Are you confident your AML controls would meet the FCA's expectations?
In a notice that may have been lost in the middle of the August holiday period, the Financial Conduct Authority (FCA) announced that it is applying increased scrutiny to Annex 1 financial institutions. The FCA has significant concerns about the financial crime risks of firms such as unregulated non-bank lenders, who should now take steps to review their anti-money laundering (AML) frameworks.
What is an Annex 1 Financial Institution?
Annex 1 financial institutions are businesses that carry on certain categories of unregulated financial activity, including commercial lending, factoring and financial leasing. These firms do not require authorisation by the FCA under the Financial Services and Markets Act 2000, because they are not carrying out “regulated activities”, but they are required to register with the FCA for AML purposes and must comply with the UK’s anti-money laundering regime.
Key Concerns from the FCA
The FCA has highlighted several concerns:
- Registration - there are still unregulated lenders who have not made the appropriate registration with the FCA;
- Business Models – the FCA has found discrepancies between firms’ registered and actual activities, and a lack of financial crime controls to keep pace with business growth;
- Risk Assessment – there are weaknesses in firms’ business-wide risk assessments and customer risk assessments;
- Due Diligence, Ongoing Monitoring and Policies and Procedures – there is often a lack of detail in AML policies, creating ambiguity around the actions staff should take to comply with their obligations under the regulations;
- Governance, Management Information and Training – the FCA has identified insufficient resources within financial crime teams, inadequate training, and an absence of a clear audit trail for financial crime-related decision-making.
In its August statement, the FCA explained that it is concerned that some firms rely too heavily on the financial crime controls of their parent company. Each individual firm within a group must assess whether these controls are appropriate for their particular financial crime risks, governance and operations.
The FCA is also concerned that some firms are relying on “off-the-shelf” procedures designed for different business models. Under the UK’s AML regime, each firm must have controls tailored to the way it operates and the particular risks it needs to manage.
Practical Implications of the FCA’s Renewed Focus
The FCA’s recent statement signals a heightened concern about the potential for Annex 1 firms to facilitate financial crime. Although these firms remain outside the full authorisation regime, the regulator appears to be using its AML supervisory powers more assertively.
The FCA has sent an information request to around 900 Annex 1 firms to improve its understanding of their activities, business models and risks. Firms must respond to this request, and where necessary refresh their risk assessments, policies and procedures.
Annex 1 firms should note that the FCA has also flagged potential AML concerns to regulated firms that deal with Annex 1 firms and has notified them that they must undertake proper due diligence, including confirming registration status, conducting independent checks, and managing any AML risks. This may mean that Annex 1 firms will be subject to increased due diligence when opening bank accounts and dealing with regulated counterparties and service providers.
The FCA has made it clear that it will be closely scrutinising applications to register as an Annex 1 firm. Firms that fail to demonstrate robust AML controls at the registration stage will face regulatory challenges and risk having their applications rejected.
What Should Annex 1 Firms Do Now
- Ensure that all entities entering into loans as lender are registered with the FCA (this includes individual SPVs when they act as the lender of record).
- Assess current financial crime risks (taking into account any changes to the firm’s business model and the comments within the 2025 National Risk Assessment) and update business-wide risk assessments and customer risk assessments as necessary.
- Review and strengthen AML policies, controls, and procedures to ensure they reflect the business model of the firm and are proportionate and effective.
- Ensure senior management accountability is clearly documented, and that appropriate fitness and propriety checks (including DBS checks) have been completed for all MLR individuals.
- Respond accurately to any information request from the FCA.
