Risk & Resilience

The Financial Conduct Authority (FCA) has issued a formal warning regarding Polaris Capital Consulting Group, which is operating without authorization in the United Kingdom. Compliance teams must recognize this firm as an unauthorized entity to mitigate risks associated with fraud and ensure clients are only engaged with regulated providers. ANAL ANALYSIS: The issuance of this warning by the FCA indicates that Polaris Capital Consulting Group is operating illegally and may be targeting individuals in the UK without permission. For compliance teams, this means the firm must be flagged in internal "do not engage" lists and watchlists. Because the firm is unauthorized, any client engagement with them would mean a total lack of protection from the Financial Ombudsman Service or the Financial Services Compensation Scheme (FSCS). The update highlights specific tactics used by fraudulent actors, such as providing misleading contact information or using details belonging to other entities to appear legitimate. This reinforces the necessity for compliance professionals to maintain rigorous due diligence and "Know Your Customer" (KYC) protocols. It serves as a reminder that any firm not appearing in the FCA Firm Checker should be treated as a high-risk entity that could lead to significant financial loss for consumers. While no new regulations were introduced, the notice highlights a specific date regarding scam protections: payments made to fraud accounts on or after October 7, 2024, may be covered by certain protections under the Payment Systems Regulator (PSR). Compliance teams should note this timeline when advising clients who have been targeted by potential scams. To mitigate risk, compliance professionals should update internal training modules to educate front-line staff on identifying unauthorized firms and using the FCA Firm Checker tool for verification. Furthermore, any mentions of Polaris Capital Consulting Group in client communications or inquiries should be flagged immediately. The primary risks associated with this update are consumer fraud and significant reputational damage if clients interact with these unlicensed entities. RISK_TAGS: Consumer Protection, Fraud Prevention, Third-Party Risk Management, AML Compliance

The Basel Committee spent two days in Indonesia earlier this week looking at a banking system that is changing faster in some places than the rules written to govern it. Artificial intelligence was high on the agenda, but it was hardly alone. Cryptoassets, interest rate risk, liquidity, systemic banks, cyber risk and the quality of supervision itself all made the list.

Europe’s heatwaves are already killing people on a scale unmatched by any other climate-related hazard on the continent. The European Insurance and Occupational Pensions Authority now says the consequences are beginning to matter for the assumptions on which insurers and pension providers build their businesses.

Finland’s financial regulator sees room to make the rulebook simpler. What it does not see is a reason to surrender the resilience that has allowed the country’s financial sector to withstand years of economic and market uncertainty.

Europe’s financial system has spent much of 2026 absorbing shocks without looking particularly shaken by them. Markets have lurched with geopolitical events and energy prices. Cyber threats have persisted. New technologies have developed faster than the institutions charged with overseeing them can comfortably digest. Through it all, European banks, insurers and investment funds have remained remarkably sturdy.

Most organizations know what they would do if a critical system went down. There are incident response plans, disaster recovery arrangements and business continuity procedures designed for exactly that scenario. But there is another question we don't ask nearly as often: What happens if the technology hasn't failed, but your organization can no longer use it?

More than half of the cyber incidents recorded by the European Union’s cybersecurity agency last year were distributed denial-of-service attacks. Most were not especially damaging, but they were, however, remarkably easy to summon. A political statement, an election, a protest or another turn in the war in Ukraine could be enough. Hacktivist groups claimed 4,709 attacks against EU Member States during 2025, according to ENISA’s latest Threat Landscape report, and more than 89% involved DDoS attacks. Public administrations bore much of it.