Your guide to this week in regulation

This week, we lead with a stark warning from Andrew Bailey, governor of the Bank of England and chair of the Financial Stability Board (FSB), who has told G20 finance ministers that frontier artificial intelligence now poses the most immediate risk to global financial stability through its impact on cyber risk.

Next, we look at the Financial Conduct Authority’s (FCA’s) latest whistleblowing data, which shows a sevenfold rise in cases prompting significant regulatory action, closely following the FCA’s extension of its non-financial misconduct rules to non-bank firms this month. Elsewhere, the FCA has continued to issue enforcement notices against motor finance brokers and dealers, a reminder that scrutiny of the sector persists alongside the compensation scheme.

Meanwhile, HM Treasury (HMT) has confirmed a new payments innovation objective for the Bank of England, and the FCA has published its latest Primary Market Bulletin covering listings and disclosure. We conclude this week with the European Banking Authority’s (EBA’s) consultation on a harmonised operational risk framework for banks.

Frontier AI named top cyber risk

Andrew Bailey, chair of the Financial Stability Board (FSB) and governor of the Bank of England, has written to G20 finance ministers and central bank governors, warning that frontier artificial intelligence now presents the most immediate risk to global financial stability. The letter, published ahead of the G20 meeting in Asheville on 31 August and 1 September, says frontier models are showing growing autonomy and threat capability, and that this could change the speed, scale and economics of cyber risk. Many jurisdictions, Bailey notes, still lack protocols to manage the release and deployment of these models.

He called on financial institutions, financial market infrastructures and technology providers to strengthen vulnerability management and their capacity to respond to and recover from incidents, given how few providers many firms share. He also flagged the risk of disruption spreading across several firms at once through common technology dependencies.

Read more on the FSB Chair’s letter to G20 finance ministers and central bank governors

FCA whistleblowing cases surge in Q2

The FCA has published whistleblowing data for the second quarter of 2026, showing a sharp rise in the share of cases prompting formal intervention. The regulator received 333 new reports between April and June, up 5.7% on the same quarter last year, though down on the 355 received in the first quarter of 2026. It closed 395 reports in the period.

Significant action to manage harm, which can include enforcement, a skilled person review or restrictions on a firm’s or individual’s permissions, was taken in 56 cases. This is seven times the 8 cases recorded in the same quarter last year. Allegations about individual conduct, honesty and integrity formed the largest category, followed by concerns about firms’ values and culture. Non-financial misconduct featured in 27 allegations.

The rise comes as the FCA extends its conduct rules on non-financial misconduct to non-bank firms this month. Firms should check that whistleblowing arrangements are well understood by staff and tested against the wider expectations now in place.

Read more on the FCA’s whistleblowing quarterly data 2026 Q2

Bank of England gains payments objective

HM Treasury (HMT) has confirmed plans to give the Bank of England a new secondary objective to support innovation in payment systems and emerging forms of digital money, including stablecoins. The duty will sit beneath the Bank’s primary objective to protect financial stability and will not require it to support innovation where this would put stability at risk. The Bank already holds a similar objective for central counterparties and central securities depositories, and this reform extends that approach to systemic payment systems.

The change will be introduced through an amendment to the Financial Services and Markets Bill, due for debate in the House of Lords on 7 and 9 September. Once in place, the Bank will report to Parliament each year on its progress. City minister Lucy Rigby said the change is intended to help UK payments regulation keep pace with technological change.

Read more on the new payments innovation objective for the Bank of England

Primary market bulletin flags new rules

The FCA has published Primary Market Bulletin 65, setting out several changes for issuers, sponsors and advisers. From Monday 21 September, all new equity submissions through the Electronic Submission System, including guidance requests, must include a declaration confirming whether the document contains inside information and, if so, what that information is.

The bulletin also explains the FCA’s emergency intervention powers under the Short Selling Regulations 2025, in force since 13 July, which allow enhanced reporting requirements or temporary restrictions following significant price falls. The FCA says these powers will be used only in exceptional and proportionate circumstances. Elsewhere, the regulator raises concerns about regulatory announcements being used as marketing materials, and reports on its review of delayed disclosure notifications for inside information and on sponsors’ approaches to expert reporting.

Read more on Primary Market Bulletin 65

EBA consults on operational risk rules

The European Banking Authority (EBA) has opened a consultation on draft technical standards specifying the operational risk management framework that institutions must maintain under the Capital Requirements Regulation, as amended by the EU Banking Package. The draft sets harmonised requirements covering:

governance, including board approval of the framework and the institution’s risk appetite;
the operational risk management process, covering identification, assessment and monitoring; and
the risk assessment system, including data, taxonomy and reporting requirements.
Institutions with a business indicator below 750 million euros would face lighter reporting frequency and less granular data requirements, reflecting the mandate to apply proportionality by size and complexity. A virtual public hearing will take place on 29 September, with registration open until 25 September. The consultation closes on 31 December 2026.

Read more on the EBA’s consultation on operational risk management