Fintech, digital assets, payments and consumer credit | UK Regulatory Outlook September 2026

Fintech

Mills Review: FCA priority recommendations on AI in retail financial services

On 6 July 2026, the Financial Conduct Authority (FCA) published the "Mills review" on the implications of advanced AI for retail financial services. The report concludes there will be four systemic shifts reshaping financial services to 2030: AI will transform firms; consumer journeys will become agent-led; AI will reshape market power and competition; and AI will amplify financial crime and cyber risk.

The report includes the following seven priority recommendations for the FCA Board to:

• Secure and adapt the regulatory perimeter.
• Strengthen system-wide coordination and oversight.
• Monitor the transition to autonomous models and adapt regulatory frameworks.
• Scale up the FCA's AI Lab to support AI models and system innovation in financial services.
• Enable the foundations for agentic finance.
• Build and adopt an AI-enabled agentic supervisory model.
• Develop a trusted public-interest AI-enabled financial capability service.

The review found that the overall regulatory framework, including the Consumer Duty and the Senior Managers Regime, remains sound, but stakeholders want greater clarity on how to interpret and govern increasing AI use within the existing regime.

Financial services AI adoption plan

On 14 July 2026, HM Treasury published the Financial Services AI Adoption Plan, developed by AI Champions Harriet Rees (Starling) and Dr Rohit Dhawan (Lloyds). Key areas covered include:

• the need for accessible and consistent regulatory support and a review of the regulatory perimeter for AI-enabled services;
• AI sovereignty and resilience, including oversight of critical external AI and cloud providers;
• upskilling across the sector; and
• readiness for agentic payments, and clarifying how existing legal and regulatory frameworks apply, or need to adapt, for near-term payment use cases.

HM Treasury has accepted the recommendations addressed to it.

FCA multi-firm review: frontier AI and cyber resilience

On 2 September 2026, the FCA published findings from its multi-firm review of frontier AI and cyber resilience, aimed particularly at small to medium-sized firms. The findings focus on three areas:

• Harness engineering, the environment, controls and processes around an AI model that make its outputs useful, safe and reliable. Firms should consider whether their use of frontier AI is supported by clear ownership, appropriate guardrails and specialist review.
• Preparing for vulnerability waves, frontier AI is changing the speed and scale at which vulnerabilities are discovered. Firms should assess whether their vulnerability management and change processes can cope with an increased volume and pace of findings.
• Cyber- and operational resilience foundations, frontier AI is exposing existing weaknesses not just in technology but in the people, systems and processes responsible for fixing vulnerabilities. The FCA notes firms' increasing reliance on third-party and software supply chain dependencies.

Firms should review the findings to understand the regulator's expectations and consider implementing any required adjustments.

The Financial Services and Markets Bill 2026–27: progress through the House of Lords

The FSM Bill is a legislative vehicle for (a) the UK's new cryptoassets regulatory framework, and (b) reform of the consumer credit regime. It has made the following progress through the House of Lords:

8 July 2026: Committee stage completed, with topics including tokenisation in UK wholesale financial markets, FCA rules on AI in financial services, and regulation of the digital asset industry.

9 September 2026: Report stage completed and a revised bill published, containing new clauses on section 166 reviews under FSMA 2000 and an innovation objective for the Bank of England.

15 September 2026: Third reading was scheduled, the final opportunity for the House of Lords to amend the bill.

Payments

HM Treasury consultation: modernising payment services regulation

On 14 July 2026, HM Treasury published a major consultation paper on modernising payment services regulation, setting out how it intends to work with the FCA to modernise the regulatory framework for payment services and electronic money.

Key proposals include:

• facilitating a more outcomes-focused, faster and proportionate regulatory system by retaining core provisions (including the regulatory perimeter and key definitions) in legislation but moving the details (for example, technical standards relating to strong customer authentication, notice periods) into regulations which the FCA can adapt in a more agile fashion. The consultation seeks views on which requirements should remain in legislation and which should be delegated to the FCA;
• reforming the current regulations to better reflect the evolving payments landscape. This includes proposals to change the list of regulated activities that constitute payment services and e-money and proposals relating to tokenised payments (tokenised deposits and stablecoins), agentic payments, financial inclusion and managing sector risks; and
• establishing a long-term regulatory framework for Open Banking, by enshrining fundamental rights of access in legislation and equipping the FCA with powers to better police pricing and services. The consultation also seeks views on whether access should remain free or move to a commercial basis, and whether adjustments are needed to support new Open Banking payment and data use cases.

The paper represents the most significant structural reform of the UK payments regulatory landscape in a long time. The consultation closes on 6 October 2026 and changes will be implemented through secondary legislation.

Court of Appeal: Quincecare duty in APP fraud, Moorwand v Hamblin

On 21 July 2026, the Court of Appeal restored a trial judge's dismissal of a Quincecare duty claim against a PSP in an authorised push payment (APP) fraud case, overturning the High Court on second appeal, Moorwand Ltd v Hamblin and others (2026).

The facts involved fraudsters incorporating a company using details stolen from an identity theft victim, opening accounts with Moorwand Ltd (an FCA-regulated payment services provider(PSP)/Electronic Money Institution (EMI)) and inducing victims to make a payment of £160,000, which was rapidly dissipated.

The Court of Appeal held that the threshold for overturning the trial judge's evaluative assessment was not met and that the High Court had misinterpreted the trial judge's reasoning.

The Court of Appeal proceeded on the basis that PSPs/EMIs can owe common law duties, including a Quincecare-type duty.

New Bank of England secondary payments innovation objective

Foxton LJ flagged issues that courts may need to consider in future cases involving companies established as vehicles for fraud.

On 27 August 2026, HM Treasury published a press release announcing its intention to give the Bank of England a new secondary payments innovation objective, subordinate to its primary financial stability objective.

HM Treasury is extending the Bank of England's existing innovation facilitation role to the regulation of systemic payment systems, including those using digital settlement assets, via an amendment to the Financial Services and Markets Bill, which is currently before Parliament.

The new objective expressly covers tokenisation and distributed ledger technology developments that have the potential to transform financial markets.

The bank will report to Parliament annually on progress.

Digital assets

Cryptoasset regulatory regime: FCA final rules

On 30 June 2026, the FCA published a large package of policy statements and guidance on the new cryptoasset regulatory regime, as follows:

• A policy statement (PS26/9) on the regimes for cryptoasset admissions and disclosures, and market abuse.
• A policy statement (PS26/10) on rules and guidance for UK stablecoin issuers covering issuance, backing assets, redemption, cryptoasset safeguarding and disclosures.
• A policy statement (PS26/11) on regulated cryptoasset activities.
• A policy statement (PS26/12) on the prudential regime for cryptoasset firms.
• A policy statement (PS26/13) on the application of the FCA Handbook for regulated cryptoasset activities and finalised guidance.
• FG26/5 – non-Handbook guidance on the application of the Consumer Duty to cryptoasset firms.
• FG26/6 – non-Handbook guidance on cryptoasset operational resilience.
• FG26/7 – non-Handbook guidance on the approach to international cryptoasset firms.

The FCA also published a webpage giving an overview of the publications and their relevance to firms carrying on various cryptoasset activities. The new rules will come into force on 25 October 2027.

The FCA will consult later in 2026 on its proposed approach to managing cryptoasset firm failure. It also plans to provide further clarity on financial crime requirements through updates to the Financial Crime Guide, and publish a further policy statement in September setting out how the regulatory perimeter applies to cryptoasset activities. Once the regime has been in force for two years, the FCA intends to undertake a formal review to assess whether it is delivering its intended outcomes.

PS26/10 is supplemented by a joint publication with the Bank of England on how systemic stablecoins recognised by HM Treasury will be jointly regulated and how firms will transition between the two regimes. The final rules, which introduce a new Cryptoasset sourcebook (CRYPTO) and a new chapter in CASS, are in the Cryptoassets (Stablecoins) Instrument 2026 (FCA 2026/36). They will come into force on 25 October 2027.

Wholesale digital markets champion report: tokenisation framework

On 13 July 2026, HM Treasury published the first report from UK wholesale digital markets champion, Chris Woolard, setting out a framework to drive tokenisation of wholesale financial markets. The report's industry priorities include:

• supporting the development of tokenised markets, including tokenised collateral and a tokenised funds market;
• building wholesale payment rails to support tokenised markets;
• developing legal certainty and best practice to remove obstacles;
• ensuring regulatory standards support tokenised markets and domestic and international interoperability; and
• supporting financial crime compliance and digital identity.

Comments on the report could be submitted until 4 September 2026.

FCA first enforcement action for unlawful cryptoasset promotion: FCA v Huobi Global SA

On 7 September 2026, the FCA published a consent order by Chief Master Shuman relating to civil proceedings commenced in the High Court against Huobi Global SA and alleged related entities (including the HTX Exchange).

The FCA alleges that HTX unlawfully promoted cryptoasset services to UK consumers in breach of section 21 of FSMA 2000.

The proceedings are stayed until 22 September 2026 to allow the parties to attempt settlement by alternative dispute resolution.

This is the FCA's first enforcement action against a cryptoasset business for unlawfully promoting cryptoassets to UK consumers.

The terms of any published settlement will provide a key indication of the FCA's approach to enforcing section 21 of FSMA in relation to cryptoassets.

The financial promotion regime for cryptoassets has been in force since October 2023. Offshore exchanges with UK customer bases should review their financial promotion compliance as a matter of urgency.