The first priority in regards to money laundering, the FCA has made it very clear that any firms that are subject to the UK’s Money Laundering Regulations must have in place systems and controls to identify, assess, monitor and manage money laundering risk.  These must be comprehensive and proportionate to the nature, scale and complexity of a firm’s activities.

In regards to economic and financial sanctions, the FCA also set the expectations that regulated forms must ensure that they operate effective systems and controls, in order to identify and manage any sanctions exposure and risk, associated with their customers and business activities.

Material issues identified with financial crime systems and controls

The FCA has emphasised that over the past two years they have identified material issues with financial crime systems and controls including (but not limited to):

• failure to carry out and/or to evidence adequate KYC/due diligence
• business-wide risk assessments not supported by a robust and effective methodology
• enhanced due diligence not adequately risk based and not commensurate to the risk event and/or the customer
• failure to regularly review and refresh risk assessments and control frameworks in an evolving threat landscape
• policies and procedures which are insufficiently detailed and tailored to firms' business models
• failure to maintain and evolve the control framework, in line with business growth
• failure to ensure name screening solutions from third party providers are appropriately and adequately calibrated to meet their business requirements
• firms unable to reasonably justify and/or verify why their sanction screening solution does not generate alerts against certain names on the UK’s Office of Financial Sanctions Implementation list. 

Actions the FCA expects payment and electronic money institutions to take

The FCA expects payment and electronic money institutions to ensure their anti-money laundering systems and controls are effective and commensurate with the risks in the business, including as it grows over time. 

This includes the expectation that your firm will conduct regular reviews to assess its compliance with anti-money laundering obligations and sanctions requirements, and to work swiftly to remediate weaknesses identified. 

Further the FCA has established a minimum expectation that your firm will comply with its responsibilities under the Proceeds of Crime Act 2002 and Terrorism Act 2000 through accurate and timely submissions of Suspicious Activity Reports (SARs) and to regularly review themes from Suspicious Activity Reporting (SARs) and act efficiently to rectify any issues identified.

The second priority the FCA highlighted was Fraud and in particular evidence that fraud incidents at payment and electronic money institutions is increasing, particularly, in relation to the cost-of-living crisis and they expect firms to take immediate action to address any weaknesses in their systems and controls to prevent fraud.

Common weaknesses identified at payment and electronic money institutions

The FCA has emphasised that over the past two years they have identified common weaknesses including (but not limited to):

• insufficient emphasis on mitigating the risk of fraud against customers and insufficient customer education relating to fraud prevention
• a lack of engagement with industry information sharing bodies
• weaknesses in firms’ anti-fraud systems and controls
• backlogs that have led to fraud reports from consumers not being actioned within a reasonable timeframe by relevant staff
• a high proportion of customer accounts being used to receive proceeds of fraud. 

Actions the FCA expects payment and electronic money institutions to take

The FCA expects payment and electronic money institutions to take immediate action to protect your firm’s customers against the risk of fraud and to ensure that your firm is not being used to receive the proceeds of fraud. 

In particular, the FCA requested that regulated firms should ensure that they:

• review their internal risk appetite statements and policies and procedures to ensure that these adequately address the risk of fraud to its customers
• regularly review fraud prevention systems and controls to ensure effectiveness; and
• maintain appropriate customer due diligence controls (at onboarding and ongoing) to identify and prevent accounts being used to receive proceeds of fraud or financial crime.

Furthermore, the FCA emphasised that firms should take immediate action to protect their customers against the risk of fraud and to ensure that the firm is not being used to receive the proceeds of fraud. This includes reviewing internal risk appetite statements and policies and procedures to ensure they adequately address the risk of fraud, regularly reviewing fraud prevention systems and controls, and maintaining appropriate customer due diligence controls at the onboarding stage and on an ongoing basis.