March 2026 Regulatory Outlook: From Frameworks to Real-World Effectiveness

Below is a summary of our most recent newsletter.

The first quarter of 2026 has delivered a clear and consistent message from regulators across the UK, EU and US: "compliance frameworks must work in practice — not just on paper".

Supervisors are no longer satisfied with well-documented policies or theoretical controls. Instead, they are focusing on whether firms can demonstrate effective governance, evidence outcomes, and show accountability at senior levels.

In this update, we explore the key regulatory themes shaping the landscape — and what firms should be doing now to stay ahead.

Governance Under the Spotlight: Evidence Over Assertion

Across jurisdictions, regulators are sharpening their focus on governance. The expectation is simple but demanding: boards and senior management must understand risks, act on them, and prove that they have done so.

This is translating into increased scrutiny of:

• The quality and relevance of management information (MI)
• How client and investor outcomes are assessed
• Oversight of outsourcing, delegation and distribution
• The speed and clarity of escalation processes

A recurring issue is that firms often produce large volumes of MI — but more information does not mean better oversight. Lengthy, operationally dense board packs can obscure rather than clarify key risks.

The shift for 2026 is towards:

• Concise, decision-focused reporting
• Clear ownership of actions
• Effective challenge from senior stakeholders
• Transparent tracking of issues and remediation

Consumer Duty: Can You Prove It's Working?

The UK Consumer Duty has moved firmly into its next phase: demonstration, not design.

Regulators are no longer asking whether firms understand the Duty — they are asking:

1. What outcomes are being monitored?
2. What evidence supports conclusions?
3. Where are the risks or poor outcomes?
4. What has been done to fix them?

Common weaknesses include board reports that describe processes but lack hard outcome data, monitoring frameworks focused on activity rather than customer outcomes, and gaps in closing the loop — identifying issues without evidencing resolution.

A useful test is whether your reporting clearly answers: what are the outcome risks, what evidence do we have, what action has been taken, and what remains unresolved. If not, refinement is likely needed.

Appointed Representatives: Tailored Oversight Is Critical

The Appointed Representatives (AR) regime remains a key regulatory concern. The challenge for principals is no longer whether oversight exists — it is whether it is proportionate, risk-based, and demonstrably effective.

Strong oversight frameworks will:

• Apply risk-based due diligence at onboarding and ongoing stages
• Tailor monitoring based on business model and risk profile
• Ensure timely escalation and intervention
• Maintain clear governance records supporting decisions

A one-size-fits-all approach is increasingly difficult to justify. Oversight must reflect the reality of each AR relationship.

Financial Crime: Moving Beyond "Paper Compliance"

Financial crime controls continue to be a regulatory priority — but the focus has shifted decisively toward effectiveness. Firms should be stress-testing sanctions screening frameworks, transaction monitoring systems, suspicious activity reporting processes, and escalation and governance arrangements.

Boards are expected to receive more than statistics. They should see trend analysis, residual risk assessments, control weaknesses and remediation progress. Importantly, outsourcing or using technology solutions does not transfer responsibility. Accountability remains firmly with the firm.

EU Focus: Cross-Border Complexity and AIFMD II Readiness

For firms operating internationally, regulators are increasingly interested in how cross-border structures function in practice, including who owns each control, where decisions are made, and how oversight is exercised across entities. Fragmented documentation is a common issue — a centralised control and accountability map is becoming essential.

With AIFMD II progressing, firms must move beyond high-level awareness to structured implementation planning, including reviewing delegation and substance arrangements, assessing reporting and disclosure changes, and coordinating legal, compliance and operational workstreams. Firms often underestimate the scale of impact — a phased programme with clear ownership and board visibility is critical.

Across the EU, AML frameworks are under scrutiny, particularly in complex, multi-jurisdictional structures, and sanctions compliance is no longer viewed as purely technical — it is a core governance issue requiring robust list management, calibrated screening logic, effective alert handling and regular assurance testing.

US: Alignment Between Policy and Practice

In the US, regulators continue to focus on whether firms' policies, disclosures and actual practices align. Inconsistencies across marketing materials, fee disclosures and operational practices remain a major source of enforcement risk — a theme increasingly relevant globally, not just in the US.

The SEC Marketing Rule has reinforced the need for strong governance over promotional activity, with claims properly substantiated, disclosures consistent across channels, and approval workflows robust and documented. Fast-moving marketing environments, especially digital, can quickly expose weak controls.

Tokenised securities and digital assets are evolving rapidly, often outpacing governance frameworks. Firms should ensure clear legal and regulatory classification, defined ownership of risk and analysis, robust custody and safeguarding controls, and ongoing monitoring of regulatory developments — the key risk being innovation outpacing compliance readiness.

Final Thoughts: Execution Is the Real Challenge

Governance must be evidenced, controls must reflect reality, and accountability must be clear.

The challenge for firms is no longer identifying regulatory expectations — it is executing effectively. The firms best positioned for 2026 will be those that simplify and strengthen governance reporting, clearly document ownership of risks, continuously test whether controls match the business model, and enhance oversight of outsourcing and cross-border activity.

Ultimately, resilient compliance frameworks combine legal clarity, operational ownership and governance visibility. Where these elements are disconnected, weaknesses are far more likely to be exposed under regulatory scrutiny.