Financial Crime Prevention & Compliance

The FCA expects a risk-based approach to anti-money laundering under the Money Laundering Regulations 2017 (MLR 2017). This includes a documented business-wide risk assessment, customer due diligence (CDD) proportionate to risk, ongoing monitoring of business relationships and transactions, suspicious activity reporting (SARs) to the NCA, staff training and awareness programmes, and independent audit of AML systems and controls. The FCA assesses firms against these requirements during supervisory visits and through its financial crime data returns.

Regulation 18 of MLR 2017 requires firms to carry out a documented assessment of the money laundering and terrorist financing risks they face. The business-wide risk assessment (BWRA) must consider customer types, countries of operation, products and services offered, delivery channels, and transaction volumes. It must be kept up to date (reviewed at least annually), approved by senior management, and made available to the FCA on request. The BWRA forms the foundation of a firm's entire AML programme and informs the level of CDD applied to different customer segments.

All firms subject to the Money Laundering Regulations must appoint a nominated officer (commonly known as the Money Laundering Reporting Officer, or MLRO) to receive internal suspicious activity reports and decide whether to submit SARs to the National Crime Agency. Under SM&CR, the MLRO role is designated as SMF17 and requires FCA pre-approval. The MLRO must have sufficient seniority, resources, and authority to fulfil the role effectively. For smaller firms, the MLRO role can be combined with other senior management functions.

Regulation 24 of MLR 2017 requires firms to provide regular training to all relevant employees. The FCA expects AML training to be delivered at induction for new staff and refreshed at least annually for all employees. Training should be tailored to the specific risks and typologies relevant to the firm's business, cover current regulatory expectations and emerging threats, and include practical case studies. Records of training delivery and attendance must be maintained and made available to the FCA on request.