The FCA has published CP26/19, a consultation paper proposing substantial changes to how it calculates penalties and makes enforcement decisions. While the headline additions cover cryptoasset market abuse, the underlying framework changes affect every authorised firm—including IFAs.
This isn't just housekeeping. The proposals signal a more aggressive, more consistent approach to enforcement. Here's what you need to understand.
What's Actually Changing
The consultation covers three main areas:
1. Extended penalty framework for cryptoassets
The FCA is bringing its existing penalty calculation methodology to cover cryptoasset market abuse under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. If you're advising on or promoting crypto-related products, you're now firmly within the same enforcement framework that applies to traditional securities.
2. Updated decision-making procedures for individuals
The proposals include changes to how the FCA handles enforcement against individuals, including senior managers. The regulator is streamlining its internal processes, which typically means faster case progression from investigation to outcome.
3. Penalty calculation methodology refinements
While the core five-step penalty framework remains, the FCA is clarifying how it applies aggravating and mitigating factors. This matters because it affects the difference between a warning letter and a six-figure fine.
The Five-Step Framework: A Quick Refresher
For those who haven't had the pleasure of studying DEPP 6.5 recently, the FCA calculates penalties using five steps:
Step 1: Determine the appropriate figure based on revenue (for firms) or income (for individuals). For most breaches, this starts at a percentage of relevant revenue—typically between 0% and 20%.
Step 2: Adjust for the seriousness of the breach. This is where the FCA considers factors like whether the breach was deliberate, how long it continued, and whether clients suffered loss.
Step 3: Apply any mitigating or aggravating factors. Cooperation with the investigation, previous disciplinary record, and remedial action all come into play here.
Step 4: Add a deterrent uplift if needed. The FCA can increase penalties to ensure they're not simply seen as a cost of doing business.
Step 5: Apply any settlement discount. Early settlement can reduce penalties by up to 30%.
Why This Matters for IFAs
You might think enforcement actions primarily target large institutions. The numbers tell a different story.
In 2025, the FCA issued 47 final notices against individuals, many of them advisers at smaller firms. The median penalty for individual advisers was £76,000. Several cases involved financial promotion breaches—specifically, misleading social media posts and website content.
The common thread? Many of these cases started with routine supervision, not whistleblowers or client complaints. The FCA's increased use of data analytics means it's spotting patterns across firms that would have gone unnoticed five years ago.
The Supervision-to-Enforcement Pipeline
CP26/19 should be read alongside the FCA's broader shift toward what it calls "assertive supervision." The regulator has been explicit: it wants supervisory findings to feed more directly into enforcement outcomes.
In practice, this means:
- Section 166 skilled person reviews are more likely to trigger enforcement referrals
- Thematic reviews increasingly result in firm-specific action, not just "Dear CEO" letters
- The gap between a supervisory warning and a formal investigation has narrowed
For IFAs, the message is clear: treat supervisory correspondence as seriously as enforcement correspondence. A request for information about your financial promotions process isn't casual curiosity.
Practical Steps to Take Now
Review your financial promotions process. The FCA's most common findings against advisers relate to promotions that aren't fair, clear, and not misleading. This includes social media posts, website content, and client communications. Every promotion needs documented sign-off.
Check your record-keeping. The FCA expects firms to retain records of all financial promotions for at least six years, including evidence of the approval process. If you can't demonstrate who approved a promotion and when, you have a problem.
Understand your SM&CR responsibilities. CP26/19's changes to individual enforcement procedures mean senior managers face increased personal exposure. Make sure your statement of responsibilities accurately reflects who's accountable for compliance.
Respond to the consultation. The deadline for responses is typically 12 weeks from publication. If aspects of the proposals would disproportionately affect smaller firms, say so. The FCA does read responses, and the final rules often differ from the consultation version.
The Bottom Line
The FCA isn't becoming more punitive for its own sake. It's becoming more systematic. The same data-driven approach that helps it identify market abuse helps it spot patterns in financial promotion breaches across hundreds of adviser firms.
The firms that thrive in this environment are those with clear, documented processes—not because documentation is exciting, but because it's the difference between explaining a mistake and explaining why you had no controls in the first place.
PostGuard automatically checks your social media posts against FCA financial promotion rules before you publish. Catch problems before the FCA does — start with 3 free checks at postguard.online