FCA Sharpens its Focus on Financial Crime Governance and Outsourcing

In August, we considered the FCA's review of asset managers' and alternative firms' financial crime controls. Two themes stood out: governance and senior management oversight, and firms' continuing responsibility for financial crime controls performed by third parties. 

The message was straightforward: activities can be outsourced; responsibility cannot. 

The FCA's latest consultation, CP26/38, Financial Crime Guide Updates, reinforces both themes. 

Although the FCA says that the proposed amendments are guidance, do not impose new requirements, and do not change senior management's responsibilities, the proposed text gives firms considerably more detail about what effective governance and oversight should look like in practice.

Governance: senior management needs visibility and evidence

The proposed changes reinforce the importance of active senior management involvement in financial crime. Interestingly, proposed FCG 3.2.1 would change the existing expectation that senior management should “know about” the money-laundering risks to which the firm is exposed to an expectation that they will “understand” those risks. The change in language is subtle but potentially significant: it suggests an expectation of substantive understanding by senior management of the firm's exposure to money-laundering risk, rather than just awareness of it.

Similarly, the proposed fraud guidance states that management information (“MI”) should provide senior management with sufficient information to “understand” the fraud risks to which their firm is exposed and should be provided both regularly and ad hoc. 

The proposed guidance identifies the ongoing review by senior management of the “content, quality and relevance” of MI, coupled with appropriate challenge, as good practice.

Taken together, these provisions point to an expectation that senior managers do more than receive financial crime information: they should understand it, challenge it and be able to demonstrate how it informs their decision-making.

Fraud: extending the governance focus  

Fraud receives substantially expanded treatment. New FCG 4.1.4 expressly connects the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 with firms' regulatory systems and controls obligations. Although the FCA does not enforce the offence, it states that a breach “may impact upon” a firm's compliance with relevant SYSC rules.

That sits alongside new FCG 4.2.1A, under which senior management is expected to take “clear responsibility” for managing fraud risks, with evidence that it is actively engaged in the firm's approach. 

The combined message is that fraud prevention is not simply an operational control issue: it is also a governance issue. 

Outsourcing: contractual arrangements in focus 

The outsourcing theme from the July multi-firm review is carried directly into the proposed Guide. The FCA says regulated firms remain accountable for effective financial crime systems and controls throughout the delivery chain, including outsourced, white-labelled and embedded-finance arrangements.

The proposed Guide therefore gives more concrete expression to the concerns identified in the FCA's July review.

Outsourcing CDD/EDD without maintaining oversight and monitoring is identified as poor practice. Where third-party tools or services support CDD or transaction monitoring, the firm remains responsible for appropriate oversight and governance.

Contractual arrangements are also brought into focus. The FCA identifies as good practice having appropriate service-level agreements, regularly reviewing the quality and suitability of third-party tools and services, and ensuring that continuing regulatory responsibilities are met. Similar themes appear in the proposed sanctions guidance, including oversight of outsourced screening and vendor-configured settings.

Practical takeaways 

Taken together with the FCA's July findings, the proposed amendments reinforce a consistent supervisory message. Firms should be able to demonstrate who owns financial crime risks, what information reaches senior management, how that information is challenged and acted upon, and how outsourced controls are monitored in practice. 

The emphasis placed on fraud in the proposed guidance is noteworthy and consistent with the FCA’s current focus on that area. As we noted in July, 56 of the FCA's 127 open enforcement operations as at 31 March 2026 concerned fraud, equivalent to 44% of the total.

The explicit linkage between the failure to prevent fraud offence and the FCA's SYSC requirements may provide a further prompt for firms to review their fraud prevention frameworks. Importantly, the two regimes are distinct: irrespective of whether conduct gives rise to liability for the corporate offence, weaknesses in a firm's fraud systems and controls may have independent regulatory implications under the FCA regime.