For regulated firms, the Target pillar is the chapter to read. The government says too much private-sector activity is still focused on low-value tick-box compliance, and it holds up July’s narrowing of mandatory EDD for high-risk jurisdictions as the model, estimating that change alone saves the regulated sector £178.1m a year. Next come consultations on further MLR changes to reduce low-value activity, a review of the SARs regime that will examine raising the suspicion threshold (for example to "reasonable grounds to suspect"), and a review of Companies House discrepancy reporting. For context, the UKFIU received 866,616 SARs in 2024–25.

The same chapter tightens as well as eases. HM Treasury will consult on stronger supervisory enforcement powers, including unannounced visits and a greater ability to hold directors accountable for MLR breaches. A separate consultation will look at bringing property developers, offshore virtual asset service providers, antiques and antiquities dealers, football clubs and agents, and donation-based crowdfunding into scope, alongside changes for letting agents and higher-risk high-value goods dealers. Under Integrate, a new National Financial Intelligence Service in the NCA will bring together JMLIT and Data Fusion, work alongside the UKFIU, and extend the banks’ partnership model to cryptoasset firms, money service businesses and electronic money institutions. The UKFIU is also to get a power to compel information from firms without court approval.

The notice is worth reading in full because the failures were ordinary configuration and process gaps that most firms could find in their own systems. The screening system didn’t treat the Russian corporate prefix "PAO" as part of a match, so no alerts fired on PAO Sovcomflot and 328 transactions worth around £5.4m went through. The payment processor screened payments before correspondent banks were added to the chain and never rescreened the full chain. Internal list entries for designated banks lacked their BICs, when the BIC was the only identifier in the payment message. And in May 2022, to manage alert volumes, the bank changed its guidance so that accounts under investigation were restricted only where there was evidence of 50% or greater ownership by a designated person.

Two further details stood out to me. An internal money laundering alert identified that a remitter might be owned by a person designated under the anti-corruption regime, but the sanctions escalation went to the wrong team, wasn’t redirected, and the case was closed with no further action. On discounts, the bank received 20% for voluntary disclosure and co-operation, short of the 30% maximum, because breaches worth about £6.9m came to light only after OFSI wrote to it, others were disclosed seven to ten months late, and some initial disclosures were materially incomplete. The 20% settlement discount took the total reduction to 40%.

The First Supervisory Notice sets out what the FCA found when it requested ten client files in December 2025. Every file was assessed as inadequate. In several, no customer risk assessment was completed before onboarding. Six customers had been rated high risk, yet the firm hadn’t obtained or verified source of funds or source of wealth for any of them. Screening was deficient in six of the ten files; in one, adverse media searches used a misspelling of the customer’s name, and the FCA itself found reporting of an alleged money laundering scheme and an FBI investigation that the firm had missed.

Monitoring tells the same story. In one file, 4,968 alerts were closed as not suspicious, 3,294 with no documented rationale, and 294 remained open. The firm confirmed that a single individual was responsible for reviewing alerts. When asked for its records, it produced around 180,000 documents that the FCA found largely unusable, and in system walkthroughs it couldn’t locate evidence of risk assessments, due diligence or monitoring. The FCA concluded that the documentation was either never obtained or never kept, and under regulation 28(16) a firm that can’t demonstrate its CDD was appropriate has failed the test.

The part that affects firms directly is what the supervisors have signed up to. The FCA will publish examples of good and poor practice on the use of AI during 2026–27 and update its Financial Crime Guide with good practice on AI tools and information sharing. HMRC will run outreach on AI and tech-based compliance tools, and the Gambling Commission will develop policies on AI and new technologies. The strategy ties this to the FCA’s Mills Review, published in July, and to wider use of digital ID in customer due diligence.

The review is about cyber, but its questions transfer directly to AI in AML. The FCA asks who owns decisions about the use of frontier AI, and whether a firm can tell the difference between outputs that are technically plausible and findings that are genuinely exploitable. Swap "exploitable" for "suspicious" and you have the central governance question for any AI-assisted screening or monitoring tool. The warning about volume applies too: a model that surfaces more issues than the team can work through simply moves the backlog somewhere else.

The point that matters for AML teams is that an existing MLR registration doesn’t convert into FSMA authorisation. Registered firms have to apply through the gateway like everyone else. Those that apply within the window can rely on a saving provision and keep operating while the FCA assesses them, while those that miss it face running off their UK business.