Anti-financial crime controls: the FCA issues a call for action

The Financial Conduct Authority (FCA) wrote a letter on 5 March 2024 to the Chief Executive Officers (CEOs) of “Annex 1” firms. These are firms that undertake specific financial activities and are therefore supervised by the FCA for compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs). There are approximately 1,000 “Annex 1” firms, which provide services such as consumer credit, safe custody services and portfolio management advice (among various others).

This “Dear CEO” letter comes amid what appears to be a significant uptick in activity and communication by the FCA with regards to its supervision and enforcement responsibilities, including recent proposals on major changes to its enforcement regime. 

In its letter, the FCA identifies four “critical” areas in which they observe common weaknesses within the anti-financial crime controls at Annex 1 firms, being: 

1. business model (including properly resourcing a firm’s anti-financial crime team);
2. risk assessments;
3. due diligence, ongoing monitoring and policies and procedures; and
4. governance, management, information and training.

Those familiar with the MLRs will observe that these represent a very substantial proportion of a firm’s obligations under the MLRs. Strikingly, the FCA has found in some instances that regulated firms do not have a business-wide risk assessment at all, which is perhaps part of the reason the FCA states that “some [firms] are still not getting the basics right”. 

The FCA “expect” that Annex 1 firms will complete a gap analysis against each of the above areas within six months and take “prompt and reasonable steps” to close any gaps identified. The FCA also expect that a senior manager will be responsible for the gap analysis and any remedial work undertaken in light of it. The FCA warn that they may, in “future engagements”, ask firms to provide the findings of their gap analysis and evidence of subsequent actions taken. Where a firm’s actions in response to this letter are deemed inadequate, the FCA “will consider appropriate regulatory intervention”.  

The letter is followed by a helpful appendix, setting out common weaknesses in more detail. Annex 1 firms, to whom this letter was addressed, will be guided by this as they undertake their gap analysis and associated work over the next six months. However, we consider that all firms subject to the MLRs – whether recipients of this letter or not – would be well advised to consider their own anti-financial crime controls in light of it and take remedial action if required. 

The FCA state this letter is the product of recent “on-site firm visits and desk-based assessments”. It appears they have been increasingly active in this area; we can expect to see yet more activity, and potentially enforcement, in the future.