For many firms carrying on lending and related financing activities, registration as an Annex 1 financial institution under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the "MLRs") has historically been treated as an administrative exercise. Unlike FCA authorisation, Annex 1 registration has often been perceived as a relatively narrow anti-money laundering ("AML") requirement, attracting limited supervisory engagement once obtained. Recent FCA activity suggests that view is no longer accurate.

Over the last year, and particularly in recent months, the FCA has become increasingly vocal about the financial crime risks it perceives within sectors carrying on Annex 1 activities. The regulator has publicly confirmed that it has issued information requests to registered Annex 1 firms (1,200 in total), is applying increased scrutiny to registration applications and expects firms to maintain AML frameworks tailored to their own business models and risks rather than relying solely on group-level arrangements. 

For firms carrying on lending, credit provision, leasing, guarantees, payment administration and other activities falling within Annex 1, the message is clear: registration should no longer be regarded as the end of the compliance journey. Rather, it represents the beginning of an ongoing supervisory relationship.

What is an Annex 1 Firm?

An Annex 1 firm is a business that carries on financial activities, which are specifically listed in Annex I to the Capital Requirements Directive which are not otherwise authorised by the FCA or Prudential Regulation Authority. These are set out in Schedule 2 of the MLRs.

It captures a broad range of activities including lending, financial leasing, guarantees and commitments, money transmission and certain payment administration activities. Where those activities are carried on by way of business, firms may be required to register with the FCA for AML supervision under the MLRs.

Historically, many market participants have assumed that because Annex 1 registration does not amount to full FCA authorisation, the regulatory burden is correspondingly light. While that distinction remains true in legal terms, recent developments suggest that the FCA is taking a much greater interest in how these businesses operate in practice. 

Why the FCA Is Paying Greater Attention

In its recent regulatory communications, the FCA identified concerns regarding financial crime risks within the Annex 1 population and highlighted what it regards as weaknesses in some firms' AML arrangements. In particular, the FCA referred to situations where firms rely heavily on generic policies or group-wide controls without adequately considering the specific risks arising from their own operations. 

This focus reflects several broader regulatory themes in the FCA’s supervisory approach in recent years:

• increasing emphasis on financial crime prevention;
• greater use of data-driven supervision;
• heightened scrutiny of governance and accountability arrangements;
• increased focus on firms outside the traditional perimeter; and
• a desire to intervene earlier where potential consumer or market risks are identified. 

Against that backdrop, Annex 1 firms are a logical supervisory target. Many businesses operate substantial unregulated lending or financing activities that are outside of the FCA’s remit. The collapse of Market Financial Solutions Limited (MFS) earlier this year is a prime example of why the FCA is seeking greater visibility over how these firms assess and manage money laundering and financial crime risks (and why it wants a better understanding of how these business structures work in practice).

Information Requests: A Sign of a More Active Supervisory Approach

One of the most significant developments has been the FCA's decision to issue information requests to registered Annex 1 firms. The regulator has also warned that registration applications will be subject to greater scrutiny and may take longer to process. 

Although the precise content of information requests will vary between firms, the broader significance is difficult to ignore.

Historically, many Annex 1 firms have had relatively limited direct interaction with the FCA following registration. The recent information-gathering exercises indicate a more proactive supervisory approach in which the regulator seeks a deeper understanding of firms' business models, governance frameworks and AML controls.

Firms should therefore assume that the FCA will increasingly expect them to demonstrate not only that policies exist but that those policies are properly implemented, understood by staff and effective in practice.

The Areas Most Likely to Attract Regulatory Attention

Based on recent FCA statements and the issues that frequently arise in Annex 1 registration projects, several themes are particularly likely to attract scrutiny.

Governance

The FCA has repeatedly emphasised the importance of firms maintaining governance arrangements that are proportionate to their business model and risk profile.

For Annex 1 firms, this means being able to demonstrate:

• clear responsibility for AML compliance;
• effective oversight by senior management;
• documented decision-making processes; and
• appropriate escalation procedures for higher-risk matters.

Where responsibility is fragmented across multiple group entities, firms should be prepared to explain exactly how governance operates in practice.

Risk Assessments

A recurring weakness identified by regulators across multiple sectors is the use of generic risk assessments that do not adequately reflect the firm's actual activities.

Firms should review whether their business-wide risk assessment properly addresses issues such as:

• customer types;
• source of funds risks;
• geographic exposure;
• transaction structures;
• introducer relationships; and
• the specific nature of lending or financing activity undertaken.

A document downloaded from a template provider or inherited from another group company is unlikely to satisfy regulatory expectations unless it has been properly adapted to the firm's circumstances.

Reliance on Group Controls

One particularly interesting feature of the FCA's recent comments is its concern that some firms may be relying excessively on group-level controls. Many lending groups operate through multiple entities performing different functions: one may originate, another provides funding, another administers or services transactions. 

Where a registered Annex 1 entity relies on wider group arrangements, it should nevertheless be capable of demonstrating that it understands its own risks and maintains oversight of the controls designed to mitigate them.

The regulator is unlikely to be satisfied by a simple assertion that "another company in the group takes care of AML".

Funding Flows and Business Models

Another area that may attract increased scrutiny concerns the underlying structure of lending arrangements.

Questions often arise regarding:

• the identity of the true lender;
• the movement of funds through group structures;
• the role of SPVs;
• co-lending arrangements; and
• investor funding models

These issues can become particularly important where firms are assessing whether Annex 1 registration is required in the first place.

The FCA is likely to expect firms to have a detailed understanding of their transaction flows and to articulate clearly why they have concluded that registration is, or is not, required.

Registration Applications Are Becoming More Challenging

The FCA has expressly stated that firms should expect registration applications to receive increased scrutiny and that processing times may lengthen as a result. 

For firms considering a future application, this has a number of practical implications.

Registration should no longer be approached as a straightforward form-filling exercise. Instead, applicants should ensure they are able to explain:

• their business model;
• ownership structure;
• governance arrangements;
• risk assessment methodology;
• customer due diligence procedures;
• source of funds controls;
• monitoring processes; and
• record keeping arrangements.

Applications supported by generic documentation or inconsistent explanations are likely to encounter greater resistance than may previously have been the case.

Looking Ahead

The FCA's recent statements show the Annex 1 population is receiving considerably more attention than in previous years. While registration remains distinct from full FCA authorisation, firms should not assume that this translates into a light-touch supervisory environment. Instead, current developments point towards a more engaged and inquisitive regulator, particularly where financial crime controls, funding structures and governance arrangements are concerned.

The most important takeaway is that Annex 1 registration should no longer be viewed merely as an administrative requirement. The FCA increasingly appears to regard registration as a gateway through which it can better understand and supervise sectors that have historically sat on the edge of the regulatory perimeter. 

For firms carrying on Annex 1 activities, the challenge is therefore no longer simply obtaining registration. It is demonstrating, on an ongoing basis, that the business understands its risks, operates effective controls and can withstand increasing regulatory scrutiny.

Key takeaway for clients

If your business is registered under Annex 1, or is considering registration, now is an appropriate time to revisit your AML framework, governance arrangements and perimeter analysis. Firms that prepare proactively are likely to be significantly better positioned if and when the FCA knocks on their door.