The FCA has now published the final UK cryptoasset regime, completing its Crypto Roadmap and confirming that crypto activities will be brought fully within the existing FSMA framework from 25 October 2027. The headline messages are contained in the accompanying FCA press release and new overview webpage, which together provide a useful guide through what is a substantial package of policy statements, guidance and consultations. While much of the architecture was already visible through earlier consultations, firms now have something they have lacked throughout much of the process: certainty. The significance of today's package is not that it changes the direction of travel, but that it finalises the framework and provides a clear route to implementation. Firms have three months until the authorisation gateway opens and less than sixteen months until the regime comes into force. That is a comparatively short implementation period given the governance, operational, and prudential changes many firms will need to make. The challenge is no longer understanding what regulation might look like. It is demonstrating readiness to operate within it. The FCA has also used the final package to reinforce a broader message running through much of its recent work: the UK's crypto regime is intended to support innovation, growth and competitiveness while maintaining high standards of consumer protection and market integrity. The final framework reflects a regulator that has listened to industry feedback in several key areas, while remaining firmly committed to bringing crypto firms within mainstream financial services regulation.

Cyber incidents are increasingly giving rise to complex, long‑tail litigation risk, particularly for financial services firms. As regulators place growing emphasis on operational resilience, outsourcing governance and accountability, the same regulatory findings may be repurposed to support civil follow‑on claims long after incidents occur. Regulatory investigations are taking longer to conclude and, alongside damages claims, courts are showing an increased willingness to grant urgent injunctive relief to prevent data misuse. As a result, firms should approach cyber preparedness not only as a regulatory or operational issue, but as a litigation risk mitigation exercise – aligning regulatory engagement, disclosure decisions and contractual liability planning from the outset. This article is the second in our three‑part Emerging Themes in Financial Regulation & Disputes 2026 series and follows our earlier analysis of cyber resilience and the 2026 regulatory shift. It examines the evolving litigation and regulatory landscape shaping cyber and operational resilience expectations for the year ahead and identifies practical priorities for financial services firms seeking to respond proactively. Our accompanying articles consider (i) cyber resilience and the 2026 regulatory shift; and (ii) operational resilience and the growing influence of critical third‑party designations.

The UK’s financial services reform programme has reached a decisive inflection point, with the publication of the Financial Services & Markets Bill 2026 and the May 2026 Regulatory Initiatives Grid marking a clear shift from policy development to implementation and execution. As a mid‑year update to our Emerging Themes in Financial Regulation & Disputes 2026 outlook, these developments confirm – and refine – the trajectory identified at the start of the year: a move towards a more flexible, growth‑oriented and regulator‑led framework, driven by the interplay of politics, people and technology. This should not be understood as deregulation. Rather, the direction of travel is one of recalibration, with reduced legislative prescription offset by increased supervisory discretion, a broader regulatory perimeter and heightened expectations of accountability – particularly in relation to senior individuals, consumer outcomes and technology‑driven risks. The latest reforms also signal a decisive transition from consultation to delivery, with clearer timelines, more proactive supervisory engagement and a growing emphasis on outcomes‑based regulation. For firms, the message is clear: 2026 is already shaping up to be a busy and consequential year. The pace of change is accelerating, and the regulatory environment is becoming more dynamic, judgement‑based and interventionist, requiring a strategic approach to managing both regulatory risk and opportunity.

As crypto moves from the margins to the mainstream of the UK financial system, regulatory uncertainty is giving way to structured supervision, authorisation and enforcement. BCLP’s Emerging Themes 2026 crypto series tracks this transition in real time — from the expansion of the regulatory perimeter, through new conduct and market integrity regimes, to the operational and governance expectations that will define participation in regulated crypto markets. This article focuses on the latest step in that progression: the FCA’s publication of its perimeter guidance in Consultation Paper CP26/13, a critical development in translating legislative intent into practical compliance obligations as the UK’s new crypto regime takes shape.

UK regulators have not yet fully exercised the breadth of their powers to address shortcomings in organisational cyber‑security measures—but that restraint is unlikely to continue. The policy statements published on 18 March 2026 by the FCA, PRA and Bank of England, introducing a new single regime for operational incident and third‑party reporting, signal the direction of travel. The framework—under which firms must report serious cyber and operational incidents through a unified portal and provide structured information on their critical third party (CTP) dependencies—reflects the UK regulators’ sharpened focus on digital risk, system resilience, and their recognition of the vulnerabilities inherent in  complex technological supply chains. This shift sits alongside the UK government’s broader agenda. As the Cyber Security and Resilience (Network and Information Systems) Bill (NIS Bill) progresses and HM Treasury (HMT) prepares to designate major technology providers as CTPs using its FSMA powers, firms can expect a step‑change in supervisory expectations. Cyber‑security, data protection and operational resilience disciplines must now operate as a single, evidence‑based ecosystem capable of withstanding assertive regulatory challenge. The coming year will require firms not only to demonstrate alignment on paper, but to evidence—consistently and credibly—that controls work in practice. This article is the first in our three part Emerging Themes in Financial Regulation & Disputes 2026 series. We examine the evolving regulatory and risk landscape shaping cyber and operational resilience expectations for the year ahead—and set out practical priorities for financial services firms seeking to respond proactively. Our accompanying articles will examine (i) the evolving cyber litigation risks facing financial services firms and (ii) operational resilience and the growing influence of CTP designations.