Financial crime remains one of the Financial Conduct Authority’s cross-sector priorities.  Insurance firms should take note of the regulator’s findings from its recent review of financial crime frameworks in the sector.

Published: 30 June 2026
Authors: Daren Allen & Claire Kershaw

Key facts

The FCA undertook a multi-firm review of financial crime systems and controls in the insurance sector and has recently published its findings here.

Several large insurance firms were reviewed across the retail, wholesale and life insurance markets.  These firms were asked to provide the FCA with documents in response to 38 questions across ten key groups of financial crime controls.

The FCA evaluated the design of firms’ controls against the Money Laundering Regulations 2017, the FCA’s Financial Crime Guide, the SYSC rules, and guidance issued by the Joint Money Laundering Steering Group and the Financial Action Task Force.

Overall, the FCA found life insurance firms generally had stronger controls than retail and wholesale firms, with six cross-sector themes emerging (see our key takeaways).

The FCA highlighted the following ‘headline’ areas for improvement:

• retail – risk assessment and policies and procedures
• wholesale – fraud risk management
• life – transaction monitoring.

Firms should note the full findings and take appropriate action

Key takeaways

AML transaction monitoring – firms should ensure they consider the risks and benefits of their approach to this and clearly document their rationale.  Any reduction or simplification in controls should be risk-based, proportionate and clearly evidenced.

Controls monitoring and testing – this must be clearly co-ordinated to avoid gaps in coverage (or duplication).  Firms without internal assurance expertise should be able to evidence how they have considered financial crime risks and assessed need for specialist or outsourced reviews.

Policies and procedures – firms should consider supplementing group-level frameworks with more specific policies and procedures tailored to individual business units and jurisdictions.  How these interact and are implemented in practice should be clearly documented.

Roles and responsibilities – firms should also consider using a RACI (Responsible, Accountable, Consulted, Informed) matrix to define roles and responsibilities clearly across their financial crime framework.

Obligations management – to support clear accountability and oversight firms should consider an obligations register or similar method of articulating its legal and regulatory obligations, and mapping them to specific controls, processes and responsible roles.

Third-party outsourcing – where firms outsource financial crime activities, they should categorise third-party relationships by risk and apply proportionate oversight, documenting oversight activities and decisions clearly.

For more information or advice, please contact our Financial Services Disputes and Investigations team.