Annex 1 firms under the microscope: the FCA industrialises AML scrutiny

The FCA has moved from sampling to saturation. With an information request now issued to around 900 Annex 1 firms, following earlier work with 300 firms in late 2025, the regulator has effectively contacted every registered firm in the sector (FCA). The message to boards is blunt: registration is not a formality, and reliance on parent company controls will not hold.

Key Executive Takeaways

• The FCA has written to all registered Annex 1 firms, including unregulated lenders, safe custody providers, money brokers and financial leasing companies, and is scrutinising new registration applications more closely, meaning longer approval timelines and higher evidential bars.
• Regulated firms transacting with Annex 1 counterparties are expected to conduct enhanced due diligence and seek direct confirmation of registration status, shifting AML risk assessment onto the wholesale and lending relationships desk.
• Group-level financial crime controls and generic procedures are explicitly insufficient: each entity must demonstrate tailored controls proportionate to its own business model and risks.

A supervisory posture, not a one-off exercise

The FCA's statement, published on 7 August 2026, frames the intervention as ongoing intelligence-gathering rather than a discrete thematic review (FCA). The regulator's concerns cluster around two axes: firms leaning on parent company frameworks without local calibration, and unregulated lending routed through special purpose vehicles and other complex structures. Both are recognisable patterns in private credit, asset-backed finance and bespoke lending arrangements that have expanded materially in recent years.

The operational consequence is that firms should expect registration applications to take longer, and that intelligence from the 900-firm information request will feed disruption activity (FCA). For boards, that means the population of counterparties a regulated firm deals with today may look different in twelve months, either because firms exit voluntarily or because the FCA acts on what it finds.

The counterparty due diligence problem

The more immediate question sits with regulated firms doing business with the Annex 1 population. The FCA has explicitly told regulated firms to continue due diligence and to seek direct confirmation of registration status (FCA). That is a higher standard than checking a public register: it implies live confirmation, documented enquiry, and an assessment of the counterparty's own controls rather than trust in its group affiliation.

Banks providing warehouse lines to unregulated lenders, custodians onboarding safe custody providers, and prime brokers or clearing banks servicing money brokers should read this as a direct instruction. The exposure is twofold: reputational, if a counterparty is later disrupted, and supervisory, if the firm's own AML controls are judged to have accepted comfort where scrutiny was warranted.

Governance implications for group structures

The insistence that each entity assess whether parent controls are appropriate to its own financial crime risks cuts against a common cost-efficiency model in financial services groups (FCA). Shared services and centralised MLRO functions remain permissible, but the burden of proof has shifted. Boards of subsidiaries within a group perimeter need documented evidence that the controls they inherit are calibrated to their specific activities, customers and geographies.

The wider signal is that the FCA is willing to use its AML supervisory tools to reach parts of the market that sit outside conduct authorisation. For senior leaders, the practical implication is that counterparty risk and financial crime risk are converging, and the diligence file needs to reflect that.