TITLE: Financial Conduct Authority Sets Retail Banking Regulatory Priorities for 2026 BODY: On March 2026, the Financial Conduct Authority (FCA) published its Regulatory Priorities report for retail banking, establishing four key focus areas for the next 12 months. The report applies to retail banks and building societies operating in the United Kingdom and replaces more than 40 portfolio letters, consolidating supervisory expectations into a single guidance document. The FCA's four priority areas are: access to cash and essential banking services; good outcomes from products and services; fighting fraud and other financial crime; and operational resilience and data security. Under the first priority, the FCA will monitor designated firms' compliance with Access to Cash sourcebook requirements and assess branch closure notifications to ensure consumers and businesses maintain reasonable access to cash services. The FCA has noted that over 200 banking hubs and nearly 150 other cash and deposit solutions have been established to support this objective. Regarding consumer outcomes, the FCA expects firms to improve data-led monitoring and assessment of retail customer outcomes under the Consumer Duty, with targeted action against outliers delivering poor value or outcomes for vulnerable customers. For financial crime, the FCA will use data analytics to identify non-compliant firms and continue reviewing money laundering controls. On operational resilience, firms must identify emerging risks, refine action plans for critical third-party dependencies, and improve cyber protection strategies. The FCA will also support innovation, including artificial intelligence adoption through its Supercharged Sandbox and AI Live Testing programmes, with an evaluation report expected by year-end 2026. Additional areas of focus include business banking outcomes, open banking evolution, stablecoins and tokenised deposits, and a motor finance commission review. Key implementation dates include the targeted support regime going live on 6 April 2026, an open finance roadmap expected in March 2026, and incident and outsourcing reporting final rules anticipated in H1 2026. REFERENCE: Financial Conduct Authority. (2026). Regulatory Priorities: Retail Banking. Available at: www.fca.org.uk

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always generate an update. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and summarise it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. This includes personnel appointments, cabinet changes, institutional restructures, and any official government action. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. - Content scope is broad: generate updates for all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are an AI assistant generating Horizon scanning updates for government, regulatory, and institutional content. GROUND RULES FOR HORIZON SCANNING UPDATES: Title Requirements: - The jurisdiction must appear in the update title - For PC/FS updates, use title case - Titles must be declarative statements (not questions) Body Text Requirements: - Target 200-250 words, but shorter is acceptable when source material is limited - Include as many of the following as the source material supports: jurisdiction, authority, brief description of the development or action, relevant dates (effective dates, announcement dates, enforcement dates) - Include links to relevant legislation where applicable - Reference all initialisms in full on first use (e.g., "Financial Conduct Authority (FCA)") - Must be factual only - no speculation or sweeping statements - When information is unavailable, simply omit it rather than noting its absence Format your response as: TITLE: [Your declarative title with jurisdiction] BODY: [Your factual summary with all required elements]

Horizon Scanning Outline. Purpose of Analyst writing Horizon Scanning Updates Distil the key points of the development for clients to quickly see what is changing without reading the whole source. Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes. Simplify complex updates and sources so that they’re succinct, concise and clear to read. Consistently structure and write updates in the same format. Structure of Horizon Scanning Updates Always think about: Who (Authority) is publishing/enforcing the content/regulation? Where (Jurisdiction)? What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed? Who is this update applicable to (credit, e-money institutions, etc.)? Why is this update noteworthy? What is its significance? When is the update applicable? Title Describe what the update is about. Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what). All titles should be written in present tense. Avoid using acronyms Approx 10 - 20 words Example Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance Paragraph 1 Open with the date of the update (When) Name the authority that released the update (Who) Summarise the release (What) Example On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets. Paragraph 2 Summarise key points. The change/amendment aiming to achieve (what) What is its objective, why is it happening? Why is it significant? (why) Who does it impact or concern? (Who) The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document. Example SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to: Study Indian and global best practices. Prepare the guidelines. Address the concerns and issues arising from AI/ML usage. SEBI is consulting on the following principles to develop the guidelines: Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models. Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information. Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results. Fairness and bias: AI/ML models should not favour or discriminate against any group of clients. Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security. Paragraph 3 Acts as a “Call To Action”. Provide forward looking context: What actions need to be taken? Who needs to take action? Next steps to the development. Include any relevant dates (When) Response dates - should always be provided for consultations Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted. Example The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026. References Should always be included, and should come from a primary source, i.e., an authority, not a news source. General Style Notes: 200-250 words Active voice Authorities and companies referenced as a single entity (“It”, not “they”) Titles in title case Internal Vixio vocabulary guide Content Style Guide Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content. A Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA). Act - when just referring to “the act”, it does not need a capital a. Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell). - advice (noun) - give formal suggestions (for example, I gave them advice). Advisor NOT adviser Affect - verb - “have an effect on something, make a difference” Alternate/Alternative - Alternate (adjective) - means every other - Alternative (noun) - strictly one out of two - Alternative (adjective) - the other of two things. Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”. AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT Among/while NOT Amongst/whilst API - application programming interface Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act. Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”. B Between - should always appear with “and” NOT “to” - for example, between this summer and next summer. Big tech - two words, breaks convention of other tech words Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522). Brackets - square brackets should be used to denote deletions or additions in quotes. Buy now, pay later - no hyphens Bullet points - see Lists C Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a) Cardrooms not card rooms Cases - legal cases should appear in italics, with a v for versus. Casino-resorts NOT casino resorts or resort-casinos Chief executive NOT chief executive officer Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes) Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000) Comparisons - compare with (highlighting differences) - compare to (highlighting similarities) Companies/organisations - singular entities (it NOT they) should be followed by “which/that” rather than “who” Ltd, not Limited Complement - to accompany something/add value Compliment - give praise (complimentary = free) Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings) Comprise/comprising - should NOT be followed with “of”, as it means to “consist of” Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,) Continually - if something occurs repeatedly/regularly in the same way Continuously - if something occurs without interruption or gaps Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone) Contrast - by contrast - when comparing one thing to another - in contrast - simply noting a difference Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting Court of Justice of the European Union (CJEU) rather than ECJ Cryptocurrency - one word, not hyphenated. Crypto-assets - hyphenated Cybersecurity - one word, not hyphenated CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar) m for million, bn for billion, trn for trillion. D Date format - Month, Day, Year (e.g., March 7, 2019) For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…” For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...” For NIBs: always use dates rather than days. Department for Digital, Culture, Media & Sport - ampersand Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2) - try to use widely known titles rather than just numbers to ensure the directives are more easily recognised. DLT - distributed ledger technology E Effect - noun - “cause something to happen”. Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–). Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”. esports NOT eSports or e-sports Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”. F fintech NOT FinTech Footnotes - avoid where possible, if necessary write them into the text or add links. G GGR - “gross gaming revenues” Government - does not need a capital g. Governor - should be written out in full, NOT Gov. Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines) H Headlines - all words should begin with a capital Horseracing NOT horse racing Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money - DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper I Impact - should be used as a noun - i.e. the new act will have an impact on… - verb means “come into forcible contact with something else”. - using “affect” as a verb is more accurate. J Judgment - legal decision Judgement - one’s own opinion Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters. Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive. OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur DON’T need capitals unless a figure of importance (i.e., Prime Minister, President) Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be. Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team). K KYC - know your customer L Legislature - does not need a capital l. Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables. Licence - noun (UK), i.e. a driver’s licence License - verb/noun (US) Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent). M MONEYVAL NOT Moneyval More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players. N Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive. Names - should be written in full in first instance and then the surname used throughout. Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences. Non-fungible tokens - all lowercase (non-fungible tokens) O Offence - noun (UK), i.e. commit an offence Offense - noun (US) Organisations/companies - singular entities (it NOT they) should be followed by “which/that” rather than “who” Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears). Over - should not be used as a replacement for “more than”. P Parliament - does not need a capital p. Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”. - passed is the past tense of “to pass” - “the law was passed in government”. Prepaid, not pre-paid Percentages - numbers should always be written as figures percent NOT per cent or % Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent) Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to” Principal - main, most important Principle - a fundamental source or basis of something Programme (UK) Program (US, UK - for computer program, Australian English) Q Quotes - speaker should be referenced in the past tense (said NOT says) Quote marks - double quote marks should be used for speech - single quote marks should only be used for titles and within quotes. (See Quote reference sheet for more information on how to use quotes.) R regtech NOT RegTech Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines) Racetracks not race tracks S Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018. Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act. Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.) Sports betting NOT sportsbetting Sports team names Storey (pl. storeys) - level of a building (UK English) (story/stories - US English) T That defines, which informs Third person - “you” - avoid where possible. Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a) Tenses - content should generally be written in past tense - present tense should be used for something that has just happened and will be continuing into the future. U United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”) U.S. Department of Justice - Justice Department (with capitals as requested) V Vixio GamblingCompliance / Vixio PaymentsCompliance Vixio (to be used on its own after first instance) W Which informs, that defines While/among NOT Whilst/amongst While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”. X Y Year quarters - Q1, Q2, H1, H2, etc. Z Acronyms AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT API - application programming interface DLT - distributed ledger technology --- Now, given the above instructions and style guide, please generate a horizon scanning update based on the following webpage content. Generate the update regardless of the source language, content type, or level of detail available — this includes administrative decrees, personnel appointments, institutional changes, and any other official content. Use whatever information is present. Regulatory Priorities Retail Banking March 2026 Financial Conduct Authority Regulatory Priorities: Retail Banking This Regulatory Priorities report is for: Contents Foreword Retail banks Page 3 Building societies Executive summary Page 4 These firms should also see our Mortgages report. What we’ve done in the market Page 7 Our priorities: Access to cash and essential banking services Page 8 Our priorities: Good outcomes from products and services Page 9 Our priorities: Fighting fraud and other financial crime Page 10 Our priorities: Operational resilience and data security Page 11 Other areas of focus Page 12 You can find all our Key publications and speeches Regulatory Priorities Page 13 reports at www.fca.org.uk Timeline Page 14 2 Financial Conduct Authority Regulatory Priorities: Retail Banking Foreword We’re committed to being a smarter regulator – predictable, purposeful and proportionate. Central to that is how we communicate to the firms we regulate what’s important to us. These new Regulatory Priority reports replace more than 40 portfolio letters. Published annually, they set out our areas of focus by industry sector. They attempt to pull together all that we’re doing – whether by supervisors or in policy development. A clear, succinct one-stop shop. They should act as a guide for firms’ boards and chief executives. You should read these reports carefully, review the priorities within them – and act where you need to. This is the latest example of how we’re transforming the way we supervise. This year, we’ll go further, expanding dedicated supervisory contacts, applying a more risk-based approach for our largest firms, and making data collection more targeted and efficient. Our goal is simple: less intensive attention on firms doing the right thing, and stronger, faster action where harm is greatest. Importantly, we also want you to engage with us. We welcome your feedback on these reports and our approach to supervision. Share your insights, challenge our thinking, and work with us as we refine this new model. Together, we can build a regulatory system that deepens trust and rebalances risk, to support growth and improve lives. David Geale Executive Director of Payments and Digital Finance Emad Aladhal Director of Retail Banking 3 Financial Conduct Authority Regulatory Priorities: Retail Banking Executive summary Retail banking is changing significantly. People are using branches less and digital channels more. Business models are diversifying, with new entrants and more fintech involvement, and as open banking and payment types evolve. An effective banking sector remains vital to the financial health of people and businesses, a strong and growing economy, and our national and economic security. So, we need retail banking that stays accessible to consumers and businesses, gives them good outcomes, is operationally resilient including against bad actors, and fights hard against fraudsters and financial crime. Our 4 priorities for the next 12 months focus on those essentials. Underpinning our approach, we’ll ensure firms keep the Consumer Duty integral to how they treat retail customers. Getting good outcomes will deepen consumers’ trust and increase their confidence to seek products and services that meet their needs and match their capacity for risk, helping them navigate their financial lives. We also want a competitive market and we’ll support growth and innovation. Six banks and building societies are now drawing on our scale-up support. And we’ll support firms’ adoption of targeted support: new ways to empower consumers to make better, more informed decisions about investments and pensions. We’ll help firms thoughtfully consider innovation, including by understanding our rules through Innovation Pathways. We’ll also support firms’ responsible adoption of artificial intelligence (AI). We want them to use AI to help consumers get good outcomes, including receiving the right information when they need it, as well as good service and support. We’ll continue to provide a space for firms to experiment and test in, to enable safe and responsible AI adoption. This includes continuing cohort 1 and launching cohort 2 of the Supercharged Sandbox and AI Live Testing – which firms are welcome to apply for. We’ll publish an evaluation report from AI Live Testing by the end of the year. An effective banking sector remains vital to the financial health of people and businesses, a strong and growing economy, and our national and economic security. 4 Financial Conduct Authority Regulatory Priorities: Retail Banking Our retail banking priorities for this year Access to cash and essential banking services Many consumers now bank digitally, and many firms are undertaking digital-first transformations. But these can reduce face-to-face contact and may render some services inaccessible. We monitor We monitor designated firms to make sure gaps in access to cash are filled quickly, as required by the rules on reasonable cash designated access for consumers and businesses (which we made under the firms to make new powers Parliament gave us). sure gaps in And firms’ digital transformations must avoid causing foreseeable harm to retail customers, especially those less digitally capable. access to Any alternative service firms propose should be accessible to customers before branches close. We closely monitor firms’ cash performance under our guidance on branch closures/conversions and the Consumer Duty. are filled We’ll intervene where we need to. quickly, as required by Good outcomes from products and services the rules on We’ve seen firms make good progress driving positive outcomes reasonable under the Consumer Duty. They should keep developing their data for monitoring retail customer outcomes, so they can see cash access for where further action is needed to support consumers in pursuing consumers and their financial objectives and avoid causing them foreseeable businesses harm. Where we identify poor outcomes, especially poor value or for customers in vulnerable circumstances, we’ll take targeted action. Fighting fraud and other financial crime Financial crime threats evolve rapidly and firms must monitor their fraud, money laundering and other risks, and continuously refine their defences. They should help consumers understand fraud risks and support victims fairly. We’ll use data analytics and other tools to identify outliers and make proportionate, targeted interventions. Operational resilience and data security Firms should identify emerging risks and critical third-party dependencies, refining action plans to address vulnerabilities and remain within important business service impact tolerances. They should continue improving their cyber and information protection strategies, with tested recovery plans. We’ll use specialist tools to engage firms about their resilience. Those four priorities are our main focus in the next 12 months. 5 Financial Conduct Authority Regulatory Priorities: Retail Banking However, other areas of focus (see p12) include: • business banking outcomes • innovations in retail banking (including open banking and open finance, stablecoins and tokenised deposits; see the Payments Forward Plan of the Payments Vision Delivery Committee) • motor finance commission review We’ll continue to monitor risks and opportunities through data, market intelligence and industry engagement, and pause or stop work if we need to look at urgent new issues. As we progress our work, we’ll ensure we take the most appropriate and proportionate action to review and act as needed. Where we find serious misconduct, we’ll consider the tools available to us, including supervisory intervention or enforcement. How our retail banking priorities support our strategy Retail banking priorities Access to cash Fighting fraud and essential C A prioritie and other F s banking services financial crime Help Fight consumers crime Support growth Operational Good outcomes resilience from products and data and services security 6 Financial Conduct Authority Regulatory Priorities: Retail Banking What we’ve done in the market For several years, we’ve focused on four essentials of retail banking. YouGov poll on the Consumer We’ve supervised firms as they’ve embedded the Consumer Duty and made progress on giving good outcomes to retail Duty, 2025: customers. Firms have responded well when we showed them areas to improve, such as sharing more value with cash savers, and 55% treating customers in vulnerable circumstances of bereavement or power of attorney better. More recently, we reviewed a range of of the UK public banks’ approaches to fair value when providing business current say banks accounts, and found improvements but also areas where they communicate could do better (we’ll add these to our Price and Value Outcome clearly (up from Insights webpage in due course (Q2 2026)). 44% in 2023) As a result of firms’ work under the Duty, public trust in them is improving, and customer satisfaction too. 51% But most firms still have further to go on their data-led monitoring say that and assessment of retail customer outcomes. banks protect We’ve supervised firms’ embedding of our branch closure customers from guidance and rules for ensuring consumers and businesses harm (up from have reasonable access to cash. Firms investing in digital-first 40%) transformations have made progress in preventing foreseeable harm or poor outcomes. For example, the sector has established over 200 new banking hubs and nearly 150 other cash and deposit 47% solutions so far, to help consumers access essential retail banking services. But there’s more to do, and improvements firms can make say banks offer in how they approach individual branch closures. value for money (up from 36%) We’ve supervised firms’ implementation of our operational resilience rules. They’ve set impact tolerances for their important business services and tested their ability to remain within them. But staying resilient and secure remains an ongoing challenge, as risks Research by UKCSI and threats multiply. shows satisfaction And we’ve continued to take action to fight financial crime, with banks and including fining firms for past failings, and supervising firms’ work building societies on strengthening their systems and controls. Firms have made at the highest level progress, including on fraud: they successfully implemented the recorded Payment Systems Regulator’s (PSR) reimbursement requirements on authorised push payment (APP) fraud, and some are already (81.6 out leveraging AI to fight financial crime. But there’s an ongoing challenge in staying ahead of fraudsters and other bad actors who may themselves be enabled by AI or quantum computing. of 100) 7 Financial Conduct Authority Regulatory Priorities: Retail Banking Our priorities: Access to cash and essential banking services Retail banks and building societies What we expect firms to do • Fill significant gaps in local cash access services in accordance with our Access to Cash sourcebook (where the firm is designated under the regime). • Avoid causing foreseeable harm to retail customers when implementing digital- first transformations, including by analysing customer need and making sure any proposed alternatives are in place and accessible before a branch closure. • Comply with the Basic Bank Account regulations (where the firm is designated), making it easy for eligible consumers to apply. • Ensure financial crime controls don’t lead to unnecessary or overlong account freezing. Firms have improved their approaches to branch closures under our guidance, and deployment of banking hubs is accelerating. But assessments and communications about individual branch closures can still be patchy. More people The Financial Ombudsman Service is upholding fewer complaints have a current about firms’ closure or non-provision of current accounts, but account now. some stakeholders still report access concerns for some specific consumer cohorts. In 2017: 2.5% What we’ll do this year • Monitor designated firms’ Access to Cash compliance of UK adults and solutions to fill gaps in cash access. We’ll intervene didn’t have a in instances of non-compliance and begin evaluating how effective the regime is. current account • Assess firms’ branch closure notifications. In 2024: • Research the harms that reduced in-person banking services may create. 1.6% • Conclude ‘mystery shopping’ on how firms provide basic didn’t bank accounts and feed back to firms on good and bad practice (Q2 2026). (FCA Financial Lives 2024 survey) 8 Financial Conduct Authority Regulatory Priorities: Retail Banking Our priorities: Good outcomes from products and services Retail banks and building societies What we expect firms to do For retail customers, under the Consumer Duty firms should: • keep improving their data and management information dashboards for monitoring and assessing consumer outcomes, and their governance over these • take action where need is identified to support consumers in pursuing their financial objectives and to avoid causing them foreseeable harm, including for those in vulnerable circumstances, financial difficulties, or where fair value isn't being provided • keep consumer outcomes front and centre when designing and delivering products or services, especially new, innovative or AI-based ones We’ve seen firms make good progress on driving positive consumer outcomes, but most still have further to go on their data-led monitoring and assessment of these. Firms’ embedding of the Duty must be a continuing effort, especially as consumer behaviour changes and technology and business models evolve. What we’ll do this year • Monitor data and consumer outcomes, including as indicators of firms’ embedding of the Duty in their cultures and controls. • Monitor the market to identify poor consumer outcomes, especially for customers in vulnerable circumstances or who are getting poor value. We’ll take action against outliers. • Undertake risk-led reviews on high-impact topics that emerge as priorities. • Support cross-sector work on customer journeys, the Products and Services and Consumer Understanding outcomes, and firms’ approaches to outcome monitoring. From January 2023 to November 2025, deposits in lower paying easy access accounts with Big 9 firms fell by £124bn, while those in their time/ notice accounts grew by £140bn. (Big 9: Lloyds Banking Group, HSBC Bank UK, Barclays Bank UK, NatWest Group, Nationwide Building Society, Santander Bank UK, Virgin Money UK, Co-op Bank, TSB.) 9 Financial Conduct Authority Regulatory Priorities: Retail Banking Our priorities: Fighting fraud and other financial crime Retail banks and building societies What we expect firms to do • Help consumers understand fraud risks and support victims fairly. • Monitor and mitigate the risks firms and consumers face, refining defences and control frameworks and promptly and effectively remediating any weaknesses. • Keep improving systems and controls, to combat bad actors’ evolving tactics and technologies. • Learn from FCA outputs and keep investing in resources and controls, including advanced technology such as AI where appropriate. The mass open nature of retail banking presents inherent financial crime risks. So firms must help defend consumers from fraud, and the financial system from money laundering and other misuse. Most firms have invested heavily in systems and controls for detection, disruption and prevention, but some have progressed more than others, against constantly evolving threats. What we’ll do this year 88% • Engage with firms progressing system and control In the first year of improvement programmes, or that have heightened risks. the PSR’s APP fraud reimbursement • Use data and analytics to identify outliers and target policy (October proportionate interventions. 2024 to September • Continue our review of money laundering controls around 2025), 88% of the cash deposits, including through the Post Office. money consumers • Assess selected firms on specific types of financial crime risks lost to APP scams and controls. within the scope of the policy was An independent evaluation of the PSR’s APP fraud policies will returned to them conclude in Q3 2026. (£173m; PSR figures). 10 Financial Conduct Authority Regulatory Priorities: Retail Banking Our priorities: Operational resilience and data security Retail banks and building societies What we expect firms to do Continue building operational resilience and data security by: • identifying emerging risks to resilience, incorporating these in scenarios and testing to refine action plans for remediating vulnerabilities and remaining within impact tolerances • continuing to evolve and improve cyber protection and information protection strategies, with tested recovery plans to mitigate harms from cyberattacks and third- party failures • managing any live issues within impact tolerances, managing the impact on customers and communicating effectively with them • participating in cross-industry initiatives where appropriate, to help improve system-wide resilience and recovery strategies Firms face continual risks to resilience and security from technology transformations (e.g. digital-first strategies, AI adoption), increasing reliance on critical third parties, cyber threats (including from state actors), and insider risks (malice or negligence; see the Insider Risk Guidance for example). Number of Firms need to mitigate these risks, learning from regulators' outputs and operational other stakeholders (see for example our recent review of 2025 CBEST cyber security assessments). incidents retail banking firms What we’ll do this year reported to us With the PRA (and other stakeholders) we’ll: in past 4 years: • engage firms about their technology change programmes, and 2022-409 operational resilience self-assessments • collect information on insider risk management, to gather 2023-415 insights on its maturity in the sector 2024-477 • introduce new rules for reporting operational incidents and information on material third parties (following CP24/28), engaging 2025-468 with firms during the implementation period following publication 11 Financial Conduct Authority Regulatory Priorities: Retail Banking Other areas of focus Retail banks and building societies Business banking outcomes Small businesses are important to the economy and the outcomes they get from retail banking are important for their resilience and growth. Under the Consumer Duty, firms should monitor and assess outcomes for their eligible business customers, support them in pursuing their financial objectives, and avoid causing them foreseeable harm. We’ll monitor eligible business customers’ outcomes under the Duty, intervening where necessary. We also want firms to assess business customers’ treatment and access to services, and to identify potential improvements, particularly in sectors important to our national and economic security and the medium- to long-term growth of the UK economy. We’ll use our convening power to encourage a system-wide response supporting access to banking and finance for businesses, particularly in those sectors. Innovations in retail banking Firms’ responsible adoption of innovations can benefit consumers, competition and growth. Current innovations relevant to retail banking include AI, and targeted support (which firms can now apply for permission to provide, including by using our pre-application support service – PASS). Future potential innovations include open banking’s further evolution, open finance, and stablecoins and tokenised deposits; see our Payments Regulatory Priorities (forthcoming). We want firms to consider and test the opportunities and risks these developments present. We expect them to keep the Duty and consumer needs at the heart of their innovations and to maintain good governance and controls over these. We’ll support these potential developments and want firms to engage with us and other stakeholders about them. We’ll also engage firms on how banking business models may be affected. Motor finance commission review Some firms are affected by the Supreme Court’s decision on motor finance and our consequent interventions on potential redress. They should comply with our interventions on complaints handling. We’ll decide whether to introduce a redress scheme and, if so, we would expect to publish final rules in late March. If a scheme is introduced, then later we’ll assess firms’ compliance with it and consumers’ outcomes, intervening where necessary. Senior Managers and Certification Regime Working with the Treasury and the PRA, we’re reviewing the efficiency and effectiveness of the SMCR regime, to halve its regulatory burden (H1 2026). 12 Financial Conduct Authority Regulatory Priorities: Retail Banking Key publications and speeches Below are some key documents relevant to retail banking firms, published since our last retail banking portfolio letter (October 2024) but not included above. Relating to firms’ obligations and consumer outcomes under the Duty: Our Consumer Duty webpage, for the latest Consumer Duty updates Firms’ treatment of customers in vulnerable circumstances – review Consumer Support Outcome: good practices and areas for improvement Digital design in customers’ online journeys: good practice and areas for improvement International payment pricing transparency – good and poor practice Statement on firms working together to manufacture products or services Complaints and root cause analysis: good practice and areas for improvement Relating to firms’ systems and controls around fraud and financial crime: PS24/17: Financial Crime Guide updates Firms’ use of the National Fraud Database and money mule account detection tools Combating romance fraud – prevention, detection and supporting victims FG25/3 Treatment of politically exposed persons for anti-money laundering purposes FG24/6 Guidance for firms that enables a risk-based approach to payments Risk assessment processes and controls in firms: our findings Final notices on Monzo, Barclays and Nationwide for past control failings PSR decision notice on Bank of Ireland UK for failing to implement Confirmation of Payee by the required deadline Relating to firms’ operational resilience and data security: PS24/16: Operational resilience: Critical third parties to the UK financial sector FCA Cyber Coordination Group Insights 2024 Relating to transition finance: Raising standards in transition finance: clarity, coherence, collaboration (speech) Relating to firms’ cultures: PS25/23: Tackling non-financial misconduct in financial services Culture is contagious (speech) 13 Financial Conduct Authority Regulatory Priorities: Retail Banking Timeline Our indicative timelines of key start dates are set out below. Plans may change if we have new priorities or existing priorities change scope. Here is our full regulatory initiatives pipeline for 2026-27. Access Q2 2027 Evaluation of the Access to Cash regime: review will begin in Q4 2026, with the output published at end Q2 2027. Consumer outcomes 2026 Retail banking disclosure rule review: we intend to review where simplifying prescriptive disclosure requirements may support consumer understanding, and aim to consult in 2026. H1 2026 Consumer Duty scope and distribution chain: consultation on clarifying the application and requirements of the Duty, including across distribution chains. Financial crime Laid in HMT consultation on improving the effectiveness of the money laundering 2026 regulations: a statutory instrument is expected to be laid in 2026. Operational resilience Planned Information and communication technology, cyber risk management and for 2026 resilience: PRA/BoE consultation paper planned for 2026. H1 2026 Incident and outsourcing and third-party reporting: FCA, PRA and BoE final rules expected H1 2026, with implementation 12 months later. Innovation H2 2026 Adopting targeted support: the authorisations gateway for firms to seek permission opened on 2 March, and the regime goes live on 6 April 2026. March FCA open finance roadmap: expected to be published in March 2026. 2026 Q4 2026 Statutory instrument for open banking: expected to be laid in Q4 2026, with the FCA consulting on new rules for the long-term regulatory framework. 14 Financial Conduct Authority Regulatory Priorities: Retail Banking 2026 FCA crypto roadmap policy statements: to be published in 2026. Smarter regulator H1 2026 Modernising the redress framework: joint FCA/Financial Ombudsman Service policy statement and further consultation, planned for the first half of 2026. H1 2026 Senior Managers & Certification Regime: working with the Treasury and PRA, review the efficiency and effectiveness of SMCR. 15 © Financial Conduct Authority 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 1-9079 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts

Regulatory Priorities: Retail banking report

Classification

Pipeline Progress

🔄 Pipeline Journey

🤖 How this summary was made

Full AI Instructions