The Financial Conduct Authority (FCA) has told the roughly 1,200 firms registered with it solely for anti-money laundering purposes that registration under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 is a supervisory judgement, not an administrative filing — and it is using regulation 58’s fit-and-proper test, regulation 59’s refusal grounds and regulation 60’s cancellation power to make the point.

In a statement first published on August 7, 2026 and updated on August 13, the FCA said it is “closely scrutinising applications to register as an Annex 1 firm” and that firms “should expect registration applications to take longer”. It also confirmed an information request to around 900 Annex 1 firms, following work with 300 firms in late 2025 — which, on the FCA’s own arithmetic, means every registered Annex 1 firm in the United Kingdom has now been contacted. This analysis sets out what an Annex 1 firm is under regulation 55, what the FCA has found since 2024, how refusal and cancellation work, and how the same population is treated in Ireland, the European Union and the United States.

Key facts

• Around 1,200 Annex 1 firms are registered with the FCA solely for anti-money laundering purposes (FCA statement, March 20, 2026). The figure was around 1,000 in March 2024.
• All of them have now been contacted — 900 information requests in August 2026 plus 300 firms engaged in late 2025 (FCA statement, August 7, 2026).
• The register is discretionary. Regulation 55(1) says the FCA “may maintain a register of Annex 1 financial institutions” — a power, not a duty.
• Refusal is mandatory on fitness grounds. Regulation 58(1), applied by regulation 58(2), says the registering authority “must refuse to register” where the applicant, an officer, a manager or a beneficial owner is not fit and proper.
• The decision clock is 45 days under regulation 59(3A)(ii), with at least 28 days for representations where the FCA is minded to refuse.
• Unregistered operation is a criminal offence. Regulation 86(1)(b) carries up to two years’ imprisonment, a fine, or both on indictment; regulation 76 permits a civil penalty of “such amount as it considers appropriate”.
• The application fee is £560 — fee category 2 on the FCA’s application fees schedule.

Methodology and sources

The regulatory text is taken from the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692) as amended — regulations 10, 26, 55 to 60, 76 and 86 and Schedule 2, in consolidated form on legislation.gov.uk. The FCA’s position comes from three of its own publications: the Dear CEO letter of March 5, 2024, the statement of March 20, 2026 on unregulated lenders, and the statement of August 7, 2026. Comparative material comes from the Irish Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 as revised, Directive (EU) 2024/1640 and Regulation (EU) 2024/1624 in the Official Journal, and 31 CFR Part 1029. Scope is the UK, Ireland, the EU and the US, from March 2024 to September 2026. Where the FCA has published no figure — most obviously the number of Annex 1 registrations refused or cancelled — this article says so rather than estimating.

What regulation 55 actually creates, and what it does not

An Annex 1 financial institution is defined by regulation 55(2) as a financial institution falling within regulation 10(2)(a) — an undertaking carrying out one or more “listed activity” — that is not a money service business, an authorised person, a bill payment service provider, or a telecommunication, digital and IT payment service provider. The listed activities sit in Schedule 2 and comprise points 2 to 12, 14 and 15 of the old capital requirements directive annex: lending, including consumer credit, credit agreements relating to immovable property, factoring with or without recourse and the financing of commercial transactions including forfeiting; financial leasing; guarantees and commitments; trading in money market instruments, foreign exchange and transferable securities; participation in securities issues; advisory services on capital structure and mergers and acquisitions; money broking; portfolio management and advice; safekeeping and administration of securities; safe custody services; and issuing electronic money. The test is activity-based, which is why the population is so heterogeneous and why firms are so often surprised to find themselves inside it. The FCA’s registration guidance draws one edge narrowly: “If only the legal or beneficial interest in loans is transferred to your firm, you do not need to register with us.” Origination, not acquisition, is the trigger.

The duty to register does not come from regulation 56(1), which lists high value dealers, money service businesses, trust or company service providers and cryptoasset firms. It comes from regulation 56(5), which bites once the FCA has exercised its regulation 55 power: a relevant person of that description must not carry on the business for more than 12 months from the date the register was established unless it is on the register or has applied. That is a consequential point of construction: the whole Annex 1 obligation hangs on a discretionary register the FCA chose to establish, and the prohibition attaches to a description of business rather than a named licence.

What regulation 55 does not create is a conduct regime. The FCA said so plainly in March 2026: “Our powers are currently limited to looking at how these firms are meeting their anti-money laundering obligations and they are not subject to our wider rulebook.” Customers of Annex 1 firms cannot take a complaint to the Financial Ombudsman Service. Nor is there a standing approval regime for individuals: regulation 26(2) lists the firms whose beneficial owners, officers and managers need supervisory approval — auditors, insolvency practitioners, accountants, tax advisers, legal professionals, estate and letting agents, high value dealers, art market participants — and Annex 1 firms are absent. Fitness is therefore tested at two moments only: on application under regulation 58, and after the fact under regulation 60(2). That is precisely why the FCA is now leaning on the application.

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Penalty / sanction
UK (FCA)	Regime in force June 26, 2017; scrutiny statement August 7, 2026	Annex 1 financial institutions under reg 55(2) carrying on Schedule 2 activities; c.1,200 firms	Registration under reg 55; mandatory fit-and-proper refusal under reg 58(1)–(2); material change notified within 30 days (reg 57(4))	Refusal (reg 59(1)); suspension or cancellation (reg 60(1)(b)); penalty of “such amount as it considers appropriate” (reg 76); 2 years on indictment (reg 86(1)(b))
Ireland (Central Bank of Ireland)	November 26, 2018 (s.34, Criminal Justice (MLTF) (Amendment) Act 2018)	“Schedule 2 firms” — financial institutions under s.24(1) CJA 2010 not otherwise authorised or licensed by the Bank	s.108A(1) obliges the firm to register; s.108A(4) obliges the Bank to maintain the Register. No fitness test, no refusal power	Failure to register is an offence: class A fine (up to €5,000) or 12 months summarily; a fine or 5 years on indictment (s.108A(3))
EU (national supervisors under AMLD6 / AMLR, with AMLA)	Transposition and application from July 10, 2027 (Art 78, Directive (EU) 2024/1640)	Obliged entities other than currency exchange/cheque cashing offices, TCSPs and gambling operators	Art 4(3): “minimum registration requirements which enable supervisors to identify them” — identification, not gatekeeping. Good-repute checks in Art 6(1) reach only Art 4(1) and (2) entities	Art 55(3)(a): for financial institutions, maximum pecuniary sanctions of at least €10 million or 10% of total annual turnover, whichever is higher
US (FinCEN)	Rule effective April 16, 2012; compliance date August 13, 2012 (77 FR 8148)	“Loan or finance companies” — a definition FinCEN populated with residential mortgage lenders and originators only	31 CFR 1029.210 requires a written, risk-based AML programme with compliance officer, training and independent testing. No federal registration gate	Bank Secrecy Act civil money penalties under 31 U.S.C. 5321; criminal liability under 31 U.S.C. 5322

Sources: SI 2017/692 as amended; Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (revised); Directive (EU) 2024/1640; 31 CFR Part 1029 and 77 FR 8148; FCA statements of March 20 and August 7, 2026. Last updated: September 5, 2026.

How four jurisdictions register the same firms

The divergence does not run the way the usual narrative about post-Brexit British deregulation would predict: the United Kingdom applies the hardest gate of the four. Ireland, which supervises a structurally similar population of non-bank lenders and securitisation vehicles, built the softest. Section 108A of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, in force from November 26, 2018, obliges the firm to register and obliges the Central Bank to maintain a register, and stops there. There is no statutory fitness test on entry, no power to refuse and no power to cancel written into the section; the sanction is criminal and attaches to the firm’s failure to register, not to any regulatory assessment of it.

The European Union will land closer to the Irish model. Article 4 of Directive (EU) 2024/1640 requires member states to ensure currency exchange and cheque cashing offices and trust or company service providers “are either licensed or registered”, that gambling providers are regulated, and — at Article 4(3) — that all other obliged entities “are subject to minimum registration requirements which enable supervisors to identify them”. The stated purpose is identification of the supervisory population. Article 6(1), requiring supervisors to verify that senior managers and beneficial owners “are of good repute, and act with honesty and integrity”, is expressly limited to Article 4(1) and 4(2) entities. A European non-bank lender or lessor must therefore be findable from July 10, 2027, but its directors will not face an entry test equivalent to regulation 58.

The United States sits at the permissive end. FinCEN’s 2012 rulemaking at 77 FR 8148 created 31 CFR Part 1029 for “loan or finance companies” but populated that definition with residential mortgage lenders and originators alone, leaving room to extend it later. Fourteen years on, a US commercial lender, equipment lessor or factor has no federal anti-money laundering programme obligation under Part 1029, no federal registration and no federal fitness review; what discipline exists comes from state licensing. The arbitrage implication is not relocation — Annex 1 status follows the activity carried on in the UK — but that a group running one business model across all four jurisdictions gets four incompatible answers to the question “who has approved this entity, and against what standard?”

“Poor financial crime controls make it easier for criminals to abuse the financial system and damage the integrity of UK markets. We have made fighting financial crime a priority and though we’ve seen progress generally amongst the firms we supervise, this report highlights some basic failures amongst Annex 1 firms which are not subject to our full regulatory regime. These must be addressed.”

— Emad Aladhal, Director of the specialist team at the FCA dedicated to reducing and preventing financial crime and fraud (Financial Conduct Authority)

Enforcement context: what the gate looks like when it closes

The FCA has not published a Final Notice cancelling an Annex 1 registration, and it publishes no refusal statistics for the population. That absence is worth stating plainly rather than filling with inference. What it has published is the tariff: the March 2024 Dear CEO letter told Annex 1 chief executives that its tools “range from requiring third-party reviews to enforcement action that can result in outcomes such as fines and removal of Annex 1 firm registration”.

What happens when a firm treats an MLR registration decision as advisory is clearest in a different registered population. In R v Olumide Osunkoya, sentenced at Southwark Crown Court on February 28, 2025, the defendant received four years’ imprisonment after the FCA refused his company GidiPlus Ltd registration in December 2021 and he ran 28 crypto ATM locations anyway between December 30, 2021 and March 12, 2022, later moving machines under a false identity. He pleaded guilty to five offences including operating without FCA registration, forgery and possessing £19,540 of criminal property, on transactions the FCA valued above £2.5 million. It was the UK’s first criminal sentencing for unregistered cryptoasset activity under the 2017 Regulations, and the architecture that produced it — refusal, continued operation, prosecution under regulation 86 — sits behind Annex 1 registration too.

A second, quieter pattern is visible in payments and transfers directly. On March 24, 2026 the FCA cancelled the small payment institution registration of AFG Sarafi Ltd (FRN 911232) on grounds that included the firm’s failure “to comply with a requirement of The Money Laundering … Regulations 2017 … to be included in a register maintained under the MLRs”, reasoning the same way against First Money Services Ltd (FRN 921422) on December 22, 2025 and RVB Currency UK Ltd (FRN 593854) on June 15, 2026. In each case the loss of an MLR registration was not the end point of enforcement; it was the fact that dissolved a separate permission. Annex 1 firms hold no separate permission to lose — but their regulated counterparties do, which is why the FCA’s March 2026 statement told regulated firms to seek “direct confirmation of their registration status” before doing business with them.

What this means for lenders, lessors, custodians and compliance teams

For unregulated lenders and their sponsors, the operative risk is a mismatch the FCA has flagged twice. The Dear CEO letter’s first finding was “discrepancies between the activities that firms have told us they would undertake when they registered with the FCA, and the activities firms have told us they undertake when asked during the assessment”. Regulation 57(4) requires notification of a material change, or correction of an inaccuracy, within 30 days. A firm answering a 2026 information request with a business model that does not match its registration form is disclosing a historic regulation 57(4) breach at the same time. Reconcile activities to the register first, notify, then answer.

For groups, the central August 2026 finding is that firms “rely too heavily on the financial crime controls of their parent company”, and that each entity “must assess whether these controls are appropriate for their financial crime risks, governance and operations”. The deliverable is an evidenced entity-level business-wide risk assessment and control set — not a group policy with a subsidiary’s name on the cover. The Dear CEO letter found business-wide risk assessments “completely absent” at some firms.

For structured finance teams, the perimeter question is live: an origination special purpose vehicle can be an Annex 1 financial institution, while a vehicle that only acquires an interest in loans generally is not. Deal counsel should price registration timing into transaction timetables — the FCA has said applications will take longer and published no revised service standard against the 45-day regulation 59(3A) clock.

For safe custody providers, money brokers and financial leasing companies, the exposure is the fitness of individuals never assessed. Because regulation 26 does not apply, a firm registered in 2018 may have changed every officer and beneficial owner since without any FCA approval step — and regulation 60(2) permits cancellation at any time if any person mentioned in regulation 58(1) is not fit and proper. For regulated counterparties — banks, brokers, custodians, payment institutions — the standard is now explicit: confirm registration status directly, verify it independently, document the risk assessment against the 2025 National Risk Assessment the FCA named.

“While SPVs that merely acquire receivables or participations will not necessarily fall within the Annex 1 registration regime, SPVs that originate loans may be required to register as Annex 1 financial institutions.”

— Alix Prentice, Partner, and Jennifer Staniforth, Senior Associate, Hogan Lovells (Hogan Lovells, August 20, 2026)

That reading is the corrective to the broadest interpretation of the FCA’s statement. The concern about “complex structures, including special purpose vehicles” is a concern about origination and control, not a proposal to register every vehicle in a securitisation chain.

What’s next — the forward view

Three things are pending and one is contested. The first is the output of the 900 information requests: the FCA said it will use the responses “and other intelligence to identify and disrupt financial crime risks in this sector”, but no findings publication has been announced and no deadline stated.

The second is the population. The count moved from around 1,000 in March 2024 to around 1,200 in March 2026, roughly 20% in two years, just as the FCA began slowing determinations. If refusals rise while applications keep arriving, the register will start to understate the number of firms carrying on Schedule 2 activities in the UK — a supervisory problem, because unregistered operation is exactly what regulation 86 criminalises.

The third is legislative. The Treasury has consulted repeatedly on reforming the 2017 Regulations, and the Annex 1 perimeter — an activity list inherited from an EU banking directive annex — is an obvious candidate for redrafting. Nothing has been laid.

The contested question is whether registration-only supervision can carry the weight now placed on it. The FCA has been candid that its powers here are limited to anti-money laundering obligations, yet its March 2026 statement raised consumer-harm concerns — bridging finance sold to consumers steered into incorporating limited companies, with no Financial Ombudsman Service recourse — that the money laundering regulations were never designed to address. Using regulation 58 fitness and regulation 60 cancellation to manage a consumer-protection risk is a defensible use of the only tool available. It is not the same as having the right tool, and that gap is where the next policy argument will sit. The EU, on the evidence of Article 4(3), has decided the same population needs to be identifiable rather than vetted; from July 10, 2027 there will be a live comparison of which model produces fewer failures.

Frequently asked questions

What is an Annex 1 firm?

An Annex 1 financial institution is defined by regulation 55(2) of the Money Laundering Regulations 2017 as an undertaking carrying on one or more of the activities listed in Schedule 2 — lending, factoring, financial leasing, money broking, safe custody, safekeeping of securities and others — that is not a money service business, an authorised person, a bill payment service provider or a telecommunication, digital and IT payment service provider. It is registered with the FCA for anti-money laundering supervision only, and is not authorised under the Financial Services and Markets Act 2000.

Does FCA registration mean an Annex 1 firm is FCA-regulated?

No. The FCA stated on March 20, 2026 that its powers over these firms “are currently limited to looking at how these firms are meeting their anti-money laundering obligations and they are not subject to our wider rulebook”. Its conduct rules do not apply, and customers cannot take complaints about an Annex 1 firm to the Financial Ombudsman Service.

Can the FCA refuse or cancel an Annex 1 registration?

Yes, and one power is mandatory. Regulation 58(1), applied by regulation 58(2), says the FCA “must refuse to register” an applicant if satisfied that the applicant, an officer, a manager or a beneficial owner is not fit and proper. Regulation 59(1) adds discretionary refusal grounds, including materially false information. Regulation 60(1)(b) allows suspension or cancellation after registration, and regulation 60(10) allows immediate effect where the public interest requires it.

How long does an Annex 1 registration application take?

Regulation 59(3A)(ii) gives the FCA 45 days from the application, or from receipt of further information requested under regulation 57(3), to notify its decision or that it is minded to refuse. Where it is minded to refuse, the applicant gets at least 28 days to make representations under regulation 59(3)(b)(iii) and a right of appeal under regulation 93. The FCA said on August 7, 2026 that firms “should expect registration applications to take longer”.

Do special purpose vehicles need to register as Annex 1 firms?

It depends on whether the vehicle originates loans or merely acquires an interest in them. The FCA’s registration guidance states that if only the legal or beneficial interest in loans is transferred to the firm, registration is not required. Vehicles that originate lending can fall within the Schedule 2 activity of lending, and the FCA’s August 2026 statement singled out “unregulated lending often conducted through complex structures, including special purpose vehicles”.

What happens if a firm carries on Annex 1 activities without registering?

Contravening a relevant requirement of the 2017 Regulations is a criminal offence under regulation 86(1), punishable by up to three months’ imprisonment or a fine summarily, and up to two years’ imprisonment, a fine, or both on indictment. Regulation 76 separately permits a civil penalty of “such amount as it considers appropriate” and public censure, and regulation 76(3) extends penalty liability to officers knowingly concerned in the contravention.

TheIndustrySpread has covered adjacent supervisory questions in the FCA’s Dolfin penalties, the FinCEN order making FX wire data a Bank Secrecy Act duty, the closing of the EU reverse-solicitation route, CP26/23’s split of UK and non-UK client books, the limits of Australia’s scam-liability perimeter, and in-house know-your-customer and chain monitoring.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.