Annex 1 lenders: the FCA is tightening the gate, but the fence still has a gap

For most of the last decade, Annex 1 registration was treated as an administrative step. You filed the form, paid the fee, waited and got on with your business. That changed this year. Between the FCA's statement on 7 August, a quiet change to its criminal record check requirements and the restriction of six lenders in October, the direction is clear. What is less clear is whether the FCA has the tools to finish the job.

The 7 August statement

On 7 August the FCA published a short statement saying it is applying increased scrutiny to Annex 1 firms: unregulated lenders, safe custody providers, money brokers and financial leasing companies. Its concerns were specific. Firms are relying too heavily on the financial crime controls of their parent company. They are using off-the-shelf procedures written for someone else's business. And the FCA flagged "the risks to consumers and markets from unregulated lending often conducted through complex structures".

The FCA said it had sent an information request to around 900 Annex 1 firms, following work with 300 firms in late 2025, and that applicants should expect registration to take longer. It has been true to its word on that.

Six lenders restricted

On 23 October the FCA announced restrictions on six firms:

• Kingscrown Finance Ltd (first restricted 21 April, further restrictions 25 September)
• MOMSB Ltd and Momentus Capital Ltd (7 October)
• Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd (9 October)
• Abbital Ltd (15 October)

All six are property, bridging or development lenders lending to businesses and property investors. All six were applicants, not registered firms. Kingscrown, incorporated in 2014, had never been registered with the FCA at all.

The restrictions prevent or limit new customers and new lending, limit how payments can be received from existing customers and, for five of the six, require an independent review of the firm's AML framework. Kingscrown is now in an orderly wind-down of its loan book.

The FCA has not published firm-specific failings, only "concerns about their anti-money laundering policies, controls and procedures" identified while assessing their applications. Read alongside the August statement, the themes are not hard to guess: borrowed group controls, generic procedures, opaque ownership and funding structures, and weak understanding of the money laundering risk in property-backed lending.

The detail that matters most is in the notes to editors. Every one of these restrictions was "voluntary", imposed at the firm's own request. That is not a sign of a soft touch. It is a sign of a missing power.

The quiet change: basic or standard DBS?

Alongside this, the FCA has changed its criminal record check requirement with very little noise. Its registration page now lists, as a ground for rejecting an application at the door, a DBS check not completed before submission. It says standard DBS checks must be carried out for all MLR individuals and beneficial owners who are not already approved as SMF managers. Individuals in Scotland, Northern Ireland or overseas need an equivalent check. The FCA's change log records this as a "minor amend" on 26 August.

It is not minor. A basic check discloses only unspent convictions. A standard check also discloses spent convictions and cautions, subject to filtering. That is the level of check that applies to senior managers of authorised firms.

It also does not match the FCA's own form. The MLR Individual form on Connect, still Release 7 dated January 2025, says at question 4.3 that "a basic Disclosure and Barring Service (DBS) check must be carried out", dated within the last six months. So an applicant who follows the form to the letter can be rejected under the website.

There is a further problem. A standard check is only available where the role is covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. The financial services entries in that Order cover Part 4A permissions, approved persons, controllers of authorised firms, fund operators and payment and e-money institutions. I can find nothing covering registration under the Money Laundering Regulations, or the regulation 58 fit and proper test. Unless I have missed something, most MLR individuals are not eligible for a standard check at all, and anyone ordering one has to give the DBS an eligible reason that is true.

This is not academic for us. Fundsure orders standard and enhanced DBS checks for clients through an umbrella body, and for Part 4A firms the reason is simple: senior management function, FCA. For an MLR individual at an Annex 1 applicant, that reason would not be true, and I cannot find one that is. Making a false statement to obtain a certificate is an offence under section 123 of the Police Act 1997, and the declaration falls on whoever places the order. Until that is resolved, we are following the FCA's form and ordering basic checks, with a file note explaining why. We have written to the FCA asking which requirement applies, what legal basis supports a standard check, and whether the form will be updated. I will post the answer when we have it.

The direction is clear: the FCA wants to treat MLR individuals at Annex 1 firms more like senior managers. The law has not caught up, and until the FCA explains the legal basis or corrects the form, applicants are left choosing between the form and the website.

The gap

Here is the problem. Under regulation 56(5) of the Money Laundering Regulations, an Annex 1 firm must not carry on business unless it is registered or "has applied for registration... but that application has not yet been determined". Carrying on business while neither registered nor applied is a criminal offence. But an applicant can trade.

Compare this with money service businesses, trust or company service providers and crypto firms, which are caught by regulation 56(1): they must not act at all until registered. Crypto firms are also subject to regulation 74C, which lets the FCA impose directions "before, on or after registration". Annex 1 firms have no equivalent. The FCA cannot impose requirements on an Annex 1 applicant. Its leverage is the threat of refusal, which is why the six restrictions were agreed rather than imposed.

Follow that through. A lender under restriction, or facing refusal, could stop trading, incorporate a new company, submit a fresh application and, on a plain reading of the regulations, lend lawfully through the new entity while that application is assessed. The FCA has 45 days to register the firm or issue a minded-to-refuse notice, the firm then has at least 28 days to make representations, and the decision follows "within a reasonable period". At current processing times, that is months.

There are brakes. Refusal is mandatory if a beneficial owner, officer or manager is not fit and proper, and probity is part of that test, so the same people behind a new company should eventually fail. Regulation 78 allows the FCA to prohibit individuals from managing firms subject to the regulations, although that needs a breach to be established first. And in practice, funders and banks are the real gatekeepers: the FCA has told regulated firms to confirm registration status directly, and a bridging lender whose funding line depends on being registered will struggle as a "pending" new company.

But none of these stops lending on day one. The regime relies on applicants choosing to behave.

How could the FCA get stronger controls?

The FCA cannot move the perimeter itself. HM Treasury would have to act, and there are three realistic routes.

1. Fix the MLRs. Move Annex 1 firms into regulation 56(1), so no business until registered, and extend the crypto-style direction and skilled person powers in regulations 74B and 74C to them. This is the most likely and the most proportionate fix. There is a direct precedent from 2020, it needs only a statutory instrument, and it closes the new company gap completely.

2. Use the designated activities regime. FSMA 2023 created a power for HM Treasury to designate activities and let the FCA make rules for them without requiring authorisation. Bridging and property-backed lending to non-consumers could be designated, giving the FCA conduct and controls rules without a full permissions regime. This is a middle path, and the regime was built for exactly this kind of problem.

3. Make it a regulated activity. Add a new specified activity, for example business lending secured on land, possibly above a size threshold. That brings full authorisation, SM&CR and threshold conditions. It is the biggest step and the most politically awkward, because it touches SME and property credit supply at a time when the government wants that credit flowing.

The push for standard DBS checks is a hint that the FCA already thinks of these individuals as senior managers in all but name. If HM Treasury wants that to work, the Exceptions Order will need amending too. I would not read it as a plan for full regulation. But I would expect the first route, and I would not be surprised to see it in the next round of MLR amendments.

What this means now

For applicants: expect a long process, have criminal record checks completed and dated within six months before you submit, be ready to explain which level of check you obtained and why, and build controls for your own business rather than inheriting a parent's or buying a template. The FCA is reading the documents properly now.

For funders, banks and investors in Annex 1 lenders: check registration status directly, treat "application pending" as a risk factor rather than a formality, and ask who is behind any newly incorporated lender seeking a facility.

For the FCA and HM Treasury: the tools are lagging the intent, and the paperwork is lagging the policy. Six restrictions agreed at the firms' request show the FCA is willing. Whether it is able is a different question.

*Fundsure supports firms through FCA Annex 1 registration, AML framework design and independent reviews. Get in touch if you would like to talk through an application or a review.*