Beyond Registration: What the FCA's Annex 1 Review Reveals About Modern AML Expectations

At first glance, the announcement appears directed at a niche group of businesses. However, the significance of the FCA's message extends beyond Annex 1 firms themselves. The regulator's concerns reflect broader themes emerging across AML supervision: firms are expected to understand their own risks, implement controls tailored to those risks, and be able to demonstrate that those controls operate effectively in practice. 

What are Annex 1 firms?

Annex 1 firms include businesses such as unregulated lenders, safe custody providers, money brokers and financial leasing companies. Although these firms are not generally authorised by the FCA under the Financial Services and Markets Act 2000, they are required to register with the FCA for anti-money laundering purposes where they undertake activities falling within scope of the Money Laundering Regulations. 

The distinction is important. Registration for AML purposes should not be confused with FCA authorisation. Annex 1 firms are supervised for compliance with the Money Laundering Regulations but do not fall within the FCA's wider conduct regime in the same way as authorised firms. 

Why is the FCA concerned?

The FCA has identified a number of risks within the sector, particularly the potential for some Annex 1 firms to facilitate financial crime. The regulator has also highlighted concerns around unregulated lending structures, including the use of complex arrangements and special purpose vehicles.

Perhaps more interestingly, the FCA has raised concerns about firms relying too heavily on group-wide financial crime controls. The regulator has made clear that individual firms cannot simply adopt the policies of a parent company or apply generic procedures developed for another business. Instead, each firm must assess whether its controls are appropriate to its own risk profile, governance arrangements and operational structure. 

This is a point that extends far beyond Annex 1 firms.

The continued move towards tailored compliance

One of the clearest themes emerging from recent FCA activity is the expectation that compliance frameworks must be specific to the business they are intended to protect.

Regulators are increasingly sceptical of off-the-shelf policies that bear little resemblance to the way a firm actually operates. The question is no longer whether a firm has an AML manual, risk assessment or set of procedures. Increasingly, the question is whether those documents accurately reflect the firm's business model and the risks it faces.

The FCA's criticism of over-reliance on group controls reflects this wider trend. Firms cannot assume that a policy is adequate simply because it has been approved elsewhere within the group. The key issue is whether the control is appropriate for the regulated entity applying it and capable of mitigating the particular risks that entity faces. 

Increased scrutiny of applications

The FCA has confirmed that it is closely scrutinising applications for Annex 1 registration and has warned firms to expect registration applications to take longer. Firms will need to demonstrate that they can comply with the Money Laundering Regulations and that their governance arrangements, risk assessments and financial crime controls are appropriate for the risks presented by their business.

According to the FCA, there are approximately 1,200 Annex 1 firms registered for anti-money laundering purposes in the UK. The regulator has now contacted the entire registered population through a combination of targeted engagement with around 300 firms in late 2025 and a subsequent information request to approximately 900 further firms. This suggests that the FCA's latest intervention is not a thematic sample but a sector-wide exercise.

More than a registration exercise

The FCA's latest statement should also be viewed in the context of its earlier warning to regulated firms about the risks of doing business with Annex 1 firms.

In March 2026, the FCA reminded authorised firms that they should undertake meaningful due diligence when dealing with Annex 1 businesses, including independently verifying registration status and understanding the associated risks. In practical terms, this places increasing pressure on FCA-authorised firms to identify whether the businesses they deal with are carrying on activities that require AML supervision and, where they are, to verify that the business is properly registered with the appropriate supervisory authority. The focus is no longer limited to understanding a customer's business model; firms are increasingly expected to understand the customer's regulatory status and whether it is operating compliantly within the UK's AML framework. For businesses requiring AML supervision, this means that questions about registration and supervisory status are likely to become a routine part of onboarding, periodic reviews and wider due diligence exercises.

What does this mean in practice?

For Annex 1 firms, now is an appropriate time to revisit their AML framework critically.

Businesses should consider whether:

• financial crime risk assessments accurately reflect their activities;
• policies and procedures have been tailored to the firm's operations rather than inherited from another group entity;
• governance arrangements clearly allocate responsibility for AML compliance;
• management information provides meaningful oversight of financial crime risks;
• staff understand how policies are applied in practice; and
• sufficient evidence exists to demonstrate that controls operate effectively.

Firms that rely heavily on group policies should be prepared to explain why those controls are suitable for their specific business and how they have been adapted to address entity-specific risks.

However, the implications of the FCA's announcement extend beyond FCA supervision itself.

As discussed in my previous article, “Supervised or Suspended – are Banks the new gatekeepers?", a growing number of banks and financial institutions are asking customers to demonstrate that they are appropriately supervised where their business activities require AML registration or supervision. The FCA's latest intervention is consistent with that wider trend.

A wider compliance message

The FCA's announcement reflects a broader shift in how AML supervision is being viewed across the UK.

Increasingly, questions about AML registration and supervisory status are being asked not only by regulators but also by banks, payment service providers and other financial institutions as part of their financial crime controls.

This trend is not limited to Annex 1 firms. Similar enquiries are increasingly being directed towards businesses operating across the supervised sector, including:

• accountancy service providers;
• trust and company service providers;
• estate agency businesses;
• art market participants;
• high-value dealers accepting cash above the relevant thresholds;
• cryptoasset businesses subject to AML registration requirements; and
• Annex 1 firms, including unregulated lenders, money brokers, financial leasing companies and safe custody providers. 

From a legal perspective, the obvious risk is regulatory. Businesses carrying on activities that require AML supervision without being registered with the appropriate supervisory authority may be in breach of the Money Laundering Regulations and exposed to enforcement action, financial penalties and, in some cases, criminal consequences.

However, the more immediate commercial risk is often overlooked.

Where a bank or financial institution identifies that a customer appears to be carrying on activities requiring AML supervision but cannot demonstrate that it is appropriately supervised, the consequences can be swift. Requests for registration certificates, enhanced due diligence reviews, restrictions on account activity and wider compliance enquiries are becoming increasingly common. In more serious cases, businesses may find accounts suspended, transactions blocked, banking facilities withdrawn or relationships terminated altogether.

In that sense, AML supervision is no longer simply a regulatory issue. It is increasingly becoming a banking and operational issue.

A firm that cannot demonstrate that it is appropriately supervised may face questions not only from its regulator, but also from the financial institutions on which it relies to operate. For many businesses, the immediate threat may not be a regulatory fine but the practical consequences of losing access to banking facilities.

The FCA's intervention in the Annex 1 sector therefore carries a wider lesson. Businesses that require AML supervision should expect increasing scrutiny not only from regulators but also from banks and other financial institutions. While the legal consequences of failing to obtain the appropriate supervision can be significant, the commercial consequences are often felt first. For many businesses, the immediate risk is not a regulatory penalty, but the prospect of account restrictions, disrupted banking relationships and, ultimately, being de-banked altogether.