FCA intensifies scrutiny of Annex 1 Firms over financial crime concerns

Firms including unregulated lenders, safe custody providers, money brokers and financial leasing companies need to be registered with the FCA for anti-money laundering purposes (“Annex 1 Firms”). The FCA has confirmed it is closely scrutinising firms seeking registration, as well as sending information requests to around 900 Annex 1 Firms to improve its understanding of their activities. This is largely due to mounting concerns around facilitation of financial crime and the increased risk of harm to consumers. Such concerns include over-reliance on group financial crime controls without considering whether these fit with a firm’s risks, governance and operations, complex lending structures increasing risk of consumer harm, as well as risks posed to regulated businesses when doing business with Annex 1 Firms.

Based on this, firms may want to consider this an opportunity to assess their current approach to financial crime, testing their existing controls to ensure that they do not fall below the standard the FCA expects.

The Broader Context

Fighting financial crime is one of the four core priorities of the FCA's 2025–2030 strategy, with the FCA committed to focusing on those who use regulated status to do harm, going further to disrupt criminals and supporting firms as an effective line of defence.

The enforcement data underscores the scale of this commitment. In 2025/26, over 75% of the FCA's enforcement work was directed at fighting financial crime, encompassing fraud, scams, organised crime, AML systems-and-controls weaknesses, and market abuse. Since 2021, the FCA has imposed 13 fines totalling over £300 million on banks alone for AML systems-and-controls failings. 

Further, the FCA has emphasised that tackling financial crime requires better use of data and technology, stronger collaboration between firms, regulators, government and law enforcement, and improved metrics for measuring the effectiveness of prevention efforts. Firms are encouraged to consider how they can use the information-sharing powers introduced by the Economic Crime and Corporate Transparency Act 2023 to counter money laundering and raise awareness of risks. 

The FCA has reiterated that firms carrying out activities within the scope of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the “MLRs”) must be registered with the FCA and if they are not, an application must be submitted without delay. 

To register, firms must clearly demonstrate their ability to comply with the MLRs, with the FCA expecting a tailored approach to financial crime compliance, depending on the type of activities the firm is carrying out. The FCA has warned firms that as a result, registration applications will take longer.

Why is the FCA concerned?

The FCA has identified several areas of concern among the Annex 1 population:

• Over-reliance on group-level controls: The FCA says that firms depend too heavily on the financial crime controls of their parent company. It expects that each firm within a group must independently assess whether group-wide controls are appropriate for its own financial crime risks, governance and operations. Off-the-shelf procedures designed for a different entity within the group will not satisfy the FCA’s expectations and each firm must maintain controls tailored to its specific operations and risk profile.
• Complex lending structures. The FCA has raised concerns about risks to consumers and markets arising from unregulated lending conducted through complex structures, including special purpose vehicles, increasing the potential for harm. 
• Risks to regulated counterparties. The regulator has previously highlighted the risks faced by regulated firms when conducting business with Annex 1 Firms. There may be discrepancies between an Annex 1 Firm’s registered and actual activities, financial crime controls may not have kept pace with business growth (including around resourcing) and there may be failures by Annex 1 Firms to assess their own or customers’ activities properly. Due to this, regulated firms are expected to carry out thorough due diligence, understand the business models of their Annex 1 counterparties and seek direct confirmation of their registration status.

What next?

The FCA's actions in relation to Annex 1 Firms show its broader determination to make fighting financial crime a central, operationally intensive pillar of its supervisory and enforcement work. These developments should not be seen as isolated interventions but as part of a sustained, data-led campaign to identify and disrupt financial crime risk across the UK financial system. 

While this increase in scrutiny shows that the FCA expects robust controls for Annex 1 Firms and those seeking to register, it has been careful to distinguish between effective risk management and indiscriminate de-risking. This increased scrutiny does not mean that money-laundering risk management requires Annex 1 Firms to exit entire categories of customers associated with higher risk. Instead, the FCA has stated that where such risks can be managed properly, firms (including Annex 1 Firms) should recognise the risks associated with different businesses and manage them, rather than going too far and refusing to engage with a category of customers.

Alongside increased scrutiny of those seeking to register as an Annex 1 firm, the FCA has issued information requests to approximately 900 existing Annex 1 Firms designed to understand their activities, business models and associated risks. This exercise follows earlier engagement with 300 Annex 1 Firms in late 2025. Once concluded, the FCA will have contacted the entire registered Annex 1 population.

If you are an Annex 1 Firm in receipt of a request for information, focus should be on responding to the questionnaire, while ensuring the following is considered and reviewed:

• Governance and oversight: including arrangements relating to its nominated officer and reporting mechanisms. 
• Business-wide risk assessment: it is documented and includes an assessment of the proliferation financing risk posed. 
• Policies and procedures: regularly reviewed and refreshed, representing an accurate description of what happens in practice.
• Transaction monitoring: how it happens and the screening in place, including its frequency. 
• Suspicious activity reports: data on the number made, both internally and externally. 
• Resourcing: detail on allocation and any outsourcing arrangements in place. 
• Group arrangements: ensuring any reliance on group teams can be explained with clear rationale underpinning it.

If you have received an information request or are looking into Annex 1 registration and whether it would be applicable to your firm, please do not hesitate to contact us.