When the FCA takes enforcement action against a firm or individual, it rarely happens overnight. The process typically unfolds over months or years, passing through several distinct stages – some of which produce public signals that compliance teams can watch for.
Understanding how FCA enforcement works is essential for anyone responsible for regulatory compliance, counterparty due diligence or risk management. This guide explains each stage of the enforcement process, the types of action the FCA can take, and what these actions mean for firms that work with or alongside the subject of enforcement.
The FCA's enforcement powers
The FCA derives its enforcement powers primarily from the Financial Services and Markets Act 2000 (FSMA). These powers are broad and include the ability to:
- Impose financial penalties (fines) on firms and individuals
- Vary or cancel a firm's permission, or impose requirements on it
- Prohibit individuals from performing functions in relation to regulated activities
- Issue public censures (formal public statements of misconduct)
- Apply to the courts for injunctions, restitution orders and insolvency orders
- Prosecute criminal offences including insider dealing, market manipulation and misleading the regulator
The choice of enforcement tool depends on the nature and seriousness of the breach, the regulatory outcome the FCA is seeking, and whether the subject cooperates with the investigation.
Stages of FCA enforcement
1. Identification and assessment
Enforcement cases typically begin when the FCA identifies potential misconduct through one of several channels:
- Supervision activity – routine or themed reviews that uncover issues
- Whistleblower reports – intelligence from people inside or close to a firm
- Market surveillance – automated monitoring of trading activity
- Referrals from other regulators – including the PRA, the Serious Fraud Office or overseas regulators
- Consumer complaints – patterns of complaints may trigger investigation
At this stage, the FCA's Enforcement and Market Oversight division assesses whether the matter warrants a formal investigation. Not every issue results in formal enforcement – many are resolved through supervisory dialogue.
2. Formal investigation
If the FCA decides to open a formal investigation, it will typically notify the firm or individual under investigation. The FCA has statutory powers to compel the production of documents, require attendance at interviews and obtain information from third parties.
Investigations can take years. The FCA has acknowledged that investigation timelines are a concern and has committed to improving efficiency, but complex cases involving multiple parties and large volumes of evidence take time.
What this means for compliance teams: A firm under investigation may not disclose this publicly, and the FCA does not normally announce that it is investigating a firm. That makes investigations hard to spot from public sources – but a new requirement on the register, or a change in a firm's behaviour or disclosures, may be an indirect signal.
3. Warning notice
If the FCA decides to take formal action, it first gives the firm or individual a warning notice. A warning notice sets out the action the FCA proposes to take and the reasons for it, and the recipient can make representations in response.
Warning notices themselves are not published. The FCA can, however, publish a warning notice statement – information about the matter to which a warning notice relates – under section 391(1)(c) of FSMA, and it uses that power selectively. A published warning notice statement is significant: the FCA is prepared to say publicly what action it proposes before it has decided the case, although the outcome can still change.
What this means for compliance teams: A published warning notice statement is an early signal that formal action may follow. It gives compliance teams time to assess the potential impact on their business relationships and begin contingency planning.
4. Decision notice
After considering any representations, the FCA decides what action to take and gives a decision notice setting it out.
The recipient can refer the matter to the Upper Tribunal (Tax and Chancery Chamber), an independent tribunal. A reference is not a review of the FCA's paperwork: the Tribunal rehears the case, can consider evidence the FCA did not have, and in a disciplinary case decides for itself what action, if any, is appropriate. While the reference is pending, the FCA cannot take the action set out in the decision notice. The FCA often publishes a decision notice once it has been referred, as it did in the case of former Barclays chief executive Jes Staley.
5. Final notice
If the recipient does not refer the matter, or once the Tribunal has determined it, the FCA gives a final notice – in line with the Tribunal's directions where there was a reference. In the Staley case, the Tribunal upheld the FCA's ban but reduced the fine, and the final notice reflects the lower figure.
Final notices are usually published on the FCA's website and are the definitive record of the enforcement outcome. They contain detailed findings of fact, the regulatory provisions breached, and the penalty or action imposed.
What this means for compliance teams: Final notices are the most visible enforcement output. The outcome is also recorded in the disciplinary history of the relevant firm or individual on the FCA register.
Types of FCA enforcement action
Financial penalties (fines)
Fines are the most high-profile form of enforcement action. The FCA's penalty framework considers factors including the seriousness of the breach, the size of the firm, any profit made or loss avoided, and the firm's cooperation during the investigation.
Firms that settle early receive a discount – 30% if they agree at the earliest stage. This means the published fine is often lower than the penalty that would have been imposed without settlement.
2025 in numbers: The FCA imposed about £124 million in fines in 2025, down from about £176 million in 2024, and financial crime cases accounted for most of it. See the biggest FCA fines of 2025.
Variation or cancellation of permission
A firm authorised under Part 4A of FSMA holds a permission that sets out the regulated activities it may carry on. The FCA can change or remove it:
- Own-initiative variation of permission (OIVOP): The FCA varies the permission itself – for example by removing a regulated activity – often urgently, where it believes consumers or markets are at risk.
- Cancellation: In the most serious cases the FCA cancels the permission entirely. A firm left with no permission is no longer authorised to carry on any regulated activity.
Payment institutions and e-money institutions are authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 rather than Part 4A, and the FCA can also restrict or cancel those authorisations.
Requirements
Rather than changing the permission, the FCA can impose requirements that restrict how a firm carries on its business – for example not taking on new customers, not holding client money, or holding additional capital. An own-initiative requirement (OIREQ) is imposed by the FCA; a voluntary requirement (VREQ) is one the firm applies for, usually after discussion with the FCA. A requirement is not a variation of permission: the firm keeps the same permission but must carry on its business within the limits the requirement sets. Requirements are shown on the Financial Services Register.
Prohibition orders
The FCA can prohibit individuals from performing specified functions in relation to regulated activities, or from performing any such function. Prohibition orders are used when the FCA considers that an individual is not a fit and proper person to perform those functions.
This is particularly relevant under the Senior Managers and Certification Regime (SM&CR), where individual accountability is a core regulatory principle.
Public censures
In some cases, the FCA issues a public censure rather than a financial penalty. A public censure is a formal published statement that the firm or individual has breached regulatory requirements. While it does not involve a financial penalty, it is a matter of public record and can have significant reputational consequences.
Criminal prosecution
The FCA has the power to prosecute certain criminal offences, including insider dealing, market manipulation and making misleading statements to the regulator. Criminal cases are handled through the courts and can result in prison sentences.
Why enforcement monitoring matters
For compliance teams
If you are responsible for monitoring counterparties, suppliers or appointed representatives, FCA enforcement actions against those firms directly affect your risk profile:
- A firm under enforcement may have its permission restricted or cancelled, affecting its ability to provide the services you rely on
- Enforcement action signals underlying compliance weaknesses that may affect the firm's stability and reliability
- Working with a firm that is subject to enforcement may attract supervisory attention to your own compliance arrangements
For risk management
Enforcement trends reveal the FCA's supervisory priorities. Financial crime cases made up most of the fines imposed in 2025, a sign that financial crime controls remain a central focus for the FCA. Understanding these trends helps risk managers prioritise their own compliance efforts.
For senior managers
Under SM&CR, senior managers can be held personally accountable if they fail to take reasonable steps to prevent regulatory breaches within their areas of responsibility. Being aware of enforcement actions affecting firms within your business relationships is part of exercising reasonable oversight.
How to stay informed
Manual approaches
- FCA website: The FCA publishes final notices, press releases and enforcement data on its website. However, outcomes are spread across press releases, notices and the register rather than gathered in one place for the firms you care about.
- FCA register: Enforcement outcomes are recorded on the register against the relevant firm or individual. Checking the register periodically will eventually surface them – but with a lag.
- Regulatory news services: Various legal and compliance news services report on FCA enforcement activity, but these are typically editorial rather than systematic.
Automated monitoring
For compliance teams managing many counterparty relationships, automated monitoring of the FCA register is a more dependable way to pick up enforcement action promptly. Rather than relying on periodic manual checks or news coverage, it checks every firm you care about on a fixed schedule – with Firmwatcher, every morning, plus FCA announcements within the hour – and alerts you when something new appears.
Firmwatcher checks the FCA register every morning, reads FCA announcements hourly, and emails your compliance team when a new requirement or disciplinary action appears for a firm or individual on your watchlist. Start a 14-day trial to automate your enforcement monitoring.