Enforcement Risks for Financial Crime Failings — FCA Guidance for Asset Managers

The Financial Conduct Authority (FCA) has signalled that it continues to have high expectations for asset management firms’ financial crime controls, as its latest data showed that over 75% of its 2025–26 enforcement work focused on financial crime. As such, asset managers and alternative investment firms should take note of new FCA guidance, which identifies examples of good and poor financial crime controls across the UK asset management sector.

Enforcement Risks and FCA Thematic Work

The FCA remains active on the enforcement front, stating it is continuing to increase the pace and focus of its enforcement work “to deliver impactful deterrence”. The FCA defines financial crime for its enforcement purposes as covering “fraud and scams, organised crime, weaknesses in anti-money laundering systems and controls, and market abuse”. According to the FCA’s published statistics, as of 31 March 2026 the FCA had 107 open cases relating to financial crime matters. This includes a number of criminal cases, as well as dual-track cases where an investigation is proceeding under both the criminal and civil paths.

It is important to resist the temptation of torturing the data (and statistics), but the data published by the FCA demonstrates a strong focus on financial crime compliance. This is borne out by the FCA’s supervisory engagement with 242 asset management firms to understand how those firms identify, assess and mitigate financial crime risks. Rather than conducting a thematic review of compliance with specific legal requirements, the FCA sought to identify common strengths and weaknesses across the sector and to share practical examples of effective controls.

FCA Guidance for Asset Managers

The output of this process is the FCA’s publication on “Asset management and alternative firms' financial crime controls”, setting out examples of good and poor practice observed during its supervisory engagement with asset managers and alternative investment firms.

Although the publication does not amend the UK’s anti-money laundering (AML), sanctions or broader financial crime rules, firms should not underestimate its significance. The FCA expressly assessed firms’ controls against the Money Laundering Regulations 2017, SYSC, the FCA’s Financial Crime Guide, Joint Money Laundering Steering Group (JMLSG) guidance and relevant Financial Action Task Force (FATF) standards. As with previous examples of FCA “good and poor practice” publications, the findings are likely to become an important supervisory benchmark during future FCA visits, Section 166 reviews and enforcement investigations.

For alternative investment fund managers (AIFMs) and other alternative investment managers, the report reinforces a broader regulatory theme: Notwithstanding the relatively lower inherent money laundering risks traditionally associated with institutional asset management compared with retail banking, the FCA expects firms to operate sophisticated, risk-based financial crime frameworks that are tailored to their business models, investor base, products, distribution channels and geographic exposure.

A Recurring Theme: Risk Assessments Must Drive the Control Framework

Perhaps the clearest message emerging from the FCA’s findings is that firms should no longer regard their business-wide risk assessment as a static compliance document.

Instead, the FCA expects the risk assessment to function as the foundation upon which the firm’s entire financial crime framework is constructed.

Examples of good practice included firms that:

• Identified the specific financial crime risks arising from their products, services, investor base, distribution channels and jurisdictions.
• Periodically refreshed risk assessments to reflect changes in business activities.
• Demonstrated clear links between identified risks and the controls implemented to mitigate them.
• Ensured senior management actively reviewed and challenged the assessment.

By contrast, the FCA criticised firms whose assessments consisted largely of generic statements, failed to explain why risks had been categorised in a particular way or appeared disconnected from the firm’s actual operating model.

For many firms, this is likely to require moving beyond “template” enterprise-wide AML risk assessments and toward more granular analyses that better reflect the complexities of alternative investment structures, delegated operating models and international investor bases.

Governance Remains Central

Consistent with recent FCA publications across multiple regulatory areas, governance features prominently throughout the review.

The FCA observed that stronger firms demonstrated:

• Clear board ownership of financial crime risks.
• Appropriately empowered money laundering reporting officers (MLROs).
• Meaningful management information.
• Effective escalation procedures.
• Documented challenge by senior management.

Conversely, weaker firms often treated financial crime governance as a compliance function rather than a business-wide responsibility.

This reflects a broader evolution in FCA supervision. Increasingly, the regulator appears less concerned with whether firms possess formal policies and more focused on whether senior management genuinely understands the firm’s financial crime risks and actively oversees the effectiveness of the associated control framework.

Customer Due Diligence Remains a Supervisory Priority

The report reinforces the FCA’s continuing emphasis on customer due diligence (CDD) and enhanced due diligence (EDD).

Firms with good practice had:

• Adopted genuinely risk-based onboarding procedures.
• Obtained sufficient information to understand ownership and control structures.
• Appropriately verified beneficial ownership.
• Refreshed due diligence where customer risk profiles changed.
• Documented the rationale supporting risk classifications.

Poor practice, however, included relying excessively on incomplete documentation, applying inconsistent risk ratings or failing adequately to justify why enhanced due diligence had not been undertaken in higher-risk situations.

For alternative investment managers — whose investor bases frequently include institutional investors, family offices, sovereign wealth funds and complex holding structures — the FCA’s findings underline the importance of ensuring that CDD procedures remain proportionate without becoming formulaic.

Sanctions Screening and Ongoing Monitoring

Although asset managers generally present different sanctions risks from payment institutions or banks, the FCA makes clear that sanctions compliance remains an important supervisory priority.

The publication highlights the need for firms to maintain effective screening processes, appropriately investigate potential matches and ensure ongoing monitoring reflects changes in customer risk profiles and sanctions developments.

This aligns closely with the FCA’s recent cross-sector review of sanctions systems and controls, which similarly emphasised governance, calibration of screening tools and appropriate escalation procedures.

Tailoring Controls to the Firm’s Business Model

One of the more interesting themes running through the FCA’s findings is its repeated emphasis that financial crime frameworks should reflect the firm’s actual business rather than industry templates.

Alternative investment managers frequently outsource elements of fund administration, transfer agency, investor onboarding and KYC processes.

The FCA recognises these operating models but makes clear that outsourcing does not diminish regulatory responsibility.

Where third parties undertake elements of AML or sanctions compliance, firms should be able to demonstrate:

• Appropriate due diligence before appointment.
• Clear contractual responsibilities.
• Ongoing oversight.
• Periodic testing of outsourced activities.
• Documented governance over delegated arrangements.

For many full-scope AIFMs operating global fund structures, these observations are likely to be particularly relevant given the extensive reliance placed on administrators and other service providers.

Management Information and Testing

The FCA also places considerable emphasis on firms’ ability to evidence that their controls are operating effectively in practice.

Examples of stronger firms included those that:

• Produced meaningful financial crime management information.
• Tracked key risk indicators.
• Undertook regular quality assurance.
• Performed thematic reviews.
• Used internal audit or independent testing to assess the effectiveness of controls.

By contrast, firms relying solely upon annual policy reviews or compliance attestations were viewed less favourably.

The message is clear: Firms should expect increasing supervisory scrutiny not merely of policy design but of operational effectiveness.

Practical Implications

Although the publication does not create new regulatory obligations, firms should expect it to influence future supervisory interactions.

In particular, firms may wish to review:

• Enterprise-wide financial crime risk assessments.
• AML and sanctions governance frameworks.
• Board reporting and management information.
• Investor onboarding procedures.
• Beneficial ownership verification processes.
• Outsourced AML oversight arrangements.
• Periodic customer review processes.
• Sanctions screening controls.
• Internal testing programmes.
• Training provided to senior management and front-office staff.

For many international fund managers, particular attention should be given to ensuring that UK financial crime frameworks remain appropriately integrated with wider group policies while reflecting the firm’s own UK-specific regulatory obligations.

Key Takeaways

The FCA’s latest publication should not be viewed as a routine summary of supervisory observations. Rather, it provides an important insight into how the regulator currently assesses the effectiveness of financial crime controls within the asset management sector.

The report confirms that the FCA expects firms to move beyond technical compliance toward genuinely risk-based financial crime frameworks supported by robust governance, meaningful management information and demonstrably effective operational controls.

Perhaps most importantly, the publication illustrates that supervisory expectations continue to mature. Generic policies, template risk assessments and reliance on outsourced providers without meaningful oversight are increasingly unlikely to satisfy the regulator. Instead, firms are expected to demonstrate that financial crime controls are proportionate, dynamic and closely aligned to their specific business model and risk profile.

For AIFMs and alternative investment managers, the publication therefore represents an opportune moment to conduct a holistic review of existing financial crime frameworks — not because the rules have changed, but because the FCA has provided valuable insight into how it will assess compliance with those rules in practice.