Unregulated does not mean unsupervised - the FCA’s focus on Annex 1 firms

Businesses can fall within the UK anti-money laundering (AML) regime even where their activities do not need FCA authorisation. The Financial Conduct Authority (FCA) is now subjecting Annex 1 firms and new registration applications to increased scrutiny, with particular concerns around unregulated lending structures, reliance on group-wide controls, and procedures that are not tailored to the individual business. Unregulated firms carrying on relevant financial activities, including unregulated lending, financial leasing and certain corporate finance work, should review whether registration is required and whether their AML framework can withstand scrutiny.

Why is the FCA increasing its scrutiny?

The FCA is increasing its scrutiny of businesses registered with it solely for AML supervision, commonly referred to as Annex 1 firms. These businesses may fall outside the requirement for FCA authorisation but remain subject to the UK Money Laundering Regulations (MLRs) because of the financial activities they carry on.

The FCA’s concern is not simply whether businesses have registered. It has identified potential weaknesses that could allow Annex 1 firms to be used to facilitate financial crime. These include excessive reliance on the financial crime controls of a parent company, the use of generic or off-the-shelf procedures that do not reflect the risks and operations of the individual legal entity, and unregulated lending through complex structures, including special purpose vehicles (SPVs).

In the FCA’s view, these weaknesses may reduce the effectiveness of AML controls and make it harder to identify and disrupt financial crime. The regulator is therefore seeking a better understanding of Annex 1 firms’ business models, governance arrangements and risk management frameworks.

In August 2026, the FCA announced^[1] that it was scrutinising Annex 1 registration applications more closely and warned that applicants should expect the process to take longer. It also sent information requests to approximately 900 registered Annex 1 firms, following earlier work involving 300 firms in late 2025. According to the FCA, this meant it had contacted all registered Annex 1 firms. It intends to use the information gathered, together with other intelligence, to identify and disrupt financial crime risks.

The direction of travel was reinforced in September 2026, when Steve Smart, the FCA’s Executive Director of Enforcement and Market Oversight, said the regulator had “identified weaknesses that criminals could exploit – such as over-reliance on parent company controls and complex lending structures”.^[2] He confirmed that the FCA is gathering more information, scrutinising new applications more closely and prioritising firms where it sees the greatest potential for harm.

Could your business be an Annex 1 firm?

Annex 1 status depends on the activities carried on by a business. Broadly, a business may be required to register with the FCA as an Annex 1 firm where, in the course of business in the UK, it carries on one or more of the activities listed in Schedule 2 to the MLRs and is not already supervised for those activities by the FCA, by virtue of it being an authorised firm conducting regulated activities, or another relevant supervisory body.

The important point is that being outside the ordinary regulatory perimeter does not necessarily put a business outside FCA oversight. Commercial lenders, finance lessors, providers of safe custody services and some corporate finance businesses can all be caught. Lending SPVs may also require registration, depending on their role, the interests they acquire and the activities they carry on in practice.

The perimeter is not always straightforward, particularly because the Schedule 2 activities do not align neatly with the activities requiring authorisation under the Financial Services and Markets Act 2000. Businesses should therefore assess what they do in practice, rather than relying only on labels, group arrangements or assumptions about their regulatory status.

Activities that may bring a business within scope:

• Lending, including commercial lending, factoring and financing commercial transactions

• Financial leasing

• Payment services and issuing or administering other means of payment

• Guarantees and commitments

• Trading in certain financial instruments

• Participating in securities issues and providing related services

• Certain corporate finance and M&A advisory services

• Money broking, portfolio management and advice

• Safekeeping and administration of securities

• Safe custody services

• Issuing electronic money

What Annex 1 firms need to do

An in-scope business must register with the FCA and have an AML, counter-terrorist financing and counter-proliferation financing framework in place. Registration is not a one-off formality. The firm must continue to comply with the MLRs and will be subject to the FCA’s ongoing, risk-based supervision.

In practical terms, that means understanding and documenting the risks arising from the firm's own business model through an appropriate business-wide risk assessment, appointing appropriate senior responsibility for MLR compliance and suspicious activity reporting, and maintaining proportionate policies, procedures, customer due diligence, ongoing monitoring, training and record-keeping. Group frameworks may assist, but each legal entity must be able to demonstrate that its risk assessment, policies and controls are appropriate for its own activities and risks.

Businesses preparing an application should also factor in the FCA’s warning that applications are taking longer while it applies increased scrutiny to firms’ business models, risks and proposed controls.

What if an in-scope business is not registered?

The consequences can be immediate and commercially disruptive. The FCA has directed businesses carrying on Annex 1 activities without registration to apply and may require detailed information about the nature, scale and financial scope of the activity. It may also seek the voluntary suspension of in-scope business while the position is addressed. Depending on the circumstances, carrying on relevant business without the required registration may expose the firm and those responsible for it to regulatory and potentially criminal consequences under the MLRs.

Businesses should not wait for an FCA enquiry. A proactive review provides an opportunity to determine whether registration is required, identify any gaps in the AML framework and consider how best to address historic activity. It may also reduce the risk of disruption to lending, funding, banking or other commercial relationships while the firm’s regulatory position is examined.

The FCA has also encouraged authorised firms to understand whether counterparties carrying on relevant activities are appropriately registered, increasing the likelihood that Annex 1 status will be scrutinised as part of due diligence exercises.

How Freeths can help

Our Financial Services Regulatory team helps businesses assess whether their activities fall within the Annex 1 regime, prepare FCA registration applications, review proportionate AML frameworks, and respond to FCA information requests or other supervisory engagement. If you are unsure whether your business may be in scope, you have received a letter from the FCA, or you need advice in connection with your AML obligations, please contact Sushil Kuner or Josh Bates.

Footnotes

^[1] FCA applying increased scrutiny annex 1 firms statement

^[2] FCA financial crime protective hive speech