Global Regulation Tomorrow

On 26 October, the Financial Conduct Authority (FCA) published the results of its multi-firm review into how small-medium sized enterprises (SMEs) in the defence sector currently experience banking services and whether banks could improve their understanding and decision-making.

Background

The FCA set out that it has been exploring how SMEs in the defence sector currently experience banking services and whether firms could improve their understanding and decision-making. The FCA highlights that there is no regulatory barrier preventing banks from supporting lawful defence businesses, but nonetheless some defence SMEs have found the process of opening a bank account to be unnecessarily long and complex.

Summary

The FCA set out the following key findings from its review:

• Most banks are open to supporting defence SMEs: Most firms said they are willing to serve defence SMEs and are taking steps to better understand the sector through specialist teams, relationship managers, training and governance arrangements. While firms can set their own risk appetite and commercial strategy, decisions to refuse services, restrict access or close accounts should be based on reasonable, proportionate and consistently applied grounds. Reputational and sustainability considerations may play a role, but firms must be able to justify their decisions.

• The evidence points to friction and delay, not widespread exclusion: The review found little evidence of widespread exclusion. Instead, defence SMEs often face longer onboarding and approval processes due to enhanced due diligence and additional governance requirements linked to financial crime, reputational, ESG, supply chain and other risk considerations. These delays can have significant commercial consequences. Firms should minimise unnecessary friction, maintain proportionate controls and keep applicants informed about progress and expected timescales where possible.

• Defence is not a single risk: The defence sector encompasses a wide range of businesses, from software and logistics to dual-use technologies and weapons manufacturing. Risks vary considerably depending on activities, products, markets and supply chains. Firms should avoid treating all defence businesses alike and instead adopt tailored, risk-based approaches. Broad exclusions should be justified, and controls should reflect the nature, scale and complexity of the risks involved.

• Reputational and ESG-related considerations should be clear: Stakeholders reported that defence businesses can still face negative perceptions despite changes in government policy and the geopolitical environment. The FCA emphasises that its sustainability rules do not prevent firms from serving defence customers. Where reputational or ESG considerations influence decisions, firms should define them clearly, apply them consistently and support them through appropriate governance.

• Firms do not always have a clear picture of their defence customers: Defence activities are often difficult to identify using existing classifications such as SIC codes. Firms should improve their ability to identify and monitor defence SMEs to assess whether policies operate effectively and customers are treated fairly.

• Better information can support stronger oversight: Many firms lack management information on outcomes for defence SMEs. Better data would help firms monitor consistency, identify potential process weaknesses and ensure decisions align with their risk appetite and governance frameworks.

Next steps

The FCA makes clear that it expects firms to review their processes and practices to ensure they are taking a risk-based and proportionate approach to SMEs in defence, and that their assessments reflect only the risk factors relating to each specific customer. That said, the FCA also states that this report only reflects pre-existing regulatory requirements, firms should treat it as a ‘point in time’ publication and can consider it retired by December 2028 (if not removed sooner).