The FCA has announced increased scrutiny of Annex 1 financial institutions following concerns about financial crime risks (read the FCA’s statement here).
The FCA highlights firms’ reliance on parent-company or off-the-shelf controls that may not reflect their specific risks, as well as risks arising from unregulated lending through complex structures. The FCA has increased scrutiny of registration applications and issued an information request to approximately 900 Annex 1 firms to better understand their activities, business models and risks.
Background
On 7 August 2026, the FCA announced increased scrutiny of Annex 1 financial institutions.Annex 1 firms are not authorised or subject to wider FCA regulation, but are nevertheless required to register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) where they carry on specified activities.
The FCA identifies the following types of business as examples of Annex 1 firms:
- unregulated lenders;
- safe custody providers;
- money brokers; and
- financial leasing companies.
The FCA has become increasingly concerned about the potential for Annex 1 businesses to facilitate financial crime, and about the risks to consumers and markets arising from activities that sit outside the FCA’s wider regulatory perimeter.
A developing area of FCA focus
The FCA’s approach to Annex 1 firms has developed significantly over the last two years:
- March 2024 – FCA identifies widespread AML weaknesses: the FCA wrote to CEOs of Annex 1 firms following a data-led review which identified common weaknesses, including discrepancies between firms’ registered and actual activities, financial crime controls that had not kept pace with business growth, inadequate risk assessments and insufficient resourcing and oversight (FCA announcement).
- Late 2025 – FCA expands its supervisory work: the FCA carried out further work with approximately 300 Annex 1 firms and issued information requests to these firms as part of its efforts to understand the sector.
- 25 February 2026 – MFS enters administration: Market Financial Solutions Limited (MFS), an Annex 1 business, entered administration.
- 20 March 2026 – FCA opens MFS investigation: the FCA announced an enforcement investigation into MFS. The FCA emphasised that MFS was an Annex 1 business registered and supervised solely for compliance with the MLRs, rather than an FCA-authorised firm (FCA announcement).
- 20 March 2026 – FCA highlights risks for regulated firms: the FCA also reminded regulated firms of the need to carry out appropriate due diligence when dealing with Annex 1 businesses (FCA announcement).
- 26 March 2026 – FCA Perimeter Report: the FCA’s 2026 Perimeter Report identified Annex 1 firms as an issue at the edge of the FCA’s regulatory remit. The FCA noted that greater information requirements and powers could help reduce risks by providing greater visibility of these firms. It also emphasised the distinction between the FCA’s AML supervision of Annex 1 firms and its wider regulatory powers (FCA Perimeter Report).
- August 2026 – FCA widens its information-gathering exercise: the FCA has now issued an information request to approximately 900 Annex 1 firms. This follows the work undertaken with 300 firms in late 2025 and means that the FCA will have contacted all registered Annex 1 firms. At the same time, the FCA has confirmed that it is closely scrutinising applications for Annex 1 registration.
Taken together, these developments indicate that Annex 1 firms have become a significant FCA supervisory priority, rather than a relatively low-profile registration category.
Key takeaways
There are a number of key takeaways for existing and prospective Annex 1 firms, corporate lenders and borrowers, as well as for regulated firms dealing with Annex 1 businesses:
Implications for existing Annex 1 firms
Responding to the FCA’s information request: existing Annex 1 firmsshould ensure that responsibility for coordinating their response to the FCA’s information request is clearly allocated and that the information provided is accurate, complete and consistent across the business. They should also consider reviewing their AML risk assessments, policies and procedures before submitting their response, identifying any gaps between documented controls and their operation in practice.
Where a review identifies weaknesses, firmsshould consider proactive remediation rather than waiting for the FCA to identify the issue through its supervisory work. It is also important to maintain a clear audit trail of the information and supporting evidence provided to the FCA.
Broader review: When undertaking a broader review, Annex 1 firms should examine their business model, regulatory perimeter and financial crime framework, ensuring that their activities are accurately captured, their risks are properly understood, and their systems and controls are appropriately designed to mitigate those risks.
The FCA has made clear that it wants to understand firms’ actual activities, business models, customer bases and associated financial crime risks, and whether their controls are appropriately tailored to those risks.
| Annex 1 firms should consider in particular: Regulatory perimeter and registration: whether their FCA registration accurately reflects the activities they currently undertake and whether their regulatory perimeter analysis remains appropriate; Business model and risk assessment: whether they can clearly articulate their business model and demonstrate that their financial crime risk assessment is specific to their activities, products and customer base; Group arrangements: where AML systems or controls are provided at group level, whether these adequately address the risks specific to the firm and whether any reliance on group-wide or third-party systems and controls is appropriately assessed and managed; Governance, policies and resources: whether their policies and procedures are appropriately tailored and supported by adequate senior management oversight, expertise and resources; Customer due diligence: whether their CDD framework appropriately reflects the characteristics and risks of their actual customer base, including the nature of the products and services provided; Complex structures: whether they adequately understand the ownership, control, source of funds and economic purpose of transactions involving SPVs, layered corporate structures or multiple jurisdictions; and Effectiveness of controls: whether they can demonstrate that their AML framework operates effectively in practice, rather than simply having appropriate policies on paper, and that those controls address the specific financial crime risks arising from their business model. |
Implications for prospective Annex 1 firms
Firms preparing for Annex 1 registration should consider undertaking a pre-application review of their business model and AML framework, including all of the items listed as relevant to existing Annex 1 firms in Box 1 above. The FCA expects each prospective Annex 1 firm to demonstrate that its AML framework is appropriate to its own business, governance arrangements and risk profile.
The FCA has also indicated that registration applications are likely to take longer and that applicants will need to demonstrate clearly how they comply with the MLRs. Applicants should not assume that a group-level AML framework or a generic or “off-the-shelf” template will be sufficient without appropriate adaptation to their own business.
Registration should not be regarded as a one-off compliance exercise. AML controls, resourcing and oversight must keep pace with business growth. Firms should expect increasing scrutiny of whether their business model, governance arrangements and financial crime controls are properly aligned.
Implications for corporate lenders and borrowers
The FCA has expressly identified concerns about unregulated lending through complex structures, including special purpose vehicles (SPVs). This is particularly relevant to corporate lenders, including those providing property-backed or other finance through SPVs and layered corporate structures.
The FCA’s focus does not mean that corporate lending is prohibited or that such lending is now subject to FCA regulation. Rather, it suggests that the FCA is increasingly focused on whether apparently unregulated lending structures create risks to consumers and markets that are not adequately addressed by the existing regulatory framework. The distinction between genuine commercial lending transactions and structures which may ultimately involve or expose individual consumers is particularly important.
Annex 1 lenders should therefore ensure that their AML frameworks adequately reflect the risks of their particular business model, including any complex ownership structures, cross-border transactions, third-party funding or repayment, and any uncertainty about the ultimate economic beneficiary.
Borrowers should also expect lenders and their funding banks and credit funds to seek more detailed information on corporate structures, beneficial ownership, source of funds and transaction purpose as part of enhanced due diligence.
Implications for regulated firms dealing with Annex 1 businesses
The FCA has also specifically reminded regulated firms that they should carry out appropriate due diligence on Annex 1 counterparties and obtain direct confirmation of their registration status. Counterparty due diligence should reflect the particular risks posed by the Annex 1 business, rather than assuming that registration itself provides assurance.
Regulated firms should consider whether their due diligence appropriately addresses:
- the Annex 1 firm’s precise activities and business model;
- whether those activities are consistent with the firm’s FCA registration;
- the firm’s AML governance and control framework;
- the scope and quality of any external AML audit or assurance work;
- the nature and risk profile of the firm’s customers;
- the use of complex corporate or SPV structures; and
- whether ongoing monitoring remains appropriate as the relationship develops.
The FCA has indicated that it has already identified weaknesses in some regulated firms’ approach to Annex 1 counterparties. This could have practical consequences for banking relationships, wholesale funding arrangements and other forms of institutional engagement with unregulated lenders.
Further information
The FCA’s increased focus on Annex 1 firms is likely to continue, with the information gathered through this exercise informing its future supervisory and enforcement approach and potentially leading to further scrutiny of firms operating in this space.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
