FCA high-growth firms: what the 2026 review repeats from 2023
In short: the FCA high-growth firms review, published on 10 August 2026, covers a pilot with 15 asset management, wealth management and payments firms. Four of its findings repeat the FCA’s 2023 fast-growing firms review. A payment institution’s obligations are unchanged: regulation 6(6) of the Payment Services Regulations 2017 still requires governance proportionate to its scale.
The FCA identifies a growing firm from its own data. It says its data-led approach identified firms showing signs of growth in revenue, expenditure and staff numbers, and changes in permissions or control. Between July 2025 and March 2026 it ran a pilot with 15 asset management, wealth management and payments firms, and it reported on 10 August 2026. Four of its findings repeat what it found in 25 fast-growing firms it reviewed in 2021 and 2022. A firm the FCA contacts on this basis must be able to show that its governance, financial resilience and wind-down planning have kept pace with its growth.
The 2023 review and the 2026 pilot
In 2021 and 2022 the FCA reviewed 25 solo-regulated fast-growing firms, among them payment services firms, working from their business plans, capital assessments and wind-down plans. It found that risk management frameworks and governance arrangements had not kept pace with growth, that assessments of financial resources did not account for that growth, and that wind-down plans were inadequate. It published those findings in March 2023 and recorded that they “corroborated the need for our new Early and High Growth Oversight programme”.
The FCA supervises up to 300 newly authorised or scaling firms through Early and High Growth Oversight, contacting them directly rather than inviting them to apply. It ran the July 2025 to March 2026 pilot within that programme to understand how firms grow and when risks emerge.
What the FCA said in 2023 and what it says in 2026
The FCA reported in 2026, as it had in 2023, that governance had not kept pace with growth, that financial resilience planning needed strengthening, that wind-down plans were not current, and that firms had not reassessed their risk management resourcing against the scale of the business. On regulatory change its finding reversed: in 2023 it found that firms “had not considered upcoming regulatory changes in their forward planning”, and in 2026 it recorded early preparation for the safeguarding requirements as good practice.
In 2026 the FCA also assessed cyber resilience, conflicts of interest, management information and consumer outcomes. Cyber resilience, conflicts of interest and management information appear nowhere in the 2023 review. In 2023 it mentioned operational resilience once, in the context of intragroup dependencies in wind down, and treated consumer outcomes only as a consequence of the failures it found; the Consumer Duty was not yet in application when that review was published.
| Theme | What the FCA wrote in 2023 | What the FCA wrote in 2026 |
|---|---|---|
| Governance | “governance arrangements … have not kept pace with the growth in their business activities” | “In some firms, governance arrangements had not kept pace with business growth.” |
| Financial resources | “assessment of the adequacy of financial resources did not consider the growth in their underlying business” | “Some firms needed to strengthen their financial resilience planning.” |
| Wind-down | “Wind-down plans were inadequate following the fast growth of these firms” | “wind-down plans were not always current, practical or proportionate to the business” |
| Risk resourcing | “including staffing in second and third line of defence” | “Some failed to sufficiently consider whether their risk management resources remained appropriate for the scale and complexity of the business.” |
| How the FCA told firms to act | “We expect all fast-growing firms to continually identify, assess and manage the risks” | “If they find gaps, firms should take timely and appropriate action.” |
| How the FCA described the failures it found | “Disappointingly, we found that most of these firms had not addressed our feedback adequately.” | “Growing firms may benefit from revisiting governance and oversight arrangements to ensure they remain effective.” |
The FCA’s wording has softened less than the last row of that table suggests. It still tells firms in 2026 that they should act where they find gaps, should keep resourcing and oversight evolving alongside the business, and should supplement their wind-down plans. It has dropped the expression of disappointment, and it has dropped the anchor in the threshold conditions: in 2023 it put the risk in terms of Threshold Condition 2.4 (Appropriate resources), and in 2026 it names no threshold condition and cites no Handbook provision by reference except the SUP 15 signpost below, though it invokes the Consumer Duty by name.
Dropping the threshold-condition anchor is consistent with the competitiveness and growth objective at section 1EB of FSMA 2000. Section 1B(4A) requires the FCA, so far as reasonably possible, to advance that objective as a secondary objective when it discharges its general functions in the way section 1B(1) requires; section 25 of the Financial Services and Markets Act 2023 inserted both provisions. The 2026 publication does not mention the 2023 review, which therefore stands unqualified.
The governance obligation on an authorised payment institution
A good and poor practice publication creates no obligations. An authorised payment institution must nonetheless continue to satisfy the FCA under regulation 6(6) of the Payment Services Regulations 2017 that it has robust governance arrangements, effective procedures to identify, manage, monitor and report risk, and adequate internal control mechanisms, “which are comprehensive and proportionate to the nature, scale and complexity of the payment services to be provided by the institution”. Proportionality to scale is on the face of the condition, so an institution whose governance stops matching the size of its business has a live authorisation problem.
Under regulation 12(1)(a) the FCA may vary an authorisation on its own initiative where a payment institution “no longer meets, or is unlikely to continue to meet” any of the conditions in regulation 6(4) to (9). The FCA may direct that the variation takes effect immediately, and may do so only where it reasonably considers that necessary (regulation 12(2)(a) and 12(3)); the institution may refer the decision to the Upper Tribunal (regulation 12(5)). Under regulation 37 the institution must tell the FCA without undue delay of a significant change in circumstances relevant to those conditions, and must report a substantial change that has not yet happened “a reasonable period before it takes place”.
The FCA told firms in 2026 to supplement their wind-down plans with an understanding of “relevant notification obligations such as SUP 15”, and for a payment institution that signpost is imprecise. The general notification rule at SUP 15.3.1R applies to a firm, which the FCA Handbook Glossary defines as an authorised person. The Glossary extends that definition to payment institutions, electronic money institutions and registered account information service providers for PRIN 2, PRIN 2A and the critical third parties sourcebook, and to fee-paying payment service providers and electronic money issuers for parts of the fees sourcebook. It does not extend it for SUP 15. SUP 15.14 gives directions and guidance on the form, content and timing of certain notifications required under the PSRs 2017, but its operative provisions address only the regulation 105 duty on full credit institutions and the regulation 71 duty on account servicing payment service providers. The signpost works for the asset and wealth managers in the cohort; for an authorised payment institution the operative provision is regulation 37, and SUP 15.14 bears on it only where it is an account servicing payment service provider. A payment institution must apply the Consumer Duty to its retail market business under PRIN 3.2.6R(1), which covers payment services and connected activities in a distribution chain involving a retail customer, so the fair value and outcomes monitoring points the FCA made bind it through the same Glossary limb.
Implications for growing payment and e-money firms
The FCA linked inadequate risk resourcing to third-party relationships “becoming deeper or more numerous”. Under the critical third parties regime the Treasury designates a provider only where it considers that a failure in, or disruption to, that provider’s services could threaten the stability of, or confidence in, the UK financial system, and section 312L(8) of FSMA 2000 names payment institutions and electronic money institutions among the firms that regime protects. Designation regulates the provider and leaves the institution’s own control obligations under regulation 6(6) where they are. The FCA found management information carrying references to superseded documents and meetings, which reduced the quality of oversight and made conflicts harder to identify in time. It recorded that stronger firms had prepared early for the safeguarding requirements, so a firm should expect the FCA to ask how it plans for regulatory change as well as how it complies today. A firm that has not tested its governance, safeguarding and scheme arrangements against the current scale of its business should do so before the FCA asks.
Perspective
I read the 2023 review as the operative statement of what the FCA expects of a fast-growing firm. It covers most of the same ground as the 2026 publication in firmer terms, and only in 2023 did the FCA name the threshold condition. A firm reading only the 2026 text would understate what is expected of it.
The FCA found in 2023 that internal documents including capital and liquidity assessments and wind-down plans were not reviewed regularly, and in 2026 that management information carried references to superseded documents and meetings while policies and control frameworks had not kept up with changed business models. Finding the same defect three years apart tells me where the FCA will look next in payments regulation, and a growing firm should assume its own document set is the first thing asked for.
Frequently asked questions
Does the FCA high-growth firms publication create new obligations?
No. It sets out examples the FCA identified during a supervisory pilot and makes no rules. An authorised payment institution’s continuing obligations include the governance condition in regulation 6(6) of the Payment Services Regulations 2017 and the notification duty at regulation 37, and, for its retail market business, the Consumer Duty at PRIN 2A.
How does the FCA identify a high-growth firm?
From data. The FCA has said its data-led approach identified firms showing signs of growth in revenue, expenditure and staff numbers, and changes in permissions or control. Firms do not apply to Early and High Growth Oversight; the FCA contacts them directly, and supervises up to 300 firms that way.
Do the FCA threshold conditions apply to a payment institution?
No. The threshold conditions in Schedule 6 to FSMA 2000, and the FCA’s COND guidance on them, apply to persons authorised under FSMA. A payment institution is authorised under Part 2 of the Payment Services Regulations 2017, on an application under regulation 5 and against the conditions in regulation 6, and its equivalent continuing requirements are those conditions, enforced through the own-initiative variation power in regulation 12.
For advice on whether a payment or e-money firm’s governance and control arrangements still meet the conditions for authorisation as the business scales, contact Rob Bratby at Bratby Law.
