Regulatory scrutiny is intensifying

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoring

Exit & de-risking

When the question isn’t whether scrutiny is coming, but whether you’re ready before it arrives.

The regulatory question has changed. For years, the test was whether a firm had the policy, risk assessment, monitoring system and governance committee. Increasingly, the test is whether it can demonstrate that those things actually work, end to end: that risk is understood, controls are properly designed and operate as intended, the data and technology behind them hold up, and what they produce gets interpreted, escalated and acted on.

A Section 166 Skilled Person review is the sharpest expression of that test. The FCA commissioned 31 in the year to March 2026; financial crime was the largest category, with 12, and insurance saw 7, the most of any single sector. A Skilled Person may start with the policy, but the question does not end there: they test whether the control works in practice and whether the firm can evidence that. That is a fundamentally different, and far less forgiving, question.

That scrutiny is also less contained than it used to be. A financial crime review increasingly runs into questions about governance, data, technology, third-party oversight and individual accountability, because all are tested against the same underlying question: does the control actually work, and can the firm prove it? The FCA’s June 2026 insurance review, for example, identified weaknesses across governance and ownership, group policy implementation, third-party oversight and the mapping of regulatory obligations to controls and accountable owners. The direction of travel is broader than the UK too, with AMLA moving towards direct supervision of high-risk firms in Europe.

Good enough internally is a different bar to defensible under independent scrutiny

A firm can be satisfied that its controls work; being able to prove that under external scrutiny is different. A regulatory request may start narrow but follow the evidence wherever it leads, exposing adjacent weaknesses because the same question sits behind every control: can the firm show its working? That evidence has to exist before the request arrives; it cannot be reconstructed retrospectively without the gap becoming visible.

There is a funding dimension too. A firm can identify weaknesses in sanctions data, transaction monitoring or third-party oversight and still struggle to fund the fix because the cost of acting is immediate and certain, while the cost of not acting is deferred and uncertain. The regulator expects proactive risk management; the business has competing priorities. Scrutiny is often what finally forces the trade: work that struggled for a budget line becomes unavoidable once a supervisory concern or Section 166 is underway.

Meanwhile, the business keeps moving. New products, markets, vendors and platforms change what controls need to cover, while responsibility becomes distributed across teams and providers. What was proportionate when designed can stop being proportionate without anyone deciding that it should. Each team can believe its piece is working while the chain is not. Activity can then become a substitute for effectiveness: evidence that a review happened, an alert was cleared or a test was completed is not evidence that the right data entered the control, the system assessed it correctly or the output was acted on appropriately. The FCA’s insurance review found that firms retained responsibility for outsourced financial crime activities, but only one had enhanced, risk-based oversight of higher-risk controls.

Once scrutiny arrives, constrained capacity has to do two jobs at once: keep the business running and reconstruct proof that the framework worked historically. The firm is no longer simply fixing a control; it is investigating its history, evidencing effectiveness, responding to the regulator and maintaining BAU.

The pressure compounds: expectations rise → resources remain finite → investment is prioritised → the business changes → controls fall out of alignment → scrutiny exposes the gap → remediation becomes urgent, expensive and disruptive.

The firms ready before scrutiny arrives are the ones that made the case for themselves before the regulator made it for them.

How we support you

We work across the full arc: the diagnostic before scrutiny arrives, the response once a review is under way, and the ongoing assurance that keeps a firm ready in between reviews, not just for the next one.

Typical engagements include:

Set the target operating model, with roles, governance, controls and evidence requirements defined upfront

Test readiness before scrutiny arrives, using the standard a Skilled Person or regulator would apply

Prepare the people and evidence for scrutiny, including mock interviews, coaching and independent challenge

Navigate regulatory intervention, from thematic reviews through to formal restrictions on the business

Turn findings into a board-ready remediation plan, with clear ownership, milestones and evidence of progress

Deliver the remediation and embed the changes, with governance that keeps the programme on track

Keep the firm ready between reviews, through horizon scanning and periodic independent assurance

We are on the FCA Skilled Person Panel for Financial Crime & Market Abuse (Lots E & F), in addition to Conduct (Lot D), Consulting (Lot P) and Resource Augmentation (Lot R).

See our full list of services

Our experience

A global bank

Why we were brought on: as the bank’s sanctions obligations expanded across new jurisdictions, its obligations register and horizon-scanning process couldn’t keep pace with what was changing.

What we did: we rebuilt the obligations register and horizon-scanning process, then extended it into each new jurisdiction as the bank’s footprint grew.

Outcome: a relationship recommissioned across five separate phases over two years, itself evidence that staying ahead of what’s changing is an ongoing discipline.

A UK digital wallet and merchant payments provider

Why we were brought on: following a Section 166(3)(a) notice, the firm needed an independent two-stage Skilled Person review: first, on the adequacy and effectiveness of its financial crime framework; then, on the quality and completeness of its remediation.

What we did: we assessed governance, risk assessment, policies, fraud, CDD/EDD, PEP and sanctions screening, transaction monitoring and SARs, including the firm’s role as principal to an e-money agent network. We tested files, alerts and systems and interviewed staff and senior management across all three lines of defence, delivering Stage 1 in around 13 weeks against a 16-week regulatory allowance, followed by independent assurance of the remediation plan.

Outcome: Stage 1 report delivered to the firm and regulator, followed by Stage 2 design assurance confirming the quality of the proposed remediation.

A UK e-money and payments processor

Why we were brought on: following a Section 166(3)(a) notice, the firm needed an independent two-stage Skilled Person review covering the effectiveness of its financial crime framework and the quality and completeness of remediation already undertaken, including oversight of its distributor network.

What we did: we assessed governance, risk assessment, customer and distributor controls, screening, transaction monitoring and SARs, testing files, alerts and systems and interviewing staff and senior management across all three lines of defence. We then carried the same independent scrutiny through two further phases of assurance over the resulting remediation.

Outcome: Stage 1 report delivered to the firm and regulator, followed by two further assurance phases confirming how the resulting remediation had been implemented.

£42.4m

combined FCA fine, July 2025

£39.3m

for inadequate ongoing monitoring

£46.8m

received by one client from a money laundering operation over the course of a year

A recent industry example shows the cost of scrutiny catching up with the evidence. In July 2025, the FCA fined a UK bank £42.4 million combined: £39.3 million for inadequate ongoing monitoring that let a client receive £46.8 million from a money laundering operation over the course of a year, without proper reassessment even after law enforcement alerts about the client became known, and a further £3.1 million for opening a client money account without checking the Financial Services Register.