TL:DR The FCA’s CP26/20 consultation signals a more prescriptive regime for SIPP operators, with clearer expectations for enhanced due diligence, pension scheme money and asset protection, record keeping, reconciliation and governance. Firms should assess readiness now, as the proposals point to a future where compliance must be evidenced continuously, not asserted periodically.
“Firms often asset compliance with these obligations without a sufficiently robust evidence base – FCA CP26/20”
The FCA has issued one of the most significant consultations affecting the self-invested personal pension (SIPP) market in recent years. While CP26/20 is framed as an effort to strengthen consumer protection, its implications extend far beyond compliance housekeeping. It represents a clear regulatory signal that firms will be expected to demonstrate stronger controls, better governance, more robust due diligence, and greater accountability for the assets and third parties connected to SIPP arrangements.
For firms operating in the pensions arena, the message is straightforward: reliance on board principles and legacy guidance will no longer be enough.
The FCA’s consultation proposes moving from high-level expectations to explicit, detailed rules governing due diligence and the handling of pension scheme money assets. The regulator’s concern is that inconsistent practices across parts of the marke have led to consumer losses, exposure to scams and fraud, poor record keeping and significant difficulties during schemes transfers and wind-downs.
The proposed framework is designed to create clearer accountability and stronger supervisory oversight. Importantly, it will also make it easier for the FCA to identify breaches, take enforcement action, and support consumer redress where firms fail to meet their obligations.
This indicates a shift toward evidencing operational resilience, governance effectiveness, and consumer protection outcomes.
Many firms may believe they already comply with existing expectations through adherence to Consumer Duty, Principles for Businesses, and established due diligence processes. However, the FCA’s consultation highlights a recurring supervisory finding: firms often interpret existing requirements differently, resulting in inconsistent standards across the market.
The regulator has specifically identified concerns around:
The proposed rules will establish more prescriptive requirements and clearer benchmarks against which firms will be assessed. That means firms that have historically relied on judgement-based approaches may need to revisit their controls frameworks, monitoring capabilities, and evidential records.
The consultation also signals where future supervisory attention is likely to be concentrated.
Although the consultation is focused on SIPPs, its reach extends across the wider pensions and investments fields also impacting the likes of: investment platforms, discretionary investment managers, custodians, trustees and other key stakeholders.
Firms will need to demonstrate ongoing compliance with more explicit due diligence requirements and maintain evidence that controls are operating effectively. The proposals increase expectations around third party risk management, fraud prevention, operational controls and monitoring.
Enhanced record keeping, reconciliation, audit trails, and asset-tracking requirements will place greater emphasis on operational processes and data quality.
Senior leadership will need confidence that governance arrangement can withstand increased regulatory scrutiny and support Consumer Duty outcomes.
“We have seen a subset of firms with inadequate due diligence processes, weak controls over trustee bank accounts and poorly maintained (or in some cases absent) books and records. These weaknesses lead to consumer losses and, in most serious cases, significant delays and difficulties in ensuring an orderly winddown or transfer of schemes.” FCA CP26/20
Two themes dominate the consultation:
Enhanced due diligence (EDD)
The FCA proposes explicit due diligence obligations covering investments and relevant third parties involved in SIPP arrangements. This includes introducers, advisers, discretionary investment managers and other parties that facilitate investments.
The regulator wants firms to conduct both initial and ongoing due diligence, with additional scrutiny applied where higher-risk factors exist, such as overseas entities or unauthorized firms. Proposed checks include identify verification , regulatory status validation, monitoring of disciplinary histories, and ongoing assessment of risk indicators.
This reflects the FCA’s continued focus on fraud prevention and reducing consumer exposure to high-risk or potentially fraudulent investment arrangements.
Pension Scheme Money and Assets (PSM&A)
The FCA is also proposing a new Pension Scheme Money and Assets regime for firms not currently covered by CASS requirements. The objective is to create consistent standards for safeguarding pension assets, maintaining records, conducting reconciliations, and supporting orderly transfers and wind-downs.
For many firms, this could require significant investment in operational controls, data management capabilities and oversight processes.
The consultation presents a significant challenge for firms attempting to manage increased obligations manually.
Many of the proposed requirements align directly with areas where RegTech solutions can improve efficiency, consistency and regulatory confidence.
Automated due diligence
RegTech platforms can automate screening of introducers, advisers, investment managers and other third parties against regulatory registers, warning lists, sanctions databases, enforcement records and adverse media sources.
The enables firms to maintain continuous monitoring rather than relying on periodic reviews
Ongoing risk monitoring
The FCA is placing greater emphasis on ongoing oversight rather than point-in-time assessments. RegTech solutions can provide real-time alerts, trigger-based reviews, and risk scoring frameworks that help firms identify emerging issues before they become regulatory problems.
Record Keeping and Audit Trails
One of the consultation’s central themes is evidencing compliance. Modern RegTech solutions can create immutable audit trails, automate record retention, and provide regulators with clear evidence of decisions, reviews and control activities.
Reconciliation and Asset Oversight
Technology -driven reconciliation can help firms identify discrepancies faster, improve data accuracy and reduce operational risk across pension scheme assets.
Management Information and Governance Reporting
Boards and senior mangers increasingly require clear, actionable insights into compliance risks. RegTech platforms can consolidate data into dashboards and reporting frameworks that support governance oversight and Consumer Duty monitoring.
While many firms will initially view the consultation as a compliance exercises, the consultation presents a broader strategic opportunity.
Firms that invest early in stronger controls, better data management and technology-enabled compliance frameworks are likely to benefit from:
As the FCA continues is shift toward outcomes-based supervision, firms that can demonstrate robust controls through evidence rather than assertion will be best positioned to succeed.
The consultation runs until August 2026, with final rules expected in 2027. However firms should not wait for publication for the final policy statement before assessing their readiness.
The direction of travel is already clear. The FCA wants higher standards, better governance, stronger due diligence, and improved protection of pension assets. Firms across the pensions sector should be asking whether existing processes, controls and technology are capable of meeting the expectations that lie ahead.
Ruleguard provides a GRC platform designed to help regulated firms manage the burden of evidencing and monitoring compliance. It has a range of tools to help firms fulfil their obligations across the UK, Europe, N America and APAC regions.
Ruleguard helps firms move from reactive compliance to continuous assurance by turning regulatory obligations into structured controls, workflows, evidence and management information.
For firms affected by CP26/20, Ruleguard can support readiness and ongoing compliance by helping teams map new FCA requirements to: policies, controls, attestations, reviews and evidence. Ruleguard can enable your firm to:
This gives senior management clearer visibility of whether due diligence, asset oversight and governance processes are operating effectively.
Ready to turn GRC into a board-level advantage?
Book a tailored discovery call with Ruleguard to see how leading firms unify risk and compliance, surface the insights executives care about, and stay audit-ready, without the spreadsheet sprawl.