Self-assessments: the evidence that firms used to support their operational resilience self-assessments varied in quality. Stronger submissions used granular metrics and linked these clearly to impact tolerances, scenario testing, vulnerabilities, remediation and Board reporting. 
• Impact tolerances and market harm: banks should be able to explain how they have calibrated their impact tolerances by reference to the potential impact of disruption on trading, settlement, client and counterparty activity and other time-critical wholesale market processes. They shouldn’t rely solely on generic recovery time objectives or service availability measures if they don’t fully capture the potential harm arising from disruption. 
• Remediation: where banks rely on future remediation or transformation activity, they should clearly distinguish in their self-assessments between that and current resilience capability. Firms should also show how incidents, near misses and testing outcomes have informed mapping, vulnerability assessment, remediation priorities and future scenario design including how completed remediation has been validated or re-tested. 
• T+1 settlement: firms with settlement-related important business services should consider how the move to T+1 securities settlement may affect post-trade processing, dependencies, scenario testing, ability to recover within impact tolerance and remediation priorities. They should consider if shorter settlement timelines create disruption that could affect clients, counterparties or market activity. 

Firms may wish to consider these observations alongside our operational resilience insights and observations[1] which provide cross-sector examples of good practice, common weaknesses and areas for continued improvement.

Cryptoassets: the new regime 

Our new cryptoasset application window opened on 30 September 2026 ahead of the new UK cryptoasset regime coming into force in 2027.

The cryptoasset regime[2] is a major step forward. It will bring more cryptoasset activities within our remit including custody, operating trading platforms, dealing, arranging deals, stablecoin issuance and staking.

Wholesale banks can now submit a variation of permission (VoP) application to carry out regulated cryptoasset activities. We encourage banks to submit an application by 28 February 2027. Firms that submit before this date will either be told about the outcome of their application before the regime comes into force on 25 October 2027 or, if we’re still working on the application by that point, can carry on their cryptoasset activities while we reach a decision. 

If a firm applies after 28 February 2027, but before the full regime starts on 25 October 2027, it will enter the transitional provision[3] while the application is determined. During this, firms will be limited in the cryptoasset activities they can conduct. A bank will only be able to conduct the new UK-regulated cryptoasset activities where necessary to fulfil a contract agreed before entering the transitional provision. They cannot enter into new contracts with existing or new UK customers. Find out how the gateway will operate[4] for firms that want to undertake the new cryptoasset regulated activities.

We remind firms about the pre-application services[5] we offer to firms for this VoP application. These services can also be used by firms when considering changes to their permissions, applying for rule waivers or making a change in control notification.

Innovation in digital market infrastructure 

We continue to see demand from firms seeking regulatory support through the Regulatory Sandbox and Innovation Pathways. In the first half of 2026, we saw several wholesale market propositions focused on digital infrastructure. This included solutions to improve liquidity, connectivity and portfolio management in private credit, digitise trade documents and workflows and support new approaches to fundraising, investment and ownership through digital platforms. 

These examples highlight the importance of considering the specific role and activities of the firm or platform including how assets are controlled, held and settled. Firms developing innovative market infrastructure should consider these issues early and, where appropriate, seek regulatory support to understand how their model, controls and arrangements may operate before wider deployment.

We are also using thematic Regulatory Sandbox cohorts to take a focused look at specific areas of innovation. Our next themed cohort will focus on climate scenario models, with the application window running from 1 October to 30 November 2026. The cohort will look at how firms develop and use climate scenario models[6] and how these models may help firms better understand climate-related financial risks.

To access these services and find out more about how the FCA supports innovation, please see our pages on the Regulatory Sandbox[7] and Innovation Pathways[8]. 

We will shortly publish, jointly with the Bank of England, a roadmap setting out next steps for tokenisation in UK wholesale markets.

Artificial Intelligence (AI)

In September, we published what we had learned from how firms are using, testing and preparing for frontier AI models[9].

More broadly, we have recently published AI in financial services: good practice and areas for improvement[10], which shares examples from across financial services. We also remind banks that there are ways we can support an idea or firm on AI[11].

We’ve also been engaging with banks to learn more about how they are using and governing AI elsewhere in their business. A key focus was on effective human oversight as AI-generated outputs increase and become more autonomous. In one incident, inaccurate AI-generated code recommendations were not identified during the human review stage and resulted in a loss of service. This firm introduced additional controls, including test cases and strengthening feedback mechanisms to improve the accuracy of AI-generated recommendations. 

There have been incidents of staff using AI tools unapproved by the firm resulting in data leaks, including of sensitive information. To address this, we saw firms implement mandatory training, attestations and amnesty periods to identify previously undisclosed AI usage. Firms will need to be vigilant to this risk, consider their control framework and reinforce expectations to their staff.  

As might be expected, AI is increasingly featuring in reviews by banks’ internal audit functions. Here are some areas for improvement that they have identified:  

• Committees not tracking conditional approvals and one instance where the formal approval process was not followed.
• Recording conditional approvals as full approvals.
• A use case that progressed to production under an undocumented exception.
• Inconsistencies in risk-tiering/rating agents.  
• Insufficient training, testing and maintenance of kill switches, as well as no documented list of authorised individuals to operate them.
• Incomplete AI inventories.

The FCA and Bank of England 2026 AI Survey[12] was published on 26 October 2026.

Unregistered annex 1 firms  

Certain businesses, including some unregulated lenders, safe custody providers, money brokers and financial leasing companies, may need to register with the FCA under the Money Laundering Regulations 2017. We see banks providing funding and other services to firms that are not legally permitted to carry on annex 1 activities. Banks should ensure that their financial crime systems and controls enable them to identify and manage the risks associated with the firms they fund or service. If a bank’s checks raise concerns about potentially unlawful annex 1 activity, it should contact the FCA’s firm queries team at [email protected] or on 0300 500 0597. 

Due diligence before investing in securitisation  

The definition of securitisation in UK legislation is quite broad and encompasses a large number of financings where the credit risk is tranched. Often those financings are done privately and involve regulated entities taking risk on the structure by investing or lending on a senior basis.

Whether private or public, financings that come under the securitisation definition are regulated under FCA and PRA rules. In particular, this means that institutional lenders/investors in those transactions are subject to due diligence obligations to ensure that they properly understand and assess the risks of the securitisations they invest in, both before investing and throughout the life of the investments. The FCA will soon publish its revised rules for securitisations. The rules reaffirm the critical importance of due diligence, focusing on the outcome rather than prescribing how it should be done.  

Examples of good practices that the FCA has observed when it comes to due diligence include enhanced due diligence on the credit-granting standards of originators which are neither capital requirements regulation (CRR) firms nor FCA-authorised investment firms, specific controls and risk appetite for securitisations backed by asset types which are more susceptible to fraud or at risk of double-pledging and investors taking an active role in the design and governance of agreed upon procedures (AUPs).

Prime brokerage: client risk assessment  

We reviewed how 6 wholesale banks' prime brokerage businesses incorporate conduct and reputational risk information into client risk assessments. We did this by selecting a sample of clients to test how processes were applied in practice. 

Our main observation is that, at some firms, we found limited evidence of sharing client information generated through surveillance, investigations, know your customer processes and ongoing monitoring with those responsible for managing client risk appetite.

Some firms cited confidentiality concerns as a barrier to sharing information across divisions. The strongest firms in our sample were able to share information across divisions and through escalation on a timely basis (for example through the use of forums and committees) while complying with legal and regulatory obligations and clients’ best interests. This enhanced the client risk assessment process. 

For example, one firm used information from across the business and control functions to identify emerging concerns about a client. Trade surveillance alerts, regulatory issues in different jurisdictions, inadequate awareness by the client of risks associated with its underlying clients as well as poor communications all pointed to increased risk. 

In response, the prime broker took progressively stronger action, engaging with the client to address shortcomings, restricting activity and, because the risk remained outside of the banks’ risk appetite, ultimately offboarding the client. In another example, the firm incorporated trading activity and regulatory findings into ongoing client risk assessments. This led to the prime broker reducing the client’s leverage and capacity limits. 

In these examples, we did not observe unrestricted information sharing, but we did see arrangements that enabled relevant risk information, or an appropriate assessment of it, to be made available to those responsible for client risk decisions. 

In another business line we saw one firm recognise that it needed to improve how it considered financial crime risk indicators in aggregate. On their own, indicators had not necessarily met the firm’s threshold for escalation but collectively, they pointed to a deteriorating client risk profile.

Request for quote (RFQ) controls 

At one firm, in submitting a request for a quote for a fixed income product, a trader did not understand the platform’s denomination convention and so manually entered a notional figure in the billions rather than the millions it should have been. The error was promptly identified and both parties agreed to cancel the trade, but not before it had been submitted for clearing. 

Weaknesses in ‘fat finger’ controls were identified in this and other high-touch platforms used for RFQ. Specifically, the firm identified that: 

• Onboarding requirements did not establish minimum levels of ‘fat finger’ controls (for example combinations of price, quantity, notional, volume, or other trade economics), soft block functionality and vendor control activation and controls inconsistently applied across all platforms.
• It wasn’t maintaining a platform inventory detailing the hard and soft block ‘fat finger’ controls in operation by product. 
• Annual supervisory review by business units to confirm completeness and accuracy were not performed; periodic testing of ‘fat finger’ controls was not conducted comprehensively or consistently. 
• Periodic reviews of limits and thresholds associated with hard and soft blocks were not performed and audit trails for changes did not exist. 

Firm’s governance and supervision should ensure that controls preventing the entry of erroneous orders, quotes and indications of interest are appropriately implemented, periodically tested and that thresholds and limits are calibrated to reflect current business activity.  

Internal audit metrics

We are sharing 2 key metrics gathered from the internal audit functions of 7 wholesale bank subsidiaries to provide a reference point banks may otherwise not have. There will be important underlying context to this data and, as a result, we are not providing commentary.