The stakes have risen. In a 6 August statement, the FCA said it is closely scrutinising Annex 1 applications. Its concerns include lending through complex structures such as SPVs, and off-the-shelf group procedures that do not fit the applicant's actual business.
This guide covers who needs registration, how to apply, and how to prepare for supervision.
Key Takeaways
- Assess each legal entity separately against the Annex 1 perimeter.
- AML registration is not FCA authorisation under FSMA.
- Build firm-specific, evidence-backed controls, not copied group policies.
- Registration starts ongoing supervision. It is not a one-off filing.
What FCA Money Laundering Registration Is
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) make the FCA the supervisor of Annex 1 financial institutions under regulation 7. Registration lets the FCA oversee those firms' AML and counter-terrorist financing systems.
Registration versus authorisation
Annex 1 registration does not authorise any regulated activity under FSMA. The FCA's Perimeter Report says its remit for these firms is their AML obligations. Conduct rules, consumer protections and SM&CR do not apply to them in that capacity alone.
An authorised person is excluded from the Annex 1 regime. An FCA-authorised consumer-credit lender, for example, does not need separate Annex 1 registration.
Don't treat an unrelated FSMA permission on the Financial Services Register as proof of Annex 1 registration either.
When another supervisor applies
The FCA does not supervise every business with AML obligations. Regulation 7 assigns other categories to professional bodies, the Gambling Commission or HMRC.
For example:
- HMRC supervises high-value dealers and certain money service businesses
- Professional bodies supervise relevant regulated professionals
- The Gambling Commission supervises gambling operators
Your statutory category decides the supervisor, so check the FCA registration guidance before assuming.
Who Needs FCA Money Laundering Registration?
Identify the relevant Annex 1 activities
The FCA's guidance lists activities drawn from Schedule 2 of the MLRs, including:
- Lending, including consumer credit, factoring and trade finance
- Financial leasing
- Money broking
- Safe custody and safekeeping of securities
- Guarantees and commitments
- Certain trading in money-market instruments, foreign exchange and futures
Treat this as a summary. Check the current guidance and Schedule 2 before relying on it.
The test turns on what the firm actually does, not what it calls itself. The FCA looks at commercial benefit, the activity's relevance to the rest of the business, and its regularity.
A "fintech" or "platform" label changes nothing. For UK nexus, a UK client alone, with no UK office or other UK activity, is likely insufficient.
Consider group structures and SPVs
Assess every legal entity on its own. An SPV that is the original lender needs Annex 1 registration. An SPV that only receives the legal or beneficial interest in loans does not need to register on that basis, according to the FCA.
Verify the current wording before you rely on that distinction.
The FCA also expects each group firm to test whether its controls suit its own risks and operations.
Check exclusions and overlapping regimes
Existing authorisation, another AML supervisor, or an exclusion (money service business, bill-payment provider, certain payment providers) can change the answer. Not every financial services business needs the same registration.
Run this checklist for each entity:
- What activities does it carry on, and is it doing so as a business?
- What is its contractual role: originator, funder, acquirer, agent?
- Who are its customers?
- How do funds flow?
- What is the ownership structure?
- What permissions does it already hold?
- Which authority is likely to supervise it?
Document the conclusion. Revisit it whenever products, group structure or delivery channels change.
How to Apply for FCA Money Laundering Registration
Confirm the perimeter and governance first
Settle the registration question before drafting anything. Then identify:
- The board member or senior manager responsible for MLR compliance
- The nominated officer (MLRO) and reporting lines
- Escalation arrangements
The MLRO carries personal accountability for the financial crime programme. They oversee monitoring, suspicious activity reporting, training and records.
Beneficial owners, officers and managers are subject to fit-and-proper tests covering honesty and integrity, skills and experience, and financial soundness. Check ownership, controllers, outsourcing, group support and any third parties involved in onboarding or payments. A DBS check may be needed before submission for some beneficial owners.
Build a firm-specific AML framework
The FCA expects the framework to exist when you apply. It should include a business-wide risk assessment, customer risk assessment and supporting procedures covering:
- Customer due diligence and enhanced due diligence
- Beneficial ownership checks
- Sanctions and PEP screening
- Transaction monitoring and SAR escalation
- Record-keeping and staff training
- Independent testing
Reflect your products, customers, jurisdictions, delivery channels and higher-risk exposure. Policies copied from a parent company rarely persuade without evidence of local adaptation.
Assemble the evidence
Prepare, against the latest FCA application expectations:
- Business and operating model, including why the activity sits outside FSMA regulated activities
- Customer types, turnover and source of funds
- Ownership chart and management information
- Risk assessment, policies and procedures
- Governance, MLRO details and outsourcing controls
- Customer journey, monitoring and reporting processes
Then cross-check the application, risk assessment, policies, website, product documents and financial projections. The FCA should read one coherent description of the business.
Submit and handle questions
Apply through FCA Connect. Emailed paper forms are rejected. The FCA's fee page lists the Annex 1 application fee as £560, payable at submission. Check the live page before paying.
Under regulation 59, the FCA must notify its decision, or that it is minded not to register, within 45 days of receiving the application or further information. That is not an approval guarantee. Applicants then have at least 28 days to make representations.
Incomplete, unclear or contradictory applications bring follow-up questions, delay, refusal or rework. Missing MLR Individual forms and resubmissions that ignore earlier feedback are known rejection triggers. Keep a response log for all FCA correspondence.
Verify the outcome and maintain registration
Search the Financial Services Register by firm name or reference number. Do not call yourself FCA registered until the official record supports it. The FCA also advises counterparties to obtain direct confirmation of registration.
Ongoing duties:
- Notify the FCA within 30 days if application information materially changes or proves inaccurate (regulation 57)
- Keep AML controls effective and evidenced
- Pay annual fees, which fall under fee block G.1
- Review your perimeter position regularly
What FCA Supervision Involves and How to Prepare
Understand what the FCA will test
Supervision is risk-based. Higher-risk businesses get more attention. Expect scrutiny of:
- Governance and the firm-wide risk assessment
- Customer risk classification, CDD and EDD files
- Beneficial ownership and sanctions controls
- Transaction monitoring and SAR decisions
- Training, records and management information
Written policies are not enough. Show how you test controls, record decisions, investigate alerts, escalate issues and track remediation. The FCA's Financial Crime Guide gives good and poor practice examples. It is not binding, but it shows what the regulator expects.
Make controls specific to the legal entity
The FCA warns against reliance on parent or group controls without checking fit for the subsidiary's customers, products, governance and systems. A workable adaptation looks like this:
- Start with the group policy as a baseline.
- Run a separate entity-level risk assessment.
- Assign local ownership of the framework and named responsibilities.
- Rewrite procedures for the entity's products, customers and systems.
- Keep evidence of local oversight, such as committee minutes and testing results.
Prepare for supervisory engagement
Scrutiny may involve information requests, meetings, visits, desk-based reviews or thematic work. Not every firm will see every type. The FCA announced restrictions on six lenders after concerns about AML policies and controls. The firms requested the restrictions.
Keep an inspection-ready library:
- Board and committee minutes
- Risk assessments and customer files
- Alert, case and SAR decision records
- Training logs and quality assurance results
- Internal audit findings and remediation tracking
Avoid common failures
Frequent weak points:
- Misreading the perimeter or omitting an SPV or group entity
- Submitting a generic AML programme
- Failing to show MLRO capacity
- Describing the business inconsistently
- Weak source-of-funds or beneficial-ownership procedures
- Poor record-keeping
- Missing updates or fees
Ignoring the regulator is costly too. The FCA cancelled HR Bank Limited's registration after it failed to respond to information requests. That case concerned unanswered notices, not a finding on the quality of its controls.
Use proportionate external compliance leadership
A growing fintech, crypto firm, lender or embedded finance business may need experienced help to build governance, prepare an application or remediate controls, without hiring a full-time executive yet.
Fraxtional offers fractional, director-led compliance leadership, including MLRO, CCO, CRO, BSA Officer and CAMLO roles. Its MLRO services include acting as the named MLRO, managing regulatory submissions, leading AML training and liaising with regulators such as the FCA.
Conclusion
Registration starts with a careful Annex 1 perimeter analysis. It continues with tailored AML controls, effective governance, accurate register information and ongoing evidence that the controls work.
Your next steps:
- Map each legal entity and its activities
- Compare them with the latest FCA guidance
- Assemble your control evidence
Take specialist advice if your model or group structure is complex.
Frequently Asked Questions
Who needs AML registration?
Firms carrying on Annex 1 activities, such as certain lending, financial leasing, money broking or safe custody, may need FCA registration. The answer depends on the legal entity, its activities and any existing supervisor.
How do I get FCA registered?
Assess the perimeter, prepare governance and AML controls, then submit through FCA Connect. Respond promptly to information requests, and confirm your status on the Financial Services Register.
How do I check my AML registration?
Search the FCA Financial Services Register by firm name or reference number. Confirm the legal name, status and listed details match your business.
What is an FCA registration?
It is registration for AML supervision under the MLRs. It is distinct from FCA authorisation and grants no wider financial services permissions.
What does FCA AML supervision involve?
A risk-based review of governance, risk assessments, due diligence, transaction monitoring, SAR handling, training and records. The focus is whether controls work in practice.
Can I carry on my business while my application is pending?
Current FCA guidance and regulation 59 give no express general answer. Confirm the position for your activity with the FCA or a legal adviser. Never market an in-scope business as FCA registered before registration is granted.
