Regulatory change compliance is the process by which a firm identifies new and amended rules, assesses what they mean for its business and implements them on time. Staying current means monitoring the right sources systematically, rather than reacting after a change has taken effect.
Many changes need months of lead time for systems, policies, staff training or new permissions. Supervisors expect firms to know about relevant change early and to be ready when it applies. This guide is written for compliance officers, senior managers and boards, and sits alongside the practical guide to FCA compliance in 2026.
The table lists confirmed dates for changes that affect a wide range of UK regulated firms. Each firm should add the dates specific to its own sector and permissions.
| Date | Change | Who it affects |
|---|---|---|
| 18 November 2025 | Companies House identity verification mandatory, with a 12-month transition for existing directors and persons with significant control | All UK companies |
| 4 February 2026 | FSMA 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) made | Cryptoasset firms |
| 24 April 2026 | Most SM&CR changes under PS26/6 take effect; further stages 10 July, 30 July and 1 September 2026 | Firms under SM&CR |
| 28 April 2026 | 90 days' notice and reasons for ending indefinite payment account contracts entered into from this date | Banks, PIs and EMIs |
| 7 May 2026 | CASS 15 safeguarding rules in force (PS25/12) | PIs and EMIs |
| 1 July 2026 | MiCA transitional periods ended in every EU member state | UK groups with EU crypto entities |
| 30 September 2026 | FCA cryptoasset application window opens, closing 28 February 2027 | Cryptoasset firms |
| 1 January 2027 | Basel 3.1 rules apply | PRA-regulated banks |
| 1 January 2027 | First complaints reporting period under PS25/19 begins, ending 30 June 2027 | Firms reporting complaints |
| 18 March 2027 | Operational incident and third-party reporting rules apply (PS26/2) | Part 4A firms and payment firms |
| 25 October 2027 | New UK cryptoasset regime commences | Cryptoasset firms |
| 1 January 2028 | Internal models approach for market risk under FRTB | Banks using internal models |
Some significant changes are still at the proposal stage. Firms should assess their likely effect without changing live policies until the final rules are published.
The general calendar applies to most firms. Each sector also has its own items, which belong at the top of its change log.
| Sector | Items to watch |
|---|---|
| Payment and e-money firms | CASS 15 audits and monthly returns, the payment services framework reform, account termination rules, incident and third-party reporting |
| Cryptoasset firms | The application window to 28 February 2027, FCA cryptoasset rules and guidance, commencement on 25 October 2027 |
| Banks and building societies | Basel 3.1 from 1 January 2027, Pillar 2A rebasing, FRTB internal models from 1 January 2028, PRA incident reporting |
| Investment firms | MIFIDPRU, Consumer Duty outcomes, SM&CR changes, complaints reporting |
| Mortgage and consumer credit firms | CP26/18 final rules, Consumer Duty fair value, arrears and forbearance expectations |
| Insurers and intermediaries | CP26/22 final rules, the 2026 insurance priorities, financial crime review findings |
The FCA is the primary source for the firms it regulates. Each publication type has a different status, and a monitoring process should treat them accordingly.
| Publication | What it does |
|---|---|
| Discussion paper (DP) | Explores an issue before any rule proposal |
| Consultation paper (CP) | Proposes rule changes and invites responses by a deadline |
| Policy statement (PS) | Confirms final rules and their effective dates |
| Handbook Notice | Records changes made to the Handbook by the FCA Board |
| Finalised guidance (FG) | Explains how the FCA expects rules to be applied |
| Dear CEO and portfolio letters | Set out supervisory priorities for a sector |
| Multi-firm reviews | Report findings from thematic work, with good and poor practice |
The policy statement is the definitive statement of what firms must do and by when. Multi-firm reviews and sector letters carry no new rules, but they show where supervisors will look and what evidence they expect, so they deserve the same attention. The FCA's email alerts let firms subscribe by sector and topic.
The Handbook is the FCA's rulebook, organised into sourcebooks such as PRIN, SYSC, COBS, CONC, MCOB, ICOBS and CASS. Firms should track the sourcebooks that apply to their permissions and activities, not the whole rulebook.
A documented applicability map, listing the sourcebooks and chapters that apply to each regulated activity, makes monitoring efficient and gives supervisors clear evidence of how the firm decides what is relevant. The map should be updated when the firm adds products or permissions. The Handbook's timeline view shows how a provision read on a past date, which is useful when reviewing historical compliance.
The Regulatory Initiatives Grid is published jointly by the UK financial regulators through the Financial Services Regulatory Initiatives Forum. It lists significant planned initiatives across the FCA, the Bank of England, the PRA, the Payment Systems Regulator and other bodies, with their expected timing and an indication of their likely impact.
The tenth edition was published in May 2026. Because it brings all the regulators' plans into one document, it is the best tool for resource planning: a compliance team can see which quarters will carry the heaviest implementation load and plan headcount and budget around them.
PRA-regulated firms monitor the PRA's consultations, policy statements and supervisory statements, and the PRA Rulebook. Other firms should watch Bank of England developments that affect payment systems, settlement and the wider financial system.
HM Treasury drafts the primary and secondary legislation that underpins the regulators' rules. The new cryptoasset regime, the reform of the payment services framework and the next phase of SM&CR reform all originate there, so Treasury consultations give the earliest sight of major change. The cryptoasset timetable is set out in the guide to the UK cryptoasset regime.
Statutory instruments are published on legislation.gov.uk, which also shows the version of each provision in force on a given date. Firms should also monitor the Information Commissioner's Office for data protection, the Office of Financial Sanctions Implementation for sanctions, Companies House for corporate filings, and the Financial Ombudsman Service for decisions that shape complaint outcomes.
Trade associations provide sector analysis, summaries and a collective channel for responding to consultations. Professional advisers interpret developments and their implications for a specific business.
These sources add interpretation and help with prioritisation, but they do not replace the primary publications. A good practice is to record the primary source for every item in the change log, so that the firm's understanding can always be traced back to the regulator's own words.
Monitoring should be a repeatable process, not an occasional activity. The steps below give a structure that works for most firms and produces evidence of effective governance.
| Change log field | Purpose |
|---|---|
| Reference and source | Traces the item to the primary publication |
| Status | Proposal, final rule or guidance |
| Effective date | Sets the implementation deadline |
| Impact rating | Prioritises effort and board attention |
| Owner and actions | Assigns accountability under SM&CR where it applies |
| Evidence of completion | Shows the change was implemented and tested |
For firms under SM&CR, responsibility for regulatory change should map to a named senior manager, as described in SM&CR explained.
An impact assessment answers four questions: does the change apply to us, what must change, how long will it take and who owns it. Items that touch systems or data, such as new reporting templates, safeguarding reconciliations or incident thresholds, usually need the longest lead time.
For a payment or e-money firm, for example, the CASS 15 rules required changes to reconciliation processes, the resolution pack, the monthly return and audit arrangements. Firms that started from a mapped gap analysis were able to show a complete position on 7 May 2026. What those firms must now do is covered in CASS 15 after implementation.
Firms should also consider responding to consultations that affect them. A response explains the firm's position while rules can still change, and the analysis prepared for it becomes the starting point for implementation.
Boards need a short, decision-focused view rather than a list of publications. A useful monthly or quarterly report covers three things.
The board's minutes should show that it considered material change and agreed the response. That record is the evidence supervisors use to judge whether the firm manages change in a controlled way.
Reviews of regulatory change frameworks tend to identify the same themes. Each is a useful self-assessment question for a compliance team.
Addressing these six points turns a monitoring activity into a control that supervisors can rely on.
The firm's regulatory compliance service helps regulated firms identify relevant developments, interpret new rules, build horizon-scanning processes and deliver implementation, including the cryptoasset regime, the CASS 15 safeguarding rules and the SM&CR reforms.
The FCA's consultations, policy statements, Handbook Notices and sector letters; the PRA and Bank of England for PRA-regulated firms; HM Treasury for legislation; and the Regulatory Initiatives Grid for a forward view.
A joint forward plan from the UK financial regulators that lists significant initiatives and their expected timing; the tenth edition was published in May 2026.
A consultation paper proposes rules and invites responses; a policy statement confirms the final rules and the date they take effect.
There is no prescribed frequency; many firms review monthly, with prompt attention to significant announcements and board reporting of material items.
The FCA application window runs from 30 September 2026 to 28 February 2027, and the regime commences on 25 October 2027.
The first complaints reporting period under PS25/19 starts on 1 January 2027, and operational incident and third-party reporting under PS26/2 applies from 18 March 2027.
Buckingham Capital Consulting has supported FCA-regulated firms since 2013, obtaining authorisations and variations of permission for firms including Nexpay, Hryze and Moneliq, and helps them implement regulatory change from the first consultation to the effective date. The firm builds horizon-scanning processes, impact assessments and board reporting that give supervisors clear evidence of control.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.