FCA proposes financial crime guide updates for fraud, crypto and sanctions

The Financial Conduct Authority (FCA) has opened consultation CP26/38 on updates to its Financial Crime Guide, covering fraud, cryptoassets, financial and trade sanctions, proliferation financing, data security, money laundering and terrorist financing. The consultation opened on 23 October 2026 and closes on 24 December.

The proposed text is general guidance, not a new rulebook. The FCA says it does not impose new requirements, and that firms should use it alongside their own judgement. Existing obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the Proceeds of Crime Act 2002, the Terrorism Act 2000, sanctions legislation and other applicable rules continue separately.

The audience includes all FCA-supervised firms with financial crime responsibilities, including payment service providers, retail banks, e-money firms, Annex 1 financial institutions and cryptoasset businesses.

Fraud controls would cover both sides of payments

The FCA proposes expanding its fraud chapter after supervisory work on authorised push payment (APP) fraud and money mules. The revised material would organise examples around onboarding, monitoring and reporting, with additional material on fraud risk assessments, governance, management information, assurance and staff training.

For onboarding, the proposed good practice includes building a holistic customer view, using a range of information sources for behavioural profiling, consulting fraud databases, identifying vulnerability and checking for synthetic or counterfeit documents. The FCA identifies weak record-keeping, basic checks that do not inform that wider picture and late recognition of vulnerability as poor practice.

The proposed monitoring examples are relevant to both banks and payment firms. APP fraud indicators include changes in behavioural biometrics, unexpected account-turnover changes, negative Confirmation of Payee results, new payees receiving high-value payments and increasingly desperate language in customer communications. Money-mule indicators include unexplained deposits, rapid dispersal of funds, activity on dormant accounts and inconsistent changes to online-banking credentials, devices or contact details.

The FCA’s proposed examples favour monitoring inbound as well as outbound transactions, reviewing and testing alerts, issuing customer warnings, investigating mule alerts promptly and maintaining procedures for the response to suspected money mules. It also identifies weak staff training, failure to implement new alerts promptly, absent feedback loops and a focus only on outbound monitoring as poor practice.

For reporting, the draft would encourage prompt information sharing through industry initiatives and comprehensive records of decisions to report, or not report, cases to fraud databases. The FCA is separately asking whether the Guide should provide more specific material on investment fraud, after citing UK Finance data showing a 26% increase in cases and a 40% increase in losses between 2024 and 2025.

Sanctions guidance would extend beyond names

The proposed sanctions chapter would cover financial and trade sanctions, reflecting the development of the UK regime and the establishment of the Office of Trade Sanctions Implementation (OTSI). The FCA proposes clearer explanations of the respective roles of the FCA, the Office of Financial Sanctions Implementation (OFSI), OTSI and HM Revenue and Customs.

The draft would ask firms to assess exposure arising from customers, counterparties, intermediaries, jurisdictions, goods, services, transactions, payments and payment messages. It would add material on sanctions circumvention, intermediary countries, sectoral and trade sanctions, ownership structures, connected parties and relevant trade information.

The proposed controls would distinguish between sanctions policies, list management, system calibration, testing and alert handling. They would also address third-party screening tools and outsourced arrangements, including oversight of vendor-configured settings and the timely, complete and accurate implementation of sanctions-list data. The FCA proposes encouraging monitoring beyond names, including risks linked to goods, vessels, ports, services and jurisdictions.

This is guidance on how firms should understand and manage their exposure, not a statement that every firm must use one particular screening method. The draft also covers alert backlogs, resourcing, internal decision-making standards, audit trails, asset freezing, licensing, root-cause analysis and breach reporting.

The proliferation-financing revisions would link those risks to existing sanctions controls and add examples involving strategic export controls, dual-use and military goods, onboarding, customer due diligence, screening, transaction monitoring, reporting and escalation.

For cryptoasset businesses, the FCA proposes examples on enhanced-due-diligence triggers, onboarding, monitoring, blockchain analytics and Travel Rule compliance. It also proposes a self-assessment question on whether policies, procedures and training distinguish obligations under the Proceeds of Crime Act from those under the Terrorism Act.

The FCA says certain cryptoasset activities carried out by way of business in the UK will require FCA authorisation from 25 October 2027 under the separate Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Firms will still have to comply with the MLRs and other financial crime legislation. The Guide is intended to help firms prepare for applications and understand the FCA’s expectations, rather than create that future authorisation regime.

BaaS and AI controls remain the firm’s responsibility

The proposed systems-and-controls chapter would address banking-as-a-service, white-labelled products and embedded-finance arrangements, whether the user of the service is regulated or not. It would reinforce that regulated firms remain accountable for effective financial crime systems and controls across the delivery chain, including outsourced activity.

For firms using these models, the practical issue is to map who performs onboarding, monitoring, reporting, customer communications and escalation, and how the regulated firm exercises oversight. The consultation does not itself create a new BaaS licensing or allocation rule.

The FCA also proposes updating data-security guidance for AI, synthetic identity fraud, deepfakes and digital-asset risks, alongside board involvement, crisis communication and UK GDPR and Data Protection Act 2018 references. Firms using AI or other third-party financial crime tools would still be responsible for the risks those tools present. The proposed guidance points to governance, oversight, proportionality to risk appetite, testing and validation, not an AI prohibition.

The FCA says it will consider responses and publish feedback with the final amended Guide in a Policy Statement. The FCA says responses close on 24 December 2026.