CP26/38 and what the Financial Crime Guide would change

Consultation paper CP26/38 would revise the Financial Conduct Authority's Financial Crime Guide on fraud, sanctions, cryptoassets and proliferation financing, and the text would stay guidance rather than a new rulebook.

The Financial Conduct Authority (FCA) opened CP26/38 on October 23, 2026, and paragraph 1.16 asks for comments on Appendix 1 by December 24, 2026. Paragraph 1.5 records that the Guide imposes no new requirement. Annex 2 cites FCG 1.1.7: a departure from the guidance does not, of itself, indicate a breach. The sections below set out the draft text, the split with OFSI's penalty power, and the cases the draft now uses.

Key facts

• Opened October 23, 2026; closes December 24, 2026, via the online form or cp26-38@fca.org.uk. Source: the FCA consultation page and CP26/38, paragraphs 1.16 to 1.17.
• General guidance under section 139A of the Financial Services and Markets Act 2000 (FSMA). Annex 2 cites FCG 1.1.7. Source: CP26/38, Annex 2.
• Question 1 records UK Finance data: a 26% rise in investment-fraud cases and a 40% increase in losses between 2024 and 2025. Source: CP26/38, Annex 1.
• From October 25, 2027, certain cryptoasset activities need FCA authorisation under the Financial Services and Markets Act (Cryptoasset) Regulations 2026. The paper points to rules in PS26/13. Source: CP26/38, paragraph 2.7.
• Paragraph 2.10 cites the 2025 National Risk Assessment: cryptoasset money-laundering risk high, terrorist-financing risk medium. Source: CP26/38.
• Draft FCG 7.2A.15 rounds the Starling Bank Limited penalty to £29 million. The press release states £28,959,426. Source: FCA press release, October 2, 2024.
• On August 11, 2026, the Office of Financial Sanctions Implementation (OFSI) imposed £4,732,830.58 on Citibank, N.A., London Branch, under section 146 of the Policing and Crime Act 2017. Source: the OFSI notice.

Methodology and sources

This account uses the consultation page and CP26/38, including Chapter 2, Annexes 1 to 4 and the underlined draft Guide in Appendix 1, as published on October 23, 2026. Enforcement figures come from the Starling press release of October 2, 2024, and from OFSI's notice, published on September 2, 2026, of a penalty imposed on August 11, 2026. The quotation outside the paper is Nikhil Rathi's Mansion House speech of October 22, 2026. The frame is the United Kingdom, set beside the civil-penalty text in 31 USC 5321. Where the paper cites UK Finance, the 2025 National Risk Assessment or PS26/13, the citation is the paper's. The draft instrument prints commencement as "[date]", so no in-force date for the amended Guide is stated.

Related:CP26/37 would retire certification and notify senior roles

What CP26/38 actually proposes

The Financial Crime Guide is the FCA's general guidance on how a firm assesses systems and controls against financial crime, and CP26/38 would amend it under section 139A of FSMA, regulation 120(1) of the Payment Services Regulations 2017 and regulation 60(1) of the Electronic Money Regulations 2011. The consultation opened on October 23, 2026, and paragraph 1.16 asks for comments on Appendix 1 by December 24, 2026. Paragraph 1.5 records that the Guide imposes no new requirement and that firms should read it, then apply their own judgement. Annex 2 cites FCG 1.1.7: a departure from the guidance does not, of itself, indicate a breach of FCA rules, which is why section 138I's cost-benefit duty is treated as outside this exercise and why the paper carries no cost figures. Readers named in paragraph 1.8 are every firm supervised for financial crime, including Annex 1 institutions and cryptoasset businesses under the Money Laundering Regulations 2017.

Chapter 2 groups the drafting into seven areas, plus Money Laundering Regulations amendments that came into force in June 2026. Chapter 4 would be rebuilt around authorised push payment (APP) fraud and money mules, and investment fraud would sit inside that section. Draft FCG 4.2.1I cites Confirmation of Payee covering 99% of Faster Payments and CHAPS, reimbursement within five business days or, exceptionally, 35, a 50% claim on the receiving firm, and a ceiling of up to £85,000. Question 1 cites a 26% rise in cases and a 40% increase in losses between 2024 and 2025.

Paragraph 2.15 places trade sanctions beside financial sanctions and names the Office of Trade Sanctions Implementation (OTSI). Paragraph 2.17 sends financial sanctions to OFSI, trade sanctions to OTSI, export controls to HM Revenue & Customs, and a weak control framework to the FCA. Annex 4 prints that trade body as "OFTI", while draft FCG 7.4.2 uses OTSI. Paragraph 2.23 says a newer proliferation-finance national risk assessment will be referenced if it appears before finalisation.

Cryptoasset drafting covers firms registering since January 2020 and firms that, from October 25, 2027, need authorisation for specified activities, alongside rules the paper attributes to PS26/13. Paragraph 2.10 cites the 2025 National Risk Assessment. Draft FCG 3.2.8 lists enhanced due diligence for unhosted wallets, mixers, tumblers and privacy-enhancing coins, and the use of blockchain analytics, as good practice. A rigid cap on transfer "hops", and a third-party score the firm cannot explain, are the poor-practice examples. Draft FCG 3.2.13 restates Travel Rule expectations from September 1, 2023: collect, verify and transmit originator and beneficiary information, decide on a risk basis if it never arrives, and report persistent failure to the FCA. Staff are also asked whether they can separate a defence under the Proceeds of Crime Act 2002 from a defence under the Terrorism Act 2000.

Data-security guidance would track the Data Protection Act 2018 and the UK GDPR, and would refresh the section the paper calls the "five fallacies of data loss and identify fraud", including material on artificial intelligence and synthetic identity fraud. Draft FCG 2.2.1 keeps the regulated firm accountable across banking-as-a-service and outsourced models. Paragraph 2.27 says third-party tools must be governed against the firm's risk profile.

How three rule sets compare

Sources: CP26/38, the OFSI notice for Citibank, N.A., London Branch, and 31 USC 5321, last updated October 27, 2026.

CP26/38 leaves the Financial Crime Guide as general guidance under section 139A of FSMA. Annex 2 cites FCG 1.1.7: departing from the Guide does not, of itself, indicate a breach, because section 139B guidance sits outside the cost-benefit duty in section 138I. Paragraph 2.17 sends a financial-sanctions breach to OFSI and a trade-sanctions matter to OTSI. Under 31 USC 5321(a)(1) a willful violation draws a civil penalty of not more than the greater of the amount involved, capped at $100,000, or $25,000.

"As much as 8% of banks' workforces are dedicated to combatting crime. We should be delivering far better outcomes with those resources."

— Nikhil Rathi, chief executive, Financial Conduct Authority (Market integrity in a digital age, Mansion House, October 22, 2026)

Rathi delivered that line the day before CP26/38 appeared. The speech calls for an end to tick-box compliance, while saying information from know-your-customer checks and sanctions monitoring remains valuable. The 8% figure is Rathi's, and the paper gives no headcount of its own.

Enforcement the draft now uses as the example

Draft FCG 7.2A.15 uses Starling Bank Limited as the sanctions case study. The FCA press release of October 2, 2024 states a penalty of £28,959,426, or £40,959,426 before the 30% settlement discount. Starling grew from about 43,000 customers in 2017 to 3.6 million in 2023, then opened over 54,000 accounts for 49,000 high-risk customers between September 2021 and November 2023. The draft rounds the penalty to £29 million, describes the screen as limited to UK citizenship or UK residency, and ties the outcome to the voluntary requirement and to Principle 3.

Enforceable hooks remain Principle 3 and SYSC 6.1.1R for authorised firms, the Money Laundering Regulations for Annex 1 firms, and OFSI where a designated person was paid. The Dolfin visa-scheme penalty is a different case and sits outside CP26/38. Warning-list references in the fraud chapter sit nearer the matters in which the FCA closed firms that sold UK authorisation as a halo.

Draft FCG 7.2A.16 summarises Citibank, N.A., London Branch. OFSI's page states that on August 11, 2026 it imposed £4,732,830.58 under section 146 of the Policing and Crime Act 2017. The draft rounds this to about £4.7 million and traces the breaches to payment processing, correspondent banking, account restrictions, and staff or systems error after Russia-related designations in 2022.

"Starling's financial sanction screening controls were shockingly lax. It left the financial system wide open to criminals and those subject to sanctions. It compounded this by failing to properly comply with FCA requirements it had agreed to, which were put in place to lower the risk of Starling facilitating financial crime."

— Therese Chambers, joint executive director of enforcement and market oversight, Financial Conduct Authority (FCA press release, October 2, 2024)

What the draft means for firms and compliance teams

For banks, payment institutions, e-money firms and brokers, Chapter 4 is the operational text. The draft expects checks for vulnerability and synthetic documents, monitoring in both directions, and a policy for reporting fraud. Training would track the five-day and 35-day clocks and the £85,000 ceiling at FCG 4.2.1I. The paper treats the mule account as the route by which APP losses are cashed out.

For cryptoasset firms preparing for authorisation from October 25, 2027, the draft expects enhanced due diligence on unhosted wallets and privacy tools, blockchain analytics with a documented reason, and a Travel Rule process when counterparty information is missing. Annex 1 registration remains the gate for firms supervised only under the Money Laundering Regulations. The cryptoasset gateway and the perimeter guidance on cryptoasset front-ends are separate instruments.

For wholesale firms, custodians and fund managers, the sharper passages are sanctions and proliferation financing. A firm financing trade in dual-use goods is pointed at strategic export controls, and at the poor-practice example of assuming the exporter has already checked the licence. Draft FCG 2.2.1 leaves banking-as-a-service responsibility with the regulated firm.

For compliance teams, the Guide becomes the file a supervisor reads once a policy statement replaces Appendix 1. Mapping each self-assessment question to a control and to the reason a third-party score was accepted is the exercise the draft describes. Question 4 is the place to raise a concern that good-practice lists will be read as rules.

What happens after December 24

Paragraph 1.18 says the FCA will publish feedback with the final Guide in a policy statement. The paper leaves that statement undated. Commencement in the draft instrument is "[date]", so CP26/38 supplies no implementation day. Chapter 3 asks what investment-fraud guidance should sit with the APP text, whether the drafting is agreed, which topics are missing, and how guidance should be developed, including online or in-person sessions. The consultation page adds that some standalone guidance can be published without a prior consultation and later consolidated into the Guide.

Paragraph 1.6 tells firms to factor in the UK's System Priorities. Paragraph 2.6 places the fraud edits beside APP reimbursement, the Payment Services (Amendment) Regulations 2024, Economic Crime Plan 2 and the UK Fraud Strategy 2026-2029. Responses go to the online form, to cp26-38@fca.org.uk, or by post to Financial Crime Policy at 12 Endeavour Square, London E20 1JN. Until that statement replaces Appendix 1, the current Guide remains the handbook text.

TL;DR

CP26/38 opened on October 23, 2026, and closes on December 24, 2026. It would update the FCA Financial Crime Guide on APP fraud and money mules, cryptoasset controls ahead of authorisation from October 25, 2027, financial and trade sanctions, proliferation financing, data security and banking-as-a-service accountability. The Guide would stay general guidance under section 139A of FSMA. Annex 2 cites FCG 1.1.7: departing from it is not itself a breach, which is why the paper carries no cost-benefit analysis. The draft's case studies are Starling Bank Limited, £28,959,426 in the FCA press release of October 2, 2024, and OFSI's £4,732,830.58 penalty on Citibank, N.A., London Branch, imposed on August 11, 2026. Firms are expected to have read the Guide. Enforceable duties stay in SYSC, the Money Laundering Regulations and sanctions law.

FAQ

What is CP26/38?

CP26/38 is the FCA consultation "Financial Crime Guide updates", first published on October 23, 2026. It proposes amendments to the Financial Crime Guide and prints the draft as Appendix 1. The areas cover fraud, cryptoassets, sanctions, proliferation financing, data security, and money laundering and terrorist financing. The draft instrument cites section 139A of FSMA, regulation 120(1) of the Payment Services Regulations 2017 and regulation 60(1) of the Electronic Money Regulations 2011.

When does the consultation close?

The FCA page and paragraph 1.16 close the consultation on December 24, 2026. Responses go through the online form, by email to cp26-38@fca.org.uk, or by post to Financial Crime Policy at 12 Endeavour Square, London E20 1JN. Chapter 3 gives the telephone number 0207 066 0984. Feedback and the final Guide text are due together in a policy statement. That statement is undated, and the draft instrument leaves commencement as "[date]".

Would the revised Guide create new rules?

Paragraph 1.5 says the Guide imposes no new requirement and that firms should read it and apply their own judgement. Annex 2 cites FCG 1.1.7: departing from the guidance does not, of itself, indicate a breach of FCA rules. The same annex treats section 138I, the cost-benefit duty for proposed rules, as outside this exercise. Duties that can be enforced sit in SYSC for authorised firms, in the Money Laundering Regulations, and in sanctions legislation.

Which firms are expected to read it?

Paragraph 1.8 addresses every firm the FCA supervises for financial crime, including Annex 1 institutions and cryptoasset businesses under the Money Laundering Regulations 2017. Paragraph 1.9 adds trade bodies and advisers. Draft FCG 1.1.5 says the money-laundering and sanctions chapters matter to authorised cryptoasset firms and to firms registered only under those regulations. Draft FCG 1.2.3 allows a lighter touch for a small local building society than for a national retail bank.

What would change for cryptoasset firms?

From October 25, 2027, certain cryptoasset activities need FCA authorisation under the Financial Services and Markets Act (Cryptoasset) Regulations 2026. Paragraph 2.7 points to the financial crime rules in PS26/13. The draft adds examples on enhanced due diligence for unhosted wallets, on blockchain analytics, and on Travel Rule information. Paragraph 2.10 cites a 2025 National Risk Assessment rating of high for money laundering and medium for terrorist financing.

Which enforcement cases does the draft use?

Draft FCG 7.2A.15 summarises the action against Starling Bank Limited. The press release of October 2, 2024, states a penalty of £28,959,426, against £40,959,426 before the settlement discount, after the bank opened over 54,000 accounts for 49,000 high-risk customers and screened against only part of the sanctions list. Draft FCG 7.2A.16 summarises OFSI's action against Citibank, N.A., London Branch: £4,732,830.58, imposed on August 11, 2026, under section 146 of the Policing and Crime Act 2017.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.