UK Enforcement Priorities for 2026: What’s Next for Compliance?

Episode Summary

The U.K. enforcement landscape this year is focused on combating financial crime, with agencies like the Serious Fraud Office taking a more assertive approach and aiming for faster case resolutions. Skadden’s Jason Williamson and Vanessa McGoldrick highlight how U.K. agencies are becoming more emboldened in their investigations while seeking quicker resolutions. With host Andrew Good guiding the discussion, they outline what companies can expect from the SFO, as well as new legislation, such as the new Failure to Prevent Fraud offence. They also discuss increased scrutiny of crypto assets ahead of new U.K. regulations taking effect in October 2027.

Voiceover (00:02):
Welcome to An Ounce of Prevention, a podcast from Skadden's White Collar Defense and Investigations Group that explores critical issues shaping the landscape of corporate compliance and enforcement around the globe. Join us for in depth analysis and practical insights to help you navigate the complexities of corporate accountability.

Andrew Good (00:24):
Hi, and welcome to the Ounce of Prevention, a podcast series presented by the White Collar Defense and Investigations team at Skadden. My name's Andrew Good. I'm a partner in the White Collar Defense and Investigations team at Skadden's London office. The topic for this episode is UK enforcement priorities for 2026. We'll be discussing key focus areas and what is likely to be at the top of the wishlist for UK regulators and law enforcement in 2026. And to talk about those priorities, I'm joined today by my colleagues, Vanessa McGoldrick and Jason Williamson. Thanks both for joining us again on the Ounce of Prevention. It's good to see you.

Jason Williamson (01:04):
Thanks, Andrew.

Vanessa McGoldrick (01:05):
Hi, Andrew. It's a pleasure to be back.

Andrew Good (01:07):
So we've seen a lot of movement in the enforcement framework in the UK over the past year or so. Jason, what's your take on the UK enforcement landscape as we're heading into 2026?

Jason Williamson (01:18):
So I think the headline point is that financial crime is still very much front and center and a priority for UK agencies. That hasn't changed and that will continue through 2026. But I do think that 2026 is also going to be the year where we see agencies more emboldened in the investigations that they're undertaking, but also trying to look at opportunities for quicker resolutions with investigation targets. And in the last couple of years, we've seen new offenses come into force. We've seen new powers given to UK agencies, and we're likely to see more enforcement as a result. And we've already started to see some of that come through in 2025. So on the sanction side, we saw the first criminal prosecution for a Russia sanctions breach that resulted in a conviction of two individuals. We also saw a wave of new civil penalties that were levied for sanctions breaches, and there's more coming down the pipeline too.

(02:11):
From the Serious Fraud Office, we also saw new anti-corruption investigations launched and the agency working more closely with international partners to get investigations off the ground. And the agency's been really vocal about, particularly in the last year, about getting new powers, new whistleblower compensation powers as a tool to speed up investigations and its intention to enforce the new failure to prevent fraud offense. So we're seeing more activity from the SFO too. And with the FCA, fines are up there as well. So total FCA fines last year were up by about 140 million pounds compared to the previous financial year. But what's particularly interesting is that those penalties against individuals tripled in terms of value. So we're seeing more activity that's likely to continue through 2026.

(02:58):
Historically, there's been lots of criticism levied at UK agencies for being too slow to bring enforcement action and not active enough, particularly when compared against enforcement actions brought by international partners, particularly in the US. But I think there is a strong sense that UK agencies are turning the page on that and really trying to take a more active approach to their enforcement activity. And I think as we start to see greater use of those new powers, we see bolder action too.

Andrew Good (03:26):
Thanks, Jason. So it sounds like in 2026 we can expect to see some more proactive investigations by UK authorities, maybe a continuation of a trend there. Vanessa, are there headline issues or emerging trends that you think are particularly important for companies to have on their radar as we're moving into 2026?

Vanessa McGoldrick (03:44):
Absolutely, Andrew. 2025 was a real year for change. And as Jason alluded to, the new failure to prevent fraud offense has come into force through the UK Economic Crime and Corporate Transparency Act 2023 and potential additional changes to make it easier to hold corporates accountable for crime via the Crime and Policing Bill. And we've seen some significant changes in recent years to the way in which companies can be held criminally liable under English law, and this bill has the potential to expand corporate criminal liability even further and is a development that I really do think companies should be watching closely. I think we're likely to see regulators being more proactive as well. As Jason just mentioned, there's the key issue for UK agencies is the speed at which they conduct their investigations. Looking back to 2023, there were some figures published which indicated that the FCA took around three and a half years for an investigation to close, and that's something that the FCA is addressing.

(04:35):
And although they've opened fewer investigations, they are now closing cases more rapidly, and it demonstrates a revised fewer and faster investigations approach. And I think this is going to be a key area for all UK agencies as they look ahead to 2026. And all of these points point to a more assertive enforcement landscape, and I think we're only going to see that intensify through this year, particularly in the financial services and professional services sector as authorities sharpen their focus on ABC, AML, and sanctions compliance.

Andrew Good (05:05):
It does atmospherically feel like the pace is picking up in enforcement. Why don't we take a moment or two to talk specifically about ABC, that's Anti-Bribery and Corruption activity, and also fraud? Vanessa, what's new on the ABC front?

Vanessa McGoldrick (05:22):
So the UK Serious Fraud Office, the SFO, has been more proactive in the last year. They've issued new guidance on scenarios in which the SFO may need to evaluate corporate compliance programs, including to determine if a prosecution of the company is in the public interest, or for instance, to consider whether a deferred prosecution agreement is appropriate. And one of the other big trends we're seeing is how the SFO are working more closely with its international partners. So to name a few examples, in March last year, we saw the SFO announce new anti-corruption alliance with the French and Swiss authorities establishing a new task force. In June, there was a further expansion in its global reach by joining the International Anti-Corruption Coordination Centre. And earlier this month, we saw there was a collaboration between the US FBI, the Australian Federal Police, and the Belgium Police with the SFO announcing a successful operation in relation to a global email fraud using its powers under the Proceeds of Crime Act.

(06:16):
And only last week the SFO assisted the... Italy's Guardia di Finanza to search the home in Venice in connection with a fraud and bribery investigation into the past management of a social housing company. So we're certainly seeing more of this type of cross-border collaboration involving the SFO, and it's certainly going to make it harder for companies to try and hide behind the jurisdictional boundaries. One of the most recent developments though with the SFO is the sudden announcement by the current director of the SFO to step down halfway through his five-year term. This change might cause a bit of disruption and display in the current caseload, and I think it will be interesting to wait and see who the replacement will be and what their vision for the SFO will be going forward.

Andrew Good (06:56):
Thanks, Vanessa. Appreciate those insights. It'll be interesting to see who replaces Nick Ephgrave. Jason, shifting slightly to talk a little bit more specifically about fraud, could you walk through what's on the horizon for companies thinking about preventing fraud or reacting to investigations into fraud?

Jason Williamson (07:13):
Yeah, sure, Andrew. So I think as listeners will be aware, the most significant change we've seen in this area in the last year is the new Failure to Prevent Fraud offence and that came into force in September last year. Just to recap at a very high level, a large organization can commit that offense if an associated person of the company, so an employee, agent, a subsidiary, et cetera, commits certain fraud offenses with the intention of benefiting the company or its clients. The company does have a defense, so it has a defense if it's either the victim of the fraud or it has reasonable anti-fraud procedures in place. So now that it's in force, we're expecting UK agencies to start getting new investigations off the ground and bringing enforcement action. The Serious Fraud Office has been very clear that the offense is a key enforcement priority over the next couple of years.

(08:00):
So I think we'll probably see the new SFO director continue with that too. And if companies haven't already started doing so, now is really the time to start looking at reviewing your policies and procedures, making sure that you have controls in place that are designed to manage fraud risks in your operations, and also making sure that your employees are trained on those risks as well. And companies don't need to start from scratch if that works. The UK government has put out guidance on what anti-fraud procedures might look like. That guidance has lots of similarities and parallels with guidance that was put out for the Bribery Act. So a good starting point might be looking at your bribery controls, for example, and seeing how they can be utilized in a fraud scenario and managing fraud risks too.

Andrew Good (08:42):
Yeah, I think that new offence is going to be a significant development moving forward. I'm certainly aware that clients are taking a close look at their policies and procedures, assessing whether there are any gaps in what they have set up to try to prevent fraud occurring. And that's something that they'll want to work through fairly quickly given that the offense is already active as of September. Another area I think is interesting is really the crossover between the crypto digital asset space and financial crime. Is that an area that you think we'll see more enforcement activity in?

Jason Williamson (09:16):
For sure. Yeah, I think that's right. We're going to see a lot of change in the way that crypto assets are regulated and the scrutiny that's applied to them by regulators, and it's really been a long time coming. So looking back to 2023, the treasury put out proposals for how to regulate crypto assets, and that included new proposals around new regulated activities for crypto assets in particular. And what that essentially means is for firms that wanted to provide crypto services in the UK, they'd have to be regulated and authorized by the Financial Conduct Authority. So that happened in 2023. Looking at December 2025, the government brought forward new legislation to put that into effect. So it is pushing forward with that change, but it's due to come into force a little bit down the line. So in October 2027. And for a lot of crypto firms, this will be the first time that they are regulated under the Financial Services and Markets Act.

(10:06): So there's a lot to get up to speed on. The FCA has started to put information out to help businesses prepare for that, and that's included what the authorization process might look like, the systems and controls that they expect to be put into place, and how you can ensure that you're meeting those compliance obligations. And it's a real big shift. So firms really do need to start. Although we have a bit of a runway before that comes into force, firms do really need to start getting on top of those expectations now rather than waiting until shortly before it goes live. On the enforcement side, as crypto becomes more regulated, we'll see more enforcement activity too, and we're already seeing developments in that space. So in the last couple of years, we've seen big changes to the way that powers that UK agencies have to tackle crime involving crypto assets.

(10:50): That includes new powers to seize crypto assets connected to suspected criminal activity. Last year, we saw UK authorities start to make use of those powers. For example, we saw the use of freezing orders over crypto wallets, and there was a money laundering investigation that led to around more than five billion pounds worth of cryptocurrency being seized, although it's still the subject of ongoing proceedings. So it's still an evolving area of law, but we are seeing UK agencies start to make use of those new tools in crypto space.

Vanessa McGoldrick (11:22):
And it's also another area where we're seeing closer cooperation between UK authorities and their international counterparts, particularly with respect to the crypto-related fraud and crypto being used as a vehicle for sanctions of Asian. So last year we saw the UK, EU and US enforcement authorities working together to take action in initiatives like Operation Destabilise. And the NCA uncovered large money laundering network operating in the UK, which was allegedly helping individuals evade Russia-related sanctions. And this network was involved in collecting illicit cash from activities such as drug trafficking, firearm supply, and organized immigration crime, and then converting these criminal proceeds into clean cryptocurrency.

Andrew Good (12:04):
Well, it sounds like the message is fairly clear. If you are operating in the crypto and digital asset space and you want to keep operating in the UK, it's really time to start preparing for a significantly more rigorous regulatory environment. Shifting gears a little bit, another area that we've seen a fair amount of discussion over the past year, maybe a little more, is non-financial misconduct. Vanessa, what do you think we're likely to see as developments in 2026 in this space?

Vanessa McGoldrick (12:34):
Thanks, Andrew. As you say, non-financial misconduct is getting a lot of attention, and there are new rules coming into force with the FCA in September of this year. The FCA is making it clear that for non-banking regulated firms now, serious misconduct such as bullying, harassment, violence is a matter of regulatory concern, and they're expanding the scope of the conduct rules to non-banks when previously it's just covered banks. So the FCA is expecting an increase in the notifications of conduct rule breaches for this type of non-financial misconduct as a result of the change coming into force in the autumn. And there are also changes to regulatory references as the FCA is keen to prevent what they refer to as rolling bad apples. So people moving from one firm to another with serious and substantiated cases of poor personal behavior being shared in regulatory references. And at the end of last year, the FCA finalized its new handbook guidance online financial misconduct.

(13:29):
So it's certainly an area that the FCA has been focused on and will continue to be focused on. With respect to the new guidance that came in at the very end of last year, this guidance reiterates that private life conduct, including social media activity, can be relevant to the fitness and propriety assessments that firms are conducting over their regulated people. Firms are not required to monitor staff's private lives or social media accounts proactively. Behavior in the private life, it is only relevant where it poses a non-remote non-speculative risk to the regulatory standards or public confidence. With violence, sexual misconduct, dishonesty, repeated legal disregard is highlighted as significant. It should be noted though as well that the guidance does discourage trivial and implausible investigations and clarifies that unproven allegations should be treated with caution. So in essence, regulated firms need to make sure that their culture and conduct standards are up to scratch and encourage a genuine speak-up environment with good culture.

Andrew Good (14:25):
That's a good point. And it sounds like they're really trying to strike the balance between some separation between private and professional life with ensuring safe environment where people are working. I think that's just going to be a continued area where things are coming to a head and a place for interesting developments. Turning slightly, I don't think we could conclude a podcast here without talking a little bit about economic sanctions. Economic sanctions have obviously been high on the agenda and enforcement for the last few years, and that's given the geopolitical environment doesn't seem likely to shift in the near term. What can we expect here moving into 2026?

Vanessa McGoldrick (15:04):
I mean, sanctions enforcement is only going to get tougher. As you know, the geopolitical situation is uncertain, and we're seeing the ramping up of sanctions with Russia continuing to be a key focus, particularly if a peace still isn't agreed. There's been the first successful UK prosecution for Russia sanctions offense last year, and I think that emboldened the authorities, and the NCA have emphasized that these convictions of individuals demonstrate not only that designated individuals are on their radar, but so are those who enable the breaches of those regulations. So it's clear that the remit's broadening, and I think we're going to see more actions both in the civil and criminal context. I mean, Jason, what do you think?

Jason Williamson (15:43):
I agree with all of that. And I think there's a lot of noise right now around Greenland and what's going to happen there, but I do think that Russia will continue being a key focus in terms of sanctions and potentially tariffs. I may be eating my words in a few months, but hopefully not. But we're hearing things like the US Congress may soon vote on a bill to impose secondary sanctions and tariffs on countries that are buying Russian energy. So that would be a pretty big development. I think any action in the US is likely to be supported by similar additional sanctions packages in the UK and the EU as well. Another area that I think will be a key focus for 2026 is Iran. So that was, I'd say, one of the biggest changes we saw last year was in Iranian sanctions. In October last year, we saw the UK and the EU reimpose a range of sanctions because Iran wasn't complying with the 2015 nuclear agreement.

(16:34): Those sanctions are pretty wide-ranging and they have a particular emphasis on the Iranian gas sector and oil sector and financial institutions too. And new sanctions are coming. So the UK has said it will impose new sanctions on Iran in light of the crackdown on protestors. Those sanctions are likely to target key sectors such as the finance and energy sectors, and the geopolitical situation with Iran is incredibly uncertain. So I think there's likely to be a lot more in that space in the coming weeks and months.

Andrew Good (17:03):
So it sounds like in addition to the packages that are being put out and the substantive sanctions, there are also sort of procedurally new powers and tools maybe on horizon for enforcement authorities. What should companies be aware of in terms of changes to the process and to the tools regulators can use?

Jason Williamson (17:19):
I think sticking with sanctions. So in July of last year, obviously put out a consultation about making changes to civil sanctions enforcement. We're likely to see the output of that consultation this year. There is an expectation that will lead to quicker investigations, higher penalties, potential discounts for complying with an investigation, et cetera. And as Vanessa touched on earlier, there's changes to corporate criminal liability coming down the pipeline too, which would be a significant change. So if the Crime and Policing Bill goes forward and it makes companies potentially liable for any criminal offense rather than just a limited set of financial crime offenses, that would be a pretty big change that people need to keep their eye on as well, I think.

Vanessa McGoldrick (18:00):
I think the other thing to keep an eye on for this year is the issue of remuneration for whistleblowers. It's something that the SFO has talked openly about considering implementing rule changes. And this comes on the back of HMRC's new reward scheme, which is a payment of up to 30% of any tax amounts recouped over 1.5 million on the back of the information provided. And we've discussed this topic before on our previous podcast, so have a listen. There's also a consultation on introducing a recklessness offense for the fraudulent evasion of direct taxes as well. And then switching to the FCA and the issue of naming and shaming powers, that's something else that's been in the spotlight. In general, the fact that the FCAs open an investigation into a company or an individual is confidential to the market. And this was something that the FCA consulted on last year and were looking at changing, but they're not moving forward with that.

(18:48):
The confidentiality will in general remain, although it is worth noting that the FCA do and have in exceptional cases, publicly named a company when they open an investigation. And we saw that recently in the Claims Protection Agency case.

Andrew Good (19:03):
Thank you. I just wanted to add another hotspot that I think we may continue to see in 2026. In our practice, I've been seeing auditing firms step up and take on a quasi-regulatory role at the companies they're auditing, and they're both requiring companies to look into allegations of misconduct and also requiring companies to share information about reviews that they're performing there and in connection with government investigations. Auditors obviously can't lovey fines against their clients, but they really do have substantial leverage and dealing with them is quite a delicate process because there can be questions about privilege when information is shared with auditors, and that's particularly the case when matters that are being looked at span across borders. I think we're going to continue to see that trend there.

Vanessa McGoldrick (19:50):
Yeah, I agree, Andrew. And I think follow-on point to add to that is this additional challenge for companies who are in the middle of a regulatory investigation and this need to balance regulatory requests or requirements, their investigations are kept confidential and the company's auditors requesting information about those investigations. And this issue is a real challenge and a real balancing act. And in practice, sometimes we see engagement with regulators on this issue can help, but it really highlights that another reason why it's essential that companies get their legal compliance finance teams working closely together with their counsel to manage this difficult tightrope.

Andrew Good (20:29):
Couldn't agree more on that. And so having covered a couple of the areas that we think we're going to see activity in moving into 2026, what do we think companies should be thinking about in terms of some practical tips and areas to focus on as they kick off the year?

Vanessa McGoldrick (20:45):
We might commonly say that an important thing is to make sure that the compliance framework is robust and up-to-date. So look at what are the changes. And this means reviewing and updating your policies and procedures, taking into account new offenses such as the new failure to prevent fraud offense, refresh your risk assessments, update your training for employees, and any other kind of third parties that you might be onboarding and who are working on providing services on your behalf and really make sure that you're reflecting the latest guidance and regulatory expectations across your compliance framework.

Jason Williamson (21:16):
And just to add on that, as Vanessa says, keep an eye on regulatory developments, whether that changes to criminal liability or new sanctions packages, it's going to be important to stay on top of that and also really be proactive in identifying and addressing risks and making sure that senior management is engaged and setting the right tone from the top. It's obviously something that regulators are always looking at. So I think that's important too.

Andrew Good (21:37):
Well, as we've walked through, there's a lot for companies to be thinking about throughout 2026. Vanessa, Jason, thank you both for talking us through this today.

Vanessa McGoldrick (21:48):
Thanks, Andrew.

Jason Williamson (21:48):
Thanks, Andrew. My pleasure.

Andrew Good (21:49):
And that's all for today's episode of Ounce of Prevention. We hope you'll be able to join us next time. In the meantime, stay vigilant, stay compliant, and please tune in for the next episode. We'll be discussing a new key topic that's shaping our industry. Until then, goodbye and thanks for your time.

Voiceover (22:11):
Thank you for joining us for today's episode of An Ounce of Prevention. If you like what you're hearing, be sure to subscribe in your favorite podcast app so you don't miss any future conversations. Additional information about Skadden can be found at skadden.com.