Regulation is often discussed in terms of policy change. In practice, its impact is already being felt elsewhere. Across the London market, firms are adjusting how they manage data, suppliers and internal processes, well ahead of formal deadlines. The shift is less visible than pricing or product change, but more fundamental.
For Nafisah Hussain (pictured), acting director of public policy at the International Underwriting Association, the real change lies in how regulation is being implemented rather than what it says.
“The immediate shift this year is actually operational,” Hussain said, pointing to new requirements around incident reporting and third-party arrangements being finalised by the FCA and PRA.
Even where implementation timelines extend to 2027, firms are already building the infrastructure required to comply, with “registers and playbooks” being developed now.
Solvent exit planning and redress reforms are adding to an already dense regulatory timetable. The effect is cumulative, with firms adapting not just to individual rules, but to a constant state of implementation.
That shift means compliance is no longer a discrete exercise, but an ongoing operational function embedded across the business.
Unlike previous waves of regulation, the current agenda is not directly targeting pricing. Instead, it is reshaping how products are governed and delivered.
“Consumer Duty is prompting clearer role definition in distribution chains,” Hussain said, while operational resilience requirements are “resetting tolerances for service continuity and vendor reliance.”
The shift is subtle but significant. Pricing may be unchanged, but the way products are designed, distributed and monitored is being reworked in the background, with climate-related reporting requirements adding further layers of governance and disclosure.
The effect is to push responsibility deeper into the organisation, with clearer accountability for how products are designed and delivered.
Keeping pace is becoming more complex, not simply because of volume, but because of how different requirements interact. “I think it’s cumulative,” Hussain said. “There’s a number of things that they’re trying to juggle all at once.”
Data sits at the centre of that challenge. Firms are being asked to collect, validate and report increasing amounts of information, often across multiple jurisdictions and systems, with “a lot of data collection happening,” as Hussain put it.
Emerging risks such as cyber and AI are introducing new governance expectations, adding further pressure to already stretched operational frameworks. The result is not a single point of strain, but a system under continuous load.
While the direction of travel is clear, the response from the market is more measured than resistant. “I don’t think the concern has ever been pushback for the sake of pushback,” Hussain said.
The tension lies in implementation. Much of that pressure comes before rules formally take effect, as firms commit resources, redesign processes and prepare for requirements that are still evolving. In some cases, this has created unintended consequences, particularly in wholesale markets.
Consumer Duty is one example, prompting ongoing engagement between the market and regulators to refine how it applies in different contexts. Regulators are additionally being asked to balance oversight with competitiveness.
The introduction of a secondary competitiveness objective for the FCA and PRA reflects that shift, reinforcing the need to maintain the UK’s position as an attractive place to do business.
Several developments are likely to shape the next phase of regulatory impact. Climate reporting requirements are expanding, while stress testing is becoming more dynamic. The PRA’s Dynamic General Insurance Stress Test is a notable example. “What is different about this event compared to previous ones is that there is no information on what that stress will be,” Hussain said.
Much of the underlying challenge still comes back to data. Even with standardised templates, firms need robust internal systems and clear materiality judgments, while legacy infrastructure continues to limit how effectively that information can be captured and used.
The shift underway is easy to overlook because it is largely operational, but it is also structural. By the time regulation catches up, the market has already moved.
