FCA rewrites its Financial Crime Guide on APP fraud, mules, crypto and sanctions

What happened

On 23 October 2026, the UK Financial Conduct Authority (FCA) published CP26/38, a consultation on updates to its Financial Crime Guide. The proposals cover fraud, cryptoassets, financial and trade sanctions, proliferation financing (PF), data security, financial crime systems and controls, and money laundering and terrorist financing. Feedback is due by 24 December 2026, and the FCA will publish the final text in a Policy Statement.

The FCA says the Guide contains no rules and imposes no new requirements, but it expects firms to have read and considered it. The paper also says firms “should factor in the UK’s System Priorities to demonstrate how they counter financial crime risk.” Those are the nine economic crime priorities the National Crime Agency, the FCA, HM Revenue and Customs, the Home Office, and the Treasury share with the regulated sector, now in a 2026 version.

The fraud proposals draw on the FCA’s multi-firm work on authorised push payment (APP) fraud and money mules at payment service providers. They are organised around onboarding, monitoring, and reporting. Poor practice listed includes monitoring outbound transactions only, failing to promptly implement new monitoring alerts, and failing to act on specific intelligence. Mule indicators include unexpected deposits, rapid dispersal of funds, and changes in dormant accounts.

The sanctions chapter would cover trade sanctions alongside financial sanctions, reflecting the creation of the Office of Trade Sanctions Implementation (OTSI). It would clarify firms’ responsibilities for third-party screening tools, “including oversight of vendor-configured settings,” and encourage monitoring beyond name screening to goods, vessels, ports, services, and jurisdictions. For cryptoassets, the guidance prepares firms for authorisation from 25 October 2027, with examples on blockchain analytics, triggers for enhanced due diligence, and the Travel Rule.

Why it matters

Because the FCA expects firms to have considered the Guide, its good and poor practice examples are likely to become the yardstick in supervisory conversations, even before the final text lands. Firms should treat any match with a poor practice example as an issue to fix now.

The mule guidance is the most immediately testable. Many mule controls watch money leaving an account. The FCA names outbound-only monitoring as poor practice, which points firms toward inbound patterns: deposits that do not fit the customer, and money that leaves again quickly.

The sanctions material shifts some attention from the list to the plumbing. Vendor settings, list update timeliness, alert backlogs, and audit trails all appear in the proposed text. Those are areas where a firm can be fully compliant on paper and still miss a match.

Practitioner angle

• Compare your APP fraud and mule controls against each poor practice example in the fraud chapter, starting with whether you monitor inbound payments.
• Document which of the System Priorities your financial crime risk assessment addresses, and where.
• For sanctions screening, record who owns vendor-configured settings, how quickly list updates go live, and how alert backlogs are measured.
• If your firm will seek crypto authorisation, map your blockchain analytics and Travel Rule processes to the proposed examples now.
• Firms that deliver Banking as a Service, through white-label or embedded finance partnerships, should confirm who owns each financial crime control.

Read the poor practice examples first, then decide whether to respond by 24 December.