FCA Annex 1 Scrutiny in 2026: What Firms Need to Review Now
The FCA has contacted the full Annex 1 population and begun restricting firms where AML controls are not good enough. We explain the areas unregulated lenders and other Annex 1 firms should review now.
Michaela Clarke
Operations & Compliance Coordinator
On this page
The FCA’s scrutiny of Annex 1 firms has intensified significantly during 2026.
What began as a wider review of the sector has now moved into direct supervisory intervention. The FCA has contacted the full population of registered Annex 1 firms, increased scrutiny of new registration applications and, most recently, imposed restrictions on a number of unregulated lenders following concerns about their anti-money laundering systems and controls.
For Annex 1 firms, particularly commercial lenders, bridging lenders and firms operating through complex property or SPV structures, the message is clear: registration under the Money Laundering Regulations is not a light-touch exercise.
Firms need to be able to demonstrate that their financial crime framework reflects how the business actually operates and that the controls work in practice.
What is an Annex 1 firm?
Annex 1 firms include certain businesses carrying on activities such as:
commercial and unregulated lending;
financial leasing;
money broking; and
safe custody services.
Where those activities are carried on by a business that is not otherwise FCA authorised, the firm may need to register with the FCA for supervision under the Money Laundering Regulations 2017.
This is different from FCA authorisation under the Financial Services and Markets Act.
An Annex 1 firm is supervised by the FCA for its compliance with the Money Laundering Regulations, but is not automatically subject to the FCA’s wider conduct regime simply because it is registered.
The FCA said in March 2026 that there were around 1,200 firms registered with it solely for AML purposes.
Why has the FCA increased its scrutiny?
The FCA has identified concerns about the potential for Annex 1 businesses to facilitate financial crime, particularly where firms are involved in unregulated lending and complex transaction structures.
In August 2026, the FCA confirmed that it had sent an information request to around 900 Annex 1 firms, following work with approximately 300 firms during late 2025.
Taken together, that means the FCA has contacted the entire registered Annex 1 population.
The regulator highlighted several areas of concern.
These include firms relying too heavily on financial crime controls operated by a parent company, using generic or off-the-shelf AML procedures that do not reflect the firm's own business, and unregulated lending carried out through complex structures such as special purpose vehicles.
The FCA has also increased scrutiny of new Annex 1 registration applications and warned firms that applications may take longer while it assesses whether the applicant can demonstrate effective compliance with the Money Laundering Regulations.
The FCA has now started intervening
The significance of the FCA's current work became clearer on 23 October 2026.
The FCA announced restrictions on six unregulated lenders after identifying concerns about their AML policies, controls and procedures while assessing their registration applications.
The restrictions included limitations on taking on new customers, entering into new lending arrangements and, in some cases, accepting payments from existing customers.
Several of the firms were also required to commission independent reviews of their AML frameworks or systems and controls.
This is an important development.
The FCA's Annex 1 work is no longer simply about gathering information and understanding the sector. It is now resulting in firm-specific intervention where the regulator is not satisfied that financial crime risks are being managed effectively.
What is the FCA likely to look at?
The starting point should be whether the firm's AML framework reflects the risks created by its actual business model.
A policy document on its own will not demonstrate that.
The FCA will want to understand how the firm identifies risk, how that risk affects customer due diligence and how the business can evidence that its controls operated when they were required.
FCA focus | Questions firms should be asking |
|---|---|
Business model and registration | Do the activities described to the FCA accurately reflect what the firm actually does, its customers, funding arrangements and transaction flows? |
Business-Wide Risk Assessment | Does the BWRA address the firm's actual customers, products, jurisdictions, transaction types, delivery channels and ownership structures? |
Customer Risk Assessment | Is there a documented methodology and does the customer's risk rating actually change the level of due diligence and monitoring applied? |
CDD and beneficial ownership | Can the firm demonstrate that customers, directors and ultimate beneficial owners are identified and verified before the relationship begins? |
Enhanced Due Diligence | Are higher-risk customers, jurisdictions and structures identified consistently and subject to additional checks? |
Source of Funds and Source of Wealth | Where the risk requires it, is information independently corroborated rather than simply recorded from the customer? |
PEP, sanctions and adverse media screening | Is screening completed at the correct point, repeated where appropriate and supported by a clear alert and decision trail? |
Transaction and repayment monitoring | Does the firm understand where money is coming from, including repayments, third-party payments, refinancing and unusual transaction patterns? |
Governance and oversight | Is responsibility for financial crime clear and does senior management receive useful information on risks, exceptions and emerging issues? |
Records and evidence | Can the firm reconstruct why a customer was accepted, what checks were completed, who approved exceptions and when those decisions were made? |
Group controls may not be enough
This is particularly important for firms operating within a wider corporate group.
The FCA has expressly warned against excessive reliance on parent-company controls.
A group may have a central AML framework, compliance team or screening platform, but each Annex 1 entity still needs to assess whether those arrangements adequately address its own risks, governance and operations.
The same principle applies to template policies.
An AML policy that looks technically comprehensive may still be ineffective if it does not reflect the firm's actual lending model, customer population or transaction flows.
For example, a property lender dealing with SPVs, overseas borrowers, corporate guarantees and refinancing transactions is likely to face a different risk profile from a straightforward domestic SME lender.
Its risk assessment and controls should demonstrate that distinction.
Property and bridging lenders should pay particular attention
The FCA has specifically highlighted concerns around unregulated lending conducted through complex structures, including SPVs.
For property and bridging lenders, that makes several areas particularly important.
The firm should be able to understand and evidence the ownership and control of borrower entities, the source of funds being contributed to a transaction, the source of repayments, the role of connected parties and the rationale for unusual or complex structures.
Where borrowers, beneficial owners or funds originate from higher-risk jurisdictions, the firm's enhanced due diligence should be capable of demonstrating why the relationship was accepted and how the identified risks are being managed.
The same applies where payments are received from parties other than the contractual borrower.
These are not simply onboarding questions. They form part of the firm's ongoing understanding of the relationship.
Policies are only the starting point
A recurring difficulty in financial crime reviews is the difference between design effectiveness and operating effectiveness.
Design effectiveness asks whether the control is properly designed.
For example, does the firm's customer risk assessment capture the relevant risk factors? Does the AML procedure require appropriate enhanced due diligence? Are responsibilities clearly assigned?
Operating effectiveness asks the more difficult question: did the control actually happen?
That requires evidence.
A review of customer files may show whether identity verification preceded onboarding, whether higher-risk customers received enhanced due diligence, whether source of funds evidence was obtained when required and whether screening alerts were properly investigated.
Where controls were completed retrospectively or records cannot demonstrate when a decision was made, the firm may struggle to show the FCA that the control was operating effectively at the relevant time.
What should Annex 1 firms do now?
Firms should not wait for another FCA information request before testing their framework.
A sensible readiness exercise should start by mapping the business as it operates today, including legal entities, lending products, customer types, funding arrangements, intermediaries and payment flows.
The firm should then refresh its Business-Wide Risk Assessment and check that the risks identified there flow through into customer risk assessment, due diligence and ongoing monitoring.
A risk-based sample of customer files should also be reviewed.
This is often the quickest way to identify whether the framework on paper is translating into consistent practice.
The firm should also examine how money moves through the business. For lenders, that includes not only funds advanced to customers but also deposits, interest, repayments, early settlements, refinancing and third-party payments.
Finally, findings should be documented, prioritised and tracked through remediation.
Senior management should be able to demonstrate both what weaknesses were identified and what was done to address them.
Independent assurance can be valuable before FCA intervention
Not every Annex 1 firm needs a formal independent review.
However, independent assurance can be particularly useful where a firm:
has received an FCA information request;
is applying for Annex 1 registration;
has materially changed or expanded its lending activities;
operates through a group or SPV structure;
deals with higher-risk or overseas customers;
has experienced significant growth; or
has not recently tested whether its AML controls operate effectively.
A credible independent review should go beyond reading policies.
It should assess the design of the framework, test how controls operate in practice, undertake risk-based file sampling, identify root causes and distinguish genuine control failures from documentation or evidencing weaknesses.
Where remediation is required, the findings should be converted into clear actions, owners and target dates, with subsequent testing where appropriate.
The Financial Crime Guide is also changing
The FCA's focus on financial crime is continuing to develop.
On 23 October 2026, the FCA published consultation CP26/38 proposing further changes to its Financial Crime Guide.
The consultation expressly applies to firms supervised by the FCA under the Money Laundering Regulations, including Annex 1 firms.
The proposed changes cover areas including money laundering and terrorist financing, sanctions, fraud, proliferation financing, cryptoassets, data security and wider financial crime systems and controls.
The consultation closes on 24 December 2026.
Annex 1 firms should therefore consider both the FCA's current supervisory findings and how its financial crime expectations are continuing to evolve.
How MEMA Consultants can support Annex 1 firms
MEMA Consultants supports financial services firms with financial crime reviews, FCA remediation and regulatory readiness.
Our Annex 1 AML Readiness Review can be tailored to the size and complexity of the business and can cover:
business model and regulatory status;
Business-Wide Risk Assessment;
customer risk methodology;
CDD and beneficial ownership;
enhanced due diligence;
source of funds and source of wealth;
sanctions, PEP and adverse media screening;
transaction and repayment monitoring;
governance and financial crime oversight;
risk-based customer file testing; and
remediation planning.
Where the FCA has specifically required an independent review, we can also assess the relevant requirement and scope the review against the regulator's stated concerns.
If your firm has received an FCA information request, is applying for Annex 1 registration or would like to assess its AML framework before further FCA engagement, speak to the MEMA team about a proportionate readiness review.
Sources
FCA, FCA highlights risks when dealing with unregulated lenders, 20 March 2026.
FCA, FCA applying increased scrutiny to Annex 1 firms, 7 August 2026.
FCA, FCA restricts 6 firms following concerns over anti-money laundering controls, 23 October 2026.
FCA, CP26/38: Financial Crime Guide updates, 23 October 2026.
Need expert regulatory guidance?
Our ex-regulator team helps firms work through complex requirements and evidence compliance with confidence.