Financial crime frameworks are often well documented. The challenge is proving that the controls behind them are operating effectively, revealing weaknesses early and keeping pace with the risks they are meant to manage.
Fighting financial crime remains one of the FCA’s four strategic priorities for 2026/27. Its programme includes proactive assessments of anti-money laundering systems and controls at firms it considers higher risk, alongside continued work on sanctions systems and controls. The FCA also reports that more than 75% of its enforcement work is focused on financial crime.
But regulatory attention is only part of the picture. More revealing are the weaknesses the FCA continues to find when it looks at how controls operate in practice.
Recent reviews have identified firms failing to follow their own customer due diligence procedures, being unable to show what enhanced due diligence had been performed, operating screening arrangements with configuration or data weaknesses and, in some cases, lacking sufficiently independent assurance.
For management and boards, the issue is not simply whether the controls exist. It is what evidence supports the view that they are working as intended.
A control can exist without working as expected
A control may be well designed on paper and still fall down in operation. Even where the process is being followed, management needs evidence that it is actually helping to identify, prevent, detect or manage the risk it was designed for.
The FCA’s April 2026 review of customer due diligence illustrates the gap. It found examples of firms whose policies distinguished between standard and enhanced due diligence but lacked enough practical detail. Some firms did not follow their own procedures for periodic reviews, while others could not produce documentation showing what enhanced due diligence measures had been taken for higher-risk customers.
In each case, the framework on paper told only part of the story.
Sanctions screening provides another example. A firm may have a screening system, defined rules and an alert process, but weaknesses in list management, configuration, data quality or alert handling can materially change what that system actually detects.
In the FCA’s May 2026 review, reported suspected breaches were commonly associated with deficiencies in screening and alert management. The regulator also identified outdated or poorly maintained lists, gaps in data coverage and weaknesses in how alerts were handled.
Control inventories and policy attestations have value, but they cannot on their own show what happens when those controls meet real customers, transactions, systems and operational pressures.
What is management information really telling you?
Financial crime functions generate a great deal of data. Alert volumes, case closures, customer reviews, screening results and training completion can all tell management something about what is happening.
The problem comes when activity starts to stand in for assurance.
Knowing that 20,000 alerts were reviewed tells management that work took place. It says much less about whether those alerts were prioritised appropriately, investigated consistently or resolved quickly enough. A high customer-review completion rate may look reassuring while repeated quality failures continue in a particular business line or customer segment.
The FCA’s sanctions work makes the point well. It says meaningful management information should help senior management understand sanctions exposure, emerging risks, control effectiveness and issues requiring escalation or remediation. Yet it found that the quality and depth of sanctions MI varied, with some firms unable even to provide information on how long alerts took to resolve.
Numbers need context.
A rise in alert volumes could have several explanations. A growing backlog might be temporary pressure on capacity, poor calibration, changing customer behaviour or something more structural. Quality assurance becomes more informative when it shows where errors are recurring rather than simply producing an overall pass rate.
A full dashboard can still leave management poorly informed.
Problems often appear before outright failure
Control weakness often shows itself before anything has formally failed.
Problems can build slowly. What starts as a temporary backlog can become normal, workarounds can linger, and the same quality issue may keep resurfacing even after actions have been closed.
Those are the kinds of signs management should be able to see early, before a more serious breach exposes the problem.
A wholesale-bank example in the FCA’s sanctions review shows how that can happen. A legacy system integration problem meant that a set of transactions was not screened for an extended period. Routine monitoring did not identify the failure. It came to light only during a later internal review, forcing the firm to examine historic transactions to assess whether breaches had occurred.
The control appeared to be operating, but one of the dependencies beneath it had failed.
Screening is only as reliable as the customer data, sanctions lists, internal feeds and system configuration behind it, as well as the people and escalation processes dealing with the alerts. Looking at the screening control in isolation can create confidence in one part of the process while missing weakness elsewhere.
Management information should help make that deterioration visible early enough to act.
Controls need to keep pace with the risk
A control can become less reliable without actually breaking. Sometimes the environment around it has simply changed.
Customer behaviour and volumes shift, products or channels evolve, sanctions designations change and data moves between systems. A screening approach that worked adequately against one risk profile may perform differently as those conditions move.
The FCA’s testing of sanctions screening illustrates this. Firms were generally effective at identifying exact matches, but performance fell when names appeared in slightly different forms, such as minor spelling variations. Screening systems also struggled in some cases with titles and honorifics, one-word names and character limits. An assessment that a control is working therefore has a shelf life.
Signs that the underlying assumptions have changed may come from monitoring and testing, incidents, customer behaviour, developments outside the organisation or assurance findings. They need to feed back into the assessment of the control rather than sit in separate information streams.
A control judged satisfactory twelve months ago should not retain that status simply because nothing has formally challenged it since.
Assurance should add information, not simply confirmation
Independent challenge becomes particularly valuable when management already has an established view of how well its controls are working.
The FCA’s customer due diligence review found that most firms had some form of compliance monitoring and audit, but the depth and independence of those arrangements varied. Stronger-performing firms used independent third line testing across onboarding and due diligence and acted on the findings. The FCA also found cases where there was no independent second-line assurance, including one where the same staff both onboarded customers and carried out assurance work on them.
That does not point to one mandatory assurance structure. The FCA presents these observations as examples of good and poor practice rather than a single operating model.
What matters is whether assurance adds something management could not already see for itself.
Testing should help establish whether the control operates as described, whether exceptions are properly understood, whether the same issues are recurring and whether remediation has changed the conditions that created the problem in the first place.
Closing an action is not the same as resolving a weakness.
If the same issue keeps reappearing through compliance monitoring, quality assurance, audit or regulatory review, that recurrence is itself important governance information.
Boards need to understand the basis for confidence
Boards and risk committees do not need operational detail on every customer file or screening alert.
They do need to understand why management believes the financial crime control environment is working, and where that confidence is less certain.
A single control rating is unlikely to provide that picture. A more credible assessment draws together operational performance, exceptions, quality findings, assurance, incidents and changes in the underlying risk.
Where those sources point in different directions, that disagreement should not simply be smoothed away in reporting.
A control rated green while backlogs are growing, quality findings are deteriorating and audit issues are recurring needs explanation. So does a remediation programme that has closed most of its actions while the same underlying weakness continues to appear.
For boards, the conversation is really about the basis and limits of management confidence. That means knowing which important controls have been independently tested, where weaknesses are concentrated, whether they appear isolated or systemic and whether deterioration is visible early enough to respond.
That goes beyond proving that policies, systems and procedures exist. It gives the board a more credible basis for confidence.
Financial crime controls will never provide absolute certainty, and governance reporting should not pretend otherwise.
Confidence comes from evidence of how controls are operating, where their limits are becoming visible, how independently that view has been challenged and whether remediation is fixing the underlying problem.
If a board is told that its most important financial crime controls are working, the organisation should be able to put the basis for that judgement on the table.
Stay up to date with the latest news and views from the world of governance, risk, audit and compliance >>>
