A marketing decision now carries a two year custodial maximum
Inside seven days, a British regulator set a criminal trial date for a social media promotion and two more moved the rules on how payments are described, priced and supplied.
A social post is now evidence in a criminal trial#
A fox does not test the ice by running across it. It watches what happened to the last animal that tried. Financial services marketing has spent three years being told that promotion rules have teeth, and this week the teeth were photographed.
On 30 July 2026, a finfluencer charged with illegal financial promotions appeared at Southwark Crown Court, entered a not guilty plea, and had a trial date set for 12 June 2028. The charges are brought under sections 21 and 25 of the Financial Services and Markets Act 2000, and the alleged conduct is promoting the buying and selling of foreign exchange contracts for difference through social media accounts and websites without authorisation, per the Financial Conduct Authority's press release.
The statute is short and unforgiving. Section 21(1) provides that a person "must not, in the course of business, communicate an invitation or inducement to engage in investment activity" unless authorised or unless the content is approved by an authorised firm, per section 21 of FSMA 2000. Section 25 makes contravention an offence carrying up to six months imprisonment on summary conviction and up to two years on indictment.
The defences in section 25 are narrow and instructive. A defendant may show they reasonably believed the communication was prepared by an authorised person, or that they took all reasonable precautions to avoid committing the offence. Both defences reward a documented approval trail and punish an undocumented one, which is a fair summary of what good financial advertising governance looks like on paper. Financial services marketing teams tend to hold the first defence and neglect the second.
The payment journey is being written into rules too#
Promotion is only the front of the funnel. The same week, the Payment Systems Regulator opened consultation CP26/2 on Specific Direction 17, the direction behind Confirmation of Payee. The proposal removes SD17's fixed expiry date of 1 November 2026 so the obligation continues, and brings payment service providers that offer the check voluntarily into scope as a new Group 3, covering Faster Payments and CHAPS, per the PSR's consultation page and the Slaughter and May weekly bulletin.
Organisations offering the check
The PSR states more than 320 organisations now offer Confirmation of Payee.
Checks completed daily
Over two million name checks are completed every day across the covered payment systems.
Consultation closes
CP26/2 closes at 5pm on 20 August 2026. Voluntary providers should read it as an in-scope notice.
Current SD17 expiry
The existing direction expires 1 November 2026. The proposal removes that date entirely.
For anyone doing fintech marketing, the commercial point hides inside the compliance one. Confirmation of Payee is a trust feature that customers now expect by default. Once voluntary providers become directed firms, "we check the name matches" stops being a differentiator to shout about and becomes a baseline to maintain quietly. Any acquisition creative leaning on it as a unique benefit has a shelf life measured in months.
The consultation closes at 5pm on 20 August 2026. That is a short window, and it lands in the middle of August, which is exactly when this sort of thing gets missed. Financial services marketing calendars rarely carry regulator deadlines, and that is precisely why the claims built on them go stale unnoticed.
Card fees get a transparency timetable#
Also on 30 July, the PSR issued specific directions to Mastercard and Visa as its card scheme and processing fees market review moved to implementation. There are two: an information transparency and complexity remedy with a twelve-month implementation deadline, and a pricing governance remedy with a four-month deadline. A further regulatory financial reporting requirement will oblige both schemes to report the financial performance of their UK card business to the regulator, per the PSR's announcement, which follows policy statement PS26/1.
| What | Date | Who it lands on |
|---|---|---|
| PSR pricing governance remedy | Four months from 30 July 2026 | Card schemes, then acquirers repricing |
| CP26/2 consultation closes | 5pm, 20 August 2026 | Any PSP offering Confirmation of Payee voluntarily |
| PSR information transparency remedy | Twelve months from 30 July 2026 | Acquirers, and the comparison claims built on their data |
| FCA transaction reporting rules take effect | 3 April 2028 | Reporting and operations, with a long build runway |
| Cryptoasset regime comes into force | 25 October 2027 | Any firm promoting cryptoassets in the UK |
The PSR's own page describes fees rising well ahead of inflation but publishes no percentage, so we have not attached one. A number that is not in the source does not belong on the page, however tempting the round figure would be.
The marketing consequence is a claims problem. Banking marketing that compares total cost of acceptance is currently arguing from data the regulator has just judged insufficiently transparent. When the transparency remedy lands, those comparisons become verifiable, which helps honest challengers and hurts everyone who has been rounding in their own favour. Financial services marketing built on unverifiable comparison is about to be marked against a source of truth.
Your martech stack is now a supervised dependency#
On 28 July, Mark Francis of the FCA and Simon Dixon of the PRA published a joint blog on resilience across an interconnected financial system. Two numbers in it belong in every vendor review: 27 per cent of incidents reported to the FCA by firms in 2025 were attributed to third-party issues, and 37 per cent of those third-party incidents were cyber-related, per the FCA and PRA blog. The piece cites the 2024 CrowdStrike outage and cyber incidents at Marks and Spencer and Jaguar Land Rover as cross-sector examples.
Financial services marketing owns more third-party integrations than any other function in a modern bank: tag managers, consent platforms, chat widgets, attribution SDKs, personalisation engines, review aggregators. Each is a supplier. Each sits inside the 27 per cent. A stack assembled by growth teams over four years is a resilience surface nobody has ever drawn.
There was relief in the week too. On 3 August the FCA finalised its transaction reporting overhaul in policy statement PS26/15, estimating an annual industry saving of 108 million pounds, taking the yearly cost from 493 million to 385 million, cutting reportable fields from 65 to 52, removing around 7 million instruments from scope and shortening the historical error correction period from five years to three. Around 400 firms are affected by the removal of foreign exchange derivatives, and the rules take effect on 3 April 2028.
Five checks for a financial services marketing function#
None of this requires a new department. It requires a trail that can be followed backwards from any live asset to the person who approved it. Quiet, documented, dull. The fox keeps its den tidy for a reason.
Every live asset that invites or induces investment activity needs a named authorised approver and a dated record. Section 25's defences turn on precisely this evidence, so an undocumented approval is functionally no approval at all.
List every third party promoting your products: influencers, comparison sites, affiliates, community moderators. A criminal prosecution is running on exactly this category of communication, and unauthorised promotion does not become safe because someone else typed it.
If your acquisition creative treats Confirmation of Payee as a differentiator, plan its retirement. Once voluntary providers are directed firms, it becomes table stakes, and a stale claim ages badly.
Draw the actual list of third parties touching your customer journey and hand it to whoever owns operational resilience. Over a quarter of reported incidents came from suppliers, and marketing owns more of them than it admits.
CP26/2 on 20 August, the PSR's four and twelve month remedies, 3 April 2028 for reporting and 25 October 2027 for cryptoassets. Put them in the marketing calendar, because each one changes a claim you are currently making.
One further note for anyone promoting digital assets. Handbook Notice 143 records ten cryptoasset instruments approved by the FCA Board on 25 June 2026, including the Cryptoassets (Stablecoins) Instrument 2026, with a further tranche approved on 30 July, per Norton Rose Fulbright's Regulation Tomorrow. The regime itself comes into force on 25 October 2027, per the FCA's new regime page. The rulebook is made, not proposed, which starts the real clock.
And a reminder that consumer harm arrives with its own comms problem. When Blue Motor Finance entered administration on 30 July, the FCA told customers to keep paying and to stay alert to fraud, noting that compensation under the motor finance redress scheme will not be protected by the Financial Services Compensation Scheme, per the FCA's news story. Every distressed-firm moment is a scam window, and the honest brands in a category are the ones who say so first.
A person who contravenes section 21(1) is guilty of an offence.
Eleven words, and they outrank every growth target in the building. Good financial services marketing has always been the kind that could survive being read aloud in a courtroom, and this week that stopped being a figure of speech.
Frequently asked questions#
Is an unauthorised financial promotion really a criminal offence?
Yes. Section 21 of the Financial Services and Markets Act 2000 prohibits communicating an invitation or inducement to engage in investment activity in the course of business unless you are authorised or the content is approved by an authorised person. Section 25 makes contravention an offence carrying up to six months imprisonment summarily and up to two years on indictment.
Does the risk apply to influencers or to the brand paying them?
Potentially both. The restriction attaches to the person communicating the promotion, so an unauthorised creator can be liable in their own right, while the firm carries responsibility for approving and monitoring what it commissions. Sound financial services marketing keeps a documented approval trail covering every third party who promotes the product.
What is Confirmation of Payee and why is it changing?
It is the check that confirms a payee's name matches the account being paid. The PSR's consultation CP26/2 proposes removing the 1 November 2026 expiry on Specific Direction 17 so the obligation continues, and bringing providers who offer it voluntarily into scope as a new Group 3. The consultation closes at 5pm on 20 August 2026.
What did the PSR require of Mastercard and Visa?
It issued two specific directions as its card fees review moved to implementation: an information transparency and complexity remedy with a twelve-month deadline, and a pricing governance remedy with a four-month deadline. Both schemes will also have to report the financial performance of their UK card business to the regulator.
Why should a marketing team care about third-party incident statistics?
Because marketing owns a large share of the third parties. The FCA reports that 27 per cent of incidents notified by firms in 2025 were attributed to third-party issues, and 37 per cent of those were cyber-related. Tag managers, consent tools, chat widgets and attribution SDKs all sit in that population and rarely appear on a resilience register.
When do the new UK cryptoasset rules actually bite?
The regime comes into force on 25 October 2027. The rulebook itself is already made rather than proposed, with ten cryptoasset instruments approved by the FCA Board on 25 June 2026 and a further tranche on 30 July 2026, so promotion and disclosure work can begin against final text now.
Read more on this topic#
Who approved that? Financial promotions and approver liability
The approver side of the same statute, and why sign-off is a named person rather than a process.
Read the pieceWhy fintech and Web3 brands are invisible in AI search
Once the compliance trail is tidy, this is the visibility problem sitting behind it.
Read the pieceChatGPT Ads for fintech
Where regulated acquisition spend is moving, and the approval questions it raises.
Read the pieceThe regulator stopped reading your ad and started reading your funnel
The same supervisory shift playing out in another regulated category this week.
Read the piece
Want the promotion trail tidy before someone asks to see it?
folkfox builds financial services marketing for banks, fintechs and payment firms: creative that survives an approver's read, affiliate estates that are actually mapped, and claims retired before they expire.