Every dated change below arrives as process. New documents. New clocks. New records. New returns. Someone has to do that work, and in most firms it is the same three people who are already busy.
Nine of the twelve rules are FCA rules on FCA-authorised firms. Three are not: inheritance tax is HMRC, Critical Third Parties lands on four technology providers, and the EU AI Act reaches by role and use case rather than sector.
Dated changes affecting UK regulated firms between now and 2028. Last reviewed: September 2026
Showing all 12 changes
A new form of help between guidance and full advice — suggestions to groups of customers with shared characteristics.
FCA and PRA reforms in force from 24 April 2026: the 12-week rule extended, criminal record check validity moved from three to six months, SMF7 scope widened, Statement of Responsibilities windows changed, enhanced-firm thresholds adjusted. Staged follow-ons on 10 July, 30 July and 1 September 2026. Phase 2 needs Treasury legislation and a consultation was expected later in 2026.
CCI replaces PRIIPs and UCITS disclosure. An optional transition period runs from 6 April 2026 to 7 June 2027; the rules are fully in force from 8 June 2027.
HM Treasury announced the first four Critical Third Parties on 10 July 2026 — AWS EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK. The designations took effect, and joint Bank of England, PRA and FCA oversight began, on 13 July 2026.
From 15 July 2026, third-party lenders offering deferred payment credit come under FCA regulation, with creditworthiness and affordability rules. Merchant-provided own DPC agreements and DPC broking are not brought into regulation by this change.
Proposals on scope and proportionality, including wholesale markets and non-UK customers. Policy statement expected Q1 2027.
The ultimate statutory deadline; staged connect-by dates run ahead of it. Schemes with fewer than 100 relevant members sit outside mandatory scope — but a scheme crossing 100+ after 1 April 2024 can come into scope, with a deadline of the later of six months after its scheme year-end or 31 October 2026.
Expected to follow the AI Input Zone feedback. Expected, not guaranteed.
Two regimes, two scopes. Incident reporting reaches all Part 4A firms, payment service providers, UK RIEs, registered trade repositories and credit rating agencies. Third-party reporting is narrower — enhanced-scope SM&CR firms, banks, designated investment firms, building societies, Solvency II firms, CASS large firms, UK RIEs, authorised EMIs and PIs, and consolidated tape providers.
Most unused pension funds and death benefits enter the estate. Certain benefits, including qualifying death-in-service benefits, are excluded; transfers to exempt beneficiaries such as qualifying spouses, civil partners and charities can be exempt from IHT. A tax change, not an FCA one — the deadlines fall on pension scheme administrators and personal representatives, not on advice firms.
Final rules and guidance were published 30 June 2026 and apply to firms granted permission on or after commencement. The enabling regulations were made 4 February 2026.
Annex III systems from December 2027; certain Annex I product-related systems from August 2028, following the 2026 amendment to the timetable.
Nine of the twelve are FCA rules on FCA-authorised firms. Three are not, and if you only work with advice firms you can stop reading at the first list:
Inheritance tax, April 2027 — an HMRC change. The deadlines belong to pension scheme administrators and personal representatives, which pulls in legal, probate and accountancy firms as well as pension providers. An advice firm feels it through client planning, not through a deadline it holds.
Critical Third Parties — the obligations sit on four technology providers, supervised jointly by the Bank of England, PRA and FCA. Nothing new lands on regulated firms.
EU AI Act — not a UK regime and not sector-based at all. It reaches by role, use case and EU nexus, so it can capture an unregulated UK software vendor while missing a UK-only advice firm entirely.
Two more are split rather than clean: pensions dashboards divides between FCA-regulated providers and TPR-regulated occupational schemes, and BNPL reaches consumer credit lenders while leaving merchant-provided own DPC outside.
The big one
The change creates a workflow that runs per death, across scheme administrators and personal representatives, with statutory and conditional deadlines throughout. Which of them run depends on the case, and every one is a date somebody has to hit while relatives wait.
All of the below is taken from HMRC's technical note. Key information-sharing deadlines were made statutory by SI 2026/818, laid on 15 July 2026.
| Clock | Who | What must happen |
|---|---|---|
| 28 days then 14 days | Scheme administrator | Provide the value within 28 days of the request. If it cannot, give an estimate and the basis for it — then the final value within 14 days of obtaining it |
| 28 or 14 days later of | Scheme administrator | Provide relevant information by the later of 28 days from the request, or 14 days from the beneficiaries being determined |
| 3 months | Scheme administrator | Report within 3 months of making the final relevant lump-sum death-benefit payment |
| 35 days | Scheme administrator | Pay the amount specified in a valid Direct Payment Scheme notice within 35 days of receiving it |
| 15 months + 14 days | Scheme administrator | A withholding notice can restrict benefits between the date of death and 15 months after the end of the month of death. It must be acknowledged and its validity confirmed within 14 days |
| 13 months or 30 days | Personal representative | Notify HMRC by the later of 13 months after the date of death, or 30 days after becoming aware the allowance has been exceeded |
Most firms will still be designing this workflow, because the regime does not take effect until April 2027.
It will get met the way a new workflow usually gets met: a spreadsheet, a shared inbox, and one person who remembers the deadlines. That holds until volume arrives.
A firm that builds the tracker before the rule lands spends the next two years not thinking about it. That is the proposition, and none of it is about AI.
Not everything. The split is between work that is rule-driven and repetitive, and work that carries accountability.
A case opens, several clocks start, documents are requested from third parties, someone must chase. Track the clocks, send the requests, escalate before the deadline, and the audit trail exists before anyone asks for it.
CCI regenerates every disclosure across a product range. Hand-editing that is weeks of work and creates version drift. Generate from one product source, with change history and intelligibility measured.
Third-party registers, tool registers, incident logs. All fail the same way: accurate the day they are built, stale within a quarter. Populate from what is actually in use, and produce the report from the register.
Consumer Duty board reporting and fair value assessments are mostly aggregation from systems you already have, assembled by hand each quarter, under time pressure. Pull it instead of compiling it.
Dashboard find and view requests need answering accurately and fast. Automate the clean matches; route the ambiguous ones to a person, with the reason attached.
Suitability, vulnerability, whether a client understood. The rules can permit automated delivery. However responsibility stays with the firm, so governance, escalation and evidence have to be proportionate to the rule and the risk.
Automate where the rule is deterministic. Use judgement, human or assisted, where the outcome depends on the client.
Most of this pipeline is the first kind: a date, a document, a register, a return. That does not need a model, it needs a system, cheaper and easier to defend than the AI conversation the market is currently having. But the line is a way of deciding what to build first, not a statement of what any rule requires.
Compliance consultants tell a firm what a new rule requires. Software vendors sell a product built for the general case.
Neither builds the specific workflow the rule creates inside that firm's own systems. The gap is widest in the eighteen months before a rule lands, when the requirement is known and nothing exists yet.
April 2027 is in that window now.
Verification
This page is only useful if the dates are right, so every item links to the body that set it.
Taken from HMRC's technical note on 4 September 2026, replacing an earlier draft that had two wrong: the reporting deadline is 3 months after the final payment, not 1 month, and the personal representative's is the later of 13 months after death or 30 days after becoming aware — not 2 months. Key information-sharing deadlines were made statutory by SI 2026/818.
The table is not exhaustive and this is not "a fixed number of clocks per case" — several deadlines are conditional, further 14-day obligations arise after certain payments and where a withholding notice is invalid, and which apply depends on the facts.
Designation of the four providers on 10 July 2026 and the start of joint Bank of England, PRA and FCA supervision on 13 July 2026, taken from the Bank's own announcement.
CCI transition from 6 April 2026 and rules in force 8 June 2027 (PS25/20). Cryptoasset regime expected in force 25 October 2027, final rules published 30 June 2026 (FCA) — these two dates belong to the UK cryptoasset regime, not to PS26/2. Both PS26/2 reporting scopes are taken from the policy statement rather than summarised: incident reporting covers all Part 4A firms and payment service providers; material third-party reporting is narrower.
6 April 2026 and 15 July 2026 came from independent review rather than being read at the FCA by us. The policy statements are linked; confirm the exact days there.
A SYSC 15A "future version" dated 25 October 2027 appeared in the previous draft. The Handbook displays it, but no specific instrument or change was identified — and the date is the day the cryptoasset regime commences, which is the likelier explanation. It should not have been presented as a resilience milestone.
High, firm-specific and watch-only are MoiraCorp's engineering view of what is deterministic. They are commercial judgement, not regulatory classification.
Motor finance redress, later-life lending, the pure protection market study and Handbook simplification are all live and not on this page. Tell us what is missing and we will add it.
Last reviewed: 4 September 2026 · Next review: 1 December 2026, or on publication of the FCA's AI good and poor practice material, whichever is sooner.
Regulatory mapping for operational planning, not legal advice. Applicability depends on permissions, activities, customers and facts. Primary sources are linked throughout; firms should confirm their own position with their compliance or legal advisers.
You know what is coming.Now check which of these rules actually reach your firm, by firm type and permission.
See which rules apply →
The matrix shows which rules apply to your kind of firm today. This page shows what is coming. If you want the workflow built before the rule lands rather than after, that is the conversation.
