The firms are Kingscrown Finance (first restricted on 21 April, with further restrictions on 25 September requiring an orderly wind-down of its loan book), MOMSB and Momentus Capital (7 October), Grosvenor Funding and Grosvenor Funding (North West) (9 October) and Abbital (15 October). The FCA’s August statement on Annex 1 scrutiny had already named the weakness it was looking for: firms leaning on their parent company’s financial crime controls, or on off-the-shelf procedures written for a different business. It is now assessing responses to an information request sent to around 900 registered Annex 1 firms, which means every one of them has been contacted. Steve Smart, the FCA’s executive director lead for fighting financial crime, was direct about what comes next: "Where they cannot satisfy us, we will intervene."

The second half of the message is for regulated firms. Banks, brokers and intermediaries dealing with Annex 1 lenders must carry out their own due diligence, including seeking direct confirmation of registration status and checking independently what they are told. The FCA has said plainly that registration under the Money Laundering Regulations is no substitute for that due diligence.

The changes are wide. There’s a new section on authorised push payment fraud and money mules built around onboarding, monitoring and reporting; guidance for cryptoasset firms ahead of authorisation from 25 October 2027; and a sanctions chapter that now covers trade sanctions alongside financial ones and sets out when to go to the Office of Financial Sanctions Implementation, the Office of Trade Sanctions Implementation, HM Revenue & Customs or the FCA. The draft also makes clear that firms using Banking as a Service or embedded finance models stay accountable for controls across the whole delivery chain, and it brings the Guide into line with the amended Money Laundering Regulations that took effect in June 2026.

For anyone working in due diligence, the new poor practice examples are worth reading line by line. One describes a manager active in private markets with no formal process for verifying the beneficial owners of multi-layered or offshore structures. Another describes a firm that buys in an adverse media screening tool without ever assessing whether its data sources are suitable or valid. A third covers firms that outsource customer due diligence (CDD) or enhanced due diligence (EDD) and stop overseeing it. On sanctions, the draft expects firms to oversee vendor-configured screening settings and to check that list updates are implemented promptly and completely.

The call-for-action list is unchanged. Iran and North Korea remain subject to countermeasures, and Myanmar to enhanced due diligence. In June the FATF said it would consider countermeasures if Myanmar made no further progress by October; it has now moved that decision point to February 2027, while pressing Myanmar again on fraud and cyber-scam activity. Vietnam was warned too: the FATF will consider next steps if it doesn’t make tangible improvements by the next plenary.

Beyond the lists, the plenary agreed to accelerate implementation of the FATF Standards on virtual assets in jurisdictions with materially important virtual asset activity, with results due in June and October 2027. It also adopted the mutual evaluations of Mexico and the United States.

The Financial Crime Guide consultation in Story 02 makes the same point in AML terms. Firms using AI and other third-party tools in their financial crime controls must govern and oversee them, remain accountable for the risks they present, keep them proportionate to their risk profile, and test and validate them. One draft poor practice example describes a firm that uses third-party technology but can’t explain or evidence the basis for the findings or scores it produces. Another describes a firm relying on machine learning tools that its key staff don’t properly understand.

The FCA is also turning the technology on itself. Rusu said it is building AI tools to oversee the 60,000 AML firms coming into its remit in 2028, and that a joint FCA and Bank of England survey shows 86% of financial firms now use AI.

For CDD teams, this is the point at which the register should start to carry more weight. Once the transition closes, every individual director and PSC of a UK company should have a verified identity behind their entry. Verification won’t tell you who really controls a company, and corporate directors and limited partnerships are still to come, but it does change what a gap in verification tells you.