FCA Restricts Six Annex 1 Firms Over AML Controls: What Lenders and Their Banks Should Do

On 23 October 2026 the Financial Conduct Authority (FCA) announced that six firms registered with it as Annex 1 financial institutions are now operating under restrictions, after it raised concerns about their anti-money laundering (AML) policies, controls and procedures. The restrictions were voluntary, imposed at each firm's request, and the FCA says it is also assessing information from around 900 registered Annex 1 firms. If you work for a bank, an accountancy practice or a law firm that deals with unregulated lenders, this is a prompt to revisit how you check them. The facts below come from the FCA's press release and its August 2026 statement on Annex 1 firms.

What an Annex 1 firm is

Annex 1 firms are businesses that carry out certain financial activities without being authorised under the Financial Services and Markets Act 2000, and so are not regulated for conduct in the usual way, but must register with the FCA for money laundering supervision. The FCA's statement describes them as unregulated lenders, safe custody providers, money brokers and financial leasing companies. Its registration page lists the wider set of activities, including lending (consumer credit, factoring and commercial transaction financing), financial leasing, safe custody and money broking, among others. Firms authorised under the Financial Services and Markets Act do not register separately as Annex 1 institutions.

To register, applicants complete the Annex 1 form on the FCA's Connect system, submit an MLR Individual form for each senior person responsible for the activities, complete a Disclosure and Barring Service check for MLR individuals and beneficial owners who are not already approved senior managers, and pay the fee.

The six restricted firms

The press release names six firms: Kingscrown Finance Ltd, MOMSB Ltd, Momentus Capital Ltd, Grosvenor Funding Ltd, Grosvenor Funding (North West) Ltd and Abbital Ltd. The restrictions differ by firm:

• Kingscrown Finance accepted voluntary restrictions on 21 April 2026. Further restrictions on 25 September 2026 limit how it may receive payments from existing customers and require an orderly wind-down of its loan book.
• MOMSB and Momentus Capital (7 October 2026) may not take on new customers or new lending arrangements, subject to limited exceptions, face limits on accepting payments from existing customers, and must commission an independent review of their AML framework.
• Grosvenor Funding and Grosvenor Funding (North West) (9 October 2026) are under the same kind of restrictions, with an independent review of their AML framework.
• Abbital (15 October 2026) may take on new customers, make new loans or accept payments from existing customers only in specified circumstances, and must commission an independent review of its AML systems and controls.

The press release says the firms operate in sectors with a heightened risk of money laundering and other financial crime, and that the FCA expects them to show they understand those risks and have effective systems and controls to manage them, or face action.

The wider supervisory push

The restrictions follow a statement the FCA published in August 2026 saying it is closely scrutinising applications to register as an Annex 1 firm, that registration will take longer, and that applicants must clearly show they can meet the money laundering regulations. The FCA is sending an information request to around 900 Annex 1 firms about their activities, business models and risks. It says this follows work with 300 Annex 1 firms in late 2025, and means all registered Annex 1 firms will have been contacted.

The statement highlights two concerns. First, some firms rely too heavily on the financial crime controls of their parent company; the FCA says each firm in a group needs its own controls suited to its own risks, governance and operations, and cannot use generic procedures written for another company. Second, unregulated lending through complex structures, including special purpose vehicles, poses risks to consumers and markets.

What this means for firms that deal with Annex 1 lenders

The FCA's August statement asks regulated firms to continue their due diligence, to understand the business of any Annex 1 firm they deal with, and to seek direct confirmation of an Annex 1 firm's registration status. In practice, that points to a few checks. Confirm registration directly with the FCA rather than relying on a certificate the customer supplies. Ask whether the customer's AML controls are its own or borrowed from a group entity. Look at how the customer is funded and structured, especially where special purpose vehicles are involved. Review how you monitor payments to and from the customer, in line with your own suspicious activity reporting procedures. Accountancy practices that act for lenders will also want their AML governance arrangements to show who owns these client relationships.

What this means for Annex 1 firms themselves

For registered lenders, leasing companies and brokers, the message is that registration is not the end of supervision. Expect to be asked for evidence of a business-wide risk assessment, written policies that fit your own model, a named person responsible for AML, and proof that controls operate in practice. The independent reviews required in several of these cases show the FCA is willing to ask a third party to test the framework. Our overview of CPD courses includes financial crime training for teams that need to build this knowledge.

What we could not confirm

The FCA's press release does not set out the specific control failings found at each firm, so we cannot say what was wrong at any one of them. It does not state that any firm has been found to have facilitated money laundering. The restrictions were voluntary and could change; check the FCA's website for the current position before relying on this summary. The August statement does not say how many Annex 1 firms are registered beyond the information request to around 900, and we have not seen the information request itself.