In partnership with
Hi {{first_name | there}},
This week the FCA did something it has been building toward for two years. It stopped asking whether firms have financial crime controls and started counting whether those controls actually run. The headline number, 29% of asset managers with no transaction monitoring at all, is now a benchmark you will be measured against. And it landed in the same week that agentic AI entered the FCA's sandbox for AML and KYC, and the Bank of England named AI a systemic risk for the first time. So two things are happening at once. The bar for proving your controls work has gone up, and the technology now making those decisions is getting harder to explain to a supervisor.
That is what this issue is about. Below you will find the FCA findings and what they mean for your next business-wide risk assessment, FATF's ruling that "decentralised" no longer shields anyone from obligations, what an AI agent running in production does to your accountability chain, and the five weeks left before the non-financial misconduct rules reach roughly 37,000 firms on 1 September.
The Accountability Record is written each week for the people who personally answer when something goes wrong: CCOs, CROs, MLROs, SMF holders, and the compliance leads who sit beneath them.
Let's get into it.
Speak naturally. Send without fixing.
Wispr Flow turns your voice into clean, professional text you can send the moment you stop talking. Not rough transcription you have to clean up. Actual polished text — ready for email, Slack, or any app.
Speak the way you think. Go on tangents. Change your mind mid-sentence. Flow strips the filler, fixes the grammar, and gives you text that reads like you spent five minutes writing it.
89% of messages sent with zero edits. Millions of professionals use Flow daily, including teams at OpenAI, Vercel, and Clay. Works on Mac, Windows, and iPhone.
TL;DR
The FCA has quantified the gap and named the sector (22 July). Of 242 asset management and alternative firms engaged, 29% had no formal transaction monitoring and over a fifth had no adequate business-wide risk assessment. Private markets flagged as higher risk. This is the supervisory benchmark you will be tested against. Treat your next BWRA and monitoring review as the deadline.
FATF killed the "decentralised" defence (21 July). Centralised control persists in most DeFi through admin keys and governance-token concentration. If someone controls the upgrade keys, someone has obligations. Crypto-exposed MLROs: reflect the control test in your risk assessment now.
Agentic AI is inside the FCA sandbox (live to 31 Dec). 21 firms are testing agent-led payments, fraud detection and AI governance on Anthropic's models. When an agent clears an alert, the named SMF still owns the decision. The questions asked of sandbox firms become the questions asked of everyone.
Five weeks to 1 September. Non-financial misconduct conduct rules reach ~37,000 non-bank firms. Training, breach reporting and fitness assessments must be live on day one. The runway is now tight, not comfortable.
This week in three moves
1. The effectiveness era arrived in a good-and-poor-practice document. The FCA's 22 July findings are not a consultation. They set the baseline the regulator will now judge you against: 29% of firms with no transaction monitoring, over a fifth with no adequate BWRA, around 40% outsourcing CDD and EDD, many without a formal customer risk assessment underneath it. The message to MLROs is blunt. The regulator has moved from "do you have a control" to "can you show it works," and it now holds a sector-level number that is much harder to explain away than a vague intention. Private markets is where the next supervisory cycle is heading.
2. FATF made "it's decentralised" a liability, not a shield. The 21 July DeFi report finds centralised elements frequently persist and urges jurisdictions to apply a functional test to identify who actually controls an arrangement. 132 of 142 jurisdictions have identified no qualifying decentralised entity at all. Two DPRK-attributed attacks in April drove roughly 76% of the year's virtual-asset hacking losses, over USD 570m. If your firm touches crypto rails or DeFi-adjacent counterparties, your risk assessment should already answer "who controls this."
3. The regulator is learning agentic AI faster than most boards are governing it. 21 firms are live-testing agentic use cases in the Supercharged Sandbox with Anthropic, and the AI Live Testing cohort is putting agents against AML and KYC. Separately, the Bank of England's July Financial Stability Report escalated AI from conduct risk to systemicrisk. When AI moves from the conduct rulebook to the financial-stability rulebook, the evidence expected of the accountable SMF rises with it. A vendor assurance letter is not dependency governance. Your board should already know which named individual owns any agentic process running in production.
Enforcement
No new UK financial penalty this week. The quiet fine year continues, but effectiveness scrutiny is loud. Two AML actions show where the bar now sits.
ABN AMRO — €8.5m (DNB, Netherlands). For weak ongoing due diligence on higher-risk customers, not onboarding. Ongoing CDD is the European enforcement frontier. If your customer risk assessment is point-in-time, this is your warning that periodic is no longer defensible.
Sabre Global Technologies — £1,000,920.59 (OFSI, UK). The largest UK sanctions penalty since 2020 and the first under OFSI's new settlement route. Sanctions risk sat in a technology firm, not a bank. OFSI is doubling maximum penalties while offering up to 70% settlement discounts. Model both numbers into your risk appetite.
Most recent individual action: the FCA's proposed £99,600 penalty against BancTrust's CEO for failing to disclose an overseas investigation and sanction. Fitness and propriety is a continuing personal obligation, not an application-form formality.
Countdown to 1 September
The non-financial misconduct conduct rules (COCON 1.1.7FR) extend conduct rules to bullying, harassment and violence with a sufficient work-related link across ~37,000 non-bank firms. Not retrospective, but training, breach reporting and fitness-and-propriety assessments must be operational on day one. If your September conduct training does not yet cover NFM, fix that this week.
BuildMoat
⚠️ Disclosure: BuildMoat publishes The Accountability Record. Evaluate this with the same scrutiny you would apply to any vendor.
Put this week's two facts side by side: the FCA is now counting whether controls run, and agentic AI is entering AML and KYC workflows. The evidential question is no longer "do you have a control," it is "can you show, on demand, who reviewed the AI-driven output, when, and on what basis, before it cleared an alert or reached a report." BuildMoat links every AI-driven decision in a regulated workflow to a named Senior Manager under SM&CR and generates the evidence trail a supervisor can read. Currently developing evidence-trail coverage for AI-assisted financial crime workflows. More at buildmoat.co.uk.
What is an EOR—and why are companies using it?
Opening entities in every country can be slow, expensive, and hard to scale.
That's why more companies are using EOR to hire globally faster.
See how Oyster helps teams hire, pay, and support talent in 180+ countries while staying compliant along the way.
Calendar
21 Aug — Responses close: CP26/24 (consumer investment disclosures).
1 Sep — NFM conduct rules in force (~37,000 firms).
16 Sep — Responses due: CP26/27 (remuneration, solo-regulated firms).
18 Sep — Responses due: CP26/23 (Consumer Duty scope).
14 Oct — Responses due: CP26/28 (UK AIFM regime).
31 Dec — Supercharged Sandbox second cohort concludes.
1 Jan 2027 — Basel 3.1 implementation takes effect.
One thing to read
"Asset management and alternative firms' financial crime controls: our findings" (FCA, 22 July). Read it even if you are not an asset manager. It is the clearest recent statement of how the FCA now assesses financial crime controls: sector baselines, named practices, and a hard shift from existence to effectiveness. The private-markets risk framing is where the next supervisory cycle is heading.
The FCA found 29% of firms have no formal transaction monitoring. If a supervisor asked tomorrow, could you evidence not just that your monitoring exists, but that it works?
Results shared in next week's issue.
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
