A sea change in regulatory investigations and enforcement − speech by David Chaplin

It is a real pleasure to be in Leeds for the Fifth Conference on Financial Law and Regulation.

Leeds is an important base for the Bank of England as we build a stronger national presence and deepen our engagement with institutions, practitioners and scholars across the UK. The Bank first opened a Leeds branch in 1827,^{footnote [1]} and our growing presence here reflects a commitment: not only to operate from different locations, but to engage across the country with the professional and intellectual communities that shape our financial system.

It is therefore particularly fitting to be here at the University of Leeds, contributing to a conference that brings together legal, regulatory and academic perspectives on some of the most challenging questions facing financial law and regulation today.

Some of these questions arise in the context of investigations and enforcement. And that’s what I am going to talk about.

Introduction

For a long time, there was a relatively settled picture of what a regulatory enforcement investigation looks like: how it begins, how it proceeds, and when (where appropriate) responsibility for regulatory breaches is acknowledged and action taken. That model has served an important purpose, and in many cases, it continues to do so.

What I want to discuss today though is how, in a growing number of PRA and Bank enforcement cases, that familiar pattern is changing. I’ll explore how that change has come about, what it entails, and why we think it matters.

Recently, we have seen a clear and consistent shift in how the subjects of our investigations are engaging with us. This is a change we have championed and will continue to encourage because of the benefits it brings for all concerned.

What is that trend? Put simply, it is that subjects of investigations are engaging with us earlier in the investigations and enforcement process and proactively identifying, acknowledging and remediating breaches.

This is not something isolated to a small number of cases. It is not behaviour confined to exceptional or isolated circumstances. Rather, what we are seeing is a sustained change in approach, which we see as having the potential to become the new default: a shift in how responsibility and candour are being understood and acted upon in regulatory enforcement.

We believe this represents a genuine sea change in how a growing number of enforcement cases are now being approached.

The focus here is not on the launch of a new policy, but on how a policy we have already introduced is playing out in practice and the impact it is having on behaviour in live enforcement cases.

Our remit

As a reminder, the PRA is responsible for the supervision of approximately 1,300 banks, building societies, credit unions, insurers and major investment firms. In addition to this, the Bank of England has broader regulatory responsibilities, including the supervision of certain financial market infrastructures in the UK.

In the enforcement space, we have powers to discipline firms, including through financial sanctions, public censures and the temporary suspension of permissions. We also continue to pursue individual accountability and to publish outcomes in appropriate cases, including, where necessary, prohibiting individuals who are not fit and proper in order to protect the wider regulated community.

Before going further, it is worth stepping back and making a broader point about the character of PRA and Bank enforcement.

The PRA is a supervision-led rather than an enforcement-led regulator. Our investigations and enforcement resource has always been precision-focused, and used in a targeted way to support supervisory aims. This reflects a need to look back and understand what has gone wrong, as well as a need to look forward and positively influence future behaviour, including in relation to matters where there may be shortcomings apparent, but (perhaps just by good fortune) crystallised harm has not yet arisen. While the enforcement division works closely with supervisors and supports their aims, we are functionally independent from supervision, which helps ensure that we approach matters objectively and with fresh eyes. Our enforcement activity stretches across the entire gamut of PRA-authorised firms: large and small deposit-takers, designated investment firms, insurers, reinsurers and credit unions.

Enforcement action is brought to support specific supervisory objectives, strategies, and outcomes. In the PRA context, this is guided by its primary statutory objectives: to promote the safety and soundness of PRA‑authorised firms and to secure an appropriate degree of protection for policyholders.

That approach has resulted in a steady number of public outcomes each year, and we expect that to continue. Our focus is on cases that deliver appropriate outcomes while sending clear deterrent signals to the wider community of PRA-authorised firms, individuals and Bank regulated entities.

But what is changing, against that steady position, is how those cases are conducted and resolved, and how efficiently and constructively accountability is achieved.

‘Contentious regulatory work’ - the investigations and enforcement orthodoxy

To understand why this matters, let’s briefly consider the orthodox model that has traditionally shaped regulatory enforcement cases. That model typically followed a familiar pattern:

The regulator opens an investigation and gathers evidence, perhaps over a significant period. The evidence is analysed and tested. Once a settled regulatory view has formed, if the regulator considers that breaches have been identified and action is appropriate, a proposal for action is put to the subject. This may be treated as a case to answer and engagement often becomes, at least in the first instance, defensive: the subject, and their counsel, often adopt a defensive posture, with initial engagement focused on minimising exposure by challenging the regulator’s conclusions. Admissions may eventually come as part of a settlement, but often late on in the process.

This approach has driven a set of familiar conventions, on the part of investigation subjects and those advising them, including caution about taking early positions; the labelling of learning and remediation as “enhancements” rather than corrections; careful avoidance of any acknowledgement of rule breaches until the regulator’s view is known; and a tendency to approach enforcement as “quasi‑litigation" rather than as a process of regulatory accountability.

It is important to say that this approach may not be wrong or improper. In some cases (particularly where facts are contested or responsibility is genuinely unclear) it may be entirely appropriate.

But it is not the only model, and it is not the best model for every situation. If it is treated as the only model, we risk losing the opportunity, in appropriate cases, to do something better — better not only for the regulator but also better, undoubtedly, for the subject of investigations and the wider regulated community.

And it bears pausing here to note that, every (not the majority, but every) enforcement case where we have made findings of breaches of rules by a firm to date has been resolved by settlement (that’s 21 cases in total).^{footnote [2]} To date, no firm cases have been contested at our Enforcement Decision Making Committee or the Upper Tribunal (Tax and Chancery Chamber).

We do not open investigations unless the statutory thresholds for doing so are met and our investigation opening criteria^{footnote [3]} are engaged. But we do not think the fact that all our actions against firms have settled is a function of the PRA only pursuing cases where breaches are clear and obvious at the point of opening an investigation. Rather, it reflects the fact that firms, by the time we reach a settlement proposal, have understood the nature of the case against them and internally acknowledged the weaknesses and failings within their systems, controls and governance frameworks. Firms typically recognise the value in the certainty of a settlement and the opportunity to demonstrate contrition and move on from past wrongdoing or failures.

This might be taken to suggest that the approach followed historically where an investigation may be treated as a contentious or adversarial endeavour may be misplaced and unnecessary in many cases.

Not all investigations result in enforcement action. It remains the case, that some investigations are closed with no action taken, and that will inevitably continue.

We do not open investigations lightly, but the fact that some investigations conclude without findings of breach reflects an important feature of how we approach enforcement. We do not open investigations with a predetermined outcome, nor do we focus only on the most straightforward or easily provable cases. This also demonstrates a central point that PRA and Bank investigations are conducted with an open mind; something that will not change.

But I am talking about a different, yet substantial, category of investigations: cases where there is often a realistic and shared understanding at an early stage that a regulatory breach is very likely to have occurred. Such scenarios are not uncommon and often arise as a result of independent reports firms may have commissioned, section 166 “skilled person” reviews,^{footnote [4]} root cause analysis exercises or post incident reports. Such work is often sufficient to enable a firm to understand what went wrong, why and how; and who is accountable for this.

In cases such as these, the traditional orthodoxy can lead to unnecessarily slow, resource intensive, and expensive processes.

The consequence, which we have seen many times, can be investigations that take much longer than they need to. This increases cost, uncertainty, and strain for firms, individuals, and, yes, for regulators alike. It can also introduce significant delay between the events which may have prompted an investigation and the publishing of a settled enforcement outcome.

It needn’t be like this.

Efficiency, speed and regulatory burden

Efficiency and speed are not abstract virtues in enforcement.

They matter because quick and efficient investigations reduce prolonged uncertainty for firms and individuals, as well as allowing regulatory resources to be deployed where they add most value and where they enable the regulator to be most effective. Quick and effective investigations also enable lessons from enforcement outcomes to reach the wider market more quickly, with the aim of improving understanding and therefore behaviours, to the benefit of firms, individuals and the regulator.

This also connects to a broader discussion about efficiency and regulatory burden on firms.

Some of that regulatory burden arises directly from the need to comply with rules. Regulators should, of course, keep their rules under review and look to reform them where appropriate to reduce burden in a way which is proportionate to risk. There are rightly many recent examples of regulators, including the PRA, seeking to do this.

In an enforcement context, reducing regulatory burden does not, however, mean reducing enforcement activity such that the incentive to properly and fully comply with the letter and spirit of rules diminishes.

But regulatory burden does not arise only from compliance with rules. It can also be driven by the conduct and behaviour of parties and unnecessary procedural friction.

Where enforcement can be carried out in a way that uncovers the facts and delivers accountability more quickly, without compromising deterrence, and without unnecessary duplication of effort, that is a real and meaningful reduction in regulatory burden.

From the Bank’s perspective, efficient enforcement is not about rushing. It is about doing the right work meticulously, in the right order, without unnecessary delay, to ensure an appropriate regulatory outcome is achieved.

Over recent years, we have focused on how enforcement policy design can support that aim with clear architecture and incentives which promote efficiency and candour.

Incentives

A helpful analogy here is civil justice.

In civil litigation, early engagement is not just encouraged; it is structurally incentivised. Under the Civil Procedure Rules, the overriding objective, costs rules, and judicial expectations all push parties towards narrowing issues, accepting responsibility where appropriate, and resolving disputes proportionately.

Accordingly, a party that resists the obvious, or prolongs proceedings unnecessarily, does so at real risk.

I referred earlier to a tendency to treat investigations and enforcement as “quasi litigation” – investigations and enforcement are not civil litigation, quasi or otherwise. This has been affirmed at the Court of Appeal: a regulator is not an “ordinary litigant” and the conduct of cases is not to be treated as “ordinary litigation”.^{footnote [5]} But the underlying insight holds: behaviour follows incentives.

And what we have sought to do in our enforcement policy is rebalance incentives, without compromising rigour or fairness.

The Early Account Scheme as a signal

That brings me to the Early Account Scheme — the “EAS”.

The EAS was introduced as part of an enforcement policy update we made in 2024.^{footnote [6]} It is available to subjects under investigation in appropriate cases, and it is best understood as a signal to subjects of PRA and Bank investigations about how we expect mature regulatory engagement to work in appropriate cases.

It signals that: early, high quality internal investigation is valued; comprehensive and accurate factual accounts matter; early admissions of regulatory breaches made well in advance of settlement are meaningful; and proactive candour can materially affect the efficiency and outcome of an investigation.

The EAS is available to both firms and individuals, and gives subjects a mechanism to adapt their approach to regulatory engagement, in effect an architecture for co-operation with appropriate checks and balances.

Specifically, it gives a subject an opportunity to produce a candid Account (with an expectation that this will be done in six months or less) which is comprehensive, accurate and timely, supported with relevant material, and arrived at through an appropriately rigorous process.

This is not a process that relies on the subject simply providing an account in isolation. It is a collaborative and iterative endeavour, with the PRA actively engaging, testing and, where necessary, challenging the content of the Account as it is developed. Our existing investigative tools remain fully available, including the use of compulsory powers where appropriate, and an Account produced under the EAS sits alongside the broader evidential picture, including documentation and information already held by Supervision. In addition, senior management accountability is built into the process, through attestation as to the accuracy and completeness of the Account. We also retain the ability to pursue any lines of enquiry that are not adequately reflected in an Account. Taken together, these features are designed to ensure that early candour is accompanied by rigour, not at the expense of it.

Where a subject produces an Account in this way, and makes early admissions, providing they have ceased the behaviour giving rise to the breaches, and carried out necessary remediation, they may be entitled to an enhanced discount of up to 50% on any regulatory penalty.

What do we mean by “early admissions”? This is an area where precision matters.

”Early admissions” do not mean general expressions of regret, tactical concessions made once settlement parameters are already clear, or pure factual acknowledgements distinguished from regulatory breaches.

What we mean by early admissions in PRA and Bank cases is the acceptance of relevant facts and regulatory breaches which are made significantly in advance of any settlement proposal and at a stage where those admissions genuinely shape the scope, direction, and duration of the investigation.

In other words, open and candid regulatory engagement in good faith. This mirrors what comprises one of our fundamental expectations as to firm engagements with the regulator more generally: to be open and co-operative.^{footnote [7]}

What the lived experience shows so far

We recognise that this may demand an adjustment in mindset and requires an element of trust. That includes confidence that subjects who come forward early will be treated fairly, in line with the framework we have set out.

But what has been striking is how these signals have already translated into real behavioural change. We welcome this change.

Across a growing number of our enforcement investigations, we are now seeing earlier without prejudice engagement, investigation subjects volunteering structured factual accounts, and admissions being made months, and in some cases years, earlier than would previously have been typical.

This is evident if you look at our cases since the EAS policy was published in early 2024 with admissions as to rule breaches now regularly being proactively made early on and, in one case, with a firm even making clear that it would, in light of the facts and matters, be appropriate for a financial sanction to be imposed (crucially, this was before any such proposal had been put before the firm).

A number of these cases were already in progress when the EAS policy was published so were not formally on the “EAS track”. However, the way that these outcomes were arrived at represents a response to the policy signal the EAS policy sent upon publication.

And in March this year we published our first outcome in a firm case in which the EAS policy was formally applied.

This was action in respect of U K Insurance Limited, a subsidiary of Direct Line Insurance Group plc (now owned by Aviva).^{footnote [8]} It proved to be a successful pilot case. We were impressed with how the subject engaged and the commitment the firm demonstrated to self-reflection and contrition which was completely in tune with what we are hoping to achieve with the scheme. The firm engaged proactively and candidly with our investigation team during the EAS process and provided a comprehensive, timely, accurate and fulsome Account. Shortly following production of the Account, and (critically) significantly in advance of any settlement proposal being put to the firm by the PRA, the firm made admissions, both as to relevant facts and regulatory rule breaches. This meant our investigation could proceed efficiently and quickly and we recognised this by giving the firm the maximum discount.

Collectively these recent examples represent a break with our past actions. They represent a pattern of change in how subjects are choosing to engage with enforcement.

It’s one we hope will continue and why we would describe what is happening as genuinely significant. It is grounded not just in policy language, but already in observable behaviour across our cases.

For the PRA and the Bank, it means more focused and efficient investigations, better use of specialist resources, and outcomes delivered closer to the underlying events.

For firms and individuals under investigation, it means shorter periods of uncertainty, reduced cost and disruption (an opportunity to acknowledge, reflect and move on from breaches) and stronger incentives for governance, escalation, and remediation.

Bringing this together

Enforcement works best when it is understood not as a contest, but as a disciplined process for accountability, learning and rebuilding trust, with responsibility recognised early enough for it to do its job properly.

The approach I have described today is new and may take some getting used to. It will sit alongside more traditional approaches rather than replace them entirely.

But the destination, an appropriate regulatory outcome, has not changed. What is changing, in many cases, is the route taken to get there and the pace at which we arrive.

Together, these developments represent a sea change in how regulatory investigations and enforcement are conducted. They bring new optionality and scope for faster outcomes. They mark not just a change in form, but in substance, in how subjects of investigations engage with us and how accountability is achieved.

I would like to thank Edward Aldred, Tara Connolly, Geoff Egerton and Ossie Fikret for their help in preparing this speech. And to colleagues across the Bank, including in particular Olie Dearie, Rob Price and Aaron Schroeder-Willis, for their helpful comments.