REG Reviews – October 2026

The House of Lords has recently challenged and criticised the effectiveness and the ability of the FCA’s Consumer Duty to deliver tangible and measurable change in the insurance sector.

However, David Geale, executive director of consumers, payments and competition at the FCA has defended the rule, emphasising that it’s been an effective and crucial tool that has already resulted in many noticeable positive outcomes across different organisations. He said: “It is proving that it has got teeth.”

The Consumer Duty, introduced in July 2023, was designed to improve consumer outcomes by requiring firms to put customers’ needs first.

The FCA believes the framework is proving effective, with ongoing enforcement action demonstrating its ability to drive accountability, while also giving firms greater flexibility than prescriptive rules to achieve the right outcomes for consumers.

The FCA also emphasised that improving consumer understanding and value should take priority over standardising insurance products, warning that overly prescriptive approaches could reduce flexibility and limit customer choice.

At the same time, FCA officials acknowledged that while progress is being made under the Consumer Duty, there is still more work to do to keep pace with changing market conditions and deliver better outcomes for consumers.

Consumer group Which? submitted a super-complaint to the FCA in September 2025 over concerns about claims handling, sales practices and regulatory enforcement in home and travel insurance.

The FCA acknowledged inconsistencies in claims handling and said it is carrying out further multi-firm reviews, while stressing that insurers’ boards must take responsibility for customer outcomes.

Chris Knight, director of insurance at the FCA, stressed that insurers remain accountable for claims outcomes even when work is outsourced. She said the FCA is reviewing outsourcing arrangements, including remuneration and incentives, and plans to survey 400 firms to better understand how claims activities are being outsourced across the sector.

The FCA has around 100 staff dedicated to insurance including approximately 80 focused on retail general insurance, which underlines its growing focus on strengthening oversight and improving consumer outcomes across the market.

Hiscox’s tenth annual Cyber Readiness Report found that 38% of small UK businesses suffered a successful attack in the past twelve months, against a global average of 29%. British firms are not defending themselves badly. They spend $59,700 on cyber resilience on average, the third highest figure of any country in the study. They get hit anyway, at an average cost of $35,908, or around £26,650, per incident.

The figure that matters to brokers sits underneath those. Only 10% of UK businesses hold a dedicated cyber insurance policy. Among charities the figure falls to 5%. Nine in ten UK firms are carrying the whole of that £26,650 themselves, and carrying it more often than firms in almost any comparable market.

Read the three numbers together and a familiar objection falls apart. Small business owners who decline cyber cover tend to say one of two things: that they are too small to be a target, or that their IT spend already covers it. UK small firms are demonstrably the most targeted in the study, and they are already spending more than most on defence. The spending is not preventing the attacks. It is arriving in the form of firewalls, endpoint tools and consultants rather than in the form of cover for the five weeks of disruption that follows a successful intrusion.

For brokers in SME commercial lines, this is the clearest penetration argument available at the moment. A market where 90% of the customers have no product is not a saturated market. It is an unsold one, and the sales obstacle has shifted from proving the risk to proving that money spent on cover buys something the IT budget does not.

The charity figure deserves separate attention. Charities hold volunteer records, donor databases and beneficiary data, often on modest systems run by small teams. A 5% take-up rate against that exposure is an advice gap rather than a pricing one, and brokers with charity and not-for-profit books have an easy conversation to start this renewal season.

Anyone sitting on a client list of owner-managed businesses has the makings of a campaign here. Three data points, one question about who absorbs the cost, and a product most of the list has never been offered.

The FCA looked at how firms are using frontier AI models in cyber security work and published what it saw. Its conclusion will not comfort anyone who has been treating AI as a security upgrade. The regulator found that frontier AI is “exposing firms’ weaknesses in their vulnerability management practices, access management controls, dependency mapping and remediation processes”, and described the technology as behaving like a stress test on the organisation rather than a tool bolted onto it.

One sentence in the review deserves pinning above a desk. The FCA found that the value firms get from these models is “determined less by what models are being used and more by the governance, tooling, controls, human oversight and operational environment they’re in”. Buying the better model changes little. The firm that already knows what it owns, who can access it and how fast it can patch gets a return. The firm that does not gets a longer list of problems it cannot clear.

That is the bottleneck the review keeps returning to. AI finds vulnerabilities faster than engineering teams can fix them, so the constraint moves from detection to remediation capacity and triage. A broker whose IT function is two people and a managed service contract will hit that wall sooner than a carrier with a security team.

The FCA said it wrote this for operational resilience, technology and risk leaders, and that it wants small and medium-sized firms in particular to learn from the practices it observed. Most UK brokers and MGAs sit inside that definition, and most of them face the hardest item on the FCA’s list. Dependency mapping and supply chain visibility are difficult when a firm owns very little of its own technology. The policy admin system belongs to a software house. The data comes from three suppliers. The infrastructure sits with a cloud provider. Asked to produce a map of those dependencies and say who patches what, under which contractual term and to what timescale, a good many firms would struggle to answer in a week.

Compiling that map is work worth starting before someone asks for it. The same questions already run through the Critical Third Parties regime and through supervisory interest in outsourcing, so the answer gets used more than once.

The review ends on a point worth repeating to any board getting excited about automation. The FCA says human judgement remains critical, because the models speed up discovery and cannot make the decisions about what to fix first.

On 29-30th September, more than 400 senior leaders from Europe’s MGA market gathered in Paris for the European MGA Summit, hosted by The Insurer, from Reuters. REG was there as Gold Sponsor, with a stand, a seat on the main stage and the summit’s official drinks reception, REGezvous.

The room reflected the whole delegated authority chain: MGA founders and executives, carriers and capacity providers, reinsurers, brokers, investors, insurtechs and advisers. Most were director level or above. Across two days the agenda covered capacity and capital, technology, specialist underwriting and cross-border expansion. One theme kept coming up: Europe’s regulatory landscape.

On the second morning, REG CEO Stephen Line joined Eva Maria Barbosa, Partner at Clyde & Co, and Giulia of Italian MGA JK Insurance for the panel “Charting a path through a complex regulatory environment”. Four points stood out.

– Europe still can’t agree on what an MGA is. An MGA is an agent in Germany and a broker in France, while Spain and the Netherlands each have their own category. Where you set up shapes where you can sell and how fast you can grow. Stephen also asked the room whether full harmonisation would bring welcome consistency or stifle innovation.

– Passporting works; the pressure comes from elsewhere. The panel agreed passporting still opens 27 markets with relative ease. The bigger cost is the growing set of obligations carriers pass down the chain, from product oversight and DORA to the UK’s PS26/2, coming in March 2027.

– Do the basics well, at scale. Stephen described sanctions, AML, adverse media and operational resilience as the “known knowns” of every market. Building them into systems that scale, and monitoring them continuously rather than only at onboarding, frees teams to focus on growth. He also confirmed REG is building a PS26/2 accelerator to take on much of that burden.

– Partnerships are getting deeper. Relationships between carriers and MGAs are moving towards fewer, longer-term, multi-year arrangements. Trust, transparency and being able to answer questions quickly are what win capacity.

Why were we there? Europe’s MGA market is growing quickly. Every new market, binder and capacity partner adds counterparties that carriers, MGAs and brokers must onboard, evidence and monitor across borders. That is the problem REG was built to solve. Our platform helps insurance businesses find, onboard and continuously monitor their counterparties, and more than 400 insurance businesses already use it.

Sponsoring the summit was a deliberate investment in that market. We wanted to contribute to the regulatory debate, hear first-hand where friction sits across the chain, and make sure what we build reflects it.

On the opening evening, REG hosted REGezvous, the summit’s official drinks reception, bringing customers, partners and new contacts together in one room. Across the two days, our team also spoke with carriers, MGAs, brokers and service providers on the REG stand.

Those conversations, and the discussion on stage, pointed to the same pressures. Carriers now expect their partners to take on work that once sat with them: pricing, exposure modelling, conduct data and product oversight. The same due diligence questions arrive from every new capacity provider, each in a different format. And capacity itself is at stake: Eva warned that providers are already turning down MGAs that can’t demonstrate DORA compliance. Giulia described JK Insurance’s answer: one control framework that maps every carrier and regulator requirement once and reuses it, so compliance is built around underwriters rather than on top of them.

What’s next? PS26/2 is coming, insurers are showing growing interest in the Nordics and Eastern Europe, and Europe’s MGA definitions may still shift. Through all of it, the firms that move fastest will be the ones that can show their partners what good looks like, quickly and continuously. That’s the work REG exists to make easier.

Our thanks to The Insurer and Reuters Events for an excellent summit, to Eva and Giulia for a thoughtful discussion, and to everyone who visited our stand or joined us at REGezvous. If we didn’t manage to meet in Paris, or you’d like to continue the conversation, we’d be glad to hear from you.

From 1 September 2026, the FCA’s new non-financial misconduct rules came into effect, explicitly bringing serious bullying, harassment and violence within the individual conduct standards.

The rules apply to non-bank financial firms, including insurers and other businesses within the insurance sector, covered by the Senior Managers and Certification Regime (SM&CR).

Previously, the FCA addressed non-financial misconduct mainly through existing conduct and fitness requirements.

While it had already confirmed that issues such as bullying, sexual harassment and discrimination were within its regulatory scope, the lack of a specific rule meant firms had to interpret how these behaviours applied within current conduct requirements.

The FCA has expanded the scope of non-financial misconduct, making it clear that serious behaviour issues inside or outside the workplace can affect an individual’s suitability for regulated roles, potentially leading to more people being barred from entering or remaining in the industry.

Paul Griffin, head of employment for Europe, Middle East and Asia at Norton Rose Fulbright, told Insurance Times that the FCA is placing greater emphasis on leadership accountability, with senior managers expected to address misconduct effectively and foster a culture where concerns can be safely raised and escalated.

He added that regulators are increasingly assessing not only whether misconduct occurs, but also how firms and their leaders respond to it, highlighting the need for close alignment between compliance and HR teams.

Shaun Hurst, principal regulatory adviser at Smarsh emphasised that:“NFM rarely announces itself. It builds over time and the early signals are rarely breaches in themselves – exclusionary behaviour, a manager who repeatedly talks over the same person, or misuse of authority that’s just about deniable each time it happens.”

Jacqueline Girow, executive director at the London International Insurance Brokers’ Association, said smaller brokers should not assume that demonstrating good culture requires large compliance budgets. She stressed that firms of all sizes need to show regulators how employee concerns are raised, handled and resolved.

So will the new non-financial misconduct rules and general stronger regulation translate into meaningful improvements in workplace culture? And how effectively will the new rules change behaviour across the insurance sector?

While the new rule has only just come into effect, it is likely to drive meaningful change across insurance and financial services, shifting the focus from hypothetical risks to clear regulatory requirements with inevitable enforcement and penalties for non-compliance.

Hiscox research found that nearly a third of organisations worldwide experienced a successful cyberattack in the past year, highlighting the growing financial impact of cyber incidents.

Rosie Simms from Insurance Age has reported on Hiscox’s 10th annual Cyber Readiness Report. Based on 6,800 cyber security decision-makers across the UK, Europe and US, the research found that cyber incidents cost organisations an average of £38,600 and caused around 32 hours of operational disruption.

Around a third of businesses said attacks had delayed growth plans, increased staffing costs, caused financial losses or resulted in missed opportunities, highlighting the wider and longer-term impact of cyber threats.

Hiscox found that around 28% of those affected by cyber incidents faced financial penalties or reputational damage. In response, businesses are increasing their investment in cyber resilience, spending an average of $51,000 on measures such as new technology, expert staff and enhanced employee training.

According to Eddie Lamb, global head of cyber at Hiscox: “Cyber risk has become a recurring cost, not an exceptional event, so the investment we’re seeing in cyber resilience is good news as businesses start to take back control.”

Aviva, the ABI and Coalition have all highlighted the growing scale of cyber risk, from rising claims costs to widespread attacks among UK SMEs.

With cyber attacks becoming more frequent and costly, the growing gap between the risks businesses face and the protection they maintain raises an important question: are organisations doing enough to prepare for the next attack?