FCA Restricts Six Annex 1 Lenders Over AML: What Annex 1 Firms and the Firms That Bank Them Must Do

On 23 October 2026 the FCA announced restrictions on six unregulated lenders, known as Annex 1 firms, after it raised concerns about their anti-money laundering (AML) controls while assessing their applications. The restrictions were imposed at each firm's request and limit new customers and new lending. Five of the firms must commission an independent review of their AML framework, and one must wind down its loan book in an orderly way. The FCA is also assessing replies from around 900 registered Annex 1 firms, and it reminds banks and other regulated firms that registration is not a substitute for their own due diligence.

What an Annex 1 firm is

An Annex 1 firm is a business that carries on certain financial activities in the UK without being authorised under the Financial Services and Markets Act 2000 (FSMA), and so must register with the FCA for anti-money laundering supervision only. The name comes from Annex I to the EU Capital Requirements Directive, whose list of activities the Money Laundering Regulations 2017 (the MLRs) reproduce in Schedule 2.

Regulation 55 lets the FCA keep the register. It defines an Annex 1 financial institution as a business carrying on one or more listed activities that is not an FSMA-authorised person, a money service business, a bill payment service provider or a telecommunication, digital and IT payment service provider. Banks fall outside the definition, as do some narrow cases in regulation 10, such as a business whose only listed activity is trading for its own account with no customers.

Registration is not authorisation. In March 2026 the FCA said around 1,200 firms were registered for AML purposes only, that its powers over them are limited to their AML obligations, that its wider conduct rules do not apply, and that their customers cannot use the Financial Ombudsman Service. A lender that is already FCA-authorised, for example for consumer credit lending, does not register separately. A lender moving into regulated consumer lending needs FCA consumer credit authorisation instead.

What happened: six lenders under restriction

The FCA says it raised concerns about each firm's AML policies, controls and procedures while assessing its application. The restrictions were imposed at each firm's request and limit taking on new customers or doing new business with existing customers, including extending existing credit. The FCA's press release names each firm.

The first firm, a lender for business and investment purposes, including property investment, had never been authorised by or registered with the FCA, according to the FCA's May 2026 notice. The FCA has said it will consider restricting the business of firms seeking registration where it considers this appropriate.

Why the FCA is acting now

The restrictions follow more than two years of FCA work on the sector:

• 5 March 2024. A Dear CEO letter to Annex 1 firms, then about 1,000 registered, set out common control failings and asked each firm to complete a gap analysis within six months.
• Late 2025. The FCA followed up with 300 firms.
• 20 March 2026. It reminded regulated firms to check Annex 1 firms properly, and noted cases where consumers were encouraged to set up limited companies to obtain unregulated bridging finance, without access to the Financial Ombudsman Service.
• 7 August 2026. It announced increased scrutiny, said registration applications will take longer, and sent an information request to around 900 firms, which means it has now contacted every registered Annex 1 firm.
• 23 October 2026. It announced the six restrictions and said it is assessing the responses to find where further action is needed.

The August statement named three concerns: firms relying too heavily on a parent company's financial crime controls, firms using off-the-shelf procedures designed for another business, and unregulated lending through complex structures, including special purpose vehicles.

What the FCA expects of AML controls

The MLRs set the standard, and the FCA's published findings show where Annex 1 firms fall short. A firm should be able to show:

• A written business-wide risk assessment covering its customers, countries, products, transactions and delivery channels, kept up to date (regulation 18).
• Customer risk assessments based on each customer's own facts, not one rating for a whole group of customers.
• Policies, controls and procedures that are proportionate, approved by senior management and clear about when simplified or enhanced checks apply (regulation 19).
• Customer due diligence that identifies and verifies the customer and its beneficial owners and understands the purpose of the relationship, with ongoing monitoring of transactions and, where necessary, source of funds (regulation 28).
• Enhanced due diligence for high-risk cases, including customers or parties established in a country on the Financial Action Task Force call for action list (regulation 33).
• A clear route for staff to report suspicions to a nominated officer, who decides whether there are grounds for suspicion.
• Where appropriate to its size, a board member or senior manager responsible for MLR compliance, screening of relevant staff and an independent audit function (regulation 21). The FCA must be told who holds the responsible officer and nominated officer roles within 14 days of each appointment.
• Regular, role-specific training, with written records (regulation 24).
• Controls that are the firm's own, keep pace with growth and are discussed at senior management level with a clear record of decisions.
• Registered details that match the actual business, with changes notified to the FCA within 30 days.

Our guide to designing an AML/CFT framework covers each element in more depth.

What an independent AML review covers

The FCA has not published the terms of reference for these reviews. The MLRs describe the job of an independent audit function: to examine and evaluate whether the firm's policies, controls and procedures are adequate and effective, make recommendations and monitor whether they are followed. A review commissioned after FCA concerns should test each area the FCA has criticised and give a clear view on whether controls work in practice, not only on paper.

What banks and payment firms serving Annex 1 firms must do

Banks, payment and e-money institutions and other regulated firms that provide accounts or payment services to Annex 1 firms carry their own MLR duties. The FCA says that when dealing with Annex 1 firms, regulated firms must do due diligence to understand the firm's business. That includes seeking direct confirmation from the firm of its registration status, independently checking the information it provides, and understanding and managing the risks, such as those in the 2025 National Risk Assessment. Registration is not a substitute for that work.

In practice:

• Confirm status. Ask the firm directly whether it is registered or still an applicant, ask for the activities it registered for and compare them with its actual business.
• Check for restrictions. Where a customer is under FCA restrictions, make sure account activity is consistent with them, particularly limits on new lending and on receiving payments from existing customers.
• Understand the model. Know who funds the lending, who the borrowers are, how repayments flow and whether special purpose vehicles sit in the structure.
• Look past the parent. Do not assume a group's controls cover the subsidiary you serve.
• Rate risk on facts. Apply enhanced due diligence where risk is high and monitor transactions against the expected pattern, as regulation 28(11) requires.
• Record the decision. Keep a written rationale for onboarding, keeping or exiting each relationship.

Our guide to customer due diligence best practice sets out file standards that apply equally to Annex 1 customers.

If you are applying for registration

The FCA has increased its scrutiny of Annex 1 lending firms seeking registration and says these applications will take longer than usual. Its registration page lists the grounds on which it rejects an application:

• the wrong form, or a paper or emailed form instead of the Annex 1 form on Connect
• a form with little or no information completed
• a missing MLR Individual form for any senior person responsible for Annex 1 activities
• standard DBS checks not completed for all MLR individuals and beneficial owners who are not approved SMF managers, or an equivalent check for those based in Scotland, Northern Ireland or outside the UK
• no fee paid on submission

Beyond completeness, the application should show how the firm will meet each MLR requirement in practice, with controls written for its own business. The FCA can refuse registration under regulation 59 and, once a firm is registered, suspend or cancel it under regulation 60. The FCA describes failing to register as an offence that can carry civil or criminal sanctions. Our compliance support team prepares Annex 1 applications and the AML framework behind them.

A 30-day action plan

Our financial crime team reviews AML frameworks for lenders and the firms that serve them, and our consumer credit page covers lenders moving into FCA authorisation.