CFD marketing compliance has been a product argument for seven years. Leverage caps. Risk warnings. Restricted access for retail clients. Every intervention was about the instrument — how much rope a retail trader gets, and what has to be printed beside it.
On 25 September 2026, the FCA moved the argument somewhere else. The press release that landed that morning is not about what CFD firms sell. It is about who they are, and whether a consumer can tell who they are actually dealing with.
What the FCA actually did
The release is short and the numbers are specific. Twenty-one Contracts for Differences firms have closed since 2025 following the crackdown, and three other firms are currently cancelling their permissions — which is where the FCA’s own headline number of twenty-four comes from. Then comes the sentence that explains why:
“The FCA has been challenging CFD firms that carry out little UK business but use their authorisation as a badge to make linked overseas companies look more trustworthy than they really are.”
A badge. That is the regulator’s own noun for it. The authorisation is doing the work of a promise — this firm is UK-regulated, so the consumer gets UK protections — and the FCA’s finding is that the trading was happening through a linked overseas entity where those protections did not apply. In the FCA’s words, this “creates the misleading impression that consumers are dealing directly with a UK-regulated firm and benefit from UK protections when they do not.”
Read the remedies, because they describe the enforcement posture better than the closure count does. Firms have faced “a range of actions, including restricting their trading abilities, requiring independent reviews of their business and opening enforcement investigations in the 2 most serious cases.”
Two are operational. One is existential. And the middle one is the one an agency should read twice.
“Independent reviews of their business” is a records request
An independent review is not a conversation. It is a production exercise. Somebody with no stake in the outcome arrives and asks for the record: which promotion went to which audience, approved by whom, on what date, against which version of the rules, and what the claim said at the moment it was served.
A firm that keeps that record answers in an afternoon. A firm that kept screenshots, a shared drive and the memory of the person who set the campaign up answers in a scramble — and the scramble is the finding.
The Director of sell-side supervision states the intent plainly:
“Consumers need to know exactly who they’re dealing with and what protections they have. When firms blur the lines between their UK-regulated activities and overseas businesses, we will step in. These closures show we’re prepared to take action to protect consumers.”
Three steps, and all three were about identity
The release’s own notes to editors give the sequence, and it is worth reading as a progression rather than as background:
- 2019 — “the FCA restricted the sale of CFDs to retail customers.” The instrument.
- 2024 — “the FCA set out priorities for the CFD sector.” The sector.
- 2025 — “the FCA warned investors in CFDs at risk of losing UK protections through redirection offshore.” The identity.
- 2026 — twenty-four firms closed or cancelling over misuse of authorisation. The identity, enforced.
And the instruction the FCA gives to consumers is an identity instruction, not a product one. It tells them to use the Firm Checker — and, specifically, to check they are “dealing with a UK-authorised firm, and not an overseas firm with a very similar name to a UK firm.” Not “check the leverage.” Not “read the risk warning.” Check who this actually is.
No firm is named in the release, and none is named here. Nothing in this post is a claim about any specific company. The finding is about the regulator’s method, and it applies to whoever is running the spend.
Where an agency actually sits in this
If you run PPC for a forex, CFD or prop-firm brand, you are standing on the exact surface where the identity claim gets made. An ad does not have to say “UK-regulated” to carry the implication. The domain on the landing page, the naming of an entity, the badge in the creative, the Telegram channel the funnel ends in — the ad is what turns a licence into a promise, and it is the agency that puts it in front of a consumer.
This pipeline has spent months documenting the tools that serve those funnels — the Telegram-lane trackers that attribute joins and first-time deposits back to the ad, and the retention language (or absence of it) in the notices around them. The FCA’s crackdown lands on the same funnels with a different question attached: not how many deposits did this ad produce, but who was on the other end of it, and can you show it.
That is a harder question for a spreadsheet than it sounds. Tracking the conversion and being able to reconstruct the decision that produced it are two different products. The first one most of the market already owns. The second one is what an independent review asks for.
The same question, one layer down
Here is the part that is genuinely new for agencies rather than advertisers. The FCA asked who is really behind this brand? The same shape of question is now being asked one layer lower, about the operation: who made this change, on whose account, under which jurisdiction, and what did the value say before and after.
That is not a compliance officer’s hypothetical. It is the state of the category. Every platform that gained a write path this year documented an approval gate or a policy guardrail and made at least one of them configurable — a menu with an off position, a retention window sold by the day, a change journal that files the work under the account owner. We have written about each of those, and each one is real. What none of them produces by default is the artefact an independent reviewer would ask for: a row naming a person, a time, a change, and an engagement.
Note also what enforcement actually runs on. Documents. “We believe” is not a defence; “here is the record” is.
2027: the supervisor puts AI on the list
Two days before the CFD release, on 23 September, ESMA set a new Union Strategic Supervisory Priority on digital innovation from 2027. Its initial focus is stated directly: “how supervised entities use artificial intelligence and tokenisation,” with the authority noting it will keep addressing challenges “including those emerging from advanced models such as frontier AI.”
Put the two together and the direction is unambiguous. The UK regulator used the last week of September to announce more closures of firms whoseidentity was unclear. The EU regulator has announced that how supervised firms use AI becomes a supervisory priority — which means the agent that makes the change is now inside the perimeter too, not just the human who signed the account up.
None of that creates a record by itself. It just means the record stops being optional.
What a defensible record has to answer
If an independent reviewer, a client, or a regulator asks about one decision months after it happened, a record that resolves it has to carry five things. Not vibes — fields:
- Who. The named person — or the named agent, identified as such — that made or approved the change. Not “the team.”
- When. A timestamp on the change itself, not only on the campaign’s creation.
- What. The value before and the value after. A description of an intent is not a record of a change.
- Which object. The specific campaign, ad set, creative or budget it touched — and which client engagement it belonged to.
- Which rulebook. The jurisdiction or regulatory regime the change was made under, so the claim can be tested against the rules as they stood that day.
Two properties matter as much as the fields. The record has to be exportable — a record you can only look at through someone else’s interface is a screen, not evidence. And it has to be stored independently of the platform that accepted the change, because an enforcement action is exactly the situation in which your access to that platform is the thing at risk.
Where Ott sits, and what we won’t claim
This is the layer Ott exists for, so it is fair to say where it fits — and where it does not.
- Activity Logging records four fields on every operation — the timestamp, the actor, the value before and after, and the linked object — and stores them independently of the ad platform, so the record outlives the account that accepted the change. It covers Meta today; Google Ads is on the roadmap, and we would rather say that than let you discover it.
- Client scope files each change against the brand it belongs to, so the record is read per client rather than per ad account.
- Telegram conversion tracking closes the funnel that this sector actually runs, attributing joins and first-time deposits back to the ad. It is in the Agency tier — it is not included on Starter.
For completeness: the FCA’s own data-protection and register surfaces are separate questions from any of this, and the EU AI Act deployer duties that apply to agencies running agents on client accounts are a different piece of the same story. The 25 September release is narrower and sharper: one regulator, one sector, one failing, twenty-one firms closed and three more cancelling.
The badge problem and the record problem are the same problem
Twenty-one firms closed, and three more are cancelling, because a consumer could not tell who they were dealing with. That is a failure of verifiable identity at the front of the funnel — the part of the funnel the agency operates.
When the reviewer arrives, the equivalent question about your operation is whether you can tell who did what. The answer to that is a row, not a memory, and it is worth having before anyone asks for it. Regulators do not typically announce the review in advance; they announce the closures afterwards.