Fraud prevention for financial advisers: what the FCA expects

There is no single FCA fraud prevention checklist for financial advisers. Instead, the FCA expects every advice firm to have policies, procedures and controls that counter the risk of the firm being used to further financial crime, and it explains how in the Financial Crime Guide and its multi-firm reviews. A workable fraud framework covers two risks: the firm being used to commit or launder fraud, and clients being defrauded, for example through impersonation or payment scams.

What the FCA rules require

The Financial Crime Guide names two rules that "require firms to establish and maintain effective systems and controls to counter the risk that they might be used to further financial crime": SYSC 3.2.6R and SYSC 6.1.1R. Which one is yours depends on your firm type under SYSC 1 Annex 1, so check it before you rely on either. SYSC 3.2.6R covers a narrower group of firms; for most advice firms the relevant rule is in SYSC 6. The application provisions of SYSC 6.1 say its rules apply to a MiFID optional exemption firm, a category many advice firms fall into.

SYSC 6.1.1R says a firm "must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and appointed representatives (or where applicable, tied agents) with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime." Note the reference to appointed representatives: a network or principal firm should make sure its fraud controls reach its ARs too.

For firms within SYSC 3, SYSC 3.2.6R says a firm "must take reasonable care to establish and maintain effective systems and controls for compliance with applicable requirements and standards under the regulatory system and for countering the risk that the firm might be used to further financial crime." The practical point is the same under either rule: policies, staff who apply them, and evidence that they work.

What the Financial Crime Guide adds

The Financial Crime Guide is titled "A firm's guide to countering financial crime risks". Its introduction says it "provides practical assistance and information for firms of all sizes and across all FCA-supervised sectors" (FCG 1.1.1). That makes it the most useful single reference for an adviser building a fraud control framework.

The guide is not binding. FCG 1.1.7 says "the guidance is not binding and we will not presume that a firm's departure from our guidance indicates that it has breached our rules." In practice, it still helps to treat the guide as the benchmark, and to be able to explain why your own approach works wherever you depart from it.

The guide also links fraud controls to the Consumer Duty. It suggests firms may consider additional steps in their customer journeys to help prevent fraud, such as a real-time human contact for security or fraud concerns. For an advice firm, that can mean a named person clients can call when something about a payment request looks wrong.

For a fuller walk through the Handbook rules, see our insight on financial crime and the FCA Handbook rules.

FCA fraud prevention guidance in 2026

The FCA's financial crime page for firms points firms first to the Financial Crime Guide and the Financial Crime Thematic Reviews, and lists the FCA's latest publications. The FCA is consulting on updates to the Financial Crime Guide, so check that page for the current position and review your framework against the final text. Two recent reviews listed there are worth reading:

• Money mules: "Money mules: mule activity and cashing out findings". The review's subject is the use of accounts to move fraud proceeds, so any firm that receives or sends client money should set red flags for it.
• Asset management and alternative firms: "Asset management and alternative firms' financial crime controls: our findings". Its findings are relevant to investment-linked advice firms.

Client-facing fraud: what the APP review teaches advisers

Advisers often think of fraud as something that happens to banks. The clearest FCA statement on customer fraud is the multi-firm review "Anti-fraud controls and complaint handling in firms (with a focus on APP Fraud)". It is aimed at UK payment service providers, and it sampled 12 firms.

The review says the FCA was "disappointed to find several common weaknesses" in how firms managed fraud risk and treated customers. Its main themes were slow complaint handling, management information that focused on commercial risk appetite rather than customer impact, unclear decision letters, limited evidence that vulnerability was considered, and gaps in money mule risk management.

Advice firms that move or instruct client payments, or that handle switches, withdrawals and changes to bank details, can use the same themes as a checklist of questions. This is our reading of the FCA's themes, not a direct requirement on advisers.

A practical fraud control framework

The steps below turn the FCA's rules and themes into a working framework. They are suggested steps, not an FCA list.

1. Write a fraud risk assessment. Cover the firm being used for fraud or laundering and clients being defrauded. Record the risks, the controls against each, and who owns them.
2. Control client payments and bank detail changes. Verify any new or changed payment instruction through a route other than the one it arrived by, and record the check.
3. Set red flags for mule and scam activity. Include unexpected third-party payments, rapid movement of funds and pressure to act quickly.
4. Train staff and set an escalation route. Staff need to know what a suspicious request looks like and who to tell, without delay.
5. Handle complaints from fraud victims fairly. Set response times, write clear decision letters and record how vulnerability was considered.
6. Report management information on customer impact. Board packs should show how many clients were affected and what happened to them, not only the firm's risk appetite.
7. Review the framework against the FCG each year. Update it when the FCA changes the guide or publishes new findings.

What a supervisor is likely to ask for

Expect questions about evidence rather than policy wording: the risk assessment, the controls mapped to each risk, training records, and how real suspicious requests were handled. Dated evidence that controls operated is worth more than a policy on paper. A fraud incident that is badly handled can also become a complaint and a Consumer Duty issue at the same time, so keep the fraud framework joined up with complaints handling and vulnerability.

How MEMA can help

MEMA Consultants helps advice firms build fraud and financial crime controls that map to SYSC and the Financial Crime Guide, with evidence the firm can show an FCA supervisor. Start with our financial crime service. If you are an MLRO or financial crime lead, our page for MLROs and financial crime leads sets out how we work with them.