FCA publishes multi-firm review into wholesale banks supervision

On 2 November 2026, the Financial Conduct Authority (FCA) published learnings gained from supervisory work they’ve undertaken, risks they’ve seen crystallise and findings from internal audit functions in relation to wholesale banks.

Summary

The FCA set out the following findings, in particular:

Improving the resilience of firms and markets

• Data management: The FCA continues to identify weaknesses in data management, including incomplete data ingestion caused by coding defects and communication-surveillance gaps arising from data and lexicon issues. Firms should ensure effective data ingestion, completeness controls and clear data lineage, including where third-party providers are used.
• Asset inventory management: Weak disposal and redeployment controls, inconsistent processes, unclear accountability and inadequate reconciliations can prevent firms maintaining complete asset inventories, including identifying devices without current security controls.
• Algorithmic trading controls: The FCA identified algorithmic trading weaknesses, including a defect that caused a significant unintended intraday position following inadequate testing of an enhancement. Firms should assess changes across the entire trading process and consider Regulatory Technical Standards (RTS) 6 requirements on testing, governance, pre-trade controls, and order cancellation. Similar considerations may inform controls around AI and automation.
• Data loss prevention framework: An employee circumvented data loss prevention controls through techniques including splitting information across emails, changing classifications and file formats, and embedding information in images, illustrating the need for robust controls against evolving behaviours.
• Evidencing resilience in practice: Banks have strengthened operational resilience, but improvements remain necessary. Self-assessments should use granular evidence linked to impact tolerances, testing, and remediation. Impact tolerances should reflect potential wholesale-market harm rather than generic recovery metrics. Firms should distinguish future remediation from current capabilities, learn from incidents and testing, and consider T+1 settlement implications for settlement-related important business services.

Enhancing efficient, competitive and innovative markets

• Cryptoassets: the new regime: The new regime will regulate additional activities including custody, trading platforms, dealing, arranging, stablecoin issuance and staking. Wholesale banks can apply for variations of permission, with applications encouraged by 28 February 2027 ahead of commencement on 25 October 2027. Later applicants face transitional restrictions.
• Innovation in digital market infrastructure: Demand continues for FCA innovation support, particularly around digital wholesale infrastructure. Firms should consider asset control, holding and settlement early. The FCA and Bank of England will also publish a tokenisation roadmap.
• Artificial Intelligence (AI): AI-related concerns include insufficient human oversight, unapproved tools causing data leakage, governance failures, inconsistent risk ratings, inadequate kill-switch arrangements and incomplete AI inventories.

Preventing financial crime and market abuse

• Unregistered annex 1 firms: Banks should identify and manage risks from businesses conducting annex 1 activities without required FCA registration.
• Due diligence before investing in securitisation: Institutional investors must conduct appropriate due diligence before investing and throughout securitisation investments, including enhanced controls for higher-risk assets.

Ensuring firms effectively manage conflicts of interest and conduct oversight

• Prime brokerage: client risk assessment: Banks should ensure relevant surveillance, investigation, KYC and monitoring information appropriately informs client risk decisions and escalation.
• Request for quote controls: Firms should strengthen “fat finger” controls through appropriate implementation, inventories, periodic testing and calibration of thresholds and limits.