The FCA has restricted six Annex 1 firms following concerns about their anti-money laundering controls. With the regulator still reviewing information from hundreds of other firms, what does this mean for the wider Annex 1 sector?
On 23 October 2026, the Financial Conduct Authority (FCA) announced that six Annex 1 firms had been placed under Voluntary Requirements (VREQs) following concerns about their anti-money laundering (AML) policies, controls and procedures.
In these cases, the restrictions limit the firms’ ability to take on new customers or undertake new business with existing customers. Five of the six firms are also required to commission independent reviews of their AML frameworks, while one is subject to requirements relating to the orderly wind-down of its existing loan book.
For firms operating in the Annex 1 sector, this is an important development. The FCA has been signalling for some time that it intends to increase its scrutiny of these businesses. The regulator has been gathering more information about firms’ activities and financial crime risks, increasing its scrutiny of registration applications and demonstrating a willingness to intervene where firms are not meeting its expectations.
The latest announcement is a further indication of how that supervisory approach is developing. It also raises an important question for other Annex 1 firms: would their own AML arrangements stand up to similar scrutiny?
How did we get here?
Annex 1 firms must register with the FCA for supervision under the Money Laundering Regulations (MLRs), even where they are not otherwise FCA-authorised. This distinction is important. Although these firms are not subject to the FCA’s wider regulatory regime, they are still required to maintain effective AML systems and controls appropriate to their business and the risks they face.
The FCA’s attention to this sector is not new.
In 2024, it wrote to Annex 1 firms highlighting concerns about AML standards and the need for firms to ensure their arrangements met regulatory requirements. This was followed by further supervisory work involving approximately 300 firms in late 2025.
In August 2026, the FCA confirmed that it had issued an information request to around 900 Annex 1 firms. Together with its earlier supervisory work, this meant that the FCA would have contacted the entire registered Annex 1 population.
The regulator has also become increasingly explicit about the weaknesses it is finding. These include firms relying too heavily on the financial crime controls of parent companies, adopting generic or off-the-shelf procedures that do not reflect their own business, and failing to adequately understand the risks associated with complex lending arrangements.
In September 2026, Steve Smart, the FCA’s Executive Director of Enforcement and Market Oversight, reinforced the regulator’s focus on Annex 1 firms, explaining that it was gathering more information, scrutinising new applications more closely and prioritising firms presenting the greatest potential harm.
The latest VREQs should therefore be viewed as part of a wider programme of supervisory activity rather than six isolated cases.
Should Annex 1 firms expect more FCA intervention?
We think so.
The FCA identified concerns about the firms’ AML policies, controls and procedures while assessing their registration applications. The resulting restrictions demonstrate the regulator’s willingness to intervene where firms cannot demonstrate that their AML arrangements meet regulatory expectations.
Separately, the FCA is continuing to assess responses to information requests issued to the wider Annex 1 population. It has indicated that this information will help it identify financial crime risks and determine where further supervisory action may be necessary.
It would be surprising if that exercise did not result in additional supervisory engagement with firms where responses raise concerns about their AML arrangements. This could mean further information requests, scrutiny of individual firms, independent reviews and remediation requirements. Where more serious weaknesses are identified, further restrictions or cancellation action may follow.
The direction is becoming increasingly clear: Annex 1 registration is not simply an administrative requirement. The FCA expects firms to demonstrate that they understand their financial crime risks and have effective arrangements in place to manage them.
What does this mean in practice for Annex 1 firms?
For many Annex 1 firms, the challenge is not necessarily the absence of AML policies or procedures. It is whether the arrangements they have in place are sufficiently tailored to the business, implemented consistently and supported by evidence.
Through our independent reviews of Annex 1 firms’ financial crime frameworks, we have seen that firms may have many of the right individual controls in place, but that these do not always work together as a coherent framework.
For example, a business-wide risk assessment needs to accurately reflect the firm’s activities and inform the controls it applies. Similarly, policies and procedures should describe what happens in practice, rather than setting out a generic framework that is not followed.
So, if you’re MLRO for, or responsible for AML at, an Annex 1 firm, what should you think about?
- Does the business-wide risk assessment (BWRA) reflect the firm’s actual business?
The BWRA is the starting point for the AML framework and should consider products, customers, geographic exposure, delivery channels and transaction characteristics and the risks faced in each area. The important question to consider is whether the risk assessment informs the controls the firm operates, rather than simply existing as a standalone document.
- Are policies and procedures proportionate, but sufficiently specific?
The controls in place within a firm should be proportionate to the risks it faces. This does not necessarily mean having complex systems or extensive documentation, but it does mean having clear, effective controls that are appropriate for the business.
The FCA has been clear that firms cannot simply adopt generic procedures or group policies without considering whether they are suitable for their own activities. Equally, policies and procedures must accurately reflect how controls actually operate in practice, rather than describing arrangements that are not in place or are not consistently followed.
The important question is whether your documented policies and procedures reflect what happens in your business, and whether those arrangements adequately address the risks you face.
- Can the firm demonstrate that its controls actually work?
Having AML policies and procedures is one thing. Being able to evidence that the controls reflected in those policies and procedures are working in practice is another.
The important question is whether you can demonstrate that controls are operating as intended. This includes maintaining appropriate records of decisions and exceptions, and ensuring senior management receives sufficient information to understand whether the firm’s AML arrangements remain effective.
- Are the risks associated with lending and funding arrangements properly understood?
Where transactions involve multiple parties, complex corporate structures or third-party payments, firms need to understand the risks these arrangements create and what additional measures may be necessary.
This is particularly relevant given the FCA’s stated concerns about complex lending structures and the potential for financial crime.
The important question is whether the firm adequately understands the parties involved in its transactions, including beneficial ownership where relevant, the source of funds and any additional financial crime risks arising from its lending or funding arrangements.
How can Square 4 help?
At Square 4, we are already supporting Annex 1 firms, including specialist lenders, with independent reviews of their AML frameworks, assessing their arrangements against the Money Laundering Regulations and relevant FCA expectations.
Our work considers whether firms have appropriately identified and assessed their financial crime risks, whether their policies and procedures reflect their particular business model, and whether the controls they have in place are proportionate to those risks.
The FCA’s decision to require five of the six restricted firms to commission independent AML reviews is particularly relevant. It reinforces the value of independent challenge in identifying weaknesses and determining what improvements may be necessary.
Firms do not need to wait for regulatory intervention to assess their arrangements. For those that have already responded to the FCA’s information requests, now would be a sensible time to consider whether their frameworks and supporting evidence are sufficiently robust to withstand further scrutiny.
We can support firms at different stages, including:
- Independent AML health checks: reviewing the BWRA, governance, policies, procedures and controls, identifying gaps and recommending proportionate improvements.
- FCA information requests and supervisory engagement: helping firms understand what the FCA is asking, assess their existing arrangements, prepare accurate responses and address any weaknesses identified.
- Targeted remediation: supporting firms to strengthen their risk assessments, policies, procedures and controls, and helping them implement the necessary changes.
- Annex 1 applicability and registration: helping businesses establish whether registration is required, prepare applications and understand the AML obligations that follow.
- Ongoing financial crime support: providing access to specialist advisory expertise, periodic reviews and, where appropriate, managed screening and transaction monitoring services.
If you would like to discuss how Square 4 can support your firm with an independent AML review, FCA engagement or remediation, please get in touch.
