In November 2025, the Financial Conduct Authority (FCA) published its findings from a multi-firm review into how firms identify, assess, and manage financial crime risks.
The review focused on business-wide risk assessments (BWRA) and customer risk assessments (CRA), revealing persistent weaknesses in risk methodologies, governance, and record-keeping.
Effective risk assessments are central to a firm’s ability to prevent financial crime and comply with regulatory requirements. In this article, we summarise the findings and give strategic actions for firms to take next.
Background to the Review
The FCA’s review forms part of its broader financial crime supervision programme and supports its 2025–2030 strategy, which prioritises reducing and preventing financial crime across the industry.
The regulator assessed the systems and controls of a range of firms, including building societies, payment and e-money institutions, wealth managers, and custody providers. Each was reviewed against the Money Laundering Regulations 2017, Senior Management Arrangements, Systems and Controls (SYSC), the Financial Crime Guide (FCG), and guidance from the Joint Money Laundering Steering Group (JMLSG) and Financial Action Task Force (FATF).
The findings were then split into:
- Identifying, Understanding and Assessing Risk
- Mitigating Risk
- Managing Risk
Each of which are summarised in turn below.
Identifying, Understanding and Assessing Risk
The FCA found that many firms relied on generic or oversimplified risk categories when assessing financial crime exposure. In some cases, firms were unable to explain the rationale behind risk ratings or demonstrate how control effectiveness had been determined.
Good practice included risk assessments that were comprehensive, regularly reviewed, and weighted appropriately to reflect business activities. These firms combined qualitative and quantitative analysis, considered both internal and external factors, and could demonstrate alignment between risk appetite and assessment outcomes.
By contrast, poor practice included an overemphasis on fraud risk while neglecting other critical financial crime threats such as money laundering, sanctions breaches, bribery and corruption, proliferation financing, and terrorist financing.
Mitigating Risk
The review found that risk mitigation processes were often disconnected from firms’ wider strategic and operational planning. Many firms had not updated their assessments as their business models evolved, nor did they consistently document resulting actions, owners, or timelines.
The FCA emphasised that risk assessments should be living documents; integrated with business planning, product development, and growth strategies. A small number of firms demonstrated this effectively by linking their BWRA to risk appetite statements, ensuring mitigation activities were tracked and reviewed.
However, in many cases, rapid growth outpaced firms’ compliance, leaving firms exposed to unmanaged or poorly understood risks. The FCA expects firms to ensure their financial crime resources, systems, and training remain proportionate to business scale and complexity.
Managing Risk
Weak senior management oversight was a recurring theme throughout the FCA’s findings. In many firms, boards and executives were engaged primarily with fraud issues, paying less attention to the broader spectrum of financial crime risks.
Better-performing firms had established structured governance processes. These included MLRO and committee reviews, documented challenge and approval of risk assessments, and regular escalation of management information to oversight committees.
The FCA noted that few firms actively tested or refreshed their risk assessment frameworks. Dynamic assessments, those that are regularly validated and informed by testing, internal audit, or control effectiveness reviews, were cited as good practice. In contrast, static assessments with minimal testing or review were viewed as indicators of weak risk culture and ineffective governance.
What This Means for Firms
Firms should take this opportunity to benchmark their current processes and ensure that their frameworks are evidence-based, scalable, and regularly refreshed.
Key expectations include:
- Strong analysis methodologies supported by both qualitative and quantitative data.
- Documented actions and ownership, linking assessments to real mitigation activity.
- Senior management involvement and challenge, with oversight recorded and reviewed.
- Proportionate, evolving controls that reflect business growth and product innovation.
Final Thoughts
The FCA’s latest review reinforces the importance of a well-designed, dynamic approach to risk assessments. Firms that continue to rely on generic or outdated models risk falling short of regulatory standards.
Now is the time for firms to revisit their methodologies, refresh their data sources, and ensure their governance processes demonstrate clear ownership and oversight.
If your firm would benefit from an independent review of its BWRA or CRA framework, API Compliance can help. Please contact our team using the contact form for tailored guidance and support.
