Annex 1 lending: staying inside the perimeter

The FCA has spent 2026 looking hard at Annex 1 lenders. In March it warned regulated firms to check the status of the unregulated lenders they deal with, and flagged consumers being encouraged to set up limited companies to access bridging finance. In August it said it was scrutinising new registration applications more closely, that determination times would lengthen, and that it had sent information requests to around 900 of the firms already on its register. Most of the questions in those requests come back to one thing: is the firm actually doing what its registration says it does, and nothing else?

That question is harder to answer than it sounds, because Annex 1 registration rests on a negative. The FCA registers an Annex 1 financial institution for anti-money-laundering supervision only, on the footing that its lending sits outside the Financial Services and Markets Act. The moment a loan crosses into regulated territory, the firm does not have a small compliance gap. It is carrying on a regulated activity without permission, the loan is unenforceable and the registration itself is exposed. We have seen enough firms drift across the line one facility at a time, without anyone deciding to, that we have put the tests into a single flow.

The flow is attached below as a four-page PDF. Two pages of decision tree, two pages of explanatory note with the article and regulation references. It is written for a credit committee to run on every facility, not for a compliance file to be read once.

Where lenders go wrong

The first mistake is thinking the perimeter is about the loan. It is about the borrower. A loan to a company, an LLP or a partnership of four or more is outside both consumer credit and mortgage regulation, whatever the purpose and whatever the security. A loan to an individual, a sole trader or a small partnership is inside unless an exemption takes it out. So the first question on every file is who is receiving the credit, and the answer has to survive looking through nominees, bare trusts and companies formed for the occasion.

The second mistake is running one test where two are needed. Consumer credit turns on purpose: a business-purpose loan over £25,000 with the right declaration is exempt. Mortgage regulation turns on the property: a loan to an individual secured on land where 40 per cent or more is used as a dwelling is a regulated mortgage contract, and since 2016 that includes dwellings the borrower does not live in. Business purpose does not take a first charge over a home outside the mortgage regime. There is no exclusion for it. The exclusions that do exist reach second charges and investment property only, and each has its own limbs that have to be met on the day the loan is made.

The third mistake is about which company is lending. Groups tend to assume that registration belongs to the entity that signed the facility, and that a company which merely takes an assignment of completed loans is outside. The application form says something like that, but it describes a passive holder. A company that advances its own money, bears the credit risk, holds the security and keeps the margin over its funders' rate is lending, and must be registered, whoever signed first. A further advance under an existing facility is new lending, by whoever funds it, on the day it is made. Where firms have gone wrong on this it has usually been the choice of entity, not the analysis of the loan, which is why the flow asks the credit committee to name the lender of record and confirm its registration at offer and again at drawdown.

The funding side

Lending is only half the perimeter. Money taken from funders is a deposit unless an exclusion applies, and the usual exclusion is an instrument acknowledging the firm's own indebtedness for every advance. That works, but it has a consequence lenders often miss. If the acknowledgement is what takes the funder's money outside the definition of a deposit, it is also a controlled investment for the financial promotion regime, and an invitation to subscribe for it is a financial promotion. The same document cannot be an investment for one purpose and mere lending for the other. Firms have to choose a route and run it consistently through their deposit analysis, their funder communications and their disclosures.

On disclosure, one form of words matters. A registered Annex 1 firm is on the Financial Services Register. Telling funders or borrowers that the firm is "not regulated by the FCA" is wrong and misleads in the other direction. The accurate statement is that the firm is registered with the FCA for anti-money-laundering supervision only, is not authorised by the FCA, and that there is no recourse to the Financial Ombudsman Service or the FSCS.

Staying registered

Registration is the start of the obligation. The FCA's Dear CEO letter of March 2024 listed the failings it keeps finding in Annex 1 firms: registered and actual activities out of step, controls that have not kept pace with growth, weak risk assessments and under-resourced financial crime functions. The August 2026 statement added that each company in a group must have controls of its own rather than leaning on a parent's. The second page of the flow sets out what the FCA will test, from the business-wide risk assessment through customer due diligence on borrowers and funders alike, to the 14-day notification of nominated officers for each registered entity separately. That last point is where groups with several registered companies most often fall down.

The PDF is free to download and use. If your firm is applying for Annex 1 registration, responding to one of the FCA's information requests, or simply wants its loan book tested against the flow, we do that work: perimeter analysis, registration applications and resubmissions, business-wide and customer risk assessments, policy suites and outsourced MLRO support. Get in touch on 020 7898 8522 or through the contact page.

Annex 1 Perimeter Lending Flow

This article and the accompanying flow are compliance guidance prepared by Fundsure Limited. Fundsure is a compliance consultancy and not a law firm, and nothing here is legal advice.