The FCA’s 23 October consultation on its Financial Crime Guide proposes more specific expectations for firms using AI, outsourced screening and digital identity checks. CP26/38 is open until 24 December 2026 and covers fraud, cryptoassets, sanctions, proliferation financing, data security and wider anti-money-laundering controls. The proposed examples are guidance under consultation, rather than rules that took effect when the paper appeared.[1][2]
Operational examples in the draft
| Area | Proposed good practice or issue to assess |
|---|---|
| AI and machine learning | Understand tool limitations; apply governance, testing, monitoring and independent validation; evidence key decisionsSource 2 |
| Third-party sanctions tools | Check vendor settings, list completeness, timely updates and matching calibrationSource 2 |
| Fraud monitoring | Consider unusual account turnover, new high-value payees and signs of customer distressSource 2 |
| Digital identity | Review exposure to deepfakes, synthetic identities and spoofingSource 2 |
| Crypto transaction monitoring | Use risk-sensitive analysis and documented decisions, rather than a rigid number-of-hops ruleSource 2 |
| Banking as a Service | Clarify responsibilities in outsourced, white-label and embedded-finance arrangementsSource 2 |
The sanctions proposals extend the discussion of trade as well as financial sanctions and call for risks to be assessed across customers, counterparties, goods, services and payment flows. They distinguish screening policy, list management, calibration, testing and alert handling. Buying a vendor tool would not remove the firm’s responsibility to understand how it is configured.[2]
The consultation is relevant to the FCA’s financial-crime-supervised population, including Annex 1 institutions and cryptoasset businesses registered under the Money Laundering Regulations. It also anticipates the expanded cryptoasset regime due in October 2027. That scope does not make every example applicable in the same way to every broker, bank or payment firm.[1]
After considering responses, the FCA plans a Policy Statement and final guide text. The 24 December deadline is for feedback, not an implementation date or a requirement to procure a particular AI system. Existing financial-crime duties remain in place.[1]
Sources & further reading
- CP26/38: Financial Crime Guide updates Financial Conduct Authority · 23 Oct 2026 · Accessed 26 Oct 2026
- CP26/38: Financial Crime Guide updates — consultation and draft text Financial Conduct Authority · 23 Oct 2026 · Accessed 26 Oct 2026