AML / Financial Crime in United Kingdom

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-26

Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.

2028-12-01

The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.

Suggested considerations

• Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
• Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
• Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
• Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
• Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
• Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
• Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
• Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.

What changed

No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks.

Key dates

2026-04-21

Voluntary restrictions were imposed on Kingscrown Finance Ltd.

2026-09-25

Further voluntary restrictions were imposed on Kingscrown Finance Ltd, including limits on receiving payments from existing customers and an orderly wind-down requirement.

2026-10-07

Voluntary restrictions were imposed on MOMSB Ltd and Momentus Capital Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-09

Voluntary restrictions were imposed on Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-15

Voluntary restrictions were imposed on Abbital Ltd, including specified conditions for taking on customers, entering into lending arrangements and accepting payments, together with an independent review of its AML systems and controls.

2026-10-23

The FCA announced the restrictions and reiterated its enhanced oversight of Annex 1 firms and due-diligence expectations for regulated firms dealing with them.

Suggested considerations

• Annex 1 firms should consider reviewing their business-wide AML risk assessment, customer and beneficial-owner due diligence, ongoing monitoring, suspicious-activity escalation, governance, management information, resourcing and independent-testing arrangements against the Money Laundering Regulations 2017.
• Annex 1 firms seeking registration or under FCA assessment should consider ensuring that policies and controls are tailored to their actual lending activities, customer base, delivery channels and growth plans, rather than relying on generic or group-level documentation.
• The six named firms should consider mapping their operational processes, customer communications, payment arrangements and lending activity to the precise terms of their voluntary restrictions and preserving evidence of compliance with those terms.
• FCA-authorised firms should consider identifying all Annex 1 counterparties and refreshing onboarding and periodic-review procedures to obtain direct confirmation of registration, conduct independent verification, understand the counterparty's business model and assess whether its AML controls create heightened relationship risk.
• Regulated firms should consider recording the rationale for accepting, continuing or restricting relationships with Annex 1 firms and escalating discrepancies between a firm's registered activities, actual activities, ownership, governance or AML framework.
• Groups with multiple Annex 1 entities should consider documenting entity-specific risk assessments and controls, since group-wide or off-the-shelf procedures may not demonstrate that each entity manages its own risks effectively.
• Lenders and their service providers should consider contingency arrangements for restricted firms, including payment handling, loan-book servicing, customer communications and orderly wind-down scenarios.

What changed

Kingscrown Finance Ltd is subject to restrictions limiting how it may receive payments from existing customers and requiring an orderly wind-down of its existing loan book. MOMSB Ltd, Momentus Capital Ltd, Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd are restricted from taking on new customers or entering into new lending arrangements, subject to the specified exceptions; restrictions also apply to accepting payments from existing customers, and the firms must obtain independent reviews of their AML frameworks.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-10-13

The FCA and NCA arrested three suspects, searched five residential premises in London and Manchester, and seized more than 30 mobile phones, laptops and tablets in an ongoing investigation.

Suggested considerations

• Compliance teams may wish to review whether market-abuse surveillance covers relevant instruments, trading venues, employee dealing, client orders, communications and potential information-sharing networks, with risk-based scenarios for insider dealing and manipulation.
• Firms should consider testing escalation procedures for suspected inside information, including preservation of communications and devices, prompt investigation, documented decision-making and submission of suspicious transaction and order reports where required.
• Firms subject to UK anti-money-laundering requirements may wish to assess whether insider-dealing alerts are linked to customer due diligence, transaction monitoring, suspicious activity reporting and source-of-funds or source-of-wealth reviews.
• Senior management and control functions may wish to confirm that restricted lists, wall-crossing procedures, information barriers, personal-account dealing controls, conflicts controls and staff training remain appropriate for organised or externally coordinated threats.
• Firms may wish to ensure that surveillance records, alert rationales, investigation files and relevant electronic communications can be retrieved promptly if the FCA requests information or conducts an enforcement investigation.
• Relevant firms should consider reminding employees and connected persons that disclosing or using inside information, recommending transactions, or encouraging others to trade can create criminal and regulatory exposure; any communication should avoid implying that the arrested individuals have been charged or found guilty.

What changed

No new obligation, rule, threshold or compliance deadline was introduced. The publication announces an ongoing criminal investigation involving arrests, searches and evidence seizures, and confirms that the FCA is using its market-abuse and financial-crime enforcement powers jointly with the NCA. The FCA reported four insider-dealing convictions in 2025/26, including two cases producing combined prison sentences of 11 years, and fines totalling £1.77 million imposed on 12 people for insider dealing, market manipulation and misleading statements.

Key dates

2023-01-01

The Economic Crime and Corporate Transparency Act 2023 received Royal Assent during 2023; its voluntary information-sharing provisions are identified by the FCA as a potential mechanism for firms to share information concerning economic crime. The specific commencement date for any relevant provision should be verified against the applicable commencement instruments.

2025-01-01

Cifas introduced a dedicated funds received for money muling filing category and revised filing criteria and guidance, making 2025 filing data not directly comparable with 2023 and 2024. The date is stated as January 2025 rather than a specific day.

2026-09-23

The FCA published its multi-firm review on money-mule activity and cashing out findings.

Suggested considerations

• Firms should consider refreshing their business-wide and customer-risk assessments to reflect mule-chain activity, including the concentration of cashing out between the second and fifth accounts and the higher concentration at the second account.
• Compliance and fraud teams may wish to test whether transaction-monitoring scenarios identify linked accounts, repeated use of accounts across fraud types, rapid onward transfers, fragmented card spending, international destinations and higher-value crypto-related cash-outs.
• Firms should consider reviewing controls across the full payment chain rather than focusing only on the first account receiving suspected fraud proceeds, including internal account link analysis and escalation between fraud, AML and investigations teams.
• Banks, payment institutions and EMIs may wish to compare detection and response performance by account tenure, customer type and channel, noting that 74.1% of EMI closures and 56.9% of PI closures in the survey occurred within six months of account opening.
• Firms should consider assessing whether their use of the National Fraud Database is effective and whether suspected cases meet the applicable Cifas evidential and category criteria; the FCA data should not be interpreted as requiring Cifas filings to equal account closures.
• Firms should consider whether the Economic Crime and Corporate Transparency Act 2023 information-sharing provisions can lawfully support prevention, detection or investigation of linked mule activity, with appropriate governance, records and data-protection controls.
• MLROs and nominated officers may wish to prepare for the further FCA and National Economic Crime Centre alert and retain evidence showing how the review findings were considered and, where appropriate, incorporated into control enhancements.

What changed

The FCA has provided new supervisory findings on the scale, profile and mechanics of money-mule activity based on a survey of 35 firms and analysis by a 22-firm public-private cell covering 140 cases across seven fraud types. It expects firms to use the findings in their own money-mule risk assessments and to review and strengthen controls for detecting, preventing and disrupting mule activity.

Key dates

2026-03-18

The FCA opened its call for input on whether FCA regulation affects SME access to finance.

2026-06-30

The FCA completed the call for input during Q2 2026.

2026-09-17

The FCA published Feedback Statement FS26/2: Supporting SME access to finance.

Suggested considerations

• Compliance teams may wish to record that FS26/2 is a feedback statement rather than a rule change and does not itself require immediate changes to policies, systems or customer communications.
• Consumer-credit lenders may wish to map products involving sole traders and small partnerships against the £25,000 scope threshold and monitor HMT and FCA consultations on the reformed Consumer Credit Act framework.
• Lenders may wish to review repeated customer-information requests, broker-to-lender information flows, declined-application explanations and referral or signposting arrangements to identify avoidable SME application friction.
• Banks, building societies, lenders and brokers may wish to monitor the development of the voluntary UK Finance digital-verification service and assess whether proposed reliance models preserve customer due diligence, anti-money-laundering and other financial-crime obligations.
• Lenders and brokers may wish to review commission arrangements, product governance and disclosures where remuneration could influence referrals of micro-SMEs to high-cost or short-term alternative lending, even where the relevant lending or broker activity is outside the FCA perimeter.
• Accredited Growth Guarantee Scheme lenders may wish to monitor the mandatory code of conduct on personal guarantees and prepare to evidence clear communications and fair and transparent use of guarantees once applicable.
• Open-finance, data and lending businesses may wish to monitor the FCA discussion paper planned for early 2027 and the Government’s planned 2027 consultation, particularly on consent, data access, interoperability, customer authentication and financial-crime controls.
• Firms serving asset-light, newer, regional or underserved SMEs may wish to assess whether underwriting data, product design and application processes adequately address limited trading histories, intangible assets and restricted collateral.

What changed

FS26/2 introduces no new rules, reporting requirements, permissions or implementation deadlines. The FCA will monitor industry work on voluntary digital verification to reduce duplicated customer checks while preserving effective financial-crime controls and firms’ existing legal and regulatory obligations. It will support a more proportionate consumer-credit regime as part of Consumer Credit Act reform, including future consultation on FCA Handbook rules replacing or recasting certain statutory requirements.

Key dates

2016-01-01

The period began during which the FCA found that the investor-visa scheme operated; the exact start date is not specified in the publication.

2019-01-01

The period ended during which the FCA found that the scheme operated; the exact end date is not specified in the publication.

2021-03-12

The FCA imposed restrictions preventing Dolfin from carrying on regulated activities, following concerns including its operation of the investor-visa funding scheme.

2021-06-01

Dolfin entered special administration; the exact date in June is not specified in the publication.

2022-02-17

The Home Office closed the Tier 1 investor visa route of entry to the UK.

2026-08-26

The FCA published the enforcement announcement concerning the bans, fines and Joukovski Decision Notice.

Suggested considerations

• Compliance teams may wish to review whether any product or client arrangement could create a misleading impression that a regulatory, immigration or other statutory investment threshold has been met when the client’s own qualifying capital is materially lower.
• Firms should consider testing the end-to-end governance of immigration-linked investment business, including approval of the business model, ownership and control disclosures, conflicts management, introducer due diligence, fee flows and oversight of connected or offshore entities.
• Firms may wish to reassess source-of-funds and source-of-wealth controls where client investments are supported by loans, circular funding, guarantees or funds provided by affiliated entities, and document why the resulting structure is consistent with the relevant immigration and financial-services requirements.
• Senior managers and boards should consider whether regulatory submissions, notifications and attestations fully disclose shadow directorships, controllers, beneficial ownership, related-party involvement and the true commercial purpose of client arrangements.
• Firms should consider conducting targeted reviews of historical investor-visa or residence-by-investment clients, including communications and files supplied to regulators or other public authorities, and escalating any potentially misleading statement or omission through the appropriate remediation and notification processes.
• Training and surveillance may be reviewed to ensure staff understand that conduct outside the core regulated service, including assistance with immigration-rule circumvention, can affect the firm’s and individuals’ integrity, fitness and propriety.
• Where third-party immigration agents or introducers are used, firms may wish to assess their incentives, remuneration, representations to clients, due-diligence records and ongoing monitoring, particularly where fees are unusually high or linked to visa approval.

What changed

This is a final enforcement outcome for Nagy and Maraj, not a new generally applicable rule or supervisory requirement. Both were prohibited from performing any function in relation to regulated activities; Nagy’s discounted penalty was £324,800, compared with an undiscounted £464,000, and Maraj’s discounted penalty was £122,000, compared with an undiscounted £174,300. Joukovski was issued a Decision Notice proposing a prohibition order, but the proposed action has no effect pending the Upper Tribunal’s determination.

Key dates

2021-01-01

The FCA’s permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect under COBS 4.14.

2026-01-01

The UK regime regulating offers of securities to the public came into force under the Public Offers and Admissions to Trading Regulations 2024.

2026-07-16

Robert Goodhew and Andrew Stoneman of Kroll Advisory were appointed joint administrators of Woodville Consultants Ltd.

2026-08-20

The FCA publication was updated and warned consumers and market participants about risky mini-bonds, loan notes and related financial promotions.

Suggested considerations

• Compliance teams should inventory current and proposed promotions, introducer arrangements and distribution channels involving loan notes, mini-bonds, litigation funding, private credit or other potentially speculative illiquid securities.
• Firms should document the classification analysis under FCA COBS 4.14, including whether the security is speculative and illiquid, whether it is excluded from the restriction, and the precise exemption relied upon for any retail communication.
• Authorised firms should verify that every financial promotion is made or approved within the firm’s permission and competence, is fair, clear and not misleading under FCA Principle 7 and COBS 4, and contains sufficiently prominent explanations of capital-loss, liquidity, issuer-default and compensation-scheme risks.
• Firms should not rely solely on an investor’s self-certification as a high-net-worth or sophisticated investor; compliance teams may wish to test the basis, timing, wording and evidence for each investor-status declaration against the applicable Financial Promotion Order exemptions.
• Banks, payment firms and professional intermediaries should consider enhanced onboarding and transaction-monitoring controls for unusual high-yield investment flows, unexplained introducer commissions, overseas exchange references, trust structures and claims of FCA-regulated involvement that may create a misleading halo effect.
• Distribution agreements should clearly identify fees, commissions, conflicts and the party responsible for the promotion, with controls to prevent unauthorised introducers from soliciting UK retail investors or passing them to unauthorised issuers.
• Firms should assess whether a proposed public offer engages the Public Offers and Admissions to Trading Regulations 2024 and related FCA requirements, while treating that assessment as separate from financial-promotion, authorisation, conduct and investor-protection analysis.
• Relevant firms and professional intermediaries should retain evidence of due diligence, approvals, investor categorisation, risk disclosures, payment flows and complaints handling, and consider reporting suspicious activity or unlawful promotions to the FCA.

What changed

The FCA has reiterated that speculative illiquid securities, including most mini-bonds and loan notes, have been subject to a permanent restriction on their marketing to retail investors since 1 January 2021 under FCA COBS 4.14. The restriction does not make every loan note unlawful or bring every issuer within FCA authorisation; firms must separately assess whether the instrument falls within the restricted category, whether an exemption applies, and whether the promotion is made or approved by an authorised person in accordance with the Financial Services and Markets Act 2000 and the...

Key dates

2020-01-01

The FCA's temporary product intervention restricting mass-marketing of speculative illiquid securities to retail investors took effect.

2020-12-10

The FCA published PS20/15, confirming permanent rules for marketing speculative illiquid securities, including speculative mini-bonds, to retail investors.

2021-01-01

The permanent FCA restrictions on mass-marketing speculative illiquid securities to ordinary retail investors came into force.

2026-08-19

The FCA published the consumer warning following continuing losses and concerns about unregulated loan notes and mini-bonds, including the collapse of Woodville Consultants Limited.

2026-08-20

The FCA page was updated; the publication continues to operate as a warning and supervisory or enforcement signal rather than a new rule.

Suggested considerations

• Compliance teams may wish to inventory all loan notes, mini-bonds, debentures, preference shares, and comparable securities promoted, approved, advised on, arranged, or distributed by the firm.
• Firms should consider testing each product against the FCA definition of a speculative illiquid security, including the denomination threshold of less than £100,000, the use of proceeds, transferability, listing, and the applicable exemptions.
• Authorised firms should consider blocking mass-market communications, including websites, social-media advertising, broad email campaigns, affiliate content, and introducer activity, where the promotion is likely to reach ordinary retail clients.
• Where an exemption is relied on, firms should consider evidencing investor eligibility, the basis for any high-net-worth or sophisticated-investor status, the timing and validity of the investor declaration, and controls preventing onward dissemination to ineligible persons.
• Firms approving or communicating relevant promotions should consider verifying that required risk warnings, loss-of-capital disclosures, liquidity and default information, and third-party fee or commission disclosures are accurate, prominent, and consistent across all distribution channels.
• Due diligence should consider whether claims such as asset-backed, secured, FCA-authorised security trustee, listed, or fixed return accurately describe the legal and economic position of investors.
• Compliance teams may wish to review introducer agreements, commission arrangements, marketing costs, investor-money flows, and the proportion of subscriptions actually applied to the underlying investment.
• Firms should consider checking that communications do not use artificial deadlines, pressure tactics, unrealistic return comparisons, or performance claims unsupported by a credible explanation of repayment capacity.

What changed

No new binding requirement or prohibition was introduced by this publication. The FCA restated that its permanent rules prohibit authorised firms from approving or communicating financial promotions for speculative illiquid securities in a manner likely to be received by retail clients, subject to defined exemptions.

Key dates

20 March 2026

- The FCA published the statement announcing increased scrutiny of Annex 1 firms and warning that registration applications should be expected to take longer

TBD (ongoing, from the date of publication)

- Annex 1 firms that are not registered should submit a registration application before continuing Annex 1 activity, because the FCA states such firms need to be registered for AML purposes

TBD (ongoing supervisory cycle)

- Around 900 Annex 1 firms are subject to FCA information requests to support supervisory risk assessment and intelligence gathering

Suggested considerations

• Confirm whether any UK business line falls within Annex 1 scope and, if so, verify that the entity is registered with the FCA for AML purposes before continuing the activity.
• Submit a registration application immediately if the firm carries on Annex 1 activity without being registered.
• Reassess the firm’s AML framework at entity level, rather than relying on group-level policies or parent-company controls, and document why the controls are appropriate for the firm’s own risks and operations.
• Replace any generic or off-the-shelf procedures with policies, controls, and procedures tailored to the firm’s actual products, customers, geographies, and delivery model.
• Prepare evidence of MLR compliance for FCA review, including risk assessment logic, governance arrangements, customer due diligence processes, and monitoring controls.

What changed

• - The FCA is closely scrutinising applications to register as an Annex 1 firm, indicating a tougher gateway for new registrations and potentially more refusals or delay where evidence is weak.
• Annex 1 firms must demonstrate compliance with the Money Laundering Regulations, rather than merely assert that controls exist.
• The FCA is warning firms that registration applications will take longer, which affects launch plans, transaction timing, and group structuring decisions.
• The FCA has sent an information request to around 900 Annex 1 firms to better understand their activities, business models, and risks.
• The FCA says it will use this information, together with other intelligence, to identify and disrupt financial crime risks in the sector.

Key dates

Autumn 2026

(TBD) - PVDC expected to publish its detailed **strategy for retail payments infrastructure**, setting key priorities for next‑generation infrastructure and aligning with the National Payments Vision

Q2 2026

(already in train) - HM Treasury consultation on retained EU payments law and FCA engagement paper (Payments Forward Plan context; relevant for alignment with infrastructure changes)

25 June 2026

- Retail Payments Infrastructure Board consultation on the design of the Future Retail Payments Infrastructure is launched

11 September 2026 Deadline

- Deadline for submission of responses to the RPIB consultation on the future retail payments infrastructure

Suggested considerations

• Assess and document your firm’s current and projected use of UK retail interbank payments (including Faster Payments, account‑to‑account, and cross‑border flows) to inform your response to the RPIB consultation.
• Prepare and submit a coordinated consultation response to the RPIB by 11 September 2026, covering your views on payment journeys, design choices, consumer protection needs and financial crime controls.
• Review your firm’s commercial and pricing models for interbank payments to understand how potential changes to the future infrastructure’s commercial model could affect revenue, costs and access.
• Map dependencies between your operational resilience framework and the existing UK retail payments infrastructure, and identify key risks and mitigants under a transition to the next‑generation infrastructure.
• Engage with industry bodies, Pay.UK and relevant trade associations to align positions on access, interoperability, fraud management, and technical standards for next‑generation retail payments.

What changed

• - A new governance and delivery model for UK retail payments infrastructure is being operationalised, with strategy set by the PVDC, design work led by the RPIB, and implementation by a new...
• The RPIB has launched a formal consultation on the design of the future retail payments infrastructure, seeking views on payment journeys, key design choices and priorities.
• The PVDC has published additional context to support stakeholders’ reading of the consultation, including expectations for the commercial model, consumer protection outcomes and financial crime...
• Responsibilities across the ecosystem are being reset, with clearer roles for public authorities (HM Treasury, Bank of England, FCA, PSR), Pay.UK, and industry participants in designing and...
• Next‑generation infrastructure is expected to support account‑to‑account payments at point of sale, enhanced cross‑border payments, and interoperability with new forms of digital money (including...

Key dates

2024

FCA letter to CEOs of Annex 1 firms raising AML concerns.; - **Late 2025 - FCA follow-up engagement with 300 Annex 1 firms.**

Suggested considerations

• Verify Annex 1 registration status directly from the firm and via independent checks (e.g., FCA Register).
• Understand the Annex 1 firm's business model, products, and risks, aligning with MLRs and 2025 NRA.
• Manage identified risks, such as AML deficiencies or consumer encouragement into limited company structures for unregulated lending.
• Document due diligence to demonstrate compliance, integrating into broader financial crime frameworks (e.g., BWRA/CRA per FCA findings).

What changed

No new rules or legislative changes are introduced; this is a supervisory reminder reinforcing existing obligations under the Money Laundering Regulations 2017 (MLRs). It emphasizes enhanced due diligence on Annex 1 firms, referencing the 2025 National Risk Assessment (NRA) for risk management. The FCA highlights proactive engagement, including a 2024 letter to CEOs and follow-up with 300 firms in late 2025, signaling intensified supervision without altering the registration-only regime under the Financial Services and Markets Act.

Key dates

25 February 2026

- MFS entered administration

20 March 2026

- FCA enforcement investigation opened (current date context)

No specific deadline provided Deadline

for investigation completion or enforcement action

Suggested considerations

• *For MFS and its Administrators:
• Cooperate fully with the FCA enforcement investigation
• Preserve all documentation related to AML/CTF compliance, customer due diligence, and transaction monitoring
• Provide access to bank accounts, transaction records, and compliance files to investigators
• Respond to FCA information requests within specified timeframes

What changed

• The FCA's enforcement investigation does not introduce new regulatory requirements but rather represents the regulator's response to alleged breaches of existing obligations.
• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017: MFS's primary regulatory obligation as an Annex 1 registered firm.