See the risk landscape
before it shifts.

Firms that vet audit engagement partners and incoming audit staff should add Zimbabwe to the jurisdictions whose qualifications can carry UK audit rights, so screening does not reject a valid recognition route or pass one it cannot evidence. Supplier due diligence records on audit providers should capture the recognition basis for each signing partner, not just the country of qualification.

Treasury and ALM teams should re-test gilt supply and collateral assumptions against the Governor's statement that the Bank intends to run the remaining unwind through sales to the Government rather than to the market, with operational detail due by April 2027. Repo pricing and liquidity buffer models built on market-facing APF sales need revisiting before that announcement lands.

Asset management arms preparing 2027 reports should build evidence of how they monitor and challenge outsourced managers and service providers, which is where the FRC says reporting is thinnest. The same oversight records feed third-party risk and outsourcing obligations, so the evidence is worth collecting once and used for both.

Treasury and trading desks should re-run concentration limits under the Financial Collateral Comprehensive Method now, because dropping internal models can lift measured intragroup securities financing exposures without any change in underlying risk. Firms relying on existing NCLEG permissions need an application planned for the window opening 1 July 2027 rather than waiting for current permissions to expire.

Cash and valuables held in custody need dual control and periodic independent reconciliation rather than reliance on the custodian's own records, since this offending ran for three years inside the function responsible for safeguarding it. Firms holding client assets or seized items should test whether a single role can both hold and count the same balance.

Firms running self-hosted model serving infrastructure should treat GPUStack instances as credential stores, rotating any cloud provider keys held by workers and auditing administrator API keys created since deployment. Inference platforms belong in the same patch and asset inventory as other internet-facing infrastructure rather than in a separate data science estate.

UK firms with US operations or USD clearing should map the typologies in the FinCEN alert and trend analysis against their own transaction monitoring, since scam centre proceeds typically move through mule accounts into digital assets rather than appearing as a single suspicious payment. The forced labour element also means scam centre exposure is a modern slavery as well as a fraud question, which argues for joining up fraud, AML and human rights reporting lines.

Screening on the primary legal name alone will miss both FZCO trading names, so firms should confirm their list ingestion captured every alias record for this entry and re-screen trade finance and shipping counterparties on the UAE licence and registration numbers as well as the names. The secondary sanctions notice puts non-US entities dealing with the company at risk, so UAE shipping and correspondent exposures deserve a look even where no obvious US nexus exists.

Contact centre and IVR platforms built on FreeSWITCH sit directly alongside customer authentication, so firms should establish the version in use, tighten which SIP peers are accepted, and review call detail records for unexplained transfers or recording activity. Arbitrary call control also weakens any control that treats an inbound call leg as evidence that the genuine customer is on the line.

Managed file transfer platforms usually carry bulk customer and payment files, so firms running Faspex should confirm the deployed version, check whether any account exercised privileges beyond its role, and treat the host as in scope for a data exfiltration review. Where a supplier operates Faspex on the firm's behalf, the version and triage question belongs in the next third-party attestation rather than the annual cycle.