The UK's anti-money laundering and financial crime framework is changing on three fronts between 2026 and 2028. The Money Laundering Regulations have been amended. Supervision is being consolidated, with the FCA taking on professional services firms and a new FSMA regime for cryptoassets. Corporate transparency is tightening through Companies House identity verification and the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
Fighting crime is one of the four priorities in the FCA's Strategy 2025 to 2030, and the FCA published four sets of financial crime findings in 2026 alone. The UK's next FATF mutual evaluation, with an on-site visit indicated for June 2027, adds a national incentive to show that controls work in practice. This article sets out each change in date order, what it means and what firms should do. The controls themselves are covered in the firm's guide to FCA financial crime compliance in 2026.
| Date | Change | Status |
|---|---|---|
| 18 November 2025 | Companies House identity verification mandatory for new directors and PSCs; 12-month transition for existing ones | In force |
| March 2026 | Fraud Strategy 2026 to 2029 published | Published |
| 24 April, 10 July and 1 September 2026 | FCA SM&CR changes (PS26/6) take effect in stages | In force |
| 9 June 2026 | Money Laundering and Terrorist Financing (Amendment) Regulations 2026 made | Made |
| 30 June 2026 | Most of the 2026 MLR amendments in force | In force |
| 30 September 2026 | FCA application window for the new cryptoasset regime opens | Open to 28 February 2027 |
| End of 2026 at the earliest | Companies House transition for existing directors and PSCs ends; limited partnership reforms | Expected |
| 1 February 2027 | EDD for cryptoasset correspondent relationships (regulation 34A) | Legislated |
| June 2027 | FATF on-site visit to the UK (indicative) | Scheduled |
| 10 July 2027 | EU Anti-Money Laundering Regulation applies (EU entities of UK groups) | Legislated |
| 25 October 2027 | New FSMA cryptoasset regime commences | Legislated |
| November 2027 at the earliest | Companies House: presenter verification and ACSP-only third-party filing | Expected |
| February 2028 | FATF plenary discussion of the UK evaluation (indicative) | Scheduled |
| April 2028 | Companies House accounts filing reforms (moved from April 2027) | Announced |
| Autumn 2028 at the earliest | FCA begins phased AML supervision of professional services firms | Subject to legislation |
Since 18 November 2025, identity verification has been compulsory for new directors and persons with significant control (PSCs) at incorporation and on appointment. Existing directors and PSCs have a 12-month transition and verify when their company's next confirmation statement is due. Companies House's transition plan states that the transition ends no earlier than the end of 2026, after which compliance activity begins against those who have not verified.
The next stages come later than many firms expected. Verification of presenters for every filing, and the requirement that third-party agents filing for companies be registered as Authorised Corporate Service Providers (ACSPs), apply no earlier than November 2027, with at least six months' notice.
Since 1 September 2025, a large organisation commits the failure to prevent fraud offence under section 199 of ECCTA if an associated person, such as an employee, agent or subsidiary, commits a specified fraud intending to benefit it, unless it had reasonable fraud prevention procedures. A large organisation meets two of three tests: more than 250 employees, more than £36 million turnover or more than £18 million total assets.
ECCTA also reformed corporate criminal liability from 26 December 2023: a company can be liable for an economic crime committed by a senior manager acting within the actual or apparent scope of their authority.
HM Treasury consulted on draft amendments in 2025. The final Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made on 9 June 2026. Most provisions came into force 21 days later, on 30 June 2026. The enhanced due diligence rule for cryptoasset correspondent relationships applies from 1 February 2027, and the full change of control provisions for registered cryptoasset businesses apply from 25 October 2027.
| Change | What it means in practice |
|---|---|
| Euro thresholds converted to sterling | Thresholds expressed in euros, such as the high value dealer cash threshold, are restated in sterling on a 1:1 basis |
| "FATF call for action country" replaces "high-risk third country" | Mandatory EDD applies to the FATF call for action list; other jurisdictions still need risk assessment |
| EDD for complex or large transactions | Applies to transactions that are unusually complex or unusually large for their nature |
| Pooled client accounts | Specific due diligence on the account's purpose; customers keep records and provide them on request |
| Trust or company service providers | Selling off-the-shelf companies is brought into scope |
| Cryptoasset correspondent relationships | New regulation 34A EDD from 1 February 2027 |
| Regulation 23 information | Authorised persons report inaccuracies or material changes to the FCA within 30 days |
The FCA's 2026 publications set the benchmark supervisors use in firm reviews. Each one lists good and poor practice that firms can test themselves against.
| Publication | Date | Main focus |
|---|---|---|
| Payments Regulatory Priorities | March 2026 | Money laundering and APP fraud in payment and e-money firms |
| Customer due diligence processes and controls | 8 April 2026 | CDD, EDD and ongoing due diligence |
| Sanctions systems and controls | 28 May 2026 | Screening, list management, alert handling, trade sanctions |
| Insurance financial crime controls | 23 June 2026 | Risk assessment, due diligence and monitoring in large insurers |
| Asset management and alternative firms | 22 July 2026 | Risk assessments, outsourced CDD, transaction monitoring |
| Money mules: activity and cashing out | 23 September 2026 | Mule detection in banks, PIs and EMIs |
The Home Office's Fraud Strategy 2026 to 2029, published in March 2026, commits over £250 million across the period. It confirms the APP fraud reimbursement regime, under which 88% of in-scope APP losses were reimbursed in its first year, and plans a call for evidence on unauthorised fraud, the move of strong customer authentication standards into FCA rules and FCA recommendations on preventing APP fraud and mule activity. Payment firms should treat the strategy as a guide to where supervisory attention will go next. The application of these findings to payment businesses is covered in the firm's article on payment institution financial crime controls.
The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, places the UK digital verification services trust framework on a statutory footing, with a public register of certified providers. HM Treasury's 2025 consultation on the MLR amendments also addressed how digital identities can be relied on for customer due diligence.
For regulated firms, certified digital identity providers offer a consistent way to verify customers remotely. The firm remains responsible for CDD, so it should assess the provider's certification, the level of assurance it offers and how its output fits the firm's risk-based approach before relying on it.
The Economic Crime Plan 2, covering 2023 to 2026, sets the Government's objectives on money laundering, kleptocracy and fraud. Its outcomes progress report of 2 September 2025 recorded 6,845 money laundering prosecutions in England and Wales in the year to December 2024, up 36%, and 3,756 convictions, up 7%. Around 32,000 entities had registered on the Register of Overseas Entities by 31 March 2025.
The report states that a further update will cover data development in the financial year ending 2027. With the plan period ending in 2026, firms should watch for its successor and for any new priorities it sets for the private sector, particularly on information sharing, which the Home Office opened a call for evidence on in March 2026.
The FCA's PS26/6 changes to the Senior Managers and Certification Regime took effect in stages on 24 April, 10 July and 1 September 2026. For firms within the regime, the MLRO function (SMF17) and the prescribed responsibility for financial crime remain central to accountability for AML controls. Statements of responsibilities and responsibilities maps should be checked against the revised rules.
E-money institutions and payment institutions are not under the senior managers regime. Their MLRO and directors are assessed at authorisation and in supervision instead. The firm's guide to SM&CR in 2026 covers the changes in detail.
ECCTA reforms limited partnerships, which have been used to hide ownership. Companies House's transition plan states that limited partnerships will have to submit more information no earlier than the end of 2026, including details of general partners and their identity verification.
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activities into the full FSMA perimeter. The FCA application window opened on 30 September 2026 and runs to 28 February 2027. The regime commences on 25 October 2027. Until then, the existing MLR cryptoasset registration applies.
Once authorised under FSMA, cryptoasset firms are subject to the FCA's conduct, prudential, operational resilience and consumer protection rules alongside AML and sanctions obligations. The 2026 MLR amendments add enhanced due diligence on cryptoasset correspondent relationships from 1 February 2027, and extend change of control notices for registered cryptoasset businesses.
UK groups with EU-authorised subsidiaries face a separate timetable. The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027 and replaces much of the national transposition of the EU directives with a single rulebook. The EU Anti-Money Laundering Authority (AMLA) is expected to begin direct supervision of selected cross-border institutions in 2028.
Group policies should be reviewed so that the EU entities meet the new rulebook while the UK entities meet the amended MLRs. Where the two differ, for example on beneficial ownership thresholds or due diligence detail, group standards should be set at the stricter level or explicitly vary by entity.
No earlier than November 2027, everyone presenting a document to Companies House must have verified their identity, and third-party agents filing on behalf of companies must be registered as ACSPs. Companies House has committed to at least six months' notice.
The accounts filing reforms, originally planned for April 2027, now take effect from April 2028. Small companies and micro-entities will file profit and loss accounts, all companies will file through commercial software, and the abridged accounts option will be removed. For firms carrying out CDD on small corporate customers, the additional financial information will improve source of funds analysis from 2028.
The FATF's assessment calendar indicates an on-site visit to the UK in June 2027 and a plenary discussion in February 2028. The UK was last evaluated in 2018. The evaluation assesses technical compliance with the FATF Recommendations and, more importantly, effectiveness: whether supervision, prevention, investigation and prosecution work in practice.
Evaluation ratings affect correspondent banking relationships, investor confidence and the regulatory priorities that follow. Supervisors and the Government have every reason to show effective supervision in the run-up, so firms should expect continued data requests, thematic reviews and case study requests.
In October 2025 the Government announced that the FCA will take over AML and counter-terrorist financing supervision of legal service providers, accountancy service providers and trust and company service providers from the professional body supervisors and HMRC. The FCA's AML supervisory reform page states that around 60,000 businesses are affected.
| Period | Milestone |
|---|---|
| 2026 | Government consultation response (June 2026) and stakeholder engagement; key changes in the Financial Services and Markets Bill |
| 2027 | FCA operating model review following legislation |
| Autumn 2028 at the earliest | Phased transition begins and FCA supervision launches |
| 2030 | Remaining professional body supervisors move across; OPBAS closes |
Professional bodies keep their non-AML conduct functions. For FCA-regulated firms, the practical effect is more consistent AML standards among the lawyers, accountants and company formation agents they rely on, and in their corporate customers' advisers.
Alongside the dated changes, the FCA's supervisory approach continues to intensify. It uses data to identify firms for review, runs multi-firm reviews, writes to sectors through Dear CEO and portfolio letters, commissions skilled person reviews under section 166 of FSMA and agrees voluntary requirements that restrict onboarding or activity.
Enforcement for financial crime controls remains active. Recent penalties include £21,091,300 for Monzo (July 2025), £39,314,700 for Barclays Bank (July 2025) and £44,078,500 for Nationwide Building Society (December 2025).
Several of these changes land within months of each other in 2027: the cryptoasset correspondent EDD rule in February, the FATF on-site visit in June, the EU rulebook in July, the cryptoasset regime in October and the Companies House filing changes from November. Firms that complete the 2026 items now spread the cost and staff time across the period rather than compressing it into 2027.
Early work also gives time to test changes before a supervisor does. A policy updated in 2026 and tested through compliance monitoring by mid-2027 is evidence of an effective framework; the same policy updated a week before a review is not. Supervisors give weight to a documented record of planned, tested change.
Firms that track change in one owned log, with a named owner and a completion test for each item, absorb this volume of change with the least disruption. The firm's article on staying on top of UK regulatory change sets out a workable process.
Buckingham Capital Consulting supports regulated firms through each stage of this timeline, with particular depth in payments, e-money, remittance and cryptoasset businesses.
Impact assessment of the 2026 amendments, updated policies and customer risk methodology, revised EDD triggers and screening lists, and training materials.
Fraud risk assessments and documented fraud prevention procedures for the section 199 offence, and Companies House verification checks built into CDD.
Gap analyses against the FCA's 2026 findings, preparation for thematic reviews and data requests, responses to Dear CEO letters, skilled person review support and interim MLRO cover.
Full authorisation files for the window that closes on 28 February 2027, including the financial crime framework the FCA will assess.
Details are on the firm's financial crime page.
On 18 November 2025 for new directors and PSCs. Existing directors and PSCs have a 12-month transition and verify with their next confirmation statement; the transition ends no earlier than the end of 2026.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made on 9 June 2026 and most provisions came into force on 30 June 2026. The cryptoasset correspondent EDD rule applies from 1 February 2027.
The FCA application window runs from 30 September 2026 to 28 February 2027, and the regime commences on 25 October 2027. The MLR cryptoasset registration applies until then.
The FCA states that a phased transition will begin no earlier than autumn 2028, subject to legislation, with the remaining professional body supervisors moving across by 2030.
The FATF calendar indicates an on-site visit in June 2027 and a plenary discussion in February 2028. The dates are indicative.
From April 2028, delayed from April 2027. Small companies and micro-entities will file profit and loss accounts and all companies will file through commercial software.
It applies to large organisations, those meeting two of three tests: more than 250 employees, more than £36 million turnover or more than £18 million total assets. Many banks and larger payment firms are in scope.
Buckingham Capital Consulting has obtained FCA authorisations and registrations for payment, e-money and remittance firms including Nexpay, Hryze and Onpoint Money since 2013, and keeps their financial crime frameworks current as the rules change. It supports firms with MLR amendment implementation, FCA supervisory reviews and cryptoasset FSMA applications.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.