At the same time, the FCA is showing increasing interest in firms' risk management frameworks and how effectively they operate in practice.
For those unfamiliar with the provision, Provision 29 was introduced as part of the 2024 UK Corporate Governance Code updates. However, it only applies to reporting periods commencing on or after 1 January 2025, meaning reporting begins in 2026.
It requires certain listed companies, including those in the FTSE 350, closed-ended investment funds, and commercial companies listed under the UK Listing Rules, to report on the effectiveness of their material risk management controls as part of their annual report and accounts.
This has led to a flurry of activity across the market, as the requirement operates on a comply-or-explain basis and firms are understandably keen to avoid scrutiny from the Financial Reporting Council (FRC) and other regulators, including the FCA.
The requirements of Provision 29 include:
Across the market, we are seeing strong top-down risk assessments and structured risk taxonomies. However, these are often not sufficiently linked to, or supported by, bottom-up risk assessments, leaving weaknesses within firms' risk management frameworks.
At Thistle Initiatives, we help firms assess their corporate governance and risk management frameworks to ensure they are fit for purpose and aligned with regulatory expectations.
Our team can support firms in meeting both their corporate governance obligations and the FCA's risk management requirements under SYSC, providing practical, proportionate solutions that strengthen governance while supporting broader business objectives.
Brian Rooney, Senior Manager in the Investments team at Thistle Initiatives, is an ICA and PFS Diploma-qualified compliance professional with over 30 years' industry experience, including serving as Head of Risk and Compliance for a number of investment firms.