The Cost of Non-Compliance: What Regulators Actually Imposed in 2026

Business cases for compliance training routinely include an avoided-fines figure, and it is almost always invented. The honest alternative is to look at what regulators actually imposed, and in 2026 the published record points somewhere most training proposals do not: at individuals.

The FCA in 2026: £19.8m, and almost all of it personal

The FCA publishes its fines as they are issued. As at the time of writing it had published 19 fines in 2026 totalling £19,832,006.

The striking feature is the split. Only two of the nineteen were against firms:

• £12,993,700 against a listed engineering group on 3 March 2026, for breaches of the Listing Rules and Listing Principle 1 concerning misleading information
• £338,000 against a merchant bank on 24 March 2026, for breaches of the Market Abuse Regulation, Principle 3 and SYSC relating to market abuse controls

The remaining seventeen were against individuals. The largest personal penalty was £2,037,892, for breach of Statement of Principle 1. Three further penalties related to the Carillion collapse, for knowing concern in market abuse and listing rule breaches.

Read the grounds rather than the names and a pattern emerges. The individual penalties cite Individual Conduct Rule 1 (integrity), APER Principles 1, 2, 6 and 7, COCON 2.1.1 (due skill, care and diligence) and the Fit and Proper test. Those are competence and conduct provisions, and most were accompanied by a prohibition order — which removes the person’s livelihood in regulated financial services, and is a cost no fine captures.

The smallest fines are worth noting too: £16,046 for breaches of APER Principles 1 and 7, and £20,000 for a COCON breach concerning due skill, care and diligence, with partial prohibition. There is no floor below which conduct failures are uneconomic to pursue.

What this means for a business case

If you are building a training case in financial services, the defensible argument is not that training prevents a corporate fine. On 2026’s record, corporate fines are rare and concentrated in disclosure and market abuse controls. The defensible argument is that the regime holds named individuals personally liable for integrity, skill, care and diligence, and that senior managers face prohibition as well as penalty.

That reframes the audience for the proposal. It is not a cost borne by the entity in the abstract — it is a personal exposure held by the people approving the budget.

CQC: small fixed penalties, unlimited fines on conviction

Health and social care works differently, with a two-tier structure.

CQC can impose fixed penalties directly:

• Breaching quality and safety rules (Regulation 22): £4,000 for the provider, £2,000 for the registered manager
• Carrying on a regulated activity without registration: £4,000
• Breaching registration conditions: £4,000 provider, £2,000 registered manager
• Missing required notifications (Regulations 14 to 18): £1,250 provider, £625 registered manager
• Failing to provide an updated statement of purpose (Regulation 12): £1,250 provider, £625 registered manager
• Obstructing entry and inspection, or failing to provide documents or an explanation: £300

On prosecution the picture changes entirely. Fines are unlimited on conviction for breaching quality and safety rules, carrying on an activity without registration, breaching registration conditions, offences relating to suspension or cancellation, and false descriptions of concerns. Carrying on an unregistered activity also carries up to 12 months.

Lesser offences are capped: £2,500 for false statements in applications, obstruction or failing to provide information, and £100 for failing to display a performance assessment.

The useful observation for a provider is the asymmetry. Administrative failures — late notifications, an out-of-date statement of purpose — carry modest fixed penalties, and the registered manager is personally liable at half the provider’s rate. Quality and safety failures carry no ceiling at all.

The costs that never appear in the fine

Three consequences do more damage than the penalty and are entirely absent from the published figures.

Prohibition and personal liability. Most FCA individual actions in 2026 came with a prohibition order. For a registered manager, CQC’s fixed penalties attach to the individual as well as the organisation.

Remediation under supervision. Reconstructing records retrospectively, under a deadline set by someone else, consumes senior compliance and clinical time at exactly the moment it is least available.

Conditions and restrictions. A regulator can constrain what a firm or individual is permitted to do. The SRA, for example, imposed conditions on 10 solicitors in 2024 who did not give the assurance that they had reflected on their practice and addressed their learning needs — a competence declaration, enforced.

How to use these figures honestly

Cite the regulator’s own published record with the date, as above. Do not extrapolate a probability of being fined from a sector total; nineteen fines across a sector of thousands of firms supports no such calculation. Do not present a corporate fine as the risk a training programme mitigates when the published record shows the exposure falling mainly on individuals for conduct and competence breaches.

And be specific about what the training actually addresses. “Our senior managers are personally exposed under COCON for due skill, care and diligence, and we cannot currently evidence their competence assessment” is a sentence with a named rule, a named risk and a named gap behind it. Our guide to building the business case for compliance training sets out the four costs that can be quantified, and our guide to CQC training records covers the evidence a provider must be able to produce. Our CPD course library covers the training itself.

Frequently asked questions

How much did the FCA fine firms in 2026?

Of the 19 fines totalling £19,832,006 published in 2026, only two were against firms: £12,993,700 for Listing Rules and Listing Principle 1 breaches concerning misleading information, and £338,000 for Market Abuse Regulation, Principle 3 and SYSC breaches on market abuse controls.

Are individuals fined more often than firms?

On the 2026 published record, substantially. Seventeen of nineteen fines were against individuals, most commonly for breaches of Individual Conduct Rule 1 on integrity, APER principles, COCON 2.1.1 on due skill, care and diligence, and the Fit and Proper test — usually with a prohibition order alongside.

What is the maximum CQC fine?

There is no maximum on conviction for the more serious offences. Fines are unlimited for breaching quality and safety rules, operating without registration, breaching registration conditions and offences relating to suspension or cancellation. Fixed penalties CQC imposes directly are much smaller, from £300 to £4,000.

Can a registered manager be fined personally?

Yes. CQC’s fixed penalties specify separate amounts for the registered manager — generally half the provider’s figure, such as £2,000 against £4,000 for quality and safety breaches and £625 against £1,250 for notification failures.

Can I use a sector fine total to estimate our exposure?

No. A total across a sector of thousands of firms does not support a per-firm probability, and a business case built on one will not survive scrutiny. Use the rules you cannot currently evidence compliance with instead.