‘Annex 1’ non-authorised firms face tougher FCA oversight as AML concerns grow

Earlier this year the regulator announced that it has sent information requests to around 900 Annex 1 firms and was increasing scrutiny of new registration applications, building on engagement with around 300 firms in late 2025.

The move forms part of a broader pattern of increasing FCA attention on financial crime risks associated with Annex 1 businesses, including unregulated lenders.

While Annex 1 registration has historically been viewed by some firms as a relatively light-touch compliance obligation, the FCA’s recent actions suggest that approach may no longer be the case.

A sector-wide warning

The FCA’s increased scrutiny of Annex 1 firms means lenders can no longer afford to treat registration and associated AML compliance as a peripheral issue. Firms across the lending chain should take steps now to understand their exposure to Annex 1 risk and address potential gaps.:

• Institutional and FCA-authorised lenders should review their exposure to Annex 1 and unregistered lenders and ensure their counterparty due diligence adequately addresses registration status and financial crime risk.
• Existing Annex 1 firms should stress-test their AML frameworks, including risk assessments, policies, due diligence, monitoring and governance, to ensure they remain effective in practice and capable of withstanding greater FCA scrutiny.
• Unregistered lenders should urgently establish whether their activities require Annex 1 registration. Where a potential historic or current registration issue is identified, firms should assess their activities and AML controls and consider their approach to registration and engagement with the FCA.

With scrutiny increasing, firms that identify and address potential issues early will be better placed to manage regulatory risk and any subsequent engagement with the FCA. The key considerations for each category of firm are explored below.

Why are Annex 1 firms attracting greater scrutiny?

The FCA’s increased focus follows the administration of Market Financial Solutions Limited (MFS) in February 2026 and the regulator’s subsequent opening of an enforcement investigation.

The case has brought renewed attention to the framework governing lenders that are registered for money laundering supervision purposes but are not authorised by the FCA under the Financial Services and Markets Act (FSMA) regime.

Importantly, the FCA’s concerns have been projected over several years, after the FCA highlighted weaknesses in AML controls across Annex 1 firms in 2024. It identified common control failings, undertook targeted engagement with around 300 firms in late 2025, reminded authorised firms of the risks of dealing with Annex 1 lenders in March 2026, and has now announced increased scrutiny across the sector.

Taken together, these developments provide a clear regulatory trend.

Annex 1 registration is no longer being treated as a low-profile administrative requirement but as an area of active supervisory interest that requires material consideration.

Institutional lenders should review their exposure

The FCA has specifically reminded FCA-authorised and institutional lenders to undertake appropriate due diligence on Annex 1 counterparties, including verifying registration status and understanding the financial crime risks associated with those relationships.

This means reviewing exposure across lending portfolios, funding arrangements and origination relationships. Particular attention may be required where lending structures involve specialist lenders, introducers or special purpose vehicles (SPVs).

Firms should understand not only who they are funding, but also the status of those businesses within the AML regime and the risks those relationships may create.

The FCA has put the market on notice that there are potential downstream money laundering risks within their distribution chains.

Existing Annex 1 firms should prepare for more active supervision

The FCA’s recent communications offer a clear indication of the areas likely to attract supervisory attention.

The regulator has identified a range of weaknesses including discrepancies between registered activities and actual business operations, deficiencies in business-wide risk assessments (BWRAs), weaknesses in customer risk assessments, inadequate customer due diligence, insufficient monitoring arrangements, and shortcomings in governance and financial crime resourcing.

Firms should therefore consider whether their AML framework accurately reflects how the business operates in practice, rather than simply how it is documented.

This exercise is particularly important for businesses operating through multiple entities or SPV structures. The FCA has specifically highlighted risks arising from unregulated lending conducted through complex structures and has indicated that firms should assess each relevant entity individually rather than assuming that group-level controls or registrations adequately address the position.

Firms should be able to demonstrate that their BWRAs, AML policies, customer risk assessments and due diligence procedures are appropriate to the risks they face and are embedded into day-to-day operations.

Unregistered lenders should assess whether registration is required

The FCA’s recent messaging may be most significant for lending businesses that have not previously considered whether they fall within the Annex 1 regime.

Businesses providing relevant services in the UK, including lending, factoring and the financing of commercial transactions, may be required to register where the conditions set out in the Money Laundering Regulations are met.

Accordingly, firms that have not assessed their position should do so promptly. Those that conclude registration is required should expect applications to be subject to increased scrutiny and should be prepared to demonstrate how they will comply with their AML obligations.

For some businesses, that review may identify a potential historic registration issue. In those circumstances, delay is unlikely to improve matters and a swift application is encouraged.

Firms should take advice on the scope of the registration requirements, assess historic and current activities, review AML controls and consider an appropriate strategy for registration and engagement with the FCA. Continuing relevant activities while a known registration issues remains unresolved may increase regulatory risk and make the firm’s historic position more difficult to explain if a registration application is submitted at a later date.

Annex 1 risk now extends across the lending chain

The wider significance of the FCA’s recent interventions is that Annex 1 risk is no longer a consideration solely for firms directly subject to the registration regime.

The regulator’s concerns now extend across the lending ecosystem, from unregistered originators and SPVS through to registered Annex 1 firms and the institutional lenders that fund them.

The commercial message is broader than registration alone. Firms throughout the lending chain should be considering how Annex 1 risks arise within their business and whether existing due diligence, governance and financial crime controls remain adequate in light of the FCA’s increased scrutiny.

The FCA has made clear that it sees financial crime risks within the sector and intends to supervise those risks more actively. Whether firms are institutional lenders, registered Annex 1 businesses or lenders that have yet to consider whether registration is required, the direction of travel is clear: Annex 1 firms may be unregulated for many purposes, but they are no longer being overlooked.

Co-written by Tom Murrell of Pinsent Masons.