Across the UK, the US, the EU and the Caribbean offshore centres, two entirely different regulatory statuses are marketed to customers under words that sound identical — a low-bar registration that usually buys nothing but anti-money-laundering supervision, and a high-bar authorisation that carries conduct rules, capital, client-money protection and access to redress.

The Financial Conduct Authority (FCA) put the distinction in writing on March 20, 2026, when it warned regulated firms about dealing with the roughly 1,200 UK “Annex 1” businesses that are registered with it solely for compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs). Its language was blunt: “Our powers are currently limited to looking at how these firms are meeting their anti-money laundering obligations and they are not subject to our wider rulebook.” This analysis walks through what registration actually buys in four regimes, how to verify a firm’s status in each, and where the deadlines now fall.

Methodology and sources

This piece rests on primary documents rather than press summaries. The UK material comes from the FCA’s statement “FCA highlights risks when dealing with unregulated lenders” (March 20, 2026), its parallel statement on Market Financial Solutions Limited (same date), its money laundering registration guidance, and regulation 34 of the Payment Services Regulations 2017. The US material comes from FinCEN’s MSB registration guidance and the Paxful consent order. The EU material is ESMA’s public statement of June 23, 2026. The offshore material is the joint FSA/FIU advisory of St Vincent and the Grenadines. Time window: March 2024 to August 2026. One caveat — status labels are jurisdiction-specific, and a word such as “registered” carries a different legal meaning in each of the four regimes below.

What an Annex 1 registration actually buys — and what it does not

An Annex 1 registration is not a licence to do business; it is a supervisory hook for financial-crime purposes only. Under the MLRs, a firm carrying on one of the listed Annex 1 activities in the UK — lending (including consumer credit, credit agreements for immovable property, factoring and the financing of commercial transactions), financial leasing, guarantees and commitments, safe custody services, money broking, portfolio management and advice, or trading in foreign exchange, money-market instruments, financial futures and options or transferable securities — must register with the FCA unless it is already authorised under the Financial Services and Markets Act 2000. Registration establishes who supervises the firm for anti-money-laundering (AML) purposes. It confers no permission, imposes no conduct rules, sets no prudential capital floor, and gives the firm’s customers no route to the Financial Ombudsman Service. The FCA said as much on March 20, 2026, describing a regime “based on registration” that is “different from the authorisation regime.”

Two of those Annex 1 categories matter directly to this readership: money broking and safe custody services. A firm whose actual business is arranging or intermediating currency trades, or holding assets for clients, can sit on the FCA’s Financial Services Register with a live entry, a firm reference number and the FCA’s name attached — and be no more supervised for how it treats those clients than an unregistered company would be. That is precisely the gap this desk documented from below when it examined FTUK’s 60-minute payout claim and the absence of FCA authorisation behind it, and again when it mapped how offshore FX licensing splits into real regimes and paper ones. The March 2026 statement is the regulator confirming the same structural problem from above.

How four regimes handle the same question

Regime / regulator	Key date	What the low-bar status is	What it does not include	Where to verify
UK — FCA Annex 1 (MLRs 2017)	Statement issued March 20, 2026	Registration for AML supervision of lenders, safe custody providers, money brokers, financial leasing firms (~1,200 firms)	No FSMA Part 4A permission, no conduct rules, no Financial Ombudsman Service access	Financial Services Register — status field reads “Registered”, not “Authorised”
UK — PI/EMI agents (PSRs 2017, reg. 34)	PSRs in force since January 13, 2018	Agent entry made by an authorised principal, which remains responsible for the agent’s compliance	The agent holds no authorisation of its own; permissions belong to the principal	Financial Services Register — the entry names a principal firm
US — FinCEN MSB registration (31 CFR 1010.100(ff))	File within 180 days of starting; renew every two years	A free federal Bank Secrecy Act filing identifying the business to Treasury	Not a licence; no bearing on whether a state money-transmitter licence is required	FinCEN MSB Registrant Search, then the relevant state regulator via NMLS
EU — MiCA CASP authorisation	Transitional period ended July 1, 2026 (Art. 143(3))	National pre-MiCA registrations that have now lapsed as a basis for serving EU clients	Clients of unauthorised CASPs “do not benefit from MiCA safeguards, including protections for client assets”	ESMA Register of authorised CASPs
Offshore — SVG FSA (IBC registration)	Advisory issued jointly by the FSA and FIU	Company registration under the international business companies framework	“No Forex Trading or Cryptocurrency licenses are issued in St Vincent and the Grenadines”	SVG company registry — a certificate of incorporation, not a licence

Sources: FCA, HM Government (legislation.gov.uk), FinCEN, ESMA, SVG FSA/FIU — all linked above. Last updated: August 10, 2026.

The divergence is not accidental. The UK ended up with two parallel gateways because AML supervision was allocated by activity while conduct regulation was allocated by permission, and the two lists never fully overlapped. The US separated the questions deliberately: FinCEN administers a federal reporting statute, while the authority to transmit money is a state matter — which is why the Conference of State Bank Supervisors has spent four years pushing the Money Transmission Modernization Act, adopted in full or in part by 31 states as of April 23, 2026. The EU closed its equivalent gap by brute force on July 1, 2026. St Vincent and the Grenadines never had a gap to close, because it never issued the licence. Firms exploit the space between these designs by quoting the regulator’s name without quoting the status.

“This statement is a timely reminder that the Annex 1 regime is a registration, not an authorisation, regime, and carries materially fewer protections for consumers and counterparties.”

— Ben Cooper, Partner and Head of Financial Crime, TLT LLP (TLT LLP insight, April 1, 2026)

Enforcement context: what a registration failed to prevent

The cleanest illustration is American. In the matter of Paxful, Inc. and Paxful USA, Inc., Number 2025-02, FinCEN imposed a $3.5 million civil money penalty on December 9, 2025, crediting $1.75 million against a parallel $4 million payment to the Department of Justice. The consent order records that the peer-to-peer virtual-currency platform “registered as an MSB with FinCEN in 2015” and yet “failed to implement even basic steps to comply with its AML regulations until 2019.” FinCEN found the company facilitated more than $500 million in suspicious activity, including transactions touching Iran, North Korea and Venezuela. Paxful admitted willful violations of the Bank Secrecy Act, including failures to register, to maintain an effective AML programme and to file suspicious activity reports. Ten years of unbroken federal registration produced none of the protection a customer reading “FinCEN registered” would reasonably infer.

“For years, Paxful disregarded its BSA obligations and facilitated transactions associated with illicit activity and high-risk jurisdictions, such as Iran and North Korea.”

— Andrea Gacki, Director, Financial Crimes Enforcement Network (FinCEN news release, December 9, 2025)

The precedent runs deeper. FinCEN’s assessment against Larry Dean Harmon, doing business as Helix, Number 2020-2 (October 19, 2020), carried a $60 million penalty for operating as an unregistered money transmitter — a figure the Paxful order itself cites as a comparator. The UK equivalent is now unfolding: Market Financial Solutions Limited, an Annex 1 business, entered administration on February 25, 2026, and the FCA opened an enforcement investigation. Its customers have no Financial Ombudsman Service claim. Separately, the FCA cancelled the authorisation of RVB Currency UK Ltd (FRN 593854) by Final Notice dated June 15, 2026, in part because the firm “failed to comply with a requirement of the MLRs to be included in a register maintained under the MLRs” — evidence that the registration layer and the authorisation layer can fail independently of each other.

A verification procedure that takes four minutes

Checking a firm’s real status is a four-step exercise, one per regime. On the FCA’s Financial Services Register, read the status field before anything else: the FCA distinguishes “Authorised” firms, which “must meet certain standards and have our permission to provide certain products and services”, from “Registered” firms, which “must meet certain requirements, but they don’t need to have our permission to provide products and services”. Then open the permissions block. An authorised firm lists named regulated activities with client-type and investment-type limitations; an Annex 1 firm’s entry shows no Part 4A permissions at all. If the entry names a principal firm, you are looking at an agent or appointed representative under regulation 34 of the PSRs — the permissions belong to the principal, not to the firm in front of you. Finally, search the FCA Warning List, which carries entries for unauthorised firms and for clones of genuine ones.

For the other three regimes the equivalents are: FinCEN’s MSB Registrant Search, which confirms only that a filing exists, followed by the state regulator or NMLS for the money-transmitter licence that actually authorises the activity; ESMA’s Register of MiCA-authorised CASPs, which since July 1, 2026 is the only basis on which a firm may serve EU clients; and, for a St Vincent entity, the company registry, which returns a certificate of incorporation and nothing resembling a financial licence. The same discipline applies to two-regulator jurisdictions such as Dubai’s split between VARA and the DFSA, where naming the emirate is not the same as naming the licence.

What this means for brokers, prop firms, payments companies and compliance teams

For brokers and introducing brokers, the operational point is counterparty due diligence. The FCA’s March 20, 2026 statement tells regulated firms to seek “direct confirmation of their registration status”, to independently verify what a counterparty tells them, and to document the risks — including those set out in the 2025 National Risk Assessment. A referral to an Annex 1 lender is a referral to a firm whose customers have no ombudsman route, and the FCA has flagged cases where consumers were encouraged to incorporate limited companies specifically to access unregulated bridging finance.

For proprietary trading firms, the exposure is in the marketing copy. A prop desk operating through a St Vincent entity that describes itself as “regulated” is making a claim its own registry contradicts; this desk has traced that structure in detail, including in the Quant Tekel review, where an FSCA-licensed broker sat alongside an SVG-registered prop entity. For payments companies, the agent question is the live one: an agent registered under regulation 34 inherits nothing but its principal’s supervision, and the principal remains responsible for its compliance. For fund managers and custodians with EU clients, the July 1, 2026 MiCA deadline has already passed, and continued reliance on a lapsed national registration is a breach rather than a transitional arrangement. For legal and compliance teams, the practical deliverable is a status-mapping file: for every counterparty, the regulator, the exact status word, the permissions or licence reference, and the redress scheme that does or does not apply. Firms that have priced the difference between licence tiers — as set out in this desk’s analysis of what an FX licence buys after ASIC’s record A$830 million year — will find the mapping straightforward.

What is next — the forward view

The UK direction of travel is towards more data and, eventually, more powers. The FCA raised AML concerns with Annex 1 businesses in a Dear CEO letter in 2024 and followed up with 300 firms in late 2025; trade press reported on August 7, 2026 that the information request has since been extended to a further tranche, taking the population contacted to roughly 900 of the 1,200 registered firms. The FCA’s own framing — powers “currently limited” — is the tell. Whether the Annex 1 perimeter is redrawn is a matter for HM Treasury, and it remains contested: widening it would pull about 1,200 firms into conduct regulation at a moment when the government is pressing for lighter-touch supervision.

The statute book is already moving. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) were made on June 9, 2026 and came into force 21 days later, on June 30, 2026. Two commencement dates matter for firms reading this: regulation 20, which inserts a new regulation 34A imposing enhanced customer due diligence on cryptoasset exchange providers, custodian wallet providers and correspondent relationships, comes into force on February 1, 2027; and the substituted Schedule 6B on changes in control of registered cryptoasset businesses takes full effect on October 25, 2027.

In the EU, ESMA said on June 23, 2026 that it and national competent authorities “may, where necessary, take coordinated action against unauthorised CASPs after the transitional period”, working alongside the European Banking Authority and the Anti-Money Laundering Authority. Expect the first national enforcement against a firm still serving EU clients on a lapsed registration within the current supervisory cycle. In the US, the open question is how many of the remaining states adopt the Money Transmission Modernization Act, and whether federal stablecoin legislation eventually displaces state licensing for a subset of issuers. The parallel fight over how status claims are advertised is already live, as this desk noted in its coverage of finfluencer licences, charges and takedowns.

FAQ

Is an FCA-registered firm regulated by the FCA?

Only for a narrow purpose. An Annex 1 firm is registered for supervision under the Money Laundering Regulations 2017 and nothing else. The FCA stated on March 20, 2026 that such firms “are not subject to our wider rulebook”, meaning conduct rules, client-money rules and the Consumer Duty do not apply, and customers cannot take a complaint to the Financial Ombudsman Service. The firm still appears on the Financial Services Register, so the register entry alone does not settle the question — the status field does.

What does “FinCEN registered” mean for a US crypto or payments firm?

It means the business has filed a money services business registration with the Treasury Department under the Bank Secrecy Act. Registration is free, is filed within 180 days of starting operations and is renewed every two years. FinCEN is explicit that registration has no bearing on whether a state money-transmitter licence is required, and it does not certify that a firm’s anti-money-laundering programme works. Paxful was registered from 2015 and was still penalised $3.5 million in December 2025.

How do I tell an authorised firm from a registered one on the FCA register?

Read the status field and then the permissions block. The FCA describes authorised firms as those that “have our permission to provide certain products and services”, while registered firms “don’t need to have our permission”. An authorised firm’s entry lists specific regulated activities with limitations; an Annex 1 firm’s entry lists none. If the entry names a principal firm, the entity is an agent or appointed representative and the permissions belong to the principal.

Does an SVG registration mean a broker is regulated?

No. The Financial Services Authority and Financial Intelligence Unit of St Vincent and the Grenadines state jointly that “there is no regulation in place for Foreign Exchange (Forex) Trading and Cryptocurrency offerings” there and that “no Forex Trading or Cryptocurrency licenses are issued” in the jurisdiction. An SVG entity holds a certificate of incorporation. Any marketing that presents that document as a financial licence is describing something the registry does not issue.

What changed in the EU on July 1, 2026?

The transitional period under Article 143(3) of MiCA ended. Entities that had been serving EU clients under national crypto regimes could no longer rely on those registrations. ESMA’s public statement of June 23, 2026 requires unauthorised providers to stop onboarding EU clients, cease marketing and wind down in an orderly way, and reminds clients that they “do not benefit from MiCA safeguards, including protections for client assets”. The ESMA Register of authorised CASPs is now the verification point.

Is being an agent of an authorised firm the same as being authorised?

No. Under regulation 34 of the Payment Services Regulations 2017, an authorised payment institution may provide services through an agent only if the agent is on the register, and the principal is responsible for the agent’s compliance. The agent holds no permission of its own, and the FCA warns that if an agent goes beyond what its principal has allowed, customers may lose Financial Ombudsman Service and Financial Services Compensation Scheme protection.

What should a compliance team do first?

Build a counterparty status map. For each firm, record the regulator, the exact status word used on that regulator’s register, the permission or licence reference, the activities covered, and the redress scheme that applies. Where a counterparty is Annex 1 registered, document the absence of ombudsman access and the resulting consumer-harm and reputational risk. The FCA expects regulated firms to seek direct confirmation of registration status rather than relying on a counterparty’s own description.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.