The Five AML/CTF Gaps Most Commonly Found in UK Fintechs

3 days ago

7 min read

Regal 38i83 Team | Regulatory Insight

The FCA's supervisory focus on financial crime controls in payment institutions and e-money firms has sharpened considerably. A multi-firm review published by the FCA in November 2025, building on its March 2024 Dear CEO letter to Annex 1 firms, identified widespread deficiencies in how regulated businesses assess and manage money laundering and terrorist financing risk. For UK fintechs, the findings are a direct signal of where supervisory scrutiny is concentrated.

This article sets out the five gaps the FCA and industry practitioners most commonly identify in AML/CTF frameworks at fintech and payment firms, and what firms should be doing to address them.

1. A Business-Wide Risk Assessment That Does Not Reflect the Actual Business

The Business-Wide Risk Assessment (BWRA) is the foundation of any AML/CTF framework. It is required under the Money Laundering Regulations 2017 (MLRs) and sets the risk context for everything else: customer due diligence thresholds, transaction monitoring parameters, controls governance, and the level of oversight senior management exercises.

The FCA's November 2025 multi-firm review found that many firms' BWRAs were generic rather than tailored. They described risks at an industry level rather than the risks specific to that firm's products, customer base, distribution channels, geographies, and transaction types. A BWRA that reads the same as any other payment firm's document, without reference to what that business actually does and who it actually serves, will not support effective risk mitigation.

The FCA also found that some larger firms had integrated their BWRA into wider enterprise risk frameworks in a way that obscured the financial crime picture. Consolidation of risk categories can dilute the granularity needed to identify and respond to specific AML/CTF exposures. Financial crime risk needs its own clearly documented view.

What good looks like. The BWRA should use both quantitative data (transaction volumes, customer numbers, geographic exposure) and qualitative assessment (knowledge of customer typologies, staff experience, information from FATF, the UK's National Risk Assessment, and other external sources). It should identify residual risk after controls are applied and measure that against the firm's stated risk appetite. It should be reviewed in full annually and updated whenever the business changes materially. The MLRO should be a central contributor and sign-off authority.

2. Customer Risk Assessments That Are Not Linked to the BWRA

A Customer Risk Assessment (CRA) should not exist in isolation. Its purpose is to translate the conclusions of the BWRA into the right level of scrutiny for each customer. If the BWRA identifies high-risk customer types, the CRA process should reflect that by triggering enhanced due diligence for those customers. If they are not connected, the firm is running two parallel processes that do not reinforce each other, and the FCA will notice.

The March 2024 Dear CEO letter explicitly flagged the risk of a business growing faster than its management of financial crime risk. Fast-growing fintechs in particular tend to onboard customers at scale before their CRA methodology has caught up. Customer risk scoring may rely on fields that are easy to collect but not genuinely predictive of risk. Profiles may not be updated as customer behaviour changes over time.

The FCA's expectations include that CRA processes should feed directly into customer due diligence decisions and transaction monitoring parameters. A customer rated as higher risk should receive a meaningfully different level of oversight, and the rationale for the risk rating should be documented and capable of being reviewed.

Enhanced due diligence (EDD) for higher-risk customers is a legal requirement under the MLRs, not an optional extra. Common weaknesses include applying EDD checks at onboarding but not updating them as the relationship develops, and failing to document the basis on which a customer has been rated as standard or enhanced risk.

What good looks like. CRA methodology should map directly back to the risk factors identified in the BWRA. Higher-risk ratings should trigger documented EDD, with clear escalation paths and senior management sign-off where required. Profiles should be reviewed periodically and whenever a trigger event occurs. Where automated scoring tools are used, the firm should be able to articulate why the scoring model reflects its actual risk profile.

3. Transaction Monitoring That Has Not Been Calibrated to the Firm's Risk Profile

Transaction monitoring is a legal requirement for firms subject to the MLRs. The obligation is to detect transactions that may be indicative of money laundering or terrorist financing. The FCA's updated Financial Crime Guide, published in November 2024 through Policy Statement PS24/17, emphasised that monitoring systems need to be tested and calibrated to the specific risk profile of the firm, not deployed on generic or default settings.

Common failures in the fintech sector include:

Using out-of-the-box monitoring rules without reviewing whether they are appropriate for the firm's customer base and transaction patterns.
Generating high volumes of alerts without adequate capacity to review and investigate them, leading to backlogs and systemic under-investigation.
Failing to tune the system over time as customer behaviour changes or new product lines are introduced.
Monitoring individual transactions without adequate consideration of patterns across a customer relationship or a network of related accounts.

The FCA has also highlighted the importance of monitoring capabilities keeping pace with technological development. PS24/17 noted that firms are increasingly using AI and machine learning tools to supplement rule-based monitoring, and the FCA's guidance encourages firms to explore these approaches where appropriate, provided they can explain the basis on which the system identifies risk and demonstrate that it has been adequately tested.

What good looks like. Transaction monitoring systems should be documented, tested on a regular cycle, and reviewed whenever the firm's products, customer types, or transaction volumes change materially. Alert investigation should be adequately resourced, with documented timelines and escalation routes. Suspicious Activity Reports (SARs) should be filed with the National Crime Agency (NCA) through the appropriate channels promptly and without tipping off the subject.

4. Inadequate Senior Management Oversight and MLRO Authority

The FCA's November 2025 review identified weak senior management oversight as a recurring theme across firms with deficient AML/CTF frameworks. This is not simply a governance point. Under the MLRs, senior management bears personal responsibility for the adequacy of a firm's financial crime controls. The Money Laundering Reporting Officer holds statutory responsibilities that cannot be delegated away.

Common weaknesses include:

The MLRO role being held by someone without adequate seniority, resource, or access to the board.
Board and senior management not receiving sufficient management information on financial crime risk to provide meaningful challenge.
Risk assessments and control frameworks being prepared and approved within the compliance function without sufficient senior oversight or documented challenge.
The MLRO not being represented on relevant committees where decisions affecting financial crime risk are made, such as new product approvals or significant changes to customer onboarding.

The FCA's March 2024 Dear CEO letter stated plainly that senior management must understand, review and challenge the BWRA, and that any challenges must be documented. This is a direct expectation that boards and senior management engage substantively with the firm's risk position, not simply ratify documents presented to them.

What good looks like. The MLRO should have direct access to senior management and the board, adequate resources to discharge their statutory obligations, and a defined escalation path for significant financial crime concerns. Board and senior management should receive regular, meaningful management information on financial crime risk, and meetings should produce documented records of discussion and challenge. The MLRO's assessment of the BWRA should be a standing agenda item at an appropriate governance committee.

5. Gaps in the Scope and Application of Customer Due Diligence

Customer due diligence (CDD) obligations under the MLRs require firms to identify and verify customers, understand the nature and purpose of the business relationship, and conduct ongoing monitoring. For many UK fintechs, CDD processes are strongest at onboarding and weaker at every subsequent stage of the relationship.

The most frequently observed gaps include:

Beneficial ownership. Regulated firms must identify and verify the beneficial owners of corporate customers. In practice, beneficial ownership chains that include offshore holding structures, nominee arrangements, or multiple layers of corporate ownership are frequently not fully traced. The MLRs require verification of beneficial ownership to the extent that is reasonable, but the regulator expects firms to apply a risk-based approach that goes further where the customer profile warrants it.

Politically Exposed Persons (PEPs) and their associates. PEP screening at onboarding is standard practice; the failure point is ongoing screening as individuals move in and out of PEP status, and screening that captures close associates as well as the PEP themselves.

Ongoing CDD. The obligation to keep CDD information current is frequently underimplemented. Firms may have strong processes for new customers but no systematic triggers for refreshing documentation on existing ones. The FCA expects that higher-risk customers are reviewed more frequently, and that any material change in customer activity or profile prompts a reassessment.

Source of funds and source of wealth. For higher-risk customers or transactions, firms need to understand not just where funds are coming from but how they were generated. Source of funds documentation that amounts to a bank statement without further investigation will not meet the standard where the customer profile or transaction pattern raises questions.

What good looks like. CDD processes should be documented end to end, with clear policies for standard and enhanced due diligence, defined triggers for periodic review, and documented evidence of the checks carried out and the conclusions reached. Beneficial ownership verification should be proportionate to the risk presented by the customer, with higher-risk corporate structures subject to deeper investigation. PEP screening should run on an ongoing basis, not only at onboarding.

The Broader Regulatory Context

The FCA has made financial crime a sustained supervisory priority. Its Dear CEO letter to the payments portfolio in February 2025 set out preventing and reducing financial crime as one of three key outcomes for regulated firms over the coming two years. The updated Financial Crime Guide (PS24/17, November 2024) gives firms detailed examples of good practice across sanctions, transaction monitoring, CDD, and cryptoassets.

The FCA's enforcement record in this area is significant. As of December 2025, the regulator had imposed 13 fines totalling well over £300 million on firms for AML systems and controls failings. While these actions have predominantly involved retail banks, the supervisory expectations they reflect apply equally to payment institutions and e-money firms.

Firms that identify gaps in any of the five areas above should treat them as a priority. A documented gap analysis, a remediation plan with clear ownership and timelines, and evidence of senior management engagement with the findings are the starting point for demonstrating to the FCA that the firm is managing its obligations seriously.

How Regal 38i83 Can Help

Regal 38i83 provides fixed-fee AML/CTF health checks and financial crime compliance advisory to UK fintechs, payment institutions, and e-money firms. Our work includes gap assessments against the MLRs and the FCA's Financial Crime Guide, BWRA reviews, CDD framework assessments, and MLRO support.

All enquiries are directed to info@regal38i83.com. We provide an initial scoping consultation at no charge, followed by a written scope and fee proposal.

This article is for information only and does not constitute legal or regulatory advice. Firms should take independent professional advice in relation to their specific circumstances. Regal 38i83 Ltd. Company number: 11449290.