Regulatory Risk & Compliance Report For the Week Ending 17 October 2025

James Ross
Oct 19
6 min read

1. Executive Summary

This report provides a technical analysis of significant regulatory developments for the week ending 17 October 2025, focusing on the key risk and compliance considerations for UK and EU financial services firms. Three dominant themes have emerged: the regulatory response to technological innovation, a continued drive towards enhancing operational and digital resilience, and significant structural reforms to UK market frameworks.

The Bank of England’s strategic approach to AI, DLT, and quantum computing signals an era of proactive regulatory engagement. Firms must now rigorously assess third-party dependencies and model-risk frameworks associated with AI. Simultaneously, the Digital Regulation Co-operation Forum’s (DRCF) call for views on agentic AI highlights looming uncertainties around liability and data protection that require immediate strategic consideration.

In parallel, the EU is advancing its resilience agenda. The Joint Committee of the ESAs has prioritised DORA implementation for 2026, sharpening the focus on the oversight of critical third-party providers. In the UK, the FCA’s review into romance fraud serves as a stark reminder of the financial crime risks associated with digital payment systems and the high expectations for customer protection and vulnerability management.

Finally, foundational changes to UK market architecture are now on a clear implementation path. The confirmation of revocation dates for the UK Prospectus and PRIIPs Regulations under the FSMA 2023 framework, along with the move to a T+1 settlement cycle in the EU by October 2027, necessitates launching major transformation projects to manage significant operational and compliance risks.

Firms are advised to review the detailed analysis below to formulate specific action plans addressing these evolving regulatory landscapes.

2. Thematic Analysis: Risk & Compliance Considerations

2.1. Innovation: AI, DLT, and Digital Assets

Bank of England (BoE) Approach to Innovation & DRCF Call for Views on Agentic AI

Summary: The BoE has outlined its strategic focus on AI, DLT, and quantum computing, acknowledging their potential to reshape financial services. Future work will scrutinise systemic risks from reliance on third-party AI providers, model homogeneity, and issues of explainability. Separately, the DRCF has launched a call for views on the regulatory challenges of “agentic AI” – systems capable of independent decision-making.
Risk Considerations:
- Systemic Risk: Increased use of similar AI models from a few dominant third-party providers could amplify systemic vulnerabilities during market stress.
- Third-Party Risk: Over-reliance on external AI vendors introduces significant operational and data security risks. The complexity of these “black box” systems makes traditional due diligence and oversight challenging.
- Model Risk: The lack of explainability and transparency in complex AI models poses a significant risk to sound governance and decision-making, potentially leading to biased or unfair customer outcomes.
- Liability Risk (Agentic AI): A lack of legal clarity on who is liable (the developer, the deployer, the user) when an autonomous AI system causes harm creates significant legal and reputational risk.
Compliance Actions:
- Immediate: Review and enhance third-party risk management frameworks to specifically address AI provider concentration risk and oversight of complex models.
- Mid-Term: Update internal model risk management policies to incorporate standards for AI explainability, transparency, and fairness testing.
- Strategic: Firms developing or deploying agentic AI should contribute to the DRCF’s call for views to help shape future regulation and begin developing internal governance frameworks to manage the unique liability risks.

FCA Consultation on Fund Tokenisation

Summary: The FCA is proposing new rules and guidance to support the adoption of tokenised funds, including a “direct-to-fund” model using Distributed Ledger Technology (DLT).
Risk Considerations:
- Operational Risk: Integrating DLT-based registers with legacy systems presents significant technical and operational challenges.
- Smart Contract Risk: Flaws or vulnerabilities in the smart contracts governing fund operations could lead to significant financial loss or operational failure.
Compliance Actions:
- Strategic: Asset managers should review the consultation to assess the opportunities and begin strategic planning for integrating DLT into their operating models.
- Technical: Firms exploring tokenisation must establish robust governance and testing protocols for innovative contract development and deployment.

2.2. Operational & Digital Resilience

ESAs 2026 Work Programme: DORA and Cyber

Summary: A key priority for the ESAs in 2026 will be the effective operation of the DORA oversight framework for critical third-party providers (CTPPs) and enhancing pan-European cyber incident coordination.
Risk Considerations:
- Concentration Risk: The designation of CTPPs will bring intense supervisory focus on firms’ dependencies on these providers.
- Incident Response Risk: Failure to effectively coordinate with authorities during a systemic cyber incident could exacerbate its impact and lead to regulatory action.
Compliance Actions:
- Immediate: Finalise and embed DORA compliance programs, with a specific focus on contractual arrangements and exit strategies for designated CTPPs.
- Ongoing: Participate in and review the outputs of industry-wide cyber resilience tests to ensure internal incident response plans align with the pan-European framework.

SRB Consultation on Communication Guidance for Banks

Summary: The SRB has issued guidance on banks’ communication strategies during resolution, expecting fully operational and tested plans to be in place.
Risk Considerations:
- Franchise Risk: Poor communication during a crisis can destroy customer and market confidence, jeopardising the success of any resolution strategy.
Compliance Actions:
- Project-Based: By 30 June 2027, firms must develop, document, and test comprehensive communication plans for resolution scenarios. This requires close coordination between communications, legal, risk, and senior management functions, as well as with resolution authorities.

2.3. Market Structure & Post-Trade Reforms

Regulation to Shorten Settlement Cycle to T+1 (EU)

Summary: The EU has formally adopted a regulation mandating a move to a T+1 settlement cycle, effective from 11 October 2027.
Risk Considerations:
- Operational Risk: This represents a monumental operational challenge. Compressing the settlement cycle increases the risk of settlement failures due to inadequate time for trade allocation, confirmation, and funding.
- Liquidity Risk: Shorter timeframes will increase pressure on intraday liquidity management for funding and collateral.
- Cross-Border Risk: Potential misalignment with other jurisdictions’ settlement cycles (e.g., the UK) could create cross-border operational complexity.
Compliance Actions:
- Immediate: Firms must initiate large-scale transformation projects to prepare for T+1. This includes assessing impacts on technology, operational processes, resourcing models (especially for different time zones), and liquidity management.
- Strategic: Engage with industry bodies and market infrastructures to coordinate the transition and address common challenges.

FSMA 2023 Commencement & New Prospectus Regime

Summary: Dates have been set to revoke the UK Prospectus Regulation (19 January 2026). The FCA has published PMB 58 with guidance and consultation on the replacement UK regime.
Risk Considerations:
- Execution Risk: Transitioning to a new prospectus regime involves significant legal and procedural changes. Failure to comply can result in delayed offerings and regulatory sanctions.
Compliance Actions:
- Immediate: Legal and compliance teams must familiarise themselves with the final rules in FCA Policy Statement PS25/9 and the new guidance in PMB 58.
- Procedural: Update all internal policies, procedures, and checklists for public offers and admissions to trading to reflect the new UK regime well ahead of the January 2026 implementation. From 1 December 2025, firms can begin submitting draft documents under the new rules.

2.4. Consumer Protection & Financial Crime

FCA Review of Romance Fraud

Summary: The FCA’s review found inconsistent practices among firms in detecting and preventing romance fraud, highlighting missed opportunities to protect vulnerable customers.
Risk Considerations:
- Regulatory Risk: Failure to protect customers from foreseeable harm is a breach of the Consumer Duty and can lead to significant enforcement action and redress payments.
- Reputational Risk: Being associated with high levels of fraud damages brand trust and customer loyalty.
Compliance Actions:
- Immediate: All payment service providers must benchmark their systems, controls, and staff training against the good practices and areas for improvement identified in the FCA’s findings.
- Technical: Review and recalibrate transaction monitoring systems to better identify suspicious payment patterns indicative of romance fraud. Enhance staff training to identify customer vulnerability better and engage with empathy and support.

FCA Consultation on Motor Finance Redress Scheme

Summary: The FCA has published FAQs on its proposed redress scheme for discretionary commission arrangements in motor finance.
Risk Considerations:
- Financial Risk: The potential scale of redress payments presents a material financial risk to affected lenders and brokers.
- Operational Risk: Administering a large-scale redress scheme will require significant operational resources and robust data management capabilities.
Compliance Actions:
- Ongoing: Affected firms must continue to preserve relevant records and engage with the consultation process.
- Preparatory: Begin planning operational workflows and resourcing for handling a high volume of consumer communications and redress calculations pending the finalisation of the scheme.