Conduct risk has evolved. What began as a post-financial crisis regulatory response — focused on mis-selling, conflicts of interest, and individual accountability — has matured into something far more demanding: a sustained supervisory focus on the culture that drives behaviour across an entire organisation.

For firms operating in the UK and across the Gulf Cooperation Council, 2026 marks a pivotal moment. Regulators are no longer satisfied with well-drafted conduct frameworks sitting in policy libraries. They want evidence that those frameworks are lived, tested, and embedded at every level of the business.

What Regulators Are Looking For

The Financial Conduct Authority has been explicit. Under the Consumer Duty and the Senior Managers and Certification Regime, the FCA expects firms to demonstrate that their governance structures actively promote good outcomes — not merely avoid bad ones. The distinction matters enormously.

In the GCC, the UAE's Securities and Commodities Authority and the Dubai Financial Services Authority have similarly sharpened their focus on conduct. The DFSA's revised Conduct of Business module places new obligations on firms to evidence how their culture supports fair treatment of clients and sound decision-making at the board level.

The common thread across jurisdictions is this: regulators are asking firms to show their working. A conduct risk framework is only as credible as the data, escalation patterns, and board-level engagement that sit behind it.

The Culture Diagnostic Challenge

Culture is notoriously difficult to measure. Unlike capital ratios or transaction monitoring hit rates, culture does not produce a clean number. This is precisely why many firms underinvest in it — and precisely why regulators have become more sophisticated in how they assess it.

Supervisors now look at a range of proxies: whistleblowing volumes and outcomes, staff survey data, the speed and quality of issue escalation, the tone of board minutes, and the consistency between stated values and actual decision-making under pressure.

Firms that rely solely on annual conduct training and a code of ethics are operating with a significant blind spot. The question regulators are asking is not whether your staff have read the policy — it is whether they would raise a concern, and whether leadership would act on it.

Senior Manager Accountability

The Senior Managers and Certification Regime remains one of the most consequential regulatory developments of the past decade. Its core principle — that accountability must be traceable to named individuals — has fundamentally changed how boards and executive committees approach conduct risk.

In practice, this means that every material conduct risk must have a clear owner. Responsibilities must be documented, understood, and regularly reviewed. Where gaps exist, regulators will find them — and the consequences for senior managers can be severe.

For GCC-based firms with UK operations, or those seeking FCA authorisation, the SMCR framework requires careful mapping of responsibilities across jurisdictions. The interaction between UK accountability requirements and local governance structures is an area where specialist advice is essential.

Building a Credible Conduct Framework

A robust conduct risk framework in 2026 should address four interconnected dimensions.

Governance and accountability. Clear ownership of conduct risk at board and executive level, with documented responsibilities and regular reporting lines. The board should receive meaningful conduct risk management information — not just incident counts, but trend analysis, root cause assessment, and forward-looking indicators.

Culture measurement and monitoring. A structured approach to assessing culture, drawing on both quantitative data (HR metrics, whistleblowing data, audit findings) and qualitative insight (staff surveys, focus groups, exit interview analysis). Culture assessments should be conducted at least annually and should inform the firm's overall risk appetite statement.

Incentives and remuneration. Conduct risk outcomes must be reflected in remuneration decisions. Firms that reward commercial performance while tolerating conduct failures send a clear signal about their true values. Regulators scrutinise remuneration frameworks closely, and the link between conduct and pay must be demonstrable.

Escalation and speak-up culture. The effectiveness of a conduct framework ultimately depends on whether people feel safe raising concerns. Firms should invest in speak-up infrastructure — multiple reporting channels, clear non-retaliation commitments, and visible follow-through when issues are raised. The absence of escalations is not a sign of a healthy culture; it is often a warning sign.

The GCC Dimension

Conduct risk supervision in the GCC is maturing rapidly. The DFSA, ADGM Financial Services Regulatory Authority, and national regulators across Saudi Arabia, Kuwait, and Bahrain are all developing more sophisticated conduct frameworks, drawing heavily on FCA and international best practice.

For firms operating across both the UK and GCC, the challenge is to build a conduct framework that satisfies both regulatory environments without creating unnecessary duplication. A well-designed group-level framework, with jurisdiction-specific overlays, is typically the most efficient approach.

Halli Whalli Global has supported firms across both regions in designing and implementing conduct risk frameworks that meet current regulatory expectations and are built to adapt as supervision evolves. Our advisory services include dedicated conduct risk and governance advisory, and our licensed governance frameworks provide a structured foundation for firms seeking a validated, regulator-ready approach.

The governance dimension of conduct risk does not exist in isolation. Firms strengthening their conduct frameworks will often find that related disciplines — particularly KYC and AML compliance and corporate governance effectiveness — require parallel attention. Senior manager accountability under SMCR, for example, intersects directly with both financial crime obligations and board governance structures. Our dedicated analysis of SM&CR beyond banking explores how the accountability regime applies across the broader financial sector and what GCC firms with UK operations need to know.

Conclusion

Conduct risk in 2026 is a board-level issue. Firms that treat it as a compliance function responsibility — rather than a leadership priority — are misreading the regulatory direction of travel. Culture cannot be delegated. It must be owned, measured, and continuously reinforced from the top.

If your firm is reviewing its conduct risk framework or preparing for regulatory engagement on culture, contact our team at [email protected].