FCA financial crime compliance means understanding how a business could be used for money laundering, terrorist financing, sanctions evasion, fraud, bribery and corruption, and running controls that are proportionate to those risks. The legal framework differs by firm type, so the starting point is an accurate view of the regulatory perimeter and a firm-specific risk assessment, not a generic AML manual.
Fighting crime is one of the four priorities in the FCA's Strategy 2025 to 2030, alongside being a smarter regulator, supporting growth and helping consumers. In 2026 the FCA has published findings on sanctions systems and controls (May), insurance financial crime controls (June), asset management and alternative firms (July) and money mule activity (September). Each of these reviews describes what good practice looks like, and supervisors use them as the benchmark in firm reviews.
The FCA's Financial Crime Guide (FCG) sets out examples of good and poor practice. It is guidance, not a substitute for the law or for Handbook rules. Payment and e-money institutions are supervised for Money Laundering Regulations compliance through a different statutory route from mainstream FSMA firms, which affects which Handbook rules apply to them.
| Area | What the FCA expects to see |
|---|---|
| Regulatory perimeter | A clear record of which regimes apply to each activity the firm carries out |
| Business-wide risk assessment | Firm-specific analysis of customers, products, jurisdictions, transactions and channels |
| Customer risk assessment | Ratings that change the level of due diligence and monitoring |
| Customer due diligence (CDD) | Verified identity, beneficial ownership and a clear purpose for the relationship |
| Enhanced due diligence (EDD) | Measures matched to the specific higher risk, with meaningful senior approval |
| Ongoing monitoring | Periodic reviews plus event triggers that keep customer files current |
| Transaction monitoring | Scenarios built from the risk assessment, calibrated on the firm's own data |
| Sanctions | Screening, ownership and control analysis, list management and tested systems |
| Fraud | Shared intelligence between fraud and AML teams, including mule detection |
| Suspicious activity reports | Timely, confidential and documented escalation to the MLRO and the NCA |
| Governance | An MLRO with authority and resources, and a board that challenges |
| Training | Role-specific content with evidence of competence |
| Compliance monitoring | Testing of how controls operate, not only whether policies exist |
| Regulatory reporting | Accurate annual financial crime data and prompt notifications |
The legal framework moved more in the last 18 months than in the previous five years. The changes below apply now or have fixed dates, and each one should appear in the firm's regulatory change log with an owner. A fuller calendar is in the firm's UK AML and financial crime regulatory timeline for 2026 to 2028.
| Date | Change | Who it affects |
|---|---|---|
| 1 September 2025 | Failure to prevent fraud offence (section 199, Economic Crime and Corporate Transparency Act 2023) in force | Large organisations |
| 18 November 2025 | Companies House identity verification mandatory, with a 12-month transition for existing directors and PSCs | All UK companies and their corporate customers' files |
| 28 May 2026 | FCA findings on sanctions systems and controls | All FCA authorised and registered firms |
| 30 June 2026 | Most of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 in force | All MLR relevant persons |
| 23 September 2026 | FCA findings on money mule activity and cashing out | Banks, building societies, PIs and EMIs |
| 1 February 2027 | New EDD rule for cryptoasset correspondent relationships (regulation 34A) | Cryptoasset exchange and custodian wallet providers |
| 25 October 2027 | New FSMA cryptoasset regime commences | Cryptoasset businesses |
The 2026 amending regulations were made on 9 June 2026. Among other changes, they replace euro thresholds with sterling on a 1:1 basis, replace the term "high-risk third country" with "FATF call for action country", add specific due diligence for pooled accounts, apply enhanced due diligence to transactions that are unusually complex or unusually large, and require authorised persons to report inaccurate or materially changed regulation 23 information to the FCA within 30 days. Policies, procedures and training materials that still refer to the old terms should be updated.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) apply AML and counter-terrorist financing requirements to in-scope businesses. They cover risk assessment, policies and controls, customer due diligence, record keeping, training and the appointment of a nominated officer. Records must be kept for five years after the relationship ends.
FCA-authorised firms are also subject to the SYSC financial crime rules, the Principles for Businesses and sector rules. Every firm, regulated or not, is subject to the Proceeds of Crime Act 2002, the Terrorism Act 2000, UK sanctions regulations made under the Sanctions and Anti-Money Laundering Act 2018, the Bribery Act 2010 and the Economic Crime and Corporate Transparency Act 2023.
Not every FCA-regulated firm is an MLR relevant person for every activity. A firm that only arranges mortgages, for example, is not automatically in scope of the MLRs, while a mortgage lender can be. Payment and e-money institutions are supervised by the FCA for MLR purposes, but the application of certain Handbook rules to them differs from banks and investment firms.
| Source of obligation | What it requires |
|---|---|
| MLRs 2017 (as amended in 2026) | Risk assessment, CDD, EDD, monitoring, records, training, nominated officer |
| Proceeds of Crime Act 2002 | Internal reporting and SARs to the National Crime Agency; tipping-off offences |
| UK sanctions regulations | Asset freezes, reporting to OFSI, trade sanctions reporting to OTSI and HMRC |
| SYSC 6.3 and the Principles | Systems and controls proportionate to financial crime risk (FSMA firms) |
| Bribery Act 2010 | Adequate procedures to prevent bribery by associated persons |
| ECCTA 2023 | Reasonable fraud prevention procedures; information sharing between firms |
The business-wide risk assessment (BWRA), required by regulation 18 of the MLRs, assesses the financial crime risk that comes from the firm's customers, products, services, jurisdictions, transactions and delivery channels. It should give specific reasoning for each rating rather than repeat generic statements about money laundering.
It should separate inherent risk, the risk before controls, from residual risk, the risk that remains after controls. Strong controls reduce residual exposure, but they do not make a high-risk product inherently low risk. The FCA's July 2026 review of 242 asset management and alternative firms found that about a fifth had no BWRA or an incomplete one, and that some completed assessments did not fully reflect inherent risk.
The BWRA should be updated whenever the business changes: a new product, customer group, jurisdiction, channel, agent network, acquisition or material growth. An annual review date on its own is not enough. The FCA expects to see the link between the BWRA and every downstream control, so each risk identified should map to the customer risk model, due diligence, monitoring scenarios and management information.
Customer risk ratings matter only if they change the level of due diligence and monitoring a customer receives. A model that rates almost every customer as medium risk has limited value, because it does not direct effort to where the risk is.
Relevant factors include customer type, ownership structure, geography, product use, delivery channel, source of funds and expected activity. In the July 2026 asset management review, 18% of firms had no formal customer risk assessment methodology.
Automated risk models need governance. The firm should understand the logic, the effect of data quality on outcomes, and how manual overrides are documented and monitored. Risk should be dynamic: unusual transaction behaviour, an ownership change, adverse information or exposure to a new jurisdiction should prompt reassessment.
Customer due diligence goes beyond collecting identity documents. It includes identifying and verifying the customer and any beneficial owner, understanding the purpose and intended nature of the relationship, and gathering enough information to assess risk and monitor activity later.
Corporate customers need particular care over ownership chains, control, business activity, counterparties and source of funds. Automated company searches support this work but do not replace an understanding of who owns and controls the customer. Since 18 November 2025, Companies House identity verification status for directors and persons with significant control is an additional data point to record during onboarding and review.
CDD evidence must stay current. Without a documented baseline of expected activity, transaction monitoring has nothing reliable to compare against, and alerts become harder to investigate.
Enhanced due diligence is required in the cases specified in the MLRs and wherever the firm identifies a higher risk of money laundering or terrorist financing. Specified cases include business relationships or transactions involving a FATF call for action country, politically exposed persons (PEPs), correspondent relationships, and transactions that are unusually complex or unusually large.
The response should match the risk. A complex ownership structure calls for ownership mapping and verification of the controlling individuals. A higher-risk jurisdiction calls for analysis of the flows and counterparties. A PEP calls for source of wealth evidence and senior management approval. Domestic PEPs are treated as lower risk than foreign PEPs as a starting point, unless other risk factors are present.
Customers change after onboarding. Ownership changes, activity expands, adverse media appears and new products are used. Periodic reviews, scheduled by risk rating, should be supplemented by event triggers such as unusual transactions, a change of director or beneficial owner, new sanctions exposure or a change in business activity.
Investigators should be able to trigger a full customer review from an alert, rather than close each alert in isolation. The FCA's 2026 sector reviews consistently point to the quality of ongoing monitoring as an area for improvement, including in large insurers, where transaction monitoring was the weakest area in life insurance.
Transaction monitoring should identify activity that is unusual or suspicious for that customer and for the firm's risk profile. There is no universal FCA scenario library. Banks, payment institutions, insurers, investment firms and cryptoasset businesses each need a different approach.
Payment and e-money firms face particular pressure here because funds move fast and often cross borders. The firm's article on payment institution financial crime controls and transaction monitoring sets out scenario design for payment businesses in detail.
UK sanctions compliance requires the firm to identify designated persons, entities they own or control, and sanctioned counterparties in payment data. The FCA's sanctions systems and controls findings, published on 28 May 2026, draw on proactive assessments of over 150 firms since February 2022.
Name screening needs current list data and calibrated matching. Tuning a system hard to cut false positives can create missed matches, so calibration should be tested with variant and non-Latin names. Sanctions exposure can also arise through indirect ownership and counterparties, which needs clear escalation and documented decisions.
Firms must report to OFSI where they know or suspect that a person is designated or that a breach has occurred. The FCA also expects regulated firms, including e-money, payment and registered cryptoasset businesses, to notify it if the firm, its agents or appointed representatives become subject to sanctions, giving the regime, the effective date, the entities affected, the impact on the business and any licences held.
Fraud creates money laundering risk when proceeds move through regulated firms, and AML monitoring often reveals fraud. Firms should avoid a rigid separation between fraud and AML teams that blocks intelligence sharing.
The FCA's money mule findings, published on 23 September 2026, surveyed 35 banks, building societies, payment institutions and EMIs. Suspected mule accounts offboarded rose from 184,935 in 2023 to 238,396 in 2025. For EMIs, 74.1% of offboarded mule accounts were closed within six months of opening, and for PIs 56.9%. Funds were usually cashed out between the second and fifth mule account in a chain, so detection beyond the first receiving account matters.
Mule activity shows up through shared devices, shared beneficiaries, rapid movement of funds in and out, structured amounts and many small credits followed by large withdrawals. The FCA expects firms to use the information-sharing provisions of the Economic Crime and Corporate Transparency Act 2023.
Since 1 September 2025, a large organisation commits the failure to prevent fraud offence under section 199 of the Economic Crime and Corporate Transparency Act 2023 if an associated person commits a specified fraud intending to benefit it, unless it had reasonable fraud prevention procedures. A large organisation meets two of three tests: more than 250 employees, more than £36 million turnover, or more than £18 million total assets. Home Office guidance describes the procedures expected.
Account restrictions and payment delays should be governed so the firm meets its legal obligations without unnecessary customer harm. In retail businesses the Consumer Duty applies to these decisions too.
Where staff know or suspect, or have reasonable grounds to know or suspect, money laundering or terrorist financing, they report internally. The MLRO, as nominated officer, decides whether to report externally to the National Crime Agency (NCA) under the Proceeds of Crime Act 2002 or the Terrorism Act 2000.
Where the firm needs to proceed with a transaction it suspects, it requests a defence against money laundering (DAML). The NCA has seven working days to respond. If it refuses, a moratorium of 31 days follows, which a court can extend.
A framework with strong policies and good technology still underperforms if the MLRO lacks authority, capacity or access to senior management. The MLRO should understand the business and its risk profile and be resourced for due diligence, monitoring, sanctions, SARs and remediation. Growing firms should reassess resourcing as volumes rise.
The MLRs require a member of the board or senior management to be responsible for compliance with the regulations, where appropriate to the size and nature of the business, in addition to the nominated officer. In firms under the Senior Managers and Certification Regime, the MLRO holds the SMF17 function and a senior manager holds the prescribed responsibility for financial crime. EMIs and payment institutions are not under the senior managers regime, but the FCA assesses their MLRO and directors at authorisation and in supervision. The firm's guide to hiring MLROs and heads of compliance covers the profile the FCA looks for.
Useful management information includes the number of higher-risk customers, EDD cases, alert backlogs, sanctions cases, fraud cases, SARs and overdue reviews. The board should challenge the framework, understand the risks it has accepted and approve the investment required. The MLRO's annual report should give the board a candid view of effectiveness.
Staff need training matched to the decisions they make. Customer-facing staff need clear escalation guidance. Investigators need technical depth on typologies and evidence. Senior managers need enough understanding to challenge the controls they oversee.
Training should be refreshed between annual cycles when sanctions regimes change, new fraud typologies emerge or the firm launches new products or enters new jurisdictions. Competence should be evidenced through quality assurance, case reviews and supervisory feedback, not attendance records alone. The FCA's July 2026 review noted that some MLROs had not received training specific to their own legal duties.
Compliance monitoring or internal audit should test whether controls work in practice, not only whether policies exist or training was completed. Testing should use customer files, cases, system data and re-performance of checks.
Sampling should be risk-based and include higher-risk customers, manual overrides, closed sanctions alerts and SAR cases. Remediation should be retested, and an action should close only when there is evidence the control now operates effectively.
The MLRs require an independent audit function where appropriate to the size and nature of the business. The FCA does not set a universal frequency, but an annual independent review is common in payment, e-money and cryptoasset firms, with scope set by the risk profile.
Payment and e-money firms face close scrutiny because payments settle quickly, which shortens the time to intervene. Cross-border flows require knowledge of several sanctions regimes and laundering typologies. Customers who have been declined elsewhere raise inherent risk, rapid growth puts pressure on compliance capacity, and outsourced onboarding and monitoring need active oversight.
Authorised push payment (APP) fraud creates both consumer harm and financial crime risk. Receiving firms are expected to prevent mule recruitment through onboarding controls and to detect mule activity through monitoring calibrated for rapid in-and-out movement.
Banks face additional exposure through correspondent banking, where they process payments for another institution's customers, and through trade finance, where over-invoicing and under-invoicing can disguise value transfer. Private banking brings high-net-worth clients, PEPs and offshore structures that require enhanced scrutiny.
The FCA's June 2026 review rated large insurers' controls as mostly effective, with improvement needed in risk assessment, client due diligence and transaction monitoring. Its July 2026 review found that half of asset management and alternative firms have more than 60% of customers based overseas, and that over a quarter lack a formal transaction monitoring process.
The FCA can act on weak systems and controls without any proven money laundering, because the breach is the inadequacy of the controls. Its tools escalate from supervisory correspondence to formal measures.
| Firm | Date | Financial penalty |
|---|---|---|
| Starling Bank | September 2024 | £28,959,426 |
| Monzo Bank | July 2025 | £21,091,300 |
| Barclays Bank | July 2025 | £39,314,700 |
| Nationwide Building Society | December 2025 | £44,078,500 |
The Starling and Monzo cases share a pattern: controls did not keep pace with rapid customer growth, and each firm onboarded high-risk customers while under a VREQ restricting it. Starling opened 54,359 accounts for 49,183 high-risk customers in breach of its VREQ. Firms under remediation can find support on the firm's regulatory turnaround page.
The FCA assesses financial crime capability during authorisation and registration. Controls must match the business model and the volumes in the application. Generic policies prompt questions and lengthen the assessment.
Directors and the proposed MLRO must be able to explain the firm's financial crime risks and controls in their own words at interview, rather than defer to external advisers. Financial resources must support the framework at the projected scale. Under-resourcing becomes both a financial crime concern and an authorisation concern, because it goes to whether the firm meets the conditions for authorisation.
New products, markets, technologies and distribution arrangements should be assessed for customer risk, geography, transaction flows, sanctions exposure, monitoring and staffing before launch. A short financial crime sign-off in the product approval process is the simplest way to make this routine.
AI and monitoring technology need governance covering model limitations, data inputs, false positive rates and detection rates. Vendor accuracy claims should be validated in the firm's own environment before reliance. Regulatory change, including FCA publications, sanctions designations and AML legislation, should be horizon-scanned and converted into owned implementation actions.
Buckingham Capital Consulting provides financial crime compliance support to regulated firms, with particular depth in payments, e-money and cross-border businesses. Work covers gap assessments from the BWRA through to board oversight, transaction monitoring calibration, sanctions reviews, interim and outsourced MLRO support, and remediation after FCA findings, skilled person reviews or audits.
For new applicants, the financial crime framework is built into the authorisation project so that the policies, risk assessment and MLRO arrangements match the business plan. Details are on the firm's financial crime page.
It covers AML and counter-terrorist financing risk assessment, customer due diligence, enhanced due diligence, monitoring, sanctions, fraud, suspicious activity reporting, governance, training and independent testing. The exact requirements depend on the firm's regulatory status and activities.
It is the firm's assessment, required by regulation 18 of the MLRs, of the financial crime risks arising from its customers, products, services, jurisdictions, transactions and channels. It should explain inherent risk, controls and residual risk and be updated when the business changes.
Firms within the MLRs must conduct ongoing monitoring, including scrutiny of transactions, scaled to risk. Data quality, calibration and investigation capacity matter as much as the software.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made on 9 June 2026 and most provisions came into force on 30 June 2026. They introduce sterling thresholds, the term FATF call for action country, pooled account due diligence and a 30-day duty to report changes to regulation 23 information.
The FCA sets no universal frequency. Testing should follow risk, with additional reviews after material change, and an annual independent review is common practice.
Yes. The FCA assesses whether adequate systems and controls exist, so weak governance, risk assessment, due diligence, monitoring or sanctions controls are breaches in themselves.
The NCA has seven working days to respond to a defence against money laundering request. If it refuses, a 31-day moratorium follows, which a court can extend.
Buckingham Capital Consulting has obtained FCA authorisations for payment and e-money firms including Nexpay, Dzing Finance and Hryze since 2013, building the business-wide risk assessment, AML policies and MLRO arrangements that each application is assessed on. It also carries out independent AML reviews, sanctions reviews and remediation programmes for authorised firms.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.