The regulatory drift problem, and why most AIM websites are already non-compliant

On 4 March 2026, the Financial Conduct Authority fined John Wood Group £12,993,700 for publishing inaccurate information in its full year 2022, full year 2023 and half year 2024 results announcements. The FCA opened the investigation in June 2025 and concluded it in nine months. Without the 30 per cent early settlement discount the fine would have been £18,562,500. The deterrence multiplier was set at five. In its final notice, the FCA went out of its way to observe that Wood Group should have learned from the Carillion notice published years earlier and should have asked whether similar risks were sitting in its own business. It had not.

I want to write about something quieter than that, but related. The Wood Group case sits at one end of a spectrum that has the obvious, public, expensive disasters at one end, and a much less visible problem at the other. The less visible problem is what I have come to call regulatory drift, and it is the most widespread compliance failure in the small AIM and small Main Market segments today. It is not fraud. It is not aggressive accounting. It is the slow, almost passive, sliding-out-of-compliance of issuers whose website disclosures were once correct and are not now, and whose company secretaries are not necessarily aware that anything has changed.

This piece is about what that drift looks like from the outside, why I think it matters, and what the relationship is between the drift you can see on a website and the drift you cannot see anywhere else.

What I have actually been looking at

For the last few months I have been auditing AIM and small Main Market issuer websites against the disclosures they are required to publish. Rule 26 is the headline framework on AIM. On the Main Market, the obligations are scattered across the FCA Disclosure Guidance and Transparency Rules, the UK Listing Rules, and the UK Market Abuse Regulation. Beyond those, every UK listed company of meaningful size is also subject to the Modern Slavery Act, gender pay gap reporting, Streamlined Energy and Carbon Reporting, the section 172 reporting duty, and the rising baseline of accessibility expectations under WCAG 2.2. Most of these obligations include a website element, and that website element is the part that decays first.

I have been looking at roughly forty issuer sites in detail, ranging from £3 million resources micro-caps to family-controlled Main Market companies with capitalisations approaching £1 billion. I have not been looking for fraud. I have been looking for whether the website does what the rules say it should.

The pattern is consistent enough that it is worth describing properly.

What drift looks like in practice

The single most common failure I see is on the significant shareholders requirement under Rule 26. The rule asks AIM companies to publish, and to keep current to within six months, the identity of shareholders holding three per cent or more of the company. It is a fundamental disclosure. It tells investors who actually owns the issuer. And it is breached at scale.

Three small examples make the point. I will describe them anonymously because the purpose here is the pattern, not the individual companies.

A roughly £8 million AIM resources company headquartered in Bermuda, operating in Indonesia, has a Rule 26 page that opens with the line "the following information is being disclosed for the purpose of AIM Rule 26 (information as of 20 August 2023)". At the time of audit, that was over two and a half years stale. There was no second timestamp on the linked significant shareholders page. The chosen corporate governance code, which has been a Rule 26 requirement since September 2018, was not named on the page itself.

A roughly £3 million AIM oil and gas explorer with assets in Bolivia, Ghana and Chad has a Rule 26 page that states "last updated 6th February 2025". At the time of audit, that page had not been touched in over fourteen months. The corporate governance code is not named on the page. The Nominated Adviser is not on the page. The WordPress theme dates from 2019.

A roughly £7 million AIM oil and gas company with operations in Georgia has a Rule 26 page with no "last updated" date anywhere on the page. The page is essentially a hyperlink index rather than substantive content. The chosen corporate governance code is not named.

Take any of those three at face value. None of them is fraud. None of them is going to attract an FCA investigation tomorrow. But all three are, on a strict reading, in breach of Rule 26 right now. The Nominated Adviser is supposed to police compliance with the AIM Rules. The Rule 26 page is the most visible, most easily checked, most permanent record of an issuer's compliance discipline. Letting it run two or three or six years out of date is a strange place to be.

This is what regulatory drift looks like. Not a single dramatic failure. Many small, observable, slow ones.

The deregulation pass made it sharper, not gentler

If you have been reading the legal trade press over the winter you will have seen the November 2025 LSE Feedback Statement, "Shaping the Future of AIM". It is the most significant deregulatory shift the AIM rulebook has had in years. The LSE has indicated it will permit dual class share structures for AIM companies. It will remove the requirement for nominated advisers to provide a "fair and reasonable" view on certain elements of director remuneration. It will raise the substantial transaction class test threshold from ten per cent to twenty five per cent. It is reviewing whether AIM Rule 11, the general disclosure rule, can be removed altogether on the basis that it duplicates Article 17 of the UK Market Abuse Regulation.

The direction of travel is clearly toward proportionality, caveat emptor, and a "growth market" identity that distinguishes AIM from the Main Market. Many of the changes are sensible. The Nomad role is being explicitly repositioned away from compliance officer and back toward strategic adviser.

What is interesting, though, is what the deregulation pass did not touch. Rule 26 is unchanged. The website is still the central, public, persistent record of an AIM issuer's compliance with the rules. The six-month significant shareholders update is unchanged. The chosen corporate governance code disclosure is unchanged. The annual accounts retention requirement is unchanged. The five-year MAR notification archive is unchanged.

In other words, when the LSE went through the rulebook with a deregulatory eye, the website obligations are the obligations they left in place.

That is a reasonable signal of where the floor sits.

Why the drift is worse than it looks

The deeper point I want to make is not about Rule 26 specifically. It is about what regulatory drift on the website tells you about everything else.

The website is the easiest disclosure surface area to maintain, the cheapest to fix, and the most visible to investors, regulators and the Nomad alike. It is also the disclosure surface area that the Company Secretary has the most direct control over, with the lowest cost of remediation. If a company's website has not been updated since 2022, it is not because the maintenance cost of doing so was prohibitive. It is because no one was watching, no one had a process, and the nominal owner of the disclosure was not aware they had drifted.

That is the leading indicator. If the easy, visible, cheap part of the disclosure stack has slipped without anyone noticing, what is the probability that the harder, more technical, less visible parts are pristine? The five-year MAR notifications archive. The substantive content of the annual report's section 172 statement. The Modern Slavery Act statement that has been sitting on the homepage in unchanged form since 2019 despite a transformed supply chain. The DTR 4 ten year retention horizon for annual reports. The accessibility statement that nobody has ever genuinely tested against WCAG 2.2.

The Wood Group case is instructive here. Read in one way, it is about misleading project accounting in a complex engineering business. Read in another way, it is the FCA observing that the company had inadequate systems, controls and procedures to prevent the misleading disclosures from being released to the market. That second framing is what should worry company secretaries everywhere. The substantive failure was an accounting failure. The regulatory failure was a controls failure. Controls failures begin somewhere small and grow.

The fact that Wood Group was held by the FCA to a standard of "you should have asked the same question Carillion's collapse should have prompted you to ask" is the part most issuers are missing. The same question, scaled to a small AIM resources company, is: have you asked whether your own systems for keeping the website disclosures current actually work?

Most have not. The evidence sits in plain text on the Rule 26 page.

What I think happens next

Three things, in order of likelihood.

First, the FCA continues to accelerate. The Wood Group investigation closed in nine months. The Carillion investigation took over eight years. The FCA's Market Oversight Data and Intelligence department, established in 2024 and operational from mid-2025, is genuinely capable of detecting late MAR Article 17 disclosures, late DTR 5 notifications, and closed-period dealings algorithmically. The Sebők case in November 2024, where a Wizz Air director was fined £123,500 for trading in a closed period, was the first case of its kind and was triggered by exactly that kind of automated detection. There will be more.

Second, the LSE continues to deregulate, and Rule 26 stays. The H1 2026 consultation will produce a redrafted AIM Rules for Companies and AIM Rules for Nominated Advisers. The Rule 11 general disclosure obligation may go. The substantial transaction threshold will rise. None of that touches Rule 26. Rule 26 is the obligation the issuer publishes against, not the obligation the Nomad polices on the issuer's behalf. It is the obligation the LSE has the strongest reason to keep, because it is the public-facing one.

Third, the small issuers who quietly fix their drift now will be in a better position than the small issuers who do not. This is not a new observation, and it is not a fashionable one. But it is true. The cost of fixing a Rule 26 page once is small. The cost of fixing every disclosure surface area on a serious website rebuild is meaningful but bounded, somewhere between £15,000 and £50,000 for the AIM and small Main Market segments. The cost of an LSE disciplinary notice is reputational rather than financial. The cost of an FCA investigation is the Wood Group cost. The cost of a private censure that nobody hears about, but that the Nomad knows about and the next Nomad transition hears about, is structural.

The unfashionable truth is that the AIM issuers who are quietly disciplined about disclosure will be the ones who survive the next ten years on AIM. AIM has shrunk to its lowest population since 2001. The companies surviving the shrinkage are not the ones avoiding regulation. They are the ones treating disclosure as a feature of running a public company, not an overhead.

What I think you should do

If you are a company secretary, a CFO, or a Nomad adviser reading this, three concrete suggestions.

The first is the cheapest. Open your own Rule 26 page right now. Find the date. If it is more than six months old, it is by definition out of compliance with the significant shareholders refresh requirement. Diary a six-monthly review. Put it in your AGM cycle. Put it in the company secretary's job description. Make it ordinary.

The second is the most useful. Ask whether the website is actually doing the job the AIM Rules and the DTRs ask it to do. Are the annual reports back ten years on the Main Market, or three years on AIM? Is the chosen corporate governance code clearly named and applied? Is the Modern Slavery statement linked from the homepage? Does the accessibility statement exist, has it been tested, and was it tested in this decade? An audit of these against the rulebook costs less than most issuers' AGM catering budget.

The third is the longest horizon. Ask whether your IR website is doing anything for your share price, beyond the bare minimum of compliance. The point of an IR website is not to satisfy Rule 26. The point of Rule 26 is to set a floor below which an IR website is not allowed to fall. The interesting question, for any board or company secretary who cares about share register quality and analyst coverage, is what the website is doing above the floor.

That is a different conversation. It is the one that actually moves the share price.

But you have to be on the right side of the floor first.

David Ville is the founder of Actually AI, a Birmingham-based consultancy that builds and maintains compliance-grade IR websites for AIM and Main Market issuers. The Listed practice is one of two strands of the firm. The other is AI strategy and digital infrastructure for UK SMEs.

If you have read this far and want to know whether your own Rule 26 page sits on the right or wrong side of the floor, the contact page is one click away.