UK FCA Pushes Beyond "Tickbox Compliance"

In a speech delivered at the City of London’s annual City Dinner late last month, Nikhil Rathi, Chief Executive of the UK Financial Conduct Authority (FCA), calls for an end to “tickbox compliance” as part of a broader shift toward outcomes-focused regulation, more effective use of existing supervisory powers, and greater cooperation to address risks that cross institutional and regulatory boundaries.

Rathi warns that AI, round-the-clock trading, and new market structures are creating risks faster than traditional regulatory processes can respond. He describes a growing “innovation delta” between technological change and institutions’ ability to adapt. While the FCA continues to reform its rules, he argues that relying primarily on new regulation would leave authorities perpetually responding after risks have already emerged.

The FCA has reduced reporting burdens and pledged less intensive supervision for firms demonstrating responsible conduct, but Rathi says these reforms will have limited effect unless firms move away from “tickbox compliance.” He points to potentially duplicative assurance processes involving data collection, risk reporting, and internal audit, some driven by regulation and others by firms themselves. FCA Deputy Chief Executive Sarah Pritchard will work with industry to identify unnecessary activity and consider whether the traditional three lines of defense model needs revisiting.

Rathi makes a similar argument on financial crime. Despite substantial resources devoted to prevention, he says excessive data collection and complex validation processes can obscure risks spanning customers, institutions, and borders. The FCA intends to explore approaches that move beyond routine know-your-customer processes to identify actual money laundering. Within the regulator, AI tools are also being used to analyze information, identify emerging threats, and allow supervisors to focus on decisions requiring expert judgment.

Rathi also argues that the FCA should look beyond whether a source of harm sits inside its regulatory perimeter and consider how its existing powers can be used where risks originate through social media platforms, offshore markets, or third-party technology providers before reaching regulated financial services. That approach, he says, requires closer cooperation among regulators, firms, law enforcement, government, and civil society. “Only through partnership can we deliver the system-wide response needed to protect market integrity,” Rathi concludes.