Horizon Scanning and FCA Expectations: What UK Firms Must Demonstrate

We found no rule in the FCA Handbook that requires "horizon scanning" by name. As of 30 September 2026, the expectation is assembled from five Handbook locations: SYSC 6.1.1R (adequate policies and procedures to ensure compliance with "obligations under the regulatory system"), SYSC 4.1.1R (effective processes to identify, manage, monitor and report risks), SYSC 3.2.6R for insurers, Principle 3, and Senior Manager Conduct Rule SC2 (COCON 2.2.2R). If you are FCA-authorized, several of those bind you today.

To check that first sentence, we fetched 291 Handbook section pages across SYSC, PRIN, COCON, FIT, MIFIDPRU, SUP 15 and more than twenty other modules and searched them for the phrase. There were no hits for "horizon scanning." The Handbook's own search is a JavaScript application we could not query, so treat this as a scoped check and not a proof.

The absence of a named rule leaves your obligations intact and is a trap for firms that read the Handbook like a checklist. The test the FCA can apply is narrower than "do you scan." It is can you evidence what you saw, what you dismissed, and who owned what happened next. If your process cannot produce a dismissal log, it is closer to a newsletter subscription than to a process the FCA will find easy to accept. Below, each anchor is mapped to the evidence a supervisor can request, followed by a 17-row FCA-evidence checklist you can self-assess against this week and the enforcement record for firms that treated regulatory horizon scanning and change assessment as optional. For the discipline itself, start with what is regulatory horizon scanning; this piece is about what the FCA expects UK firms to demonstrate.

The FCA never wrote a horizon-scanning rule; it assembled one across five Handbook locations

The table below is the rule map. Wording comes from the live Handbook, read on 30 September 2026. The application column matters more than most commentary admits, so read it before quoting any of these at your board.

Read the middle column as one composite sentence and the expectation writes itself. You must maintain procedures sufficient to comply with a regulatory system that changes, detect risks of failing to comply with it (which logically includes rules that have been announced but not yet applied), identify and report those risks to your governing body, and have named senior managers taking "reasonable steps" over the whole thing. You cannot comply with obligations you have not noticed. Horizon scanning is the mechanism by which a firm can honestly claim its SYSC 6.1.1R procedures are "adequate" next year rather than last year.

Application varies by firm type, and parts of it are changing. Since 23 October 2025 the MiFID Organisational Regulation has no separate life: the FCA transferred its content into the Handbook (PS25/13), so common platform firms now find their policy and compliance-function duties in SYSC 6.1.2-AR and SYSC 6.1.3-AR to -CR, not in article 22 of that regulation. Insurers anchor in SYSC 3.2.6R, not SYSC 6. And the Consumer Duty reporting rules are moving: in CP26/23, which ran from 29 June to 18 September 2026, the FCA proposed that firms would not need a stand-alone Consumer Duty board report while proportionate reporting to the governing body continues at least annually, with final rules expected in the first quarter of 2027.

"Horizon scanning" is the FCA's own working vocabulary

If the Handbook is silent on the phrase, the FCA's supervisory material is not. Five primary sources, most recent first.

The regulator scans its own horizon and publishes the results. On 10 June 2026 the FCA released its first external Emerging Technology Horizon Scan, describing itself as wanting "to understand technological change to anticipate its outcomes and gain early insight on what it may mean for financial services and for us as a regulator." Be precise about what this document is: it describes the FCA's scanning, and it says it is "not a set of predictions or regulatory guidance." It does tell you the regulator considers the discipline core enough to institutionalize and publish.

Authorizations expects firms to speak for themselves. Sheree Howard, the FCA's executive director of Authorisations, told the APCC Spring Conference on 22 April 2026 (Getting firms fit to run, speech as drafted) that a firm's advisers are welcome in the room but the firm must be able to "speak for themselves" and "explain their business model and operations clearly, in their own words." Her pointed line for consultants: "When a firm sits down with us, it's their competence we're assessing. Not yours." The context was authorization interviews, not regulatory change, but the principle transfers. When the FCA asks how an incoming regime affects your firm, the answer has to come from your own impact work, not a forwarded law-firm briefing.

Supervision has already written the expectation down for operational resilience. The FCA's operational resilience insights page (28 May 2024) says it directly: "Horizon scanning to establish an understanding of new and emerging risks, and the proximity of impact, are key to ensuring testing is appropriate and that controls are in place to detect, respond and recover from operational disruptions, both current and in the future." The page is addressed to firms within the operational resilience rules, which include banks, building societies, insurers and enhanced-scope SM&CR firms, and it links scenario testing to new and emerging risks and their "proximity of impact."

Multi-firm reviews use the phrase as a marker of good and poor practice. In its review of sanctions systems and controls, the FCA wrote: "We consider this horizon scanning and scenario planning to be an important process for firms to adopt as part of their risk management procedures" (6 September 2023). In its March 2025 review of liquidity risk management in wholesale trading firms, it observed that "in their risk horizon scanning, firms were not considering emerging risks."

The newest FCA paper on evidence reads like a change-management checklist. The July 2026 outcomes monitoring paper describes good practice as "actions presented to senior governance forums included named owners, target dates and status updates," and for smaller firms proposes what amounts to a dismissal-and-action log: "straightforward records such as a log of issues, agreed actions and deadlines."

The FCA publishes much of the horizon for free, and it is the natural baseline for your source list

Nobody at the FCA expects a mid-size firm to run a global intelligence operation. What a supervisor can reasonably expect is that your source list includes the regulator's own forward-looking output, because it is free and addressed to you.

The centerpiece is the Regulatory Initiatives Grid. The 10th edition, published on 19 May 2026, lists 135 live initiatives on a 24-month forward view, a similar number to the previous edition, and joint initiatives make up 33% of them, which is why single-regulator feeds miss things. It is produced by the nine-member Financial Services Regulatory Initiatives Forum, which the FCA and the Bank of England/PRA co-chair, and the Grid is published twice a year. As of 1 October 2026 no 11th edition has been published or announced, so a board pack should cite the edition number and date it relies on. Around it sit the Handbook Notices, published roughly monthly (No. 144 came out on 25 September 2026), the nine annual Regulatory Priorities reports that replaced portfolio letters in February and March 2026, the annual work program, Dear CEO letters, and open consultations.

Here is the near-term UK horizon those sources currently show, the kind of key-dates table your own management information should contain (all rows as of 1 October 2026):

Crypto firms straddling the UK and EU perimeters are running two clocks at once; the EU side is mapped in our MiCA compliance checklist.

Volume rules out "read everything" as a methodology. In its 2023 Cost of Compliance report, Thomson Reuters Regulatory Intelligence put the 2022 global count at 61,228 regulatory events, an average of 234 alerts a day (2022 data; treat it as an order-of-magnitude anchor, and see how many regulatory changes happen per year for the fuller statistics). And even once a change is spotted, CUBE's Cost of Compliance Report 2025, a survey of more than 2,000 senior compliance, risk and legal leaders across 11 markets published on 4 November 2025, found that 74% of firms take more than a year to implement new regulations. The survey comes from a regulatory intelligence vendor, so weigh it accordingly.

The enforcement record prices the gap: GBP 12.55 million, GBP 48.65 million, and one personal fine

Three enforcement actions define the cost curve, and none of them required the FCA to cite a horizon-scanning rule.

Citigroup Global Markets, GBP 12,553,800: the cost of slow impact assessment. On 19 August 2022 the FCA fined CGML for failing to properly implement the Market Abuse Regulation's trade surveillance requirements. The key fact from the final notice is that MAR was a known, dated, published change, and CGML still took 18 months to identify and assess the specific market abuse risks its surveillance needed to cover: the notice records that the risk assessment "was not substantially complete until January 2018, more than 18 months after the MAR Effective Date." The breaches were MAR article 16(2) and Principle 2 (skill, care and diligence). The fine reflects a 30% settlement discount; it would otherwise have been GBP 17,934,030. The lesson is that the FCA measured the gap between a change taking effect and the firm's impact assessment, and priced it at eight figures. Your deadline register and impact assessments are the evidence that the gap does not exist at your firm.

TSB, GBP 48.65 million: the cost of ungoverned change. On 20 December 2022 the FCA and PRA fined TSB a combined GBP 48,650,000 (FCA GBP 29.75 million, PRA GBP 18.9 million, after a 30% discount from GBP 69.5 million) for operational risk management and governance failures in its 2018 IT migration. The FCA's findings were breaches of Principle 2, in managing the outsourcing of the migration, and Principle 3. This was a change program the firm itself initiated, not an external rule change, and it failed for want of the governance machinery (risk identification, board reporting, oversight of delegation) that Principle 3 and SYSC 4.1.1R describe. Externally imposed regulatory change runs through the same machinery.

Carlos Abarca, GBP 81,620: the accountability is personal. In April 2023 the PRA fined TSB's former Chief Information Officer GBP 81,620 (reduced by 30% from GBP 116,600 for settlement) for breaching PRA Senior Manager Conduct Rule 2, the PRA's equivalent of SC2. He failed to take reasonable steps to ensure that TSB adequately managed and supervised its outsourcing arrangement for the migration. The wording of that rule mirrors the SC2 text in the rule map above. "Reasonable steps" is the standard each of your senior managers must be able to evidence, personally, for regulatory changes landing in their area. The failing was outsourcing oversight, not a missed rule change, but the standard applied is the one your senior managers face.

Seventeen evidence items cover what a supervisor could ask for tomorrow

The checklist has seventeen evidence items in five sections, each mapped to the Handbook anchor a supervisor would recognize, the senior manager who owns it, the format it should live in, and its refresh cadence. Score yourself red, amber or green against each; anything red in sections B or D is where I would start, because those are the sections the enforcement record bites on.

Two notes on using it honestly. First, row 4 is the highest-value, lowest-cost item on the table: a dismissal log converts informal awareness into examinable evidence immediately, and it is the row I would expect most firms to be missing. Second, the FCA's Consumer Duty board reports review (11 December 2024, covering the first annual reports of 180 firms, including 55 smaller firms) is the closest thing you have to a marking scheme for section C. It reported that some firms lacked the data quality to justify their conclusions and that some action plans came without timescales or action owners, and the July 2026 outcomes-monitoring paper repeats the point in positive form. Assume the same marking scheme applies to any regulatory-change information you put in front of a supervisor.

The worked row: the UK cryptoasset regime, traced through all seven columns

Take one live change from the key-dates table and run it through the checklist so the columns stop being abstract. The UK cryptoasset regime comes into force on 25 October 2027, and the FCA's authorization gateway opened on 30 September 2026, with an application period that closes on 28 February 2027 (check the FCA's direction and the commencement provisions for your own register before relying on this summary). As Sheree Howard put it in April: "from October 2027, crypto firms will need to be authorised to operate in the UK."

A firm with no cryptoasset exposure still needs the row. "We assessed it on 1 October 2026 and dismissed it because we have no cryptoasset products; reviewed by SMF16" is thirty seconds of work and the artifact that distinguishes a scanning process from a subscription. The same exercise on a change that has already landed, deferred payment credit, which came under regulation on 15 July 2026, would end in a post-implementation review with a scoping answer that depends on your model: as the FCA's policy statement PS26/1 notes, merchants offering their own agreements directly, and the broking of deferred payment credit agreements, stay outside regulation.

Three fixes belong in front of the board before the next supervisory contact

With room to fix only three things at a UK firm this quarter, I would take them in this order:

1. Start the dismissal log this week (row 4). Five columns: date seen, item, source, decision, one-line reasoning. It is the cheapest row on the checklist and the one that converts everything else you already do into evidence. Backfill nothing; start clean.
2. Reconcile the deadline register against the current Grid edition (rows 1 and 6). Print the 10th edition's initiatives relevant to your portfolio, check that each has either a register entry or a dismissal record, and put the reconciliation date in your management information. Repeat when the next edition lands.
3. Ask each senior manager for their SC2 file (row 12). Do not build one for them; ask them to produce what they would show a supervisor if a change in their area went the way TSB's migration did.

Where I sit: this checklist is the paper version of what we built RegWatch to produce as a by-product of normal operation. A Watchlist monitors your sources on the schedule you set, each Finding carries its source, dates and written reasoning, dismissing an alert requires a reason, accepted Alerts convert to Obligations with a named owner and deadline, and the audit log is tamper-evident. But the checklist works on spreadsheets and sharp discipline too, and a firm that runs it manually will demonstrate more to the FCA than a firm that bought software and skipped the governance rows.

The rules that let a supervisor ask for your dismissal log are already in force, and have been since 2001, 2016 and 2018. The only thing the FCA has not done is name the discipline in a rule. Sheree Howard's line generalizes better than any rule citation: when the FCA sits down with your firm, it is your competence being assessed, in your own words and from your own records.

Our financial services hub carries more UK financial-services coverage.

---

This article is general information, not legal advice.