The UK Financial Conduct Authority (FCA) has published a consultation paper (CP26/38) consulting on changes to its Financial Crime Guide to reflect recent supervisory findings and developments in financial crime risks. The FCA proposes updates to areas covering: (i) fraud, including authorised push payment fraud and money mules; (ii) cryptoassets, ahead of the new regulatory regime coming into full effect on 25 October 2027; (iii) financial and trade sanctions; (iv) proliferation financing; (v) data security, including to address emerging risks associated with AI, synthetic identity fraud and digital assets; (vi) financial crime systems and controls; (vii) money laundering and terrorist financing; and (viii) other consequential changes.

The proposed updates are intended to clarify and update existing guidance rather than introduce new requirements and include refreshed self-assessment questions and examples of good and poor practice. The deadline for responses is 24 December, after which the FCA intends to publish its feedback and the final amended guide in a policy statement. On future plans, the FCA is exploring more flexible ways to provide financial crime guidance, focused on emerging risks and priority areas. This could include question-and-answer sessions and standalone guidance without prior consultation where it is not required. The guidance would then be consolidated within the Financial Crime Guide at a future date.

The UK Financial Conduct Authority (FCA) has announced that restrictions have been placed on six unregulated lenders, known as Annex 1 firms, following concerns about their anti-money laundering policies, controls and procedures identified while assessing their applications. The restrictions limit the firms' ability to take on new customers or conduct new business with existing customers, including extending credit, and certain firms' restrictions require an independent review of their anti-money laundering framework.

The action forms part of the FCA's enhanced oversight of Annex 1 firms, which are required to register with the FCA for supervision under the Money Laundering Regulations (MLRs) but are not otherwise authorised or subject to wider FCA regulation. The FCA reminds firms that registration under the MLRs is not a substitute for regulated firms carrying out their own appropriate due diligence to understand the firm's business, in accordance with legislative requirements. This includes seeking direct confirmation from the firm of its registration status, conducting independent checks of the information it provides, and understanding and managing any risks.

The European Securities and Markets Authority (ESMA) has announced it has updated its Q&As on: (i) market structure under the Markets in Financial Instruments Directive II; (ii) the Market Abuse Regulation; and (iii) the Short Selling Regulation. This is part of ESMA's Simplification and Burden Reduction initiative. ESMA has withdrawn or amended several Q&As that are outdated, duplicative or no longer relevant due to legislative changes reflected in established market practices or because they are covered in other ESMA guidance, such as supervisory briefings and opinions. The changes are intended to reduce unnecessary complexity and ensure that ESMA's Q&As remain relevant, proportionate and consistent with the current legislative framework. ESMA encourages stakeholders to consider the updated Q&As alongside its other guidance when interpreting the applicable rules.

The European Securities and Markets Authority (ESMA) has published updated and streamlined guidelines on the delay in the disclosure of inside information under the Market Abuse Regulation (MAR). Under MAR, issuers are required to disclose to the public as soon as possible directly relevant inside information, to ensure that investors are informed and to prevent insider dealing. In specific circumstances, issuers may delay public disclosure to avoid prejudicing their legitimate interests. These guidelines help issuers in their decision to delay disclosure by providing a non-exhaustive list of legitimate interests that could justify such delay.

Following its February consultation, ESMA has identified five additional legitimate interests that may justify delayed disclosure, including:

• where the issuer is requested not to disclose information by a public authority
• where the issuer needs to collect additional information to enable a correct assessment of inside information by market participants
• where the issuer may risk the loss of a business opportunity following the disclosure of sensitive commercial information
• where the appointment of a member of the issuer's governing body or a manager holding a key position could be jeopardised
• where the disclosure of inside information concerning companies within the same group could cause a direct prejudice to the issuer and undermine the effectiveness of the delay applied by another company within the group.

ESMA has also removed the legitimate interests for delayed disclosure relating to protracted processes, to reflect the fact that since June, issuers are no longer required to immediately disclose inside information relating to these processes before their completion. The revised guidelines will apply from the date they are published on ESMA’s website in all official EU languages.

The UK Financial Conduct Authority (FCA) has published Market Watch 86, setting out its observations from supervisory visits to UK retail brokerage firms on the systems, controls and governance arrangements they use to identify and report potential market abuse. All of these firms used automated surveillance systems, but the FCA found material weaknesses in how their arrangements had been designed, implemented and operated in practice. Key findings include: 

• Too high a threshold for reasonable suspicion: several firms set the bar of reasonable suspicion too high. The FCA reminds firms that they do not need proof of market abuse before they submit a suspicious transaction and order report.
• Poorly tailored alert calibration: several firms had not properly calibrated their alert models in line with the nature of their client base, the financial instruments traded, and relevant market abuse risks.
• Insufficient understanding of surveillance systems: some firms appeared to rely on system settings provided by third-party vendors, which increased the risk that weaknesses in surveillance arrangements would not be identified or challenged. Calibration testing was also often limited.
• Weak governance and oversight: some senior managers had limited understanding of key surveillance activities. In some firms where surveillance responsibilities were split across different functions, no single individual had oversight of end-to-end activities. The FCA also found examples of firms with limited or no formal quality assurance process.
• Market abuse risk assessments lacking granularity: some firms had not considered all relevant characteristics of their business model; for example, they did not differentiate between institutional and retail clients. Others wrongly assumed that having an alert in place was evidence of an effective control capable of mitigating risk.

All firms are advised by the FCA to consider these findings and check whether changes to their surveillance arrangements are required. The FCA will continue to monitor this area.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published a consultation on draft regulatory technical standards (RTS) for a central EU-wide anti-money laundering and countering the financing of terrorism (AML/CFT) database. The database will act as a single platform through which supervisory authorities can report and access information on supervised entities, supervisors and supervisory activities. It is intended to support the exchange of supervisory information across the EU and to make AML/CFT supervision more targeted, risk-based and effective. To keep the reporting burden low, the draft RTS draw primarily on data that supervisors already hold or will collect in any event, so the database should impose no additional reporting costs on obliged entities.

AMLA proposes that supervisory authorities transmit the following information in relation to:

• Supervisory authorities and self-regulatory bodies: their powers and tasks; statistics on resources and staffing; and the supervisory activities they carry out.
• Obliged entities: money laundering and terrorist financing risks; sanctions, administrative measures and periodic penalty payments; and authorisations, withdrawal of authorisations and fit and proper assessments.

The draft RTS also include provisions on measures on data quality, confidentiality and the onward sharing of information contained in the database. AMLA proposes a phased implementation so that supervisors have time to adapt to the new requirements. Stakeholders are invited to give their views at a public hearing on 3 November.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published its response to the European Commission’s (EC) consultation on the review of the Markets in Crypto-Assets Regulation (MiCAR). The targeted consultation sought views on technical and legal issues on whether MiCAR remains fit for purpose in light of evolving market and international developments. AMLA makes recommendations in five areas where targeted amendments or clarifications could help address money laundering and terrorist financing (ML/TF) risks more effectively and support consistent supervision across the EU.

These are:

• Staking, lending and borrowing: AMLA suggests that the EC consider bringing these activities within MiCAR’s regulatory framework, reflecting their specific ML/TF risks.
• Decentralised Finance (DeFi) arrangements: AMLA invites consideration of a clear legal definition and common criteria for identifying who exercises effective control over crypto-asset services or activities through DeFi arrangements.
• Unauthorised stablecoins: AMLA encourages a consistent EU-wide approach that removes legal uncertainty.
• Certain asset-referenced token issuers not considered as obliged entities under the anti-money laundering and countering the financing of terrorism (AML/CFT) framework: AMLA suggests reviewing this interaction, including whether certain token issuers should fall within scope of AML/CFT rules.
• Cross-border supervision of service providers: AMLA sees scope for clearer information requirements to support effective supervision.

The EU Anti-Money Laundering Authority (AMLA) has published final draft regulatory technical standards (RTS) under Article 46(4) of the Sixth Anti-Money Laundering Directive (Directive (EU) 2024/1640) (AMLD 6). The draft RTS were previously consulted on in May and establish a simple, proportionate, and efficient framework for information exchange, cross-border inquiries, and coordinated supervision. In particular, they:

• give supervisors of cross-border groups—in both the financial and non-financial sectors—a shared baseline for working together across the EU
• set out practical arrangements for effective day-to-day cooperation, including a simplified disclosure framework allowing the onward sharing of information among EU supervisors without prior consent
• enable home and host supervisors to conduct cross-border inquiries and coordinate supervisory approaches
• favour a proportionate and risk-based approach to supervisory cooperation.

The final draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union (OJ). They are expected to come into force 20 days after being published in the OJ and will apply from 10 July 2027.

The UK Office of Financial Sanctions Implementation (OFSI) has published its annual frozen assets reporting notice alongside a reporting template, launching its 2026 review of frozen assets held under UK financial sanctions regimes. Persons holding or controlling funds or economic resources owned, held, or controlled by designated persons are required to submit a report to OFSI by 30 November, covering the value of relevant frozen assets as at the close of business on 30 September. The reporting obligation extends to assets held in the UK as well as those overseas where they are subject to UK financial sanctions legislation. The notice also reminds firms of their ongoing obligations to identify and freeze assets belonging to designated persons (and entities they own or control), report newly frozen assets to OFSI without delay, and provide information requested by OFSI.

The Annex to the notice provides a general description of the information to be reported. All returns must be submitted using the prescribed template. OFSI states that there is no requirement to submit a nil return where a person does not hold or control any funds or economic resources owned, held, or controlled by a designated person. However, if a person submitted a report last year (other than a nil return) and no longer holds those assets, they should submit a nil return.

The EU Anti-Money Laundering Authority (AMLA) has published three sets of final draft regulatory technical standards (RTS) defining key measures companies and professionals must apply to reduce anti-money laundering and countering terrorist financing (AML/CTF) under the EU AML Regulation ((EU) 2024/1624) (AMLR). For more background on the package, you may like to read our article "AML playbook: the new EU AML/CTF package". The three final draft RTS each cover a distinct area of AML/CTF requirements for the private sector:

• Draft RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries under Articles 16(4) and 17(3) of the AMLR. They are accompanied by two fact sheets covering group-wide requirements and legal impediments in third countries. The RTS set out minimum requirements for effective group-wide AML/CTF arrangements, including governance, risk management, internal controls, and secure information sharing. The RTS were previously consulted on in April.
• Draft RTS on customer due diligence (CDD) under Article 28(1) of the AMLR. They specify in detail how CDD requirements should be applied, including the information and documents to be collected. The RTS are accompanied by a fact sheet. They were previously consulted on in February.
• Draft RTS on criteria for identifying business relationships, occasional transactions and linked transactions as well as lower thresholds under Article 19(9) of the AMLR. They form the structural basis upon which CDD obligations apply. The RTS set out how companies and professionals should distinguish between the business relationships and occasional transactions, as well as how to identify linked transactions so that CDD thresholds are applied consistently. The RTS are accompanied by a fact sheet. They were previously consulted on in February and AMLA has made some revisions to improve clarity.

The final draft RTS will be submitted to the European Commission for adoption. Once adopted, they will be published in the Official Journal of the European Union and come into force 20 days later. They are expected to apply six months after they enter into force, except for specified provisions which will apply from 10 July 2029.

The UK Financial Conduct Authority (FCA) has published findings from a multi-firm review on money mule activity (a form of money laundering in which a person transfers or receives criminal funds on behalf of others) and the cashing out of fraud proceeds. The review drew on a survey of 35 firms and analysis by an industry working group of 22 firms.

Key findings include:

• Retail banks accounted for most transactions passing through mule accounts, whereas other firms experienced lower volumes but higher-value transactions.
• Card payments were the most common cash-out method, as they can resemble legitimate consumer spending and are a versatile route for dispersing and monetising fraud proceeds.
• International and crypto cash-out methods were typically higher in value, showing that mule activity was not confined to UK payment flows.
• Repeat mule accounts suggest organised criminal infrastructure rather than an isolated or opportunistic misuse, as some accounts had been used multiple times for mule activity before firms shut them down, and there were accounts across multiple scam and fraud types.

The FCA expects firms to review their controls for detecting, preventing and disrupting money mule activity and to strengthen them where necessary. Firms should consider indicators beyond the initial receiving account, including linked accounts, payment characteristics and the broader transaction context. The FCA also highlights the importance of information-sharing, including through the provisions available under the Economic Crime and Corporate Transparency Act 2023, and is working with the National Economic Crime Centre to issue a further alert providing additional details of the working group's findings.

The UK government has published its anti-money laundering and asset recovery strategy 2026–2029, setting the direction for the UK's response to money laundering and criminal asset recovery over the next three years. Alongside the UK Anti-Corruption Strategy and UK Fraud Strategies, this strategy forms part of the Government's overall approach to economic crime as will be set out in the forthcoming Economic Crime Plan 2026-29.

Measures proposed include:

• Structural reform of the UK's anti-money laundering and counter-terrorist financing supervisory regime (AML/CFT), reducing the number of supervisors from 25 to three.
• Review of how the future of financial payments will impact threats and addressing risks and opportunities presented by the growing use of stablecoins.
• Developing a policy roadmap for addressing risks and opportunities of privacy enhancing technologies in relation to cryptoassets.
• Review of the suspicious activity reporting (SARs) regime for opportunities to reduce low-value activity, including whether to raise the suspicion threshold in POCA and finalising implementation of the SARs Digital Service with AI-enhanced analytics.
• Develop an agreed problem statement regarding law enforcement speed of access to basic bank account information and a review of options.
• Use of the UK's FATF Presidency (2026–28) and G20 Presidency (2027) to promote reform of international AML standards to support a more risk-based approach and reduce low-value compliance activity.

Annex A to the strategy sets out a delivery plan, detailing key actions and milestones across 2026–29.

The European Commission (EC) has adopted a Delegated Regulation amending the regulatory technical standards (RTS) laid down in Commission Delegated Regulation (EU) 2018/1108 under the Fourth Anti-Money Laundering Directive (Directive (EU) 2015/849) (MLD4). The amending RTS set out the criteria for the appointment of central contact points for cryptoasset service providers (CASPs) and rules on their functions. The RTS amend Delegated Regulation (EU) 2018/1108 to extend its application to CASPs, reflecting amendments made to MLD4 by the Wire and Cryptoasset Transfer Regulation ((EU) 2023/1113), which extended the scope of MLD4 to cover CASPs. The RTS set out the criteria for determining the circumstances where CASPs should appoint a central contact point, a local representative in a host European Union country when operating across borders, and the functions that the central contact point should perform.

The amending Delegated Regulation is based on the European Banking Authority's (EBA) final draft RTS published in April 2025. The Council of the EU and the European Parliament will scrutinise the Delegated Regulation. If neither object, it will be published in the Official Journal of the European Union and will enter into force 20 days following its publication.

The Joint Money Laundering Steering Group (JMLSG) has published revisions to Part I of its Anti-Money Laundering and Counter-Terrorist Financing Guidance, following its June consultation and to reflect changes introduced by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (the Regulations). The amendments update guidance on a number of technical areas:

• An amendment to reflect the changes to Regulation 19, including clarification of the term "unusually" as used in Regulation 19(4), in the context of policies, controls and procedures for risk mitigation management which must provide for the identification and scrutiny of a case where a transaction is unusually complex or unusually large.
• An amendment to reflect the new provisions of Regulation 30ZA in relation to customers of insolvency banks, which enable credit institutions to permit such customers to open an account and transact from it before customer due diligence measures are fully completed.
• Amended guidance at paragraphs 5.3.94A and 5.3.99 in relation to identity verification and authority verification requirements in relation to persons purporting to act on behalf of a customer or dealing with assets under a power of attorney.
• Minor amendment to remove the specification of a bank account or securities holding in relation to the application of simplified customer due diligence in the context of a pooled account (Regulation 37).
• Various amendments to Annex 5-V which provides guidance on pooled client accounts.

The revisions have been submitted to HM Treasury for ministerial approval.

The UK Financial Conduct Authority (FCA) has updated its "submit a prospectus or circular" webpage to include information on the inside information declaration form. For equity cases, the issuer must submit a declaration form with its first submission, stating whether its submission contains inside information. If it does, the issuer must explain what that information is. The FCA needs this information so it can apply the appropriate internal controls when reviewing a submission. From 21 September, all first submissions of equity documents, including guidance requests, must include this form. The FCA will not allocate the case for review until it receives a completed form. The inside declaration form can be found here.

The UK Financial Conduct Authority (FCA) has published a statement announcing that it is applying increased scrutiny to Annex 1 firms. Annex 1 firms include unregulated lenders, safe custody providers, money brokers and financial leasing companies. This is following concerns about a number of risks the FCA has identified in the sector, particularly the potential for Annex 1 firms to facilitate financial crime. The FCA notes that some firms rely too heavily on the financial crime controls of their parent company, which are not tailored to their own firms' risks, governance and operations, and that firms cannot rely on off-the-shelf procedures designed for a different company. The FCA also highlights risks to consumers and markets arising from unregulated lending conducted through complex structures, including special purpose vehicles. In response, the FCA states that it is closely scrutinising applications to register as an Annex 1 firm. In addition, firms need to clearly demonstrate their ability to comply with the Money Laundering Regulations, with registration applications likely to take longer than usual. The FCA has also sent information requests to around 900 Annex 1 firms to improve its understanding of their activities, business models and risks. The FCA will then use this information, together with other intelligence, to identify and disrupt financial crime risks in the sector.

The UK Financial Conduct Authority (FCA) has published Handbook Notice 143, outlining amendments to its Handbook made through various instruments made at its June and July board meetings including:

• Numerous instruments relating to the UK's upcoming regulatory framework for cryptoassets which come into force on 25 October 2027 and, amongst other things, insert three new sourcebooks into the Handbook, two new chapters in the client assets sourcebook and new sections in the conduct of business sourcebook and supervision manual.
• Definition of Capital for Investment Firms Instrument 2026, which entered into force on 31 July. This instrument makes a minor technical amendment to MIFIDPRU 3.6A.1R to correct an unintended consequence following PS25/14, ensuring that the prohibition on non-cash distributions on own funds instruments operates as originally intended.
• Enforcement (Digital Markets, Competition and Consumers Act 2024) (Supplementary Amendments) Instrument 2026, which entered into force on 30 July and Enforcement Guide (Amendment) Instrument 2026, which entered into force on 31 July. Following consultation in chapter 9 of CP26/8, these instruments make supplementary amendments to the Glossary, ICOBS, CONC, UNFCOG, ENFG and DEPP sourcebooks to reflect changes in consumer protection legislation, describe the FCA's general approach to the use of its powers under the Digital Markets, Competition and Consumers Act 2024, and make clarificatory changes to its description of the use of non-FSMA and FSMA powers in the context of market abuse.
• Prospectus Rules: Admission to Trading on a Regulated Market (Clarificatory Amendments) Instrument 2026. This gives proper effect to aspects of the Public Offers and Admissions to Trading regime, which came into force on 19 January.
• Data Reporting Services (Amendment) Instrument 2026 and Technical Standards (Data Reporting Services) Instrument 2026. Following consultation in CP25/31, these instruments amend the Glossary, MAR 9, DEPP and ENFG sourcebooks, and make changes to Commission Delegated Regulation (EU) 2017/577, to establish the main regulatory obligations of the equity consolidated tape provider (CTP) and key regulatory requirements for the operation of the UK equity consolidated tape. It also establishes obligations for trading venues and approved publication arrangements to provide information to the CTP.

Feedback to the various consultations behind this Handbook Notice is set out in chapter 3 of the notice.

The UK Financial Conduct Authority (FCA) has published the findings from its review of financial crime systems and controls across asset management and alternative firms. In 2025/26, the FCA engaged with 242 asset management and alternatives firms to gather firms' own assessments of the financial crime risks they face and to understand their control frameworks. The FCA has summarised its main findings, including examples of good and poor practice. It also reminds firms of the FCA's expectations. The FCA's findings centre on how well firms: (i) understand their inherent financial crime risk; and (ii) identify, mitigate and manage financial crime risk (control risks). The review covered a range of business models, and the FCA notes that not all findings will be applicable to all firms given the diversity of the sector. The review is part of the FCA's wider financial crime supervisory work in support of its 2025–30 strategy and supervisory priorities for the sector.

The FCA found that:

• Inherent risks—some firms were exposed to heightened financial crime risks, especially those firms active in private markets, due to factors such as complex ownership structures, higher-risk customers and international fund flows. The FCA expects firms that face higher financial crime risks to have established frameworks and appropriate controls to mitigate these risks, as referenced in the Money Laundering Regulations 2017 (MLRs) and Senior Management Arrangements, Systems and Controls (SYSC) section of the FCA's Handbook.
• Control risks—most firms showed they understood legal and regulatory requirements through their control framework, but others appeared to underestimate their inherent financial crime risks, resulting in an informal approach to evaluating and managing them. The FCA sets out examples of good and bad practice relating to business-wide risk assessments, customer risk assessments, customer due diligence and enhanced due diligence, ongoing monitoring, screening, governance and training. In some instances, the FCA states that the findings were concerning and will require firms to review their financial crime frameworks to ensure they are adequately identifying, managing and mitigating the risks to which they are exposed.

The FCA encourages firms to consider its findings in the context of their own business model and activities and continue to address any gaps in their financial crime control frameworks. The FCA will continue to monitor firms through its supervisory work to make sure they are considering the points raised in this review to drive improvements.

The Financial Action Task Force (FATF) has published a targeted report on the regulatory challenges posed by decentralised finance (DeFi). The report highlights the rapid growth of DeFi and its increasing exploitation by illicit actors, including fraudsters, ransomware operators, professional money laundering networks and proliferation financing actors. The report found that approximately 93% of surveyed reporting jurisdictions have not yet implemented the FATF Standards in relation to qualifying DeFi arrangements and that only two jurisdictions have licensed or registered a DeFi arrangement in practice. FATF reiterates that DeFi arrangements fall within scope of the FATF Standard covering virtual assets—Recommendation 15—where a natural or legal person exercises control or sufficient influence over the arrangement.

The report emphasises that effective implementation of the FATF Standards in the DeFi context requires a functional and risk-based approach. It identifies a list of on-chain and off-chain indicators of control and sets out recommendations to help jurisdictions, as well as financial institutions, virtual asset service providers, and DeFi arrangements aimed at protecting the integrity of the financial system, while also preventing and mitigating the criminal abuse of the DeFi ecosystem. It also includes case studies of good practice. The report emphasises that jurisdictions with more significant DeFi activity should allocate more resources to understanding, supervising and developing approaches to mitigate the illicit finance risks associated with DeFi arrangements.

The EU Anti-Money Laundering Authority (AMLA) has published a final report containing final draft implementing technical standards (ITS) that set out AMLA's cooperation with national financial supervisors to select and directly supervise some of the most significant cross-border financial institutions in the EU. The final draft ITS cover how entities are selected, how supervision passes between national and EU level, and how AMLA and national supervisors will work side by side.

From 2028, AMLA will directly supervise some of the most impactful, cross-border financial institutions at group level. Until now, this supervision has rested with national supervisors. The new ITS will ensure consistent and uninterrupted supervision as responsibility moves between national and EU level.

The final draft ITS set out a clear, step-by-step process for identifying which firms AMLA will supervise: national supervisors gather and quality-check the data, and AMLA carries out the risk assessment and makes the selection, with the results published on its website. When an entity moves to or from AMLA's supervision, the transferring authority hands over the firm's full supervisory history to the receiving authority, preventing disruptions.

The final draft ITS were developed in close cooperation with national supervisors. They are designed for proportionality: entities are asked for detailed data only once they have been identified as eligible. Where supervisors can already establish that a firm does not qualify, it is exempted from reporting altogether. Once adopted by the European Commission, the ITS will apply to the data collection and selection process leading up to the start of direct supervision in 2028.

The Wolfsberg Group has published guidance on the provision of banking services to non-bank payment service providers (PSPs). The guidance is intended to help banks identify, assess and manage the financial crime risks arising from relationships with non-bank PSPs, recognising the increasing complexity of payment chains and the growing role of such firms in the payments ecosystem. It sets out a risk-based framework covering common business relationships, associated financial crime risks, compliance obligations and risk management expectations.

The guidance emphasises the need to: (i) apply a risk-based approach to due diligence and monitor the risks presented by different non-bank PSP activities; (ii) ensure payment transparency through complete and accurate payment information; and (iii) maintain a thorough understanding of a PSP's business model, customer activities and financial crime controls.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) have published its final report with draft regulatory technical standards (RTS) under Article 53(10) of the sixth Anti-Money Laundering Directive (EU) 2024/1640 (AMLD 6). The RTS establish a framework for assessing the gravity of breaches, determining the level of pecuniary sanctions and administrative measures, and imposing periodic penalty payments (PePPs). They set out indicators for assessing breaches, classify breaches into four levels of severity, and establish criteria for determining sanctions and other measures. They also include provisions relating to natural persons, including senior management and supervisory board members, and procedural aspects for the imposition of PePPs.

Following the February consultation, AMLA made targeted amendments, including clarifications on the application of the framework to non-financial sector firms, confirmation that category 3 and 4 breaches constitute "serious, repeated or systematic" breaches for the purposes of AMLD 6, and revisions allowing supervisors to rely on any reliable and relevant information when assessing breaches. The draft RTS will now be submitted to the European Commission for adoption before publication in the Official Journal of the EU.

The EU Anti-Money Laundering Authority (AMLA) has launched a consultation on draft implementing technical standards (ITS) establishing a common EU-wide format for reporting suspicious transactions and activities under the Anti-Money Laundering Regulation (EU) 2024/1624. Currently, the way suspicions and transaction records are reported differs from one country to another. This makes it harder for companies operating across borders to know what is expected from them, and harder for Financial Intelligence Units (FIUs) to exchange information with each other and with their partners. The proposed ITS would introduce a harmonised set of data points and reporting templates for obliged entities, while allowing for sector-specific reporting requirements, with the aim of improving consistency across member states, reducing reporting complexity for cross-border firms, and enhancing information sharing and processing by FIUs. The deadline for responses is 20 September. A public hearing will be held on 9 September.

The UK Payment Systems Regulator (PSR) has announced that its authorised push payment reimbursement policy is having a positive impact, according to the findings of an independent review. The findings show that payment fraud losses have fallen by GBP73 million per year, APP scam volumes have reduced by approximately 35,000 cases, reimbursement rates have increased from 54% to 65% overall (and to 97% for in-scope claims), and firms with historically higher fraud levels have made the most significant improvements.

The PSR noted that there is no evidence of market exit or significant moral hazard, although some inconsistency in implementation remains across firms. To address this, the PSR has published a roadmap setting out its next steps. The regulator will also consult, before the end of the year, on measures to improve the application of the policy and will continue to monitor evolving fraud risks, including by publishing data on the platforms used by fraudsters to target victims.

The UK government has published a bulletin confirming initial insights from the earlier call for evidence on the ownership and control test under UK Financial Sanctions Regulations. The call for evidence sought input on the practical operation of the test and any particular challenges in implementing the requirements.

Feedback provided the UK Office of Financial Sanctions Implementation (OFSI) with a clearer picture of how often questions of hypothetical control are raised in practice. The term hypothetical control refers to the aspect of the control test which asks the person applying the test to consider whether or not the potential controller would, if they so desired, be able (directly or indirectly) to direct the controlled entity's business as they wished. There is no requirement to demonstrate actual exercise of such hypothetical control for this aspect of the test, and it is notoriously difficult to apply in practice as it is a particularly broad and subjective area.

Respondent feedback confirmed that they encountered challenges most frequently under the Russian sanctions regime and highlighted the cost and operational burden in making assessments based on limited information, requiring enhanced due diligence, legal advice, and delaying and/or escalating business decisions. Feedback also noted the limitations on the usefulness of existing tools and guidance which are not necessarily reliable in applying the test in practice.

The bulletin confirms that this area of policy remains under ongoing review, and the government will continue to consider options for providing greater clarity.

The EU Anti-Money Laundering Authority (AMLA) has issued an advisory note highlighting money laundering and terrorist financing (ML/TF) risks associated with the end of the transitional period under the Markets in Crypto-Assets Regulation (MiCAR). After 1 July, firms must be authorised as MiCAR-compliant crypto-asset service providers (CASPs) to continue providing crypto-asset services in the EU. The note outlines ML/TF risks arising from the end of the transitional period and identifies measures that can be taken by the crypto-asset sector, anti-money laundering and counter-terrorist financing supervisors, and financial intelligence units to ensure a coordinated and risk-based response that protects the integrity of the EU financial system. The note includes a table setting out the relevant risks and the corresponding suggested mitigation measures.

The European Banking Authority (EBA) has published a consultation paper setting out a draft methodology for the imposition of fines under the Markets in Crypto-Assets Regulation (MiCAR). The proposed framework is intended to ensure that fines imposed on issuers of significant asset-referenced tokens (ARTs) and e-money tokens (EMTs) are consistent, proportionate and transparent, and support effective compliance with the regime. Under MiCAR, the EBA is responsible for supervising issuers of tokens designated as significant, and the draft methodology outlines how fines may be calculated where infringements are committed negligently or intentionally by issuers or members of their management bodies. The deadline for comments is 28 September, with a public hearing scheduled for 16 July.

Separately, the European Commission has announced it has extended the deadline for input to its consultation on EU crypto-asset rules by one month to 30 September.

The UK Financial Conduct Authority (FCA) has published Handbook Notice No. 142 which covers changes on which the FCA consulted on (among other proposals) in its quarterly consultation paper No. 51 and its consultation CP25/37 on targeted clarifications of Handbook materials.

The notice confirms the implementation of changes included in quarterly consultation paper No. 51 in relation to:

• The UK equity transparency regime, which moved provisions from UK RTS 1 to MAR 11A.
• The UK market abuse regime, where clarification has been made by introducing new provisions in MAR 1A.2 confirming where breaches of MAR do not give rise to a private right of action under section 138D of the Financial Services and Markets Act 2000.
• The UK authorised fund regime, with changes to the COLL rules in line with amendments to the revised 2025 statement of recommended practice for authorised funds.

Read more.

The Financial Action Task force (FATF) has launched a consultation on draft guidance to support the implementation of its revised Recommendation 16 (Wire transfers) on payment transparency. The Recommendation is commonly referred to as the "Travel Rule" and was updated in June 2025. The proposed guidance aims to reflect developments in the payments landscape and to strengthen the security of cross-border payments by increasing the transparency of information accompanying transfers and introducing measures to address fraud and errors. Feedback is sought on a range of issues, including:

• Detecting and preventing misdirected payments, including by leveraging the three options for alignment checks foreseen in the revised Standard.
• Implementation that supports financial inclusion, including in lower-capacity jurisdictions.
• How Recommendation 16 applies to newer payment methods, such as digital wallets and mobile money.
• Implementing Recommendation 16 and meeting data protection and privacy requirements together.

The deadline for responses is 21 August, with the final guidance intended to assist jurisdictions and firms in meeting the revised standards by the end of 2030. The full list of consultation questions is set out in the explanatory memorandum to the draft guidance.

HM Treasury (HMT) has published its consultation response on the reform of the UK's anti-money laundering and counter-terrorist financing (AML/CTF) supervisory regime for professional services firms. This follows the decision announced last October that the UK Financial Conduct Authority (FCA) will be the sole AML supervisor for legal service providers, accountancy service providers and trust and company service providers under the Money Laundering Regulations 2017 (MLRs). A consultation, published in November 2025, set out the proposed key responsibilities and duties for the FCA's expanded role, along with the legislative changes needed to implement these reforms.

The consultation response includes the policy decisions on these proposals, including:

• Registration and gatekeeping. Making the FCA responsible for registering professional services firms carrying out AML/CTF regulated activity and for maintaining a public register of those firms. The FCA will also be given an explicit power to cancel a firm's registration where it is no longer carrying out regulated activity. In addition, the application of regulation 58 "fit and proper" requirements, enabling supervisors to assess the integrity, competence and compliance history of firms and their beneficial owners, officers and managers, will be extended across legal and accountancy service providers, aligning these sectors with trust and company service providers, which are already within scope.

Read more.

The UK Financial Conduct Authority (FCA) has published consultation paper CP26/19, proposing targeted amendments to its Decision Procedure and Penalties Manual (DEPP) to ensure that its penalty framework and decision-making processes remain up-to-date, transparent and effective. The proposals also reflect the introduction of the market abuse regime for cryptoassets.

Key proposals include:

• Market abuse. Increasing the minimum initial disciplinary penalty level for serious market abuse committed by individuals from GBP100,000 to GBP150,000 to account for inflation.
• Deterrence. Making clear that the FCA has the ability to increase penalties for wealthier individuals for deterrence, having regard to income and assets.
• Relevant income. Clarifying how to treat deferred income, including bonuses, pay and shares, in line with recent Upper Tribunal decisions.

​
Read more.

Companies House has published its third progress report on the implementation of reforms under Parts 1 to 3 of the Economic Crime and Corporate Transparency Act 2023. The report highlights progress in strengthening the integrity of the UK companies register and tackling economic crime, supported by increased data-sharing with HM Revenue & Customs and the Insolvency Service. This includes contributions to a National Crime Agency-led operation targeting high-street criminality and money laundering.

The report also reflects progress in introducing mandatory identity verification (IDV) for directors and people with significant control, aimed at strengthening transparency and deterring those who use UK corporate structures to facilitate crime. Looking ahead, further measures are planned, including further IDV roll-out, enhanced transparency of the Register of Overseas Entities and a more intelligence-led enforcement approach. Annual progress reports will continue until 2030.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 have been made and laid before Parliament, alongside an explanatory memorandum. The Regulations make amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) to implement the government's consultation response to its 2024 consultation on improving the effectiveness of the MLRs. The amendments aim to strengthen the UK's anti-money laundering and counter-terrorist financing regime and ensure continued compliance with Financial Action Task Force standards.

Key changes include:

• Refining due diligence requirements so that enhanced measures focus on higher risk transactions and jurisdictions.
• Converting thresholds from EUR to GBP.
• New provisions governing pooled client accounts.
• Bringing the service of selling an off-the-shelf firm within scope of trust or company service provider services.
• Strengthening the regime for cryptoasset businesses.
• Changes to the scope of trust registration requirements.
• Improving information-sharing between supervisory authorities and other regulatory bodies.

Read more.

The UK Financial Conduct Authority has entered into a Memorandum of Understanding with the UK Office of Financial Sanctions Implementation. The MoU replaces an earlier MoU dated 21 November 2023 and sets out cooperation arrangements and exchange of information between the two regulators. The regulators commit to reviewing the effectiveness and efficiency of the MoU every two years.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has launched a consultation on draft guidelines on ongoing monitoring of business relationships under Article 26(5) of Regulation 2024/1624. The guidelines aim to ensure a proportionate, risk based and effective application of monitoring obligations across all obliged entities and set out key principles including:

• Expectations for updating customer information through periodic and event driven reviews.
• The sources of information that may be used alongside non exhaustive lists of factors to assess during periodic customer information reviews and event trigger reviews.
• How monitoring frameworks should be designed and implemented to detect unusual or suspicious activity, using appropriate manual or automated controls.

They further reflect the need for clear governance, adequate documentation, appropriate staff training, and the responsible use of advanced analytical tools, supported by effective human oversight, where appropriate. The deadline for comments is 3 September, with a public hearing scheduled for 2 July. Final guidelines are expected in Q4.

The UK Financial Conduct Authority (FCA) has published Q&A responses from its 2026 webinar on the UK anti money laundering (AML) framework for cryptoasset firms. They clarify how the current Money Laundering Regulations 2017 (MLRs) will operate alongside the forthcoming cryptoasset regime under the Financial Services and Markets Act 2000 (Cryptoassets Regulations) 2026, which commences on 25 October 2027.

Topics addressed include:

• Applications under the Financial Services and Markets Act 2000 (FSMA) regime.
• MLR registration will remain the route for firms providing in scope cryptoasset services until the new regime commences, but firms will need to obtain FSMA authorisation to continue operating under the new regime, with no automatic conversion. Current FSMA authorised firms must apply to vary their permissions if they wish to undertake the new cryptoasset regulated activities when the regime commences. Applications for the new regime will open on 30 September until 28 February 2027. Firms should consider the impact of when they submit their application. Firms are encouraged to prioritise securing FSMA authorisation over MLR-registration (with more guidance set out in an earlier webpage) and undertake early gap analyses against threshold conditions and proposed rules.

Read more.

The UK Joint Money Laundering Steering Group (JMLSG) has published a consultation on proposed amendments to Part I of its anti-money laundering and counter-terrorist financing (AML/CFT) guidance for the financial services sector. It reflects changes introduced by the draft Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (as laid and not yet made) including:

• Clarification of the term "unusually" in paragraph 2.9.
• Introduction of a bank insolvency exception in paragraph 5.2.4A.
• Updates relating to pooled client accounts in paragraph 5.3.142 and Annex 5 V.
• Amendments concerning due diligence and verification of authority where a person acts on behalf of others in paragraphs 5.3.94A and 5.3.99.

The deadline for comments is 29 June.

The UK Financial Conduct Authority (FCA) has set out guidance in a new report on compliance with the UK sanctions regimes. The FCA acknowledges that the rules on sanctions have become more complicated since February 2022.

The FCA expects firms to understand when they could be engaging in activities which are at risk of causing sanctions breaches, for example:

• Transferring funds out of accounts shortly after an individual or entity is sanctioned.
• Accessing financial services or economic resources through complex ownership chains, relatives, or close associates.
• Using third parties, intermediaries, or correspondent banks to obscure connections to a sanctioned person.
• Routing funds through cryptoasset or e-money wallets to conceal links to designated persons.
• Conducting cash withdrawals for onward movement to high-risk jurisdictions.
• Mis-declaring the nature or end use of goods in trade transactions.
• Providing falsified or incomplete trade documentation.

Read more.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published a reporting package to support the identification of provisionally eligible obliged entities by national competent authorities (NCAs). This marks the next preparatory step for its first selection cycle of entities to be subject to direct supervision from 2028, following the conclusion of its data collection exercise to test and calibrate risk assessment models.

The package, comprising a standardised reporting template and interpretative note for obliged entities, sets out instructions for NCAs to collect and submit the data required to determine which entities meet the criteria for selection in 2027. They will be responsible for collecting data by 15 August, followed by an error correction and alignment phase with home supervisors. A provisional list of eligible entities is expected to be finalised by the end of September. AMLA will host a public webinar on 10 June to offer eligible obliged entities (credit institutions, financial institutions, or their groups operating in at least six member states) a practical walkthrough of the template, with further information to follow.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has launched a consultation on draft regulatory technical standards (RTS) under Article 46(4) of Directive (EU) 2024/1640 (MLD 6). The draft RTS specify the respective duties of home and host supervisors of cross-border groups of obliged entities operating in the financial and non-financial sectors, and the modalities of cooperation between them.

Specific provisions in the draft RTS include:

• Information exchange, including obligations to share information on the supervisor's own initiative and upon request, with specific content requirements.
• Inquiries, setting out procedures for conducting or facilitating cross-border supervisory inquiries, including roles, timelines and post-inquiry exchanges.
• Common approaches, enabling supervisors to, where necessary, agree on coordinated or joint supervisory activities.

AMLA will hold a public hearing on 28 May for stakeholder input on the consultation.

The UK Financial Conduct Authority (FCA) has published Market Watch 85, setting out how the information‑sharing provisions in the Economic Crime and Corporate Transparency Act 2023 (ECCTA) can be used by firms to prevent, detect and investigate economic crime, including criminal market abuse. The FCA explains that ECCTA allows in-scope firms to share customer or former customer information with other firms directly where specified "warning" or "request" conditions are met, while providing protection from breaches of confidentiality and civil liability, subject to continued compliance with data protection requirements. The warning condition applies where a firm has taken (or would have taken) safeguarding action, such as terminating or restricting the service provided to a customer, due to suspected criminal market manipulation. The request condition applies where a firm has requested information from another firm, which it reasonably believes holds information that may assist it in taking "relevant action", including preventing, detecting or investigating economic crime.

Read more.

The UK Financial Conduct Authority (FCA) has published findings from its multi‑firm review examining the impact of market soundings on market quality in UK equity capital market (ECM) transactions. The review analysed data from 63 UK equity and equity linked transactions conducted by five wholesale banks between January 2023 and June 2025. The FCA found that trading volumes fell by an average of 13% during market sounding periods but did not observe material impacts on other market quality metrics, including effective and quoted spreads and market depth. On average, 33 investors were market sounded per transaction, with one instance approaching nearly 90 recipients; however, transactions that sounded above average numbers of recipients did not meaningfully increase overall demand or oversubscription after launch.

While the FCA does not prescribe limits on the number of market sounding recipients, it notes that the risk of inside information leakage may increase as the scale or duration of a market sounding grows and suggests firms consider whether their policies and procedures adequately reflect this. The FCA will continue to engage with banks and other market participants through supervisory work. In addition, the FCA sought feedback on Article 11 of the UK Market Abuse Regulation (MAR) with some banks suggesting improvements, including closer alignment with the EU market soundings regime and reduced record keeping requirements. The FCA will consider this feedback when assessing any future changes to UK MAR.

The EU Authority for Anti‑Money Laundering and Countering the Financing of Terrorism (AMLA) has launched two consultations on draft measures setting out requirements for business‑wide risk assessments (BWRAs) and group‑wide anti-money laundering and countering the financing of terrorism (AML/CFT) frameworks under the EU Anti‑Money Laundering Regulation (AMLR).

The first consultation specifies draft regulatory technical standards (RTS) under Articles 16(4) and 17(3) of the AMLR, setting minimum standards for the design and implementation of group‑wide AML/CFT frameworks. They address organisational aspects of group wide AML/CFT requirements, provisions on information sharing within groups, criteria for identifying the parent undertaking in the Union where multiple obliged entities are linked to a third country head office, and the extension of group wide requirements to structures other than groups (which is particularly relevant to the non financial sector). The draft RTS also cover additional measures and requirements where branches or subsidiaries operate in third countries. AMLA proposes a single set of RTS to cover both Article 16(4) and Article 17(3) mandates. The deadline for comments is 15 June, with a public hearing scheduled for 20 May. Feedback will be considered with the final draft RTS due to be submitted by 30 September.

Read more.

The UK Office of Financial Sanctions Implementation (OFSI) has published its strategy for 2026–2029. The strategy is based around the "Promote, Enable, Respond and Change" (PERC) framework:

• Promote: To shape expectations and set the standard, OFSI will run targeted campaigns for priority sectors; publish clear guidance products and assessments showing what non-compliance is and how to avoid it; and work with domestic and international regulators to promote consistency. "Promote" key performance indicators (KPIs) include sector-specific engagement campaigns and delivering joint or co-branded public output (such as joint guidance, public statements, case studies or advisories) with international partners on a quarterly basis.
• Enable: OFSI will remove friction for legitimate activity and support sanctions compliance behaviour that is fast, predictable and scalable by encouraging early engagement from firms to address risks or uncertainties, providing direct, practical compliance advice on complex scenarios, and maintaining an effective and regularly updated licensing offer with high, publicised service standards. Engagement will be modern and digital by default, including online services, reporting and forms, supported by enhanced data use, data sharing and AI enabled workflows. The "enable" KPI is to close 50% of licensing cases within six months.

Read more.

The UK government, through the UK Office of Financial Sanctions Implementation (OFSI), has updated its webpage, extending the deadline for responses to its call for evidence on the application of the ownership and control test under the UK Financial Sanctions Regulations. The deadline for responses has been extended from 11:59pm on 13 April to 11:59pm on 20 April.

The UK Financial Conduct Authority (FCA) has published findings of a multi‑firm review of customer due diligence (CDD), enhanced due diligence (EDD) and ongoing monitoring controls, setting out examples of good and poor practice for firms. The FCA assessed CDD systems and controls through a questionnaire, a desk-based review of policies and procedures, customer file reviews and interviews with staff at firms.

Key findings include:

• Policies and procedures: Stronger firms demonstrated clear distinctions between standard CDD and EDD, applying risk based approaches to higher risk customers, including politically exposed persons. However, weaknesses included unclear guidance on additional EDD measures, review frequency and how staff should identify and verify customers who cannot provide standard forms of identification. In some cases, firms failed to follow their own policies and procedures, including in relation to periodic customer reviews.

Read more.

The UK Financial Conduct Authority (FCA) has published its annual work programme for 2026/27 setting out its planned activity for the second year of its five-year strategy. The programme is structured around the following four strategic priorities:

• Being a smarter regulator: to improve regulatory efficiency and proportionality, the FCA will continue to invest in digital, data and AI capabilities, reduce administrative burdens by simplifying rules and streamlining data returns (including removing three regular returns in April), and improve the authorisation process by further reducing authorisation timelines and continuing to report against new, shorter voluntary targets. In a press release published on the same day, the FCA announced it is developing a new internal AI-enabled authorisation tool, integrated into its existing systems. The FCA will also use generative AI to review documents received from firms, which, following successful testing, it will begin rolling out more widely across authorisations and supervision.

Read more.

The draft Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were laid before UK Parliament, alongside a draft explanatory memorandum. The draft Regulations propose amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) to implement the government's consultation response to its 2024 consultation on improving the effectiveness of the MLRs. The amendments aim to strengthen the UK's anti-money laundering and counterterrorist financing (AML/CTF) regime and ensure maintained compliance with Financial Action Task Force standards.

Following feedback to the technical consultation on the draft Regulations in September 2025, the government has made a number of targeted changes, including:

• Pooled client accounts (PCAs): clarifying that banks may continue to apply a simplified, risk-based approach to PCAs where the PCA holder is: (i) subject to the MLRs or equivalent overseas regimes; (ii) the business relationship with the PCA-holder presents a low risk of money laundering and terrorist financing; and (iii) information on the identity of the underlying customers is available on request to the PCA-holder. Additional clarifications are also made.

Read more.

The UK Financial Conduct Authority (FCA) has published a statement reminding regulated firms of the risks when dealing with unregulated lenders and other "Annex 1" firms. Annex 1 firms are registered with the FCA solely for anti‑money laundering (AML) purposes and are not subject to the FCA's wider regulatory rulebook. The FCA reminds regulated firms that Annex 1 firms are not authorised under the Financial Services and Markets Act 2000, meaning that the FCA's wider conduct rules do not apply to them and their customers do not have access to the UK Financial Ombudsman Service (FOS).

The FCA therefore expects regulated firms to carry out robust due diligence, in line with legislative requirements, to understand the firm's business. This includes seeking direct confirmation from the Annex 1 firm of its registration status, conducting independent checks of information provided by the Annex 1 firm, and understanding and managing any associated risks, including those identified in the 2025 National Risk Assessment. The FCA also notes that it is aware of some cases where consumers have been encouraged to set up limited companies to access lending, such as unregulated bridging finance, from Annex 1 firms. The FCA emphasises the importance of consumers being aware that FOS protections will not apply if issues arise in these cases.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has launched a data collection and testing exercise aimed at testing and calibrating its risk assessment models for credit and financial institutions. The exercise will support the selection, in 2027, of up to 40 entities for AMLA's direct supervision from 2028, and the development of a consistent, EU‑wide methodology for assessing money laundering and terrorist financing risks. Participation is limited to entities already notified by their national competent authorities. AMLA has published a reporting package, including an interpretative note, reporting template and recording and slides from a webinar explaining the requirements and next steps. Participating firms are required to submit data by 22 April.