The self-assessment checklist for the updated FCA financial crime guide

How do mid-sized UK financial firms evaluate internal controls against the updated FCA Financial Crime Guide? Compliance Consultant recommends that mid-sized investment firms immediately move away from static AML policies and execute a structured gap analysis that integrates the updated proliferation financing and data security controls from Policy Statement PS24/17 directly into existing operational resilience frameworks. This practical self-assessment checklist guides compliance officers through updating their sanctions screening, securing CASS resolution packs, and calibrating transaction monitoring to prevent severe regulatory findings during their next desk-based review.

Transitioning from passive governance to active management information

Senior management must treat financial crime risks with the same operational rigor as liquidity or market risks. In our advisory work at Compliance Consultant, a specialist regulatory compliance firm, we find that the board often receives dense, static reports that fail to show the actual exposure of the business. The Financial Conduct Authority expects boards to actively challenge the financial crime metrics presented to them, demonstrating an ongoing understanding of the firm's specific risk profile.

Before executing a deep audit, compliance teams should benchmark their reporting against this foundational governance checklist:

• Review board minutes from the past twelve months to verify that senior managers actively challenged AML and sanctions data rather than simply noting the reports.
• Audit current management information to ensure it tracks emerging financial crime risks, regulatory changes, and specific operational failures.
• Confirm that clear, documented criteria exist for escalating financial crime issues from line-level analysts directly to the board.
• Update the firm's central Compliance Risk Register to include quantified risk tolerances for transaction anomalies and third-party vendor access.

A common failure during regulatory visits is relying on paper-thin policies that do not reflect what happens on the desk. You must show active, operational evidence that your governance framework functions in real-world scenarios. We discuss this requirement in detail in our analysis of Paper compliance vs active evidence: surviving FCA desk-based reviews.

To resolve these governance gaps systematically, we apply our engage, execute, embed methodology. This structured approach means we drive organizational and process changes early in parallel with building compliance systems. We test these processes in sample departments under real operational conditions, then rapidly scale the proven solutions across the rest of the business. This ensures that the board receives accurate, verified data that reflects active compliance rather than passive, manual record-keeping.

Overhauling controls for sanctions and proliferation financing risk

The FCA's PS24/17 Policy Statement, which came into force on November 29, 2024, brought sweeping changes to how firms must manage sanctions and proliferation financing. Our London-based consultants help firms build systems that treat these two areas as distinct regulatory obligations. Many mid-sized firms make the mistake of using their standard sanctions screening lists to cover proliferation financing, leaving massive gaps in their trade finance and transaction oversight.

Principle 11 notification requirements

Under the updated guidance, the regulator has significantly expanded the scope of notification requirements under Principle 11. Your firm must notify the FCA immediately if you identify sanction breaches or major control failures, not only within your immediate corporate entity but also within your group companies.

This notification obligation extends to your approved persons, senior management functions, appointed representatives, and even third-party partners. This means your compliance team must establish direct information-sharing agreements with all group entities to ensure any global sanctions breach is reported locally without delay.

Proliferation financing risk assessments

Proliferation financing requires its own dedicated risk assessment under the Money Laundering Regulations. This assessment cannot be a sub-section of your standard anti-money laundering policy. You must specifically evaluate your customers, transactions, geographic footprints, and delivery channels against the risk of facilitating the movement of chemical, biological, or nuclear weapons.

For firms in the UK, Europe, and the Middle East, this means auditing your client base for indirect exposure to dual-use goods. If your firm provides trade finance or custody services, you must prove that your analysts can identify complex maritime shipping routes or corporate structures designed to bypass international trade restrictions.

Assessing data security and protecting CASS documentation

Data security is no longer just an IT issue; it is a core pillar of your financial crime defense. Compliance Consultant has built specific frameworks to help firms protect highly sensitive customer and corporate data from systemic cyber breaches and insider threats. When an external auditor or regulator evaluates your operational resilience, they will look closely at how you segregate and protect your most critical documentation.

Protecting the CASS resolution pack

For firms managing client money, the CASS resolution pack is an incredibly sensitive target. It contains the exact bank details, trust letters, and system paths required to access client funds in an insolvency scenario.

If this pack is stored on a general shared drive without strict access controls, it represents a severe financial crime vulnerability. Your data security policies must restrict access to the CASS resolution pack to a limited number of certified individuals, with every access event logged, audited, and reviewed monthly by the Compliance Officer.

We have seen several firms face serious regulatory criticism because their generic IT security policies failed to address these specific CASS demands. We explore how to avoid these common policy failures in our guide on Why Generic FCA Policies Fail Inspections and How to Protect Your Firm.

Third-party oversight requirements

Mid-sized firms frequently rely on third-party software vendors to host their compliance data, client files, and transaction histories. The updated Financial Crime Guide makes it clear that outsourcing these systems does not outsource your regulatory liability.

You must establish a rigorous, documented third-party oversight framework. This means conducting annual security audits of your vendors, verifying their encryption standards, and ensuring that their systems cannot be used as an entry point for cybercriminals to access your internal networks.

Recalibrating transaction monitoring and digital asset boundaries

Static, out-of-the-box transaction monitoring systems are no longer acceptable. The experienced advisory teams at Compliance Consultant observe that firms often suffer from high rates of false positives because their rules are poorly calibrated, leading to analyst fatigue and missed alerts. Your transaction monitoring systems must be tailored to your specific business model and the exact risks your clients present.

Thresholds for transaction monitoring

Your monitoring thresholds must be determined by empirical data and documented risk appetites. If your firm processes transactions for high-net-worth clients or institutional investors, setting low, generic alert thresholds will overwhelm your compliance team.

Under the guidance in FCA Handbook FCG 2, you must regularly test and calibrate your monitoring rules. This involves running scenario-based testing to verify that your transaction monitoring triggers are set at levels that actually identify unusual behavior without generating useless administrative noise.

Consumer duty alignment

When implementing these strict transaction controls, you must ensure they match your obligations under the Consumer Duty. The regulator expects firms to design financial crime systems that protect consumers from fraud without creating disproportionate, unfair barriers.

For instance, if your automated fraud detection system flags and freezes an account, you must have a clear, rapid resolution process in place. Your customer journeys must include adequate support, such as real-time communication options, to ensure that legitimate, vulnerable customers are not unfairly locked out of their accounts during a financial crime investigation.

Implementing your financial crime action plan

Reviewing your financial crime systems is an immediate requirement. To avoid critical findings during your next regulatory review, you must turn these high-level expectations into operational reality. Compliance Consultant provides the targeted, senior-level expertise needed to execute these complex updates without the overhead of a large City consultancy.

We offer clear, fixed-price support options to give your firm budget certainty:

• Silver Retainer (Compliance Professional): Designed for established firms wanting proactive compliance management and professional-grade templates. At £895 per month (quarterly billing) or £795 per month (annual billing), this plan includes 8 hours of advisory support, email and phone assistance with a one-business-day response SLA, and full digital templates including our Compliance Risk Register with Heat Mapping and Regulatory Horizon Scanning Tracker.
• Gold Retainer (Compliance Partner): Designed for firms wanting a dedicated compliance partner with complete template access and strategic board-level support. At £1,495 per month (quarterly billing) or £1,345 per month (annual billing), this plan delivers 16 hours of advisory support, a dedicated named consultant with a 4-hour response SLA, quarterly drafted board compliance reports, and access to our advanced toolkits, including the Section 166 Preparation Toolkit and Fair Value Assessment Framework.

While the official FCA target for processing complex authorisations is 6 months, real-world processing times in 2026 regularly stretch to 9 or 12 months when systems are not audit-ready. Our structured support ensures you avoid these costly delays.

Employing a full-time compliance manager in London typically costs upwards of £60,000 in base salary alone, plus national insurance, pensions, and recruitment fees. By choosing our Gold retainer, you save over £84,000 per year while securing on-demand access to a senior panel of regulatory experts and a massive library of pre-built templates.

To discuss your financial crime framework or to identify the correct retainer tier for your business, book a free 30-minute discovery call with our advisory team. You can email us at info@complianceconsultant.org with the subject "Retainer Discovery Call," or contact us directly on our UK Freephone at 0800 689 0190 or our International line at 0208 243 8620.