FCA Annex 1 Firms: Tougher AML Scrutiny From August 2026

On 7 August 2026 the FCA published a statement confirming that it is applying increased scrutiny to Annex 1 firms, including unregulated lenders, safe custody providers, money brokers and financial leasing companies registered with it for anti-money laundering purposes. Alongside the statement, the regulator said it had sent an information request to around 900 Annex 1 firms to build a clearer picture of their activities, business models and risks. For firms in this group, two supervisory messages are immediate: registration applications should be expected to take longer, and each individual firm within a group must assess whether group financial crime controls are appropriate for its own financial crime risks, governance and operations and must have controls tailored to how it operates and the risks it needs to manage.

The trigger is the FCA’s concern that Annex 1 firms can be used to facilitate financial crime. The statement is short, but it lands on a specific supervisory posture: closer examination of new registration applications, a sector-wide data-gathering exercise that now reaches every registered Annex 1 firm, and a clear signal to regulated firms that deal with this population to check who they are dealing with.

Related reading: FCA financial crime speech, June 2026: AML reporting expectations for UK regulated firms.

The three things that changed on 7 August 2026

The statement is an escalation of an approach the FCA has been building through 2026 rather than a single new rule. The sequence matters, because it shows the direction of travel for this sector.

• Late 2025: the FCA followed up with 300 Annex 1 firms as part of its ongoing work in the sector.
• 20 March 2026: the FCA published a separate statement highlighting the risks to regulated firms when they do business with Annex 1 firms, and reminding them to carry out proper due diligence.
• 7 August 2026: the FCA confirmed increased scrutiny, sent an information request to around 900 Annex 1 firms, and said it will use the responses and other intelligence to identify and disrupt financial crime risk in the sector.

Read together, the two phases of engagement mean the FCA will have contacted every registered Annex 1 firm. That is the headline for compliance teams: this is no longer a thematic sample. If a firm holds an Annex 1 registration, it is inside the FCA’s current line of sight.

What an Annex 1 firm actually is under the Money Laundering Regulations

The label causes more confusion than almost any other term in UK anti-money laundering supervision, so it is worth being precise. Under regulation 55(2), an Annex 1 financial institution is a financial institution that falls within regulation 10(2)(a) and is not a money service business, an authorised person, a bill payment service provider, or a telecommunication, digital and IT payment service provider. Regulation 10(2)(a) covers an undertaking carrying on one or more listed activities, subject to the exclusions in regulation 10(3). Regulation 10(4) defines the listed activities as points 2 to 12, 14 and 15 of Schedule 2, including lending, financial leasing, money broking and safe custody services.

The shorthand refers to Annex I to the Capital Requirements Directive, where the activities were historically listed. The UK Money Laundering Regulations 2017 already set out the relevant listed activities in Schedule 2 when those Regulations were made, before the UK’s exit from the EU. The current UK registration perimeter should therefore be determined from the domestic 2017 Regulations, including regulations 10 and 55 and Schedule 2.

The registration regime sits in Part 6 of the regulations. The FCA maintains a register of Annex 1 financial institutions under regulation 55. Regulation 56 contains the relevant restriction on carrying on business where a register under regulation 55 has been established, and regulation 56(5) expressly recognises the case where a person has applied for registration and the application has not yet been determined. The FCA’s 7 August statement says that a firm carrying on the relevant activities without being registered should submit an application for registration.

Registered is not the same as authorised

The single most important distinction for anyone dealing with an Annex 1 firm is that AML registration confers none of the protections of FCA authorisation. Annex 1 firms are registered with the FCA solely so that their anti-money laundering controls can be supervised. They are not authorised under the Financial Services and Markets Act 2000, the FCA’s wider conduct rules do not apply to them, and their customers do not have access to the Financial Ombudsman Service.

This is why the FCA describes the lenders in this population as “unregulated” even though they hold a registration. A finance leasing company on the Annex 1 register is supervised for money laundering risk and nothing else. Treating that registration as a proxy for broader regulatory oversight is a mistake the FCA has now warned about twice in one year. The registration identifies the firm as registered for FCA AML supervision; it should not be treated as assurance that the firm’s AML controls are currently adequate. It also does not mean that the firm’s lending conduct, capital or treatment of customers is subject to the FCA’s wider rulebook.

The risks the FCA has named

The 7 August statement is specific about what worries the regulator, and each concern points at a control weakness rather than a reporting gap. Three stand out.

The first is over-reliance on a parent company. The FCA says it has seen firms lean too heavily on the financial crime controls of their parent, and it is explicit that each individual firm within a group must assess whether those controls are appropriate for its own financial crime risks, governance and operations. A group-level policy inherited without adaptation is the pattern the FCA is calling out.

The second is the use of off-the-shelf procedures. The regulator states that firms cannot rely on procedures designed for a different company, and that each must hold controls tailored to the way it operates and the risks it needs to manage. A template financial crime manual bought in and left unchanged sits directly in the FCA’s sightline.

The third is structural. The FCA’s 7 August statement expresses concern about risks to consumers and markets from unregulated lending often conducted through complex structures, including special purpose vehicles.

The information request to around 900 firms

The data-gathering exercise is the operational core of the statement, and it needs to be read for what it is. The FCA has asked around 900 Annex 1 firms for information on their activities, business models and risks. The FCA describes this publicly as an information request intended to improve its understanding of Annex 1 firms’ activities, business models and risks. The FCA has not identified the specific statutory power used for this exercise in its public statement, nor has that statement described the request as a recurring regulatory return.

That distinction matters for how a compliance team resources the response. A firm receiving the request should follow the requirements and deadline stated in its own FCA communication. The FCA’s public statement does not disclose the response deadline or state that the exercise is one-off, so those points should not be inferred from the public announcement. The quality of the answer is a supervisory signal in itself: a firm that describes its business model clearly and maps its own money laundering risks convincingly presents very differently from one that returns thin or evasive answers. The FCA has said it will use the responses, together with other intelligence, to identify and disrupt financial crime risks in the sector. Firms should answer the questions in the FCA request on their own terms rather than assume that the request is equivalent to the firm’s regulation 18 risk assessment.

For wider context on AML information-sharing approaches, see our note on FATF guidance on public-private partnerships and AML information sharing.

Slower and more searching registration decisions

Firms with a pending Annex 1 application, or planning one, should plan for a longer timeline. The FCA says it is closely scrutinising applications to register as an Annex 1 firm and that firms should expect registration applications to take longer. Applicants need to demonstrate clearly that they can comply with the money laundering regulations before the FCA will register them.

The statutory registration provisions have not been changed by the 7 August statement. What the FCA has announced is increased scrutiny of applications and an expectation that applicants clearly demonstrate their ability to comply with the MLRs. Regulation 57 permits the FCA to require a regulation 18 risk assessment and information showing how the applicant meets the MLR requirements, while regulation 19 requires proportionate policies, controls and procedures. The FCA separately states that each firm must assess whether group controls are appropriate for its own risks, governance and operations and cannot rely on off-the-shelf procedures designed for a different company.

The status of the timing point is worth keeping straight. Longer processing is the FCA’s stated supervisory expectation for how it will handle applications; it is not a change to any statutory determination period. Firms should build the delay into their commercial planning without treating a specific processing time as a legal entitlement.

What “you cannot rely on the parent” means in practice

The requirement to tailor controls is easy to state and harder to evidence, and it is where the FCA’s concern will bite. A subsidiary that operates in a different market, with different customers and different products from its parent, faces different money laundering risks, and its controls have to reflect that. Adopting the group financial crime framework wholesale, without a documented assessment of whether it fits the subsidiary’s own risk profile, is the gap the FCA is describing.

In practical terms the firm needs its own risk assessment that reaches its own conclusions, customer due diligence calibrated to its own client base, and transaction monitoring rules set for the products it actually offers. Where a group provides shared systems or a shared policy library, the subsidiary still has to show it has assessed the fit and adjusted for its own operations. Non-bank lenders and finance providers can find useful parallels in the way payment firms have approached group reliance; our summary of the Wolfsberg guidance on AML controls for non-bank payment service providers covers the same tension between group frameworks and entity-level accountability.

The MLRs allocate distinct governance responsibilities. Policies, controls and procedures under regulation 19 must be approved by senior management. Where appropriate for the size and nature of the business, regulation 21(1)(a) requires a board or senior-management individual to be appointed as the officer responsible for compliance with the MLRs. Regulation 21(3) separately requires the appointment of a nominated officer, whose functions include considering disclosures under regulation 21(5). Firms weighing how senior-manager responsibility is evidenced across the UK regime can read our coverage of the 2026 SM&CR reforms and individual accountability, which, while aimed at authorised firms, illustrates the direction of regulatory thinking on personal ownership of controls.

If you are a regulated firm dealing with Annex 1 firms

The 7 August statement echoes an earlier one. On 20 March 2026 the FCA reminded regulated firms of the risks of doing business with Annex 1 firms and set out what proper due diligence looks like. That guidance remains the reference point for any authorised firm with unregulated lenders, brokers or leasing companies as counterparties.

The FCA’s expectation is that a regulated firm dealing with an Annex 1 firm seeks direct confirmation from that firm of its registration status, conducts independent checks of the information provided, and understands and manages the associated risks, including those set out in the 2025 National Risk Assessment. Confirming registration is a floor, not a ceiling: registration tells a counterparty only that the firm’s AML controls are supervised, and, as the FCA stresses, an Annex 1 firm is not authorised under FSMA 2000 and its customers cannot use the Financial Ombudsman Service. A regulated firm that treats an Annex 1 registration as a clean bill of health has misread what the register means.

Frequently Asked Questions

We only provide commercial lending to businesses, not consumers. Do we still need to register as an Annex 1 firm?

Registration turns on the activity, not on whether the borrower is a consumer or a business. Lending is one of the listed activities in Schedule 2 to the 2017 Regulations, so a firm carrying on lending that is not otherwise authorised by the FCA or registrable in another category generally needs to be on the Annex 1 register. Where a firm is unsure whether its specific activity falls inside the perimeter, that boundary question should be checked against the regulations and the FCA’s registration guidance before proceeding.

We are a subsidiary of an FCA-authorised bank. Are we automatically outside the Annex 1 regime?

The Annex 1 definition excludes firms that are themselves authorised persons, so an authorised entity does not sit on the Annex 1 register. A separate legal entity within the group that carries on a listed activity but is not itself authorised can still be an Annex 1 firm in its own right, and being part of an authorised group does not remove its own registration obligation. Group membership is exactly the point the FCA makes about controls: each individual firm has to assess its own position.

Is the request to 900 firms a new recurring AML return we will have to file every year?

No. The FCA describes it as an information request about activities, business models and risks. The FCA’s public statement does not describe it as a recurring return, and no standing template has been identified. A firm should follow the requirements and deadline stated in its own FCA communication. Whether the FCA turns any part of this exercise into recurring data collection is a separate decision it has not announced.

What is the consequence of carrying on a listed activity without being registered?

The registration position is governed by regulations 55 and 56. Regulation 56(5) expressly recognises the case where a person has applied for registration and the application has not yet been determined. The FCA’s 7 August statement says that a firm carrying on the relevant activities without being registered should submit an application for registration. A firm that identifies a possible registration gap should check its position against the regulations and the FCA’s registration guidance and regularise it promptly where required.

Does the increased scrutiny change the legal test for registration?

The statutory registration provisions are unchanged. The FCA has announced increased scrutiny of applications and expects applicants to demonstrate clearly that they can comply with the money laundering regulations, with applications required to address the matters the FCA may specify under regulation 57, including the firm’s risk assessment and how it meets the MLR requirements.

Are Annex 1 firms subject to the FCA’s Consumer Duty and wider conduct rules?

No. Annex 1 firms are registered for AML supervision only and are not authorised under FSMA 2000, so the FCA’s wider conduct framework, including the Consumer Duty, does not apply to them and their customers cannot access the Financial Ombudsman Service. This is the core reason the FCA warns regulated counterparties not to over-read an Annex 1 registration.

How does the 7 August statement interact with the 20 March 2026 statement for our lending relationships?

The two are complementary. The March statement told regulated firms how to run due diligence on Annex 1 counterparties; the August statement tells Annex 1 firms directly that their own controls and registrations are under closer examination. A regulated lender with Annex 1 firms in its book should expect those counterparties to be answering FCA information requests and should factor that supervisory attention into its own risk view of the relationship.

Related Articles

• FCA Financial Crime Speech June 2026: how the FCA is framing AML expectations for UK regulated firms.
• Wolfsberg Non-Bank PSP AML Guidance: entity-level accountability where group AML frameworks are in play.
• SM&CR Reforms 2026: Accountability: how the UK regime evidences personal ownership of controls.
• AUSTRAC 2026 Financial Crime Risk Snapshot: a supervisor’s read on where money laundering risk concentrates.
• FATF Public-Private Partnerships and AML Information Sharing: wider context on AML information-sharing approaches.

Key Takeaways

• The FCA’s 7 August 2026 statement confirms increased AML scrutiny of Annex 1 firms: unregulated lenders, safe custody providers, money brokers and financial leasing companies.
• An information request went to around 900 Annex 1 firms; with the earlier 300 engaged in late 2025, the FCA will have contacted every registered Annex 1 firm. Follow the requirements and deadline stated in your own FCA communication.
• Registration applications will take longer, and applicants must demonstrate clearly that they can comply with the Money Laundering Regulations 2017 before the FCA registers them.
• Each firm in a group must run its own money laundering risk assessment and tailor its controls; inherited parent policies and off-the-shelf procedures are the pattern the FCA is targeting.
• Annex 1 registration is AML supervision only. These firms are not authorised under FSMA 2000, the wider conduct rules do not apply, and their customers cannot use the Financial Ombudsman Service.
• Regulated firms dealing with Annex 1 counterparties should seek direct confirmation of registration status, run independent checks, and weigh the risks in the 2025 National Risk Assessment (per the FCA’s 20 March 2026 statement).
• A firm carrying on relevant Annex 1 activities without being registered should check its registration position and submit an application where required, as the FCA’s 7 August statement directs. Regulation 56 contains the statutory registration restriction and expressly recognises an application that has been made and not yet determined.

Sources and References

• FCA, “FCA applying increased scrutiny to Annex 1 firms” (statement, 7 August 2026): https://www.fca.org.uk/news/statements/fca-applying-increased-scrutiny-annex-1-firms
• FCA, “FCA highlights risks when dealing with unregulated lenders” (statement, 20 March 2026): https://www.fca.org.uk/news/statements/fca-highlights-risks-unregulated-lenders
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), Part 6 (Registration): https://www.legislation.gov.uk/uksi/2017/692/part/6/chapter/2
• MLRs 2017, regulation 10 (financial institution definition and listed activities, Schedule 2): https://www.legislation.gov.uk/uksi/2017/692/regulation/10
• MLRs 2017, regulation 19 (policies, controls and procedures; senior management approval): https://www.legislation.gov.uk/uksi/2017/692/regulation/19
• MLRs 2017, regulation 21 (compliance officer and nominated officer appointments): https://www.legislation.gov.uk/uksi/2017/692/regulation/21
• MLRs 2017, regulation 55 (FCA register of Annex 1 financial institutions): https://www.legislation.gov.uk/uksi/2017/692/regulation/55
• MLRs 2017, regulation 56 (restriction on carrying on business where register established): https://www.legislation.gov.uk/uksi/2017/692/regulation/56
• MLRs 2017, regulation 57 (applications for registration; information the FCA may require): https://www.legislation.gov.uk/uksi/2017/692/regulation/57
• FCA, “Money Laundering Regulations” (supervision overview): https://www.fca.org.uk/firms/financial-crime/money-laundering-regulations

Preparing for the FCA’s tougher line on Annex 1 firms

For an Annex 1 firm, the immediate task is the information request: answer it fully and in accordance with the FCA’s own communication, with a firm-specific description of the business and its money laundering risks. The work behind that answer is the same work the regulator will look for in a registration decision, a live risk assessment and a set of controls the firm can show are its own. A regulated firm with Annex 1 counterparties should refresh its due diligence now, starting with direct confirmation of each counterparty’s registration status. The FCA has contacted the whole sector; the firms that respond with evidence of controls built for their own business are the ones that will move through this cycle with the least friction.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.