In August 2026, the FCA sent an anti-money laundering (AML) questionnaire to approximately 900 Annex 1 firms. It marks a shift in how the regulator supervises this part of the market. Understanding the background is important for any Annex 1 firm trying to work out what comes next, but there are also wider implications for fully authorised financial services firms that interact with them.
Annex 1 firms carry out activities such as lending, financial leasing, safe custody services and money broking without needing full FCA authorisation. Instead, they fall within the scope of the UK’s money laundering regulations, and are registered with the FCA only for AML supervision. These firms have historically sat on the edge of UK financial regulation and have largely avoided the scrutiny faced by authorised firms. That arm’s-length approach is coming to an end.
How we got here
The FCA’s concerns have been around a while. In March 2024, it sent a “Dear CEO” letter to all registered Annex 1 firms. The letter described control failings in four areas:
- Business models that had outgrown their compliance controls
- Risk assessments that were poorly documented or too generic
- Due diligence procedures that created ambiguity for staff
- Governance concerns, such as under-resourced financial crime teams, lack of training and an absence of clear audit trails around decision-making.
Firms were given six months to complete a gap analysis, with a request to “take prompt and reasonable steps to close any gaps identified”. The FCA warned that it could order third-party reviews, impose fines or remove a firm’s registration.
The urgency increased with the collapse of Market Financial Solutions (MFS), a bridging lender registered as an Annex 1 firm, which went into administration in February 2026. Around £1.3bn is alleged to be missing from the business. Several major banks were left with significant exposures, amid allegations that the same property had been used as security for more than one loan, known as ‘double pledging’. These allegations are currently unproven, and MFS’s founder denies any fraud.
On 20 March 2026, the FCA opened an enforcement investigation into MFS, which, given the FCA’s supervisory remit with Annex 1 firms, is limited to compliance with the UK’s money laundering regulations. On the same day, the FCA warned regulated firms about the risks of dealing with unregulated lenders. It also highlighted cases where consumers had been encouraged to set up limited companies to access bridging finance, leaving them without Financial Ombudsman protection.
August’s AML questionnaire may have looked like routine data collection, but it should be viewed as a formal assessment of Annex 1 firms’ financial crime controls. It followed an initial group of around 300 firms contacted in late 2025, which means the FCA has now contacted all registered Annex 1 firms.
What the FCA is concerned about
Viewed together, these events point to a set of structural weaknesses. Annex 1 leadership teams should test their own business against the following:
- Relying on someone else’s controls: depending on a parent company’s or introducer’s controls without checking that they fit your own business and risk appetite.
- Generic procedures: off-the-shelf templates that don’t reflect how the business actually manages financial crime risk day to day.
- Complex lending structures: special purpose vehicles (SPVs) that make it harder to see who really owns or controls a borrower.
- Registration that no longer matches the business: a gap between the activities a firm registered for and the products it offers today.
- Compliance that hasn’t kept up: resources, record keeping and training that haven’t grown in line with the business.
Implications
For authorised firms
The scrutiny doesn’t stop with Annex 1 firms. It also extends to regulated firms, such as banks, that fund their lending. Alongside the MFS investigation, the FCA reminded these firms of their due diligence obligations. The message is clear: an Annex 1 FCA registration is not a substitute for due diligence. Authorised firms still need to exercise robust AML controls.
For Annex 1 firms
The questionnaire is essentially a way of spotting outliers. If answers suggest that a firm’s compliance arrangements have fallen behind its growth, or that registration no longer matches what it does, that firm may well find it’s placed in a higher-risk group. Annex 1 firms that still might find themselves behind the curve here need to identify and document any gaps now. Being on the front foot and taking a proactive approach can still help demonstrate to the FCA serious intent in dealing with financial crime weaknesses.
What happens next
The deadline for responses to the questionnaire was 24 September 2026, and whilst the FCA hasn’t exactly indicated what it will do with them, there is a likely direction. Firms whose answers are thin, inconsistent or reveal gaps can expect follow-up questions, meetings or visits, and, in some cases, an independent review of their financial crime controls. Where the problems are serious, the FCA’s enforcement action could include fines or, at worst, cancellation of a firm’s registration, which for a lender would effectively end the business. At the same time, banks and other funders are likely to ask Annex 1 firms harder questions before extending or renewing credit lines.
Conclusion: the outlier model
This data-led approach is here to stay. It is the supervisory model I discussed earlier this year in The FCA at 13. As I noted then, the FCA’s anti-money laundering population is heading towards 60,000 firms, and the regulator has committed to lighter-touch supervision for firms that can show they are doing the right thing.
The Annex 1 questionnaire is that model in action. Of course, the FCA cannot visit around 1,200 Annex 1 firms, so it uses standard questions to compare the whole sector and find the outliers. Its resources will always be finite, so it will rely on data to decide where to step in.