FCA confirms targeted support framework under PS25/22
ArticleThe FCA has taken another step forward by confirming the introduction of a targeted support framework and publishing the near final rules in PS25/22.

We believe there are two key points to consider when looking at culture and its role in supporting your organisation deliver against the Code's requirements:
1 assessing whether your culture is an enable to good governance as outlined in the Code and if not, building a culture so that it supports your organisation in understanding and enables compliance with the new requirements
2 ensuring the culture is fully embedded across your organisation, with no unhelpful sub-cultures to ensure consistency and alignment, reducing risk
So, what's the difference between just implementing requirements of the Code and building compliance into your culture?
Building a culture is challenging and needs focus and energy, but it can make all the difference to both governance and to the achievement of the organisation strategy. Building and maintaining and active and embedded culture is a longer lasting and more robust method of ensuring compliance.
Both tasks require a clear plan, an understanding of what's needed, the goal your organisation wants to achieve, and how you measure success. But building a culture also needs to be clearly linked to your organisation's strategy itself, where good governance that aligns to your organisation’s goals and values is key.
Once this is done, there are then five key elements to consider:
1 Leadership and accountability
Leadership needs to take both demonstrable and personal accountability for your desired culture. This involves communicating regularly and - crucially - as an ongoing part of how leaders engage with employees.
Leaders should act as role models with the required behaviours, recognise these in others and ensure consistent messaging across the organisation.
2 Setting objectives
Organisational key objectives should be agreed, communicated and measurement should be considered in performance reviews and linked into remuneration and total pay, including both fixed and variable.
3 Talent and retention
Talent identification and management across the organisation and succession planning, should be completed as a minimum for executive management roles and business critical roles.
The requirements need to be incorporated into learning programmes, including induction. And promotion decisions need to assess the understanding and role modelling of the requirements.
4 Embedding into core business activity
Consider how all this reaches across your organisation. For example:
5 Communication
Finally, both internal and external communications should be aligned and individual teams need to incorporate culture and values into your corporate website, intranet, and other communications.
If you have a fully embedded culture, you'll be familiar with the need for the routes outlined above and will understand the consistency and alignment that it brings.
For those that still have some of this journey to go, using the need to embed the requirements into your overall desired culture more fully can have benefits that go significantly wider than the Code requirements.
For support with embedding the Code compliance into your culture, get in touch with our experts.
![]()
Get the latest insights, events and guidance, straight to your inbox.
The FCA has taken another step forward by confirming the introduction of a targeted support framework and publishing the near final rules in PS25/22.
Boards are increasingly being called upon to take ownership of technology risk oversight as a strategic imperative, reinforced by the updated UK Corporate Governance Code and the new Cyber Governance Code of Practice. In 2026, staying ahead of technology risks and regulatory shifts isn’t optional - it’s essential. Are you clear on where to focus to keep your organisation in control?
Recent high-profile failures have shown how third-party risk can lead to severe financial and reputational damage. Yet, despite growing awareness, many organisations still struggle to manage it effectively.