On 7 August 2026, the FCA highlighted that it has increased, and will continue to increase, scrutiny of so-called Annex 1 firms – including unregulated lenders, safe custody providers, money brokers and financial leasing companies. This is not the first such warning: the FCA issued a Dear CEO letter on anti-money laundering failings among Annex 1 firms in March 2024, and this latest statement is best read as a continuation of that supervisory focus rather than a one-off intervention. Whilst these activities fall outside of the normal regulatory field of view, they are within the scope of the Money Laundering Regulations. It is illustrative that the FCA has now, through two waves of information requests, contacted all registered Annex 1 firms. As the FCA builds its understanding of the activities and risks across Annex 1 firms, it can reasonably be anticipated that there will be cases where the FCA deems additional intervention appropriate.
The FCA also signaled that registration applications are likely to take longer as scrutiny intensifies (FCA, 2026).
When taking in conjunction with reminders to banks to undertake appropriate due diligence on their non-bank financial institution clients, firms undertaking Annex 1 activities may also find that their banks raise enquiries as to the registration status, regulatory standing and AML frameworks.
If there was a time when under investment in AML controls in Annex 1 firms may have had limited consequences, there is now a distinct possibility of regulatory intervention and business limitations.
Why Annex 1 Firms Are Under the Spotlight
The FCA's concern is straightforward: Annex 1 firms sit in a part of the market where oversight has historically been lighter than for fully authorised firms, while the underlying activities, unregulated lending, custody, broking and leasing, carry real potential to facilitate financial crime if controls are inadequate. The regulator has also flagged wider risks to consumers and markets from unregulated lending "often conducted through complex structures, including special purpose vehicles" (FCA, 2026).
The UK National Money Laundering Risk Assessment includes some examples of where Annex 1 services had been mis-used to further financial crime.
The Core Finding: Controls Copied, Not Built
The most instructive part of the FCA's statement is what it says about how Annex 1 firms have been getting their AML frameworks wrong. The regulator’s point is that firms have been leaning too heavily on their parent company’s financial crime controls, when each entity within a group needs to independently assess whether those controls actually fit its own risks, governance and operations. It has also made clear that generic, off-the-shelf procedures built for a different business aren’t good enough — controls need to be tailored to how the firm actually operates and the risks it actually faces (FCA, 2026).
This matters because it points to a governance failure as much as a technical one. A policy that was built for a different business model, a different customer base or a different risk profile will not hold up to scrutiny, however professionally it is drafted. The FCA has been explicit that each firm must be able to demonstrate controls that reflect its own specific risks, customer base and governance structure, not a copy-pasted version of a group-wide framework.
Firms should be able to answer, with evidence, questions such as:
Where a group-wide AML framework has been adopted, has it been assessed and adapted for this specific entity's customer base, products and jurisdictional footprint, or simply inherited?
Does the firm's risk assessment reflect its own transaction types, customer profiles and distribution channels, rather than those of a parent or sister entity?
Is governance and oversight of financial crime controls exercised locally, with clear ownership and reporting lines within the regulated entity, rather than assumed to sit with group compliance?
Can the firm produce its own documented rationale for why its controls are proportionate to its risks, rather than pointing to a template or a parent's policy suite?
Our customer risk assessment guide sets out a practical framework for building a risk assessment that reflects your own business, rather than one inherited from elsewhere.
What the FCA Expects Firms to Do Now
The statement sets out clear expectations. Firms that are not yet registered but fall within scope are expected to submit an application without delay, and must be able to show clearly that they can meet the requirements of the money laundering regulations (FCA, 2026). In our experience, this means being able to provide an evidence base of effective management of the financial crime risks inherent to Annex 1 services.
Practical considerations for Annex 1 firms:
Review whether the firm's AML policies, risk assessment and procedures were built specifically for this entity, or inherited from a parent, sister company or template provider
Ensure governance arrangements, including a clearly accountable MLRO and appropriate senior management oversight, are evidenced and operating in practice, not just on paper
Refresh the business-wide risk assessment to ensure it reflects current products, customer types and distribution channels, with clear rationale for risk ratings applied
Where registration is not yet in place, prioritise the application and ensure supporting documentation demonstrates a tailored, risk-based approach from the outset
Prepare for the possibility of an FCA information request by ensuring management information, testing records and governance minutes are readily available and demonstrate ongoing oversight
If a gap analysis or independent health check would help evidence this, our audits and assurance services are designed for exactly this kind of review.
A Wider Message for Regulated Firms
The FCA's statement also has implications beyond the Annex 1 population itself. Regulated firms, banks, payment institutions and other authorised entities, that bank, fund or otherwise do business with Annex 1 firms are told to keep carrying out due diligence and to understand the business of the firms they deal with, including seeking direct confirmation of registration status (FCA, 2026). This message is consistent with others in the context of banks providing services to other financial institutions - understand what business the FI is permitted to undertake and the extent of referred risk. In our assessment, checking for registration status alone is unlikely to amount to sufficient due diligence.
Practical considerations for regulated firms with Annex 1 exposure:
Confirm the FCA registration status of any Annex 1 counterparties, customers or partners as part of onboarding and periodic review
Strengthen due diligence to go beyond confirming registration, and assess whether the counterparty's controls appear genuinely tailored to its business, rather than templated
Ensure enhanced due diligence triggers and ongoing monitoring adequately capture the elevated risk profile the FCA has now publicly associated with this sector
Feed this development into the next review of the firm's financial crime risk assessment and third-party risk taxonomy
Final Thoughts
This statement is a reminder that registration is not a substitute for a genuinely risk-based control framework. The FCA has been unusually direct in naming the specific failure it is seeing, controls that are borrowed rather than built, and firms in this sector should treat that as a clear steer on what supervisory engagement will focus on next.
For Annex 1 firms, the priority now is evidencing that AML controls, governance and risk assessments are genuinely their own. For regulated firms with exposure to this sector, the priority is ensuring due diligence frameworks reflect the elevated risk the FCA has now put on record.
FINTRAIL supports Annex 1 firms and their regulated counterparties with financial crime risk assessments, AML framework design and gap analysis, governance reviews and third-party due diligence uplift. If you would like to discuss how this development applies to your firm, please get in touch with our team.
Further reading:References:
Financial Conduct Authority (FCA) (2026) FCA applying increased scrutiny to Annex 1 firms. Available here. (Accessed: 10 August 2026).