Annex 1 firms: FCA scrutiny escalates from warnings to intervention

The Financial Conduct Authority (“FCA”) has made clear that it is tightening its supervision of Annex 1 firms and will intervene where necessary.

In its August 2026 statement, the FCA expressed concerns with unregulated lenders, safe custody providers, money brokers and financial leasing companies and their potential to facilitate financial crime. It also confirmed it had issued information requests to around 900 Annex 1 firms, after engagement with 300 firms late last year. By October 2026, the FCA had moved from scrutiny to intervention, imposing restrictions on six unregulated lenders doing new business following AML concerns identified while assessing their registration applications.

What is driving this heightened scrutiny?

Annex 1 firms can carry out certain financial activities captured by the FCA’s anti-money laundering registration and supervision regime, without being FCA-authorized and subject to the entire FCA rulebook. They are nevertheless required to be registered with the FCA for anti-money laundering purposes.

The FCA is concerned about risks it has identified in the sector, in particular the potential for Annex 1 firms to be facilitators of financial crime. Some firms are thought to rely too heavily on the financial crime controls of their parent company, which can result in ‘off-the-shelf’ procedures being applied that are not tailored to the firm’s size or specific risks, governance or operations.

There are also concerns about unregulated lending being conducted through complex structures, including special purpose vehicles. In its March statement, the FCA referred to consumers being encouraged to establish limited companies for access to unregulated loans, including bridging finance, and warned that customers would not have access to the Financial Ombudsman Service in such situations.

An intelligence-led approach to identifying risks early

In his September 2026 speech on financial crime, Steve Smart referred to Annex 1 firms when discussing the FCA’s approach to finding risks early and disrupting harm at pace. He highlighted the concerns around over-reliance on parent-company controls and complex lending structures, alongside closer scrutiny of applications, information-gathering and targeted supervisory and enforcement action.

The FCA is evidently prioritizing firms that it considers pose the greatest risk of harm and using data, technology and intelligence sharing to identify connections and risks more quickly. The message for firms is to make sure they can adequately demonstrate the effectiveness of their controls to the FCA. Businesses operating through overseas affiliates, intermediaries or complex funding chains will need to be prepared to explain who is accountable for each activity, where decisions are made, how customers are introduced to the business and how funds flow. These explanations should support the financial crime risk assessment and analysis of which entities need registration or other permissions.

What is the FCA seeking to establish?

The FCA’s increased information-gathering is intended to improve its understanding of firms’ activities, business models and risks, and to identify and disrupt financial crime. In practice, this is likely to involve:

• establishing what registered Annex 1 firms actually do and whether the information provided at registration remains accurate;
• identifying the customers, products, jurisdictions and structures that create particular risks;
• testing whether activities or structures create risks that are not apparent from existing information; and
• using that information to inform supervisory prioritization, potential enforcement and future policymaking.

What areas should firms be ready to explain?

We are already seeing clients experiencing greater scrutiny of Annex 1 registration applications. When submitting an application, firms should expect challenge from the FCA and be prepared to answer questions from the regulator. The precise questions will depend on the request, but firms should be ready to explain:

1. Business model and activities: services and products, revenue streams, customer base, geographic presence, funding arrangements and the role of group entities or special purpose vehicles. In particular, you should be able to explain why you need an Annex 1 registration but do not need a full Part 4A permission to conduct the relevant business.
2. Governance and controls: board and senior management responsibilities, compliance and risk management resources, escalation routes, outsourcing and oversight of group or third-party providers. MLROs and nominated officers should be prepared to answer questions about their experience. To the extent you need training to be ready for the role (for example, if you are experienced in other jurisdictions but not aware of the UK-specific requirements), consider taking that training in advance of submitting the application.
3. Financial crime controls: business-wide and customer risk assessments, customer due diligence and beneficial ownership checks, enhanced due diligence where appropriate, sanctions screening, ongoing monitoring and suspicious activity reporting procedures. Ensure that your policies and procedures are ready and tailored to your particular business model at the time of application.
4. Financial and operational data: transaction volumes and values, client categories and locations, financial resources and liquidity, and, where relevant, assets under management. Firms should be clear about reporting periods, definitions and entity boundaries.

Practical considerations for firms responding to information requests

• Responses can be time- and labour-intensive, which can put pressure on small teams in particular. It is advisable to appoint a response owner to identify contributors and reviewers who will keep track of the material evidencing each answer.
• Accuracy and consistency are crucial. Factual statements and figures should be cross-checked against underlying data and records before submission. Make sure that descriptions of governance and controls reflect actual practice as well as the policies formally in place. 
• Take legal advice where appropriate to help interpret the request, coordinate communications with the regulator and assess the implications of any identified control failures. Legal advisers can also support a proportionate pre-submission review and help ensure that remediation measures are clearly explained and supported by evidence.

The FCA has been signalling for some time that Annex 1 firms will face greater scrutiny. Based on conversations with clients, it is clear that those warnings are now being backed up by action from the regulator.

If you have any questions, please do not hesitate to get in touch.