Warning Sign #1: Motor Finance and Consumer Credit Enforcement Is Accelerating
On 30 March 2026, the UK Financial Conduct Authority (FCA) confirmed an industry-wide motor finance compensation scheme and also published its final guidance on motor finance consumer redress. On the same day, the FCA also published finalised guidance on identifying and managing conflicts of interest in the motor finance context. Separately, on 26 March, 2026, an update was recorded in relation to the FCA’s credit information market review.
This is not a developing risk — it has arrived. The FCA's confirmation of an industry-wide compensation scheme and the publication of final redress guidance signals that enforcement and redress are now in motion. Any business with exposure to motor finance, consumer credit, or commission-based lending needs to assess its position urgently. The FCA's coordinated approach — issuing guidance, confirming redress schemes, and publishing conflict of interest rules simultaneously — is a textbook precursor to significant regulatory action and private litigation.
What to watch: Individual and group claims from consumers under the FCA's redress framework, regulatory enforcement actions against firms whose practices do not meet the finalised guidance standards, and secondary litigation against directors and senior managers.
Warning Sign #2: Cybersecurity and Operational Resilience Obligations Are Hardening Into Enforceable Standards
In March 2026, regulators on both sides of the Channel advances cybersecurity and operational risilience expectations. On 18 March , the UK FCA finalised PS26/2 on Operational Incident and Cyber Resilience reporting obligations. Around the same time, The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) adopted a Joint Opinion on EU Cybersecurity, alongside further updates on AI in the context of data protection and cybersecurity.
Taken together, these developments point to a tightening of supervisory expectations around how organisations manage, report, and govern cyber risk. The FCA's finalisation of operational incident reporting standards is particularly significant. Once reporting obligations are in place, every failure to report becomes an independent regulatory breach. The EDPB and EDPS joint opinion on cybersecurity signals coordinated EU-level enforcement preparation. Businesses that experience cyber incidents and fail to report them in accordance with the new standards face compounding exposure: regulatory fines for the incident itself, and separate sanctions for the reporting failure.
What to watch: FCA enforcement actions for operational incident reporting failures, GDPR enforcement for data breaches arising from cybersecurity incidents, and civil claims from customers and counterparties affected by cyber events.
Warning Sign #3: UK Employment Law Changes Are Creating a Window of Litigation Exposure
Throughout March 2026, the UK progressed multiple changes affecting employment law under the Employment Rights Act 2025. On 3 March , the UK DBT updated factsheets on the Employment Rights Act 2025. Further Statutory Instruments amending Employment Rights Act provisions were published on 25 March and 16 March. In parallel, the DBT launched a consultation on 25 March on introducing a new right in the employment context. On 5 March 2026, the UK Home Office launched a call for evidence on strengthening employment-related protections.
These developments indicate sustained legislative and policy activity in the employment space, extending beyond technical amendments into potential expansion of worker rights. The pace of change is itself the risk. Where legislation changes rapidly across multiple fronts — contractual terms, statutory rights, tribunal limits, and procedural rules businesses that are even slightly behind create significant litigation exposure. Employment tribunal claims are rising across the UK, and the combination of increased award limits, new statutory rights, and evolving procedural rules means the cost of getting it wrong is higher than ever. The window between when the law changes and when businesses update their practices is where claims are born.
What to watch: Tribunal claims arising from failure to implement updated contractual terms, whistleblowing and protected disclosure claims in light of updated guidance, and collective disputes triggered by workforce restructuring undertaken without reference to the new statutory framework.
This content has been prepared based on regulatory and legislative updates identified across UK and EU jurisdictions as of March 2026. It is intended for awareness purposes and does not constitute legal advice.
Take a look at last month’s article: Three early warning signs of litigation risk your business should not ignore | DWF Group
