What can wholesale banks learn from the FCA’s 2026 supervisory insights?

The FCA published its latest supervisory insights for wholesale banks on 2nd November 2026, which draws together issues it has encountered through day-to-day supervision, incidents at firms and the work of internal audit functions. For banks, it provides a useful indication of where the regulator is seeing controls fall short in practice, across areas including operational resilience, AI financial crime and conduct risk. Overall, this publication spotlights what existing controls look like under pressure, and the weaknesses that it exposes.

Where do 2026 wholesale banks supervision insights fit into the FCA’s wider supervisory work?

This is the third set of findings published as part of the FCA’s ongoing work on wholesale bank supervision following updates in 2025 and spring of this year. The earlier findings still stand, so this publication ought to be read as another layer of supervisory insight rather than a new set of separate priorities.  

The approach is intended to make what the regulator is seeing through its supervisory work more useful to the wider market. The findings are aligned to the areas of focus in its Regulatory Priorities report for wholesale markets and give firms practical examples against which they can consider their own arrangements. 

Resilience depends on what happens beneath the controls

Several examples highlighted in the FCA’s communication demonstrate how specific weaknesses can expose much bigger gaps in a firm’s controls.  

For example, a coding defect at one firm meant data was not ingested into a financial crime control. The gap went undetected for an extended period and was discovered through unrelated activity rather than through the firm’s own monitoring. The FCA points firms back to data lineage, completeness and testing the effectiveness of data ingestion when controls are implemented. 

There are similar lessons elsewhere.  

The regulator describes weaknesses in asset inventories, algorithmic trading controls and attempts by an employee to evade data loss prevention controls. Its operational resilience findings also suggest that firms still have work to do in evidencing the conclusions they reach, particularly around impact tolerances, remediation and how lessons from incidents and testing are carried back into resilience planning. 

Cryptoassets, digital market infrastructure and AI: innovation brings new risks

Cryptoassets, digital market infrastructure and AI all feature in the latest update. With the new UK cryptoasset regime due to come into force in October 2027, the FCA also sets out practical information for wholesale banks planning to undertake newly regulated cryptoasset activities. 

Its observations on AI are perhaps more telling about the challenges already facing firms.  

The regulator has seen inaccurate AI-generated code make it through human review and cause a service outage, as well as staff using unapproved AI tools resulting in leaks of sensitive information. Internal audit work has also identified incomplete AI inventories and weaknesses around approvals, risk ratings and kill switches.  

These are no longer hypothetical governance questions. Firms are already having to establish whether oversight designed for more conventional technology remains effective when AI is being used across the business. 

Financial crime risk needs to be seen in the round

Financial crime features in several of the FCA’s observations.  The regulator drawing attention to the need for firms to understand the risks associated with the businesses they support and the transactions and investments they are involved in. Its findings cover areas including customer and counterparty due diligence, ongoing risk assessment and the controls firms use to identify financial crime risk. 

The examples elsewhere in the publication also show how those controls can be affected by wider weaknesses, from the quality of the data they rely on to how effectively information is shared across a business.  

For firms, this makes financial crime as much an issue of effective oversight as individual policies and processes. 

Client risk cannot sit in separate pockets

The FCA’s work on prime brokerage also points to the importance of looking at client risk across the business rather than in isolation. Its review found that relevant information was not always reaching the people responsible for making client risk decisions, making it harder for firms to build a complete picture of changing risk. 

More appropriate approaches the regulator cites brought that information together, so that firms could respond when a client’s risk profile changed. The FCA also found weaknesses in some firms’ trading controls, pointing again to the need for effective oversight as risks and activities evolve. 

Suggested actions for wholesale banks

The FCA is asking firms to consider the observations and how they apply to their own activities and practices. That makes this a useful benchmarking exercise rather than simply an update to read and file away.  

The individual issues vary considerably, but many come back to whether firms can:  

• see when controls are beginning to fail  

• bring together information held across different parts of the business  

• evidence that controls continue to work in practice