CP26/23 policy statement: what to change in your files when it lands

When does the CP26/23 policy statement land?

CP26/23 opened for consultation in June 2026. Regarding the timetable, feedback closes on 18 September 2026, and the policy statement — with any new rules — is expected in Q1 2027, per UK Finance's tracking of the consultation.

Two dates frame the file-review calendar. September 2026 closes the consultation window; Q1 2027 delivers the final text. Between those dates, nothing in the Handbook moves. Files reviewed today are tested against the current rules — COBS 9.2.1R for suitability, FG21/1 for vulnerability, PRIN 2A for the outcomes — and the FCA's Consumer Duty publications hub remains the source of record for which versions apply.

The gap matters because files written now stay in the review cycle when the new text lands. An ongoing service review completed in October 2026 sits in the evidence set a Q1 2027 supervisor reads. Regarding forward planning, the working question is which parts of today's file the statement touches.

The file the FCA reads next year is the one written this year. (Source: FCA CP26/23)

What does CP26/23 change about proportionality?

CP26/23 is a scope-and-proportionality paper. The FCA published it in June 2026 after concerns that the Consumer Duty was being applied more broadly than intended — firms reading the Duty as demanding identical evidence depth regardless of firm size, business model or client base. The consultation proposes targeted changes rather than a restructuring of the Duty: new rules and guidance text, not a rewrite of the PRIN 2A outcomes.

The clearest signal for advice firms concerns vulnerable customers. Regarding FG21/1, the September 2026 analysis from Burges Salmon reads CP26/23 as proposing new rules and guidance text that clarify the treatment of vulnerable customers — clarification layered on top of the finalised guidance, which has held its February 2021 status throughout.

Small firms read the paper as a depth question. The consultation targets how much evidence is proportionate — and where the Duty's scope starts and stops — for a firm of 1–5 advisers versus a network. The distinction is the whole game at file level.

Proportionality sets the depth of the evidence, not the existence of it. (Source: FCA CP26/23)

Which file sections does the new text touch first?

Suitability reports carry the heaviest load. Regarding file structure, the sections a proportionality statement reaches first are the ones where depth is discretionary: fact-find detail, the range of options considered against the recommendation, the length and specificity of the vulnerability record. COBS 9.2.1R — the obligation at the heart of a personal recommendation — stays as the anchor; the debate runs around the evidence depth behind it. A report that maps its evidence to the suitability rules line by line reads as proportionate or padded within the first page.

Table: The four file sections a CP26/23 proportionality statement reaches first.

Vulnerability logs deserve their own line. FG21/1 has governed the area since February 2021, and CP26/23 adds text on top rather than replacing the document. A log entry that records the characteristic, the adjustment made and the follow-up date already matches FG21/1's structure; the consultation's clarifying text sits over that frame. The vulnerable customers guidance page on this site tracks the FG21/1 requirements in detail.

Supervision tests records, not intentions. (Source: FCA FG21/1)

What will the file need to show once the statement lands?

Records carry the argument after Q1 2027. Regarding evidence, the file that reads well under a proportionality regime shows three things: a dated trail, a cited rule reference and a human decision. A suitability report that cites COBS 9.2.1R at the point of recommendation, logs the vulnerability adjustment with a follow-up date, and records each ongoing service review against PRIN 2A.6 and TR24/1 para 1.40 gives a supervisor the proportionality story without a narrative essay.

Volume is the failure mode. Files padded to look thorough read as firms guessing at the Duty's breadth — the exact concern CP26/23 answers. A five-page report with line-level citations carries more weight than a twenty-page report with assertions, and the board MI question is identical: outcomes evidence scaled to a 1–5 adviser firm, not a network template.

Supervision reads the file cold. The supervisor has no access to the intention behind a paragraph, only the paragraph itself — the citation, the date and the sign-off do the persuading.

The outcome the FCA tests is the one the file can prove. (Source: FCA FG22/5)

How does a small firm evidence proportionality before Q1 2027?

Preparedness is a records problem, not a predictions problem. Regarding the gap between now and the policy statement, the file work that carries forward is work anchored to documents that survive: FG22/5, FG21/1, the COBS 9 suitability rules, PRIN 2A. Consultation text moves; the evidence structure underneath it holds.

Three records do the heavy lifting in every version of the regime. First, a dated review trail — the ongoing service tracker showing when each review fell due and when it happened, the record TR24/1 para 1.40 addresses. Second, a versioned scoring rubric — when the policy statement amends guidance text, the firm shows which rubric version scored which file, and the change is auditable. Third, a human sign-off line — the AI scores, the adviser or compliance officer decides, and the file records the decision.

I built Proven Duty's rubric versioning for exactly this moment: rules move, evidence anchors stay, and the scoring logic needs a dated trail. Files written against the current rules, with dated citations, need the smallest edit when the new text lands.

Prepared files are edited by a policy statement; unprepared files are rewritten by one. (Source: FCA CP26/23)

About the Author: Nick Thorp is the founder of Proven Duty, built AI compliance tooling for UK advice firms, and writes about what Consumer Duty means at file level.