Warning sign #1: Ofcom is moving to active enforcement on intimate images and deepfakes – with fines up to 10% of global revenue
On 9 September 2026, Ofcom announced an enforcement programme targeting online services that fail to prevent the spread of illegal intimate images and sexually explicit AI-generated deepfakes, with platforms expected to implement hash-matching technology, or equally effective measures, by 30 September 2026. Ofcom stated that non-compliant services may face enforcement action under the Online Safety Act, including fines of up to 10% of global annual revenue. Ofcom also launched a call for evidence on women's and girls' online safety, seeking data on changes in prevalence and severity of misogynistic abuse, coordinated harassment, technology-enabled stalking, and image-based sexual abuse, with submissions informing a Q2 2027 report assessing industry progress.
The 30 September 2026 implementation deadline for hash-matching or equivalent technology has passed. Ofcom is now in an active enforcement posture. For any business operating a user-to-user service or a platform with the potential for image sharing, the risk is immediate and quantifiable — fines up to 10% of global annual revenue are among the most severe regulatory penalties in the UK's enforcement toolkit. The combination of the enforcement programme and the ongoing call for evidence signals that Ofcom intends to maintain sustained pressure on this area throughout 2027.
What to watch: Ofcom enforcement investigations against platforms that failed to implement required technical measures by the 30 September deadline; civil claims from individuals whose images were shared without consent on non-compliant platforms; and reputational consequences arising from Ofcom's public naming of non-compliant services.
Warning sign #2: Iran sanctions expanded significantly – financial institutions are now in the firing line
On 7 September 2026, the UK Official Gazette published the Iran (Sanctions) (Amendment) Regulations 2026, entering into force on 29 September 2026. The amendments prohibit loans, credit, ownership interests, and joint ventures involving specified Iran-connected entities, while restricting UK credit and financial institutions from opening accounts, establishing correspondent banking relationships, or entering certain arrangements with specified persons. The Regulations also prohibit certain insurance and reinsurance services, dealings in Iranian bonds, and the provision of financial services and funds connected with a range of sanctioned Iranian trade, energy, and technology activities.
The breadth of these new prohibitions is significant. The restrictions on correspondent banking relationships, insurance and reinsurance services, and bond dealings affect a wide range of financial institutions — not only those with direct Iranian business. Any bank, insurer, or financial intermediary whose counterparty or correspondent network has any Iranian nexus needs to have conducted a compliance review before these Regulations took effect on 29 September 2026. The practical reach of these prohibitions often extends further than initial assessments suggest, particularly in complex financial structures involving multiple intermediaries.
What to watch: Enforcement actions by the Office of Financial Sanctions Implementation (OFSI) against firms found to have inadvertently continued prohibited activities after 29 September 2026; regulatory investigations arising from correspondent banking relationship reviews; and civil claims between counterparties where transactions are voided by sanctions non-compliance.
Warning sign #3: The FCA's findings on frontier AI and cyber resilience are a precursor to supervisory action
On 2 September 2026, the FCA published findings from its engagement with financial services firms on the use of frontier AI models with cyber capabilities, reporting that these models are accelerating the identification and validation of cyber vulnerabilities, increasing pressure on remediation processes, and exposing weaknesses in governance, access controls, dependency mapping, and operational resilience. The FCA emphasised the importance of clear accountability, effective oversight, and human judgement when firms use AI to support vulnerability management.
Separately, on 22 September 2026, the FCA highlighted concerns regarding unsuitable debt advice practices, identifying risks including consumers being steered towards fee-charging debt solutions without appropriate consideration of alternatives, pressure to make decisions quickly, and instances where consumers may be encouraged to alter financial information during assessments. The FCA referenced recent supervisory and enforcement action involving debt-advice firms where concerns were identified regarding suitability of advice and consumer outcomes.
When the FCA publishes multi-firm findings that identify systemic weaknesses — and explicitly references enforcement action already taken — it is signalling that further enforcement is coming. The identification of specific failures in AI governance, access controls, and dependency mapping in the context of frontier AI gives the FCA a clear benchmark against which to assess firms in future supervisory visits. For debt-advice firms, the reference to recent enforcement action is a direct warning that the regulator is active in this space. Firms in both areas should treat these publications as enforcement notices in all but name.
What to watch: FCA supervisory visits to financial services firms assessed as having inadequate AI governance or cyber-resilience arrangements; enforcement actions against debt-advice firms where Consumer Duty failings and unsuitable advice practices are identified; and personal liability for senior managers under the Senior Managers and Certification Regime where governance failings are linked to poor consumer outcomes.
This content has been prepared based on regulatory and legislative updates identified across UK and EU jurisdictions as at September 2026. It is intended for awareness purposes and does not constitute legal advice.
