The Financial Conduct Authority (FCA) has published the findings of its multi-firm review into the design of financial crime systems and controls across large insurance firms. The review provides valuable insight into how insurers are managing financial crime risks and offers practical recommendations for firms seeking to strengthen their own frameworks.
For firms operating across the retail, wholesale and life insurance sectors, the review serves as an important benchmark against which they can assess the effectiveness of their financial crime controls and governance arrangements.
Why the FCA Carried Out This Review
Insurance firms play an important role in preventing and detecting financial crime across the UK financial services sector. As part of its wider supervisory priorities, the FCA committed to reviewing the financial crime frameworks of a sample of larger insurance firms to assess whether their systems and controls were appropriately designed to identify, manage and mitigate financial crime risks.
The review focused on the design of firms’ financial crime frameworks and drew upon documentary evidence submitted in response to a detailed questionnaire covering ten financial crime control areas:
- Governance and oversight;
- Risk assessment;
- Regulatory reporting and issue management;
- People and knowledge;
- Third-party risk;
- Client due diligence;
- Sanctions;
- AML transaction monitoring;
- Fraud;
- Anti-bribery and corruption.
The FCA assessed firms against relevant legislative requirements and regulatory guidance, including the Money Laundering Regulations 2017, the FCA’s Financial Crime Guide, the Senior Management Arrangements, Systems and Controls (SYSC) sourcebook, the Joint Money Laundering Steering Group (JMLSG) Guidance and the Financial Action Task Force (FATF) standards. Each control area was rated as Strong, Moderate or Weak, depending on the robustness of its design, clarity of ownership and the balance between manual and automated controls.
Headline Findings
Overall, the FCA concluded that financial crime controls across the reviewed firms were largely effective, though with room for improvement in specific areas.
Life insurance firms emerged as the strongest performers overall, with solid results in risk assessment, client due diligence, third-party risk, people and knowledge and sanctions, though transaction monitoring remained an area needing attention.
Wholesale insurance firms demonstrated moderate-to-strong performance, particularly in anti-bribery and corruption, sanctions, and people and knowledge. Fraud risk management, however, was comparatively weaker.
Retail insurance firms performed well in sanctions, fraud risk management, and anti-bribery and corruption, but their risk assessment processes and policies and procedures were identified as areas requiring improvement.
Key Themes Across the Sector
Several cross-cutting themes emerged regardless of sector:
- Transaction monitoring tended to be less developed among non-AML-regulated firms, largely reflecting the predictability of their transaction patterns rather than a deliberate risk-based decision. The FCA was clear that any simplified approach should still be documented, proportionate, and risk-based, given firms’ ongoing obligations around suspicious activity reporting and sanctions compliance.
- Monitoring and testing activity across second and third lines of defence was often inconsistent, with limited evidence of structured, risk-based testing plans. Firms without dedicated financial crime assurance capability were encouraged to demonstrate how they had considered the need for specialist or outsourced review.
- Policies and procedures were typically strong at group level but lacked the specificity needed at business unit or jurisdictional level, creating a risk of misapplication or misinterpretation on the ground.
- Roles and responsibilities were often unclear, with most firms operating a three-lines-of-defence model but few maintaining a formal RACI matrix to clarify accountability across the financial crime framework.
- Obligations management was another gap area, with most firms lacking a register mapping legal and regulatory obligations to specific controls and accountable owners.
- On third-party outsourcing, firms consistently acknowledged that outsourcing does not transfer liability, yet only one firm in the sample demonstrated enhanced, risk-based oversight of higher-risk third-party relationships. The FCA expects firms to categorise third parties by risk and match their oversight, accordingly, supported by clear escalation pathways and documented decision-making.
What Firms Should Do Next
The FCA will provide individual feedback to firms that participated in the review and will engage further where improvements are required.
The FCA also expects all insurance firms, including those not involved in the review, to consider the findings and assess whether similar weaknesses exist within their own financial crime frameworks. Particular attention should be given to:
- strengthening enterprise-wide financial crime risk assessments;
- improving client due diligence documentation;
- clearly defining roles and responsibilities through governance frameworks such as RACI matrices;
- maintaining comprehensive regulatory obligations registers; and
- implementing proportionate, risk-based oversight of outsourced and third-party service providers.
How Complyport Can Help
Complyport supports insurance firms and intermediaries in strengthening their financial crime frameworks to meet FCA expectations.
Our specialists can assist with:
- conducting gap analyses against the FCA’s ten financial crime control areas;
- reviewing and enhancing financial crime risk assessment methodologies;
- developing business-unit-specific policies and procedures;
- designing governance frameworks, including RACI matrices and regulatory obligations registers;
- strengthening client due diligence processes;
- enhancing third-party risk management and oversight frameworks; and
- providing independent assurance reviews and practical remediation support ahead of FCA supervisory engagement.
Whether your firm is benchmarking its framework against the FCA’s latest findings or preparing for future regulatory scrutiny, Complyport can provide practical, proportionate support tailored to your business.
Book a Meeting with a Complyport SME
To discuss how the FCA’s findings may affect your business and how Complyport can help strengthen your financial crime framework, contact us today to book a meeting with one of our Subject Matter Experts.
Ask ViCA, your Virtual Compliance Assistant.
Access instant answers on regulatory changes.
Claim your complimentary 20 queries today! Register here: https://vica.chat
CPT social media:
The FCA has released its multi-firm review into insurance financial crime controls and the findings reveal clear gaps in risk assessment, third-party oversight, and accountability across retail, wholesale, and life insurance firms. Read our breakdown of what the regulator found and how firms can close the gaps.
#FinancialCrime #FCA #Insurance #Compliance #AML #RiskManagement #RegTech #ThirdPartyRisk #Complyport #FinancialServices
