Hello Tim
You are absolutely right – this is for registered providers and I am not sure if it has been implemented yet. The act of parliament (2023) allows the regulator to impose the requirements but does not compel the regulator to do so:
https://www.legislation.gov.uk/ukpga/2023/36/section/21