On 23 October 2026, the Financial Conduct Authority (FCA) published a Consultation Paper (CP26/38) in relation to proposed changes to its Financial Crime Guide (the Guide).

Background

Since the Guide was last updated, the UK’s sanctions regime has evolved, cryptoasset regulation has developed and firms have increasingly adopted artificial intelligence (AI) and third-party tools for financial crime controls. The FCA is proposing updates to the Guide to take into account these developments, as well as to factor in insights from its recent supervisory work.

CP26/38 should be read by all FCA financial crime supervised firms, including firms the FCA supervises under The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), such as Annex I Financial Institutions and cryptoasset businesses.

Summary of proposed changes

The FCA is proposing changes to the following areas of the Guide:

  1. Fraud: Updates to reflect supervisory expectations and lessons from the FCA’s multi-firm work on authorised push payment fraud and money mules, responding to industry feedback for more guidance. Other proposed changes include: (a) adding content in relation to the failure to prevent fraud offence, which was introduced as part of the Economic Crime and Corporate Transparency Act 2023; and (b) strengthening content relating to fraud risk assessments, governance and oversight, and using management information and assurance to identify, monitor and escalate risks.
  2. Cryptoassets: From 25 October 2027, firms carrying out certain cryptoasset activities in the UK will need to be authorised by the FCA under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (Cryptoasset Regulations). Firms in scope of the Cryptoasset Regulations will still need to comply with their obligations under the MLRs, as well as other financial crime legislation such as the Terrorism Act 2000 (TA) and Proceeds of Crime Act 2002 (POCA). The FCA wants its guidance to help these firms understand and comply with financial crime expectations. The FCA’s proposed updates include examples of good and poor practice and a self-assessment question to help firms consider whether their procedures adequately distinguish between obligations under POCA and the TA.
  3. Financial and trade sanctions: The UK’s sanctions regime has evolved since the Guide was last updated and since the Office of Trade Sanctions Implementation was established. The FCA proposes to update this section to reflect these developments and include examples of good and poor practice drawn from its supervisory work.
  4. Proliferation financing: Supervisory work has highlighted the need for enhanced guidance on proliferation financing risks and controls, including further detail on the FCA’s expectations for firms, and CP26/38 proposes updates in this area to address this, including examples of good and poor practice. The revisions recognise that proliferation financing may involve mechanisms similar to sanctions evasion and clarify how firms might manage the risk through existing controls.
  5. Data security: Proposed changes include: (i) updating outdated legislative references; (ii) strengthening governance expectations; and (iii) refreshing self-assessment material covering AI, synthetic identity fraud and digital asset-related risk. The FCA also proposes refreshing the case studies and the ‘Five fallacies of data loss and identity fraud’ section, as well as including learnings from recent enforcement cases.
  6. Financial crime system and controls: Updates to clarify the FCA’s expectations for firms using Banking as a Service delivery models, including where services are outsourced, white labelled or provided through embedded finance partnerships. The guidance reinforces that regulated firms are accountable for maintaining effective systems and controls across the delivery chain.
  7. Money laundering and terrorist financing: Updates so that the Guide remains current and reflects developments in industry practice, such as electronic verification, third party tools and outsourcing arrangements, and clarifying the importance of co-operation and information sharing.
  8. Consequential changes: Updates to the Guide, including reflecting recent changes to the MLRs that came into force in June 2026, updating expired links and references (including references to European Union legislation), and refreshing case studies.

Next steps

The FCA is requesting comments on CP26/38 by 24 December 2026. It will consider these and publish feedback on CP26/38, along with the final amended text of the Guide, in a Policy Statement. The feedback received will also inform future updates to the Guide.