Fraud is becoming more sophisticated, more scalable and harder to detect. As firms strengthen their defences against external threats, a recent Financial Conduct Authority (FCA) case involving £2m in client losses highlights a different vulnerability: trust.
Fraud is often pictured as a remote threat, an anonymous figure operating from overseas, beyond the reach of UK law enforcement. In practice, the person responsible may have an office, a recognised job title and the credibility of a regulated firm behind them.
For boards and senior management, this raises an important question: are firms giving internal fraud risk the same attention as external threats?
What does the recent FCA case tell us about trust and fraud risk?
On 13 October 2026, the FCA announced that two individuals who had worked at financial advice firms pleaded guilty to fraud after four clients lost £2m. The offending took place between January 2019 and January 2023 and involved the use of false documents. One individual also admitted a money laundering offence.
The firms involved were authorised by the FCA. The former had permission to provide investment, mortgage and pension advice, while the latter could provide discretionary fund management services. Neither firm was permitted to hold or control client money.
That distinction matters. Consumers are rightly encouraged to check whether a firm is authorised, and regulatory status remains a key safeguard. Authorisation provides an important regulatory framework, including requirements relating to accountability, systems and controls, supervision and routes to enforcement. However, authorisation does not remove the risk of individual misconduct.
The FCA described the case as a “serious breach of trust”, noting that the clients had relied on the individuals concerned. Clients place confidence not only in institutions, but in the people representing them. For regulated firms, this is what makes the trusted insider such a difficult risk to manage.
The scale of fraud in the UK
Wider data suggest that fraud remains a significant challenge across the UK.
The Office for National Statistics (ONS) estimated 4.5m incidents of fraud in England and Wales in the year ending March 2026. Although the year-on-year change in incidents was not statistically significant, the estimated number of victims increased by 10from 3.4m to 3.8m . [1]
Separately, UK Finance reported £1.28b stolen through payment fraud during 2025, an increase of 4%. The Report Fraud Annual Assessment FY2025/26 recorded more than £3.2b in reported cybercrime and fraud losses.
While these sources measure different populations, they demonstrate the scale of fraud across the UK.
How economic conditions shape fraud risk
Economic conditions can influence the environment in which fraud occurs, although it would be wrong to draw a direct link between economic difficulty and dishonesty. Changes in incentives, behaviours and vulnerabilities are nevertheless relevant considerations when assessing a firm’s exposure to risk.
ONS figures showed annual regular pay growth of 3.5% during May to July 2026. Once adjusted for Consumer Prices Index (CPI) inflation, real regular pay growth was only 0.8%. Meanwhile, the Bank of England held Bank Rate at 3.75% in September 2026, with CPI inflation rising to 3.5% in the same month, and expected to rise further over the following quarters.
These conditions can affect fraud risk in different ways. Consumers concerned about their financial security may be more receptive to fraudulent investment opportunities, while commercial pressures and employee vulnerabilities may also influence a firm’s risk profile.
The role of technology and artificial intelligence
Technology is also changing the fraud landscape. The Report Fraud Annual Assessment highlights a significant increase in reports identifying the use of artificial intelligence during FY2025/26, while acknowledging that the full extent of AI-enabled cybercrime and fraud remains unknown.
AI does not need to invent an entirely new category of financial crime to present a meaningful risk. Its immediate value to fraudsters may be more mundane: making existing methods more convincing and easier to scale. Poorly written phishing messages become plausible correspondence. Impersonation becomes more sophisticated. Fraudulent material can be produced more quickly and cheaply.
Technology has not invented dishonesty. It has simply given dishonesty better grammar.
Yet the focus on cybercrime, synthetic identities and AI should not overshadow a more familiar threat: individuals who already have legitimate access.
Why can internal fraud be difficult to detect?
Financial institutions have invested significantly in identifying abnormal external activity. Unusual transactions, unfamiliar devices, suspicious customers, unexpected payment destinations and anomalous account behaviour are all appropriate areas for monitoring.
But some of the hardest fraud to detect may involve someone who does not initially appear abnormal. They understand the business. They have legitimate credentials. Colleagues recognise them. Customers trust them. They may also know precisely where controls begin and end.
That requires firms to ask a different set of questions:
- Who can materially influence a customer’s financial decisions?
- Where can one individual initiate and influence several stages of the same process?
- Which activities depend heavily on personal trust?
- Where can management override established controls?
- Are longstanding relationships receiving less scrutiny simply because they are longstanding?
- Would someone challenge a trusted or senior colleague if something did not look right?
This is where internal fraud moves beyond transaction monitoring. It becomes a question of governance, accountability and culture.
Are your fraud controls working in practice?
Most firms are not short of policies. Fraud, Financial Crime, AML, whistleblowing, conflicts, personal account dealing and Consumer Duty are all typically covered. These documents matter, but their existence does not establish that the underlying controls work.
The more useful question is not “Do we have a Fraud Policy?” but “Where could fraud actually happen in our business, and how quickly would we know?”
Answering that requires an understanding of the institution’s real operating model, including customer journeys, payment processes, delegated authority, client assets, third-party reliance, employee access, conflicts, management overrides, complaints and whistleblowing. Most importantly, it means identifying where the business depends on someone being trusted without meaningful independent challenge.
How can independent challenge strengthen fraud controls?
For asset and wealth managers, fraud risk can cut across governance, financial crime controls, Consumer Duty, client asset arrangements, operational resilience and third-party oversight. Effective oversight therefore requires an understanding of how these responsibilities interact across the business.
Compliance functions need to understand more than just the applicable rules. They must understand the business model, where authority sits, how money and information move, and where controls rely too heavily on individual judgement.
Independent assurance does not remove fraud risk. Nor should external review become a substitute for management ownership. But informed challenge can identify weak controls and familiar practices that have escaped scrutiny simply because they have become normal.
These questions are not accusations. They are an important part of effective governance, particularly when the answer is “We have always done it this way.”
What does effective fraud resilience look like?
A strong fraud framework cannot guarantee zero fraud. People circumvent controls, technology evolves and criminal methodologies adapt. Trusted individuals occasionally turn out not to deserve that trust. Prevention, while essential, is therefore not enough.
Boards should also ask: If prevention failed tomorrow, how quickly would we know? Within minutes? Hours? At the month end? Or when clients ask where their money has gone?
Where concerns are only identified following a customer complaint, firms may need to consider whether their existing detection arrangements are sufficiently effective.
A mature fraud framework should therefore address four connected capabilities:
- Prevent: Make fraud more difficult to commit.
- Detect: Identify suspicious behaviour and control failures quickly.
- Respond: Contain harm, preserve evidence and escalate effectively.
- Learn: Establish why controls failed and strengthen them.
This is the difference between fraud prevention and fraud resilience.
Balancing trust and verification
Financial services depend on confidence. Clients trust advisers. Investors trust asset managers. Asset managers trust custodians and administrators. Boards trust senior management. Firms trust employees. Remove enough of that trust and financial services becomes slower, more expensive and more defensive.
The answer is not to abandon trust or treat every employee with suspicion. It is to recognise that trust without verification can become a control weakness.
The recent FCA case should therefore prompt boards to consider two questions:
- Where are we most dependent on trust?
- What independently verifies that trust?
Despite better technology, more data and increasingly sophisticated fraud-detection systems, one of financial services’ oldest vulnerabilities remains. The greatest threat is not necessarily the person trying to break through the front door. Sometimes it is the person who already has the keys.
How fscom can help
fscom Compliance Maturity Specialists™ works with asset and wealth managers to assess the effectiveness of their governance, financial crime and client asset control frameworks.
Through independent assurance, compliance advisory and targeted reviews of AML/CTF and Client Assets Sourcebook (CASS) arrangements, we help firms identify control weaknesses, assess how arrangements operate in practice and strengthen oversight and accountability.
Our approach considers not only whether policies and procedures are documented, but also whether controls are appropriately designed, consistently applied and subject to effective independent challenge.
If your firm is reviewing its fraud and financial crime controls, get in touch with our team to discuss how we can support you.
