This week, we lead with the Financial Conduct Authority’s (FCA) latest findings on fair value in consumer finance which underline the need for firms to adopt a proportionate approach and apply judgement across their business, products and customers. Meanwhile, the FCA looks at how defence small and medium-sized enterprises (SMEs) face delays and friction in accessing banking services, and it also shines a light on the opportunities and risks of post-quantum cryptography (PQC) across financial services.
Elsewhere, the Prudential Regulation Authority (PRA) and the FCA jointly open a discussion on credit union regulation as the sector grows and becomes increasingly diverse.
We conclude this week with finalised FCA rules that bring environmental, social and governance (ESG) rating providers into regulation for the first time, with applications opening in June 2027.
The FCA has published findings from its supervisory work on how consumer finance firms assess, evidence and monitor fair value under the Consumer Duty. It reviewed firms in consumer credit, debt advice, credit referencing and debt collection, and examined fees and charges on loans, credit cards and high-cost credit.
The FCA groups its findings into seven themes. Good practice included weighing customers’ time and effort alongside price, testing whether customers understood fees, and waiving fees for customers in difficulty. Some firms left out contingent fees, relied on narrative with little data, or did not compare outcomes for customers with characteristics of vulnerability. Penalty charges applied to around 3% of consumer credit agreements in the year to the second quarter of 2026, being almost 28 million individual charges.
The findings create no new requirements. The FCA says firms in other sectors may also benefit from these findings, and any firm can test its own fair value assessments against the seven themes.
Read more on fair value in consumer finance
Read more on what fair value looks like in practice
The FCA has published a multi-firm review of how SMEs operating in the defence industry experience banking services. It found no regulatory barrier to banks serving lawful defence businesses, and firms generally said they are open to doing so. The FCA found friction and delay, but no evidence of widespread exclusion.
Banks tend to treat defence SMEs as higher risk, which adds due diligence and approval stages. The FCA found that firms do not always distinguish between types of defence business, can find it hard to identify defence customers, and in some cases hold little management information on outcomes. SMEs said banks did not always explain decisions.
The FCA expects banks to review their processes so that each decision rests only on the risks of that customer, and to check that senior managers receive information on outcomes. It has written to firms serving SMEs and expects similar improvements for other sectors.
Read more on access to banking for defence SMEs
Read more on why defence SMEs need banking services that work
The FCA expects firms to start preparing now for post-quantum cryptography (PQC). A sufficiently powerful quantum computer could break widely used cryptography, which would expose customers to fraud and firms to operational disruption. The FCA points to the National Cyber Security Centre (NCSC) milestones (published last year): a migration plan by 2028, high-priority migration by 2031 and full migration by 2035. It tells firms not to wait for those dates where earlier action is safe.
The FCA expects firms to map where they use cryptography, set clear, risk-based migration objectives, and monitor, test and validate each change. It notes that failed change projects caused around a fifth of the incidents reported to it in 2025, and tells senior managers to ensure their firms allocate enough time, investment and resource.
The FCA is trialling a self-assessment tool with a sample of firms and plans to consult on cyber resilience guidance that covers these expectations.
Meanwhile, the NCSC has published its latest Annual Review.
Read more on preparing for post-quantum cryptography
Read more on migration timelines for post-quantum cryptography
The PRA and the FCA have published a joint discussion paper, DP2/26, on supporting sustainable growth and resilience in credit unions. The regulators jointly oversee around 340 credit unions, with more than two million members. Responses are due by 5 March 2027. The PRA has also published CP15/26 on rule changes for Northern Ireland credit unions, which closes on 12 January 2027.
The discussion paper proposes no policy changes yet. However, it seeks views on:
CP15/26 would add PRA rules and expectations for member referrals and loan participation, from April 2027, subject to Northern Ireland legislation. Credit unions and trade bodies may respond to either paper.
Read more on DP2/26 on credit unions
Read more on CP15/26 on Northern Ireland credit unions
The FCA has published final rules, PS26/22, that bring ESG rating providers into regulation for the first time. Providers operating in the UK market will need FCA authorisation from 29 June 2028, unless an exemption applies. They can apply from 24 June 2027, in staggered windows, and the FCA encourages early applications. The rules follow CP25/34 and the October 2025 legislation that made providing ESG ratings a regulated activity.
The rules cover transparency, governance, systems and controls, conflicts of interest, and engagement with users of ratings and with rated entities. The FCA says they are proportionate to firm size and activity, draw on international standards, and do not prescribe a methodology or sustainability view. The FCA notes that asset managers, lenders and benchmark administrators use ESG ratings. It has published guidance to help firms judge whether they fall in scope.
Providers can use the scoping guidance and the FCA’s pre-application support to prepare for their application window.
The FCA and PRA's Phase 2 consultation on SM&CR proposes a series of reforms designed to streamline regulatory requirements, reduce administrative burdens and support UK competitiveness while maintaining accountability standards. The article examines the key proposals, the potential impact on firms, and the practical steps organisations should consider as the reforms progress.
The FCA’s final UK SRS rules introduce new ISSB-aligned sustainability and climate disclosure requirements from 2027. Explore the key changes, scope, transitional reliefs and practical steps for implementation.
A looks at the FCA's new wind-down planning requirement for cryptoasset firms as the authorisation gateway opens, and why firms should start preparing their wind-down plan now.