The New Price of Being Regulated in the UK

Being regulated in the UK used to mean ticking boxes once and coasting. That era is over.

Two developments now define what "regulated" actually costs in practice: the FCA's tightening grip on Annex 1 firms, and the PRA/FCA's proposed captive insurance regime. One raises the bar for firms already inside the perimeter. The other builds a new door into it. Both signal the same thing — regulators are done accepting generic compliance as good enough.

Firms that treat this as background noise will find out the hard way that the price of getting it wrong has gone up.

Annex 1 Firms: The Free Ride Is Over

Annex 1 firms — unregulated lenders, safe custody providers, money brokers, and financial leasing companies — occupy an odd space. They're not fully regulated, but they must register with the FCA for anti-money laundering purposes.

The FCA has made clear it's applying increased scrutiny to Annex 1 firms, and the reasons are specific, not vague.

What the FCA is actually worried about:

Firms leaning on their parent company's financial crime controls instead of building their own
Off-the-shelf compliance procedures that don't match the firm's actual risk profile
Unregulated lending run through complex structures, including special purpose vehicles
Regulated firms doing business with Annex 1 firms without proper due diligence

That last point matters beyond the Annex 1 population itself. If you're a regulated firm dealing with one of these entities, the FCA expects you to check their registration status directly — not assume it.

What's Changing on the Ground

This isn't a policy statement sitting in a drawer. The FCA has already acted.

Around 900 Annex 1 firms have received information requests about their activities, business models, and risks. Combined with the 300 firms contacted in late 2025, the FCA has now reached out to essentially every registered Annex 1 firm in the country.

New applications are also under closer review. Firms need to clearly demonstrate they can comply with money laundering regulations — and should expect registration to take longer than it used to.

The message is simple: inherited compliance frameworks won't survive scrutiny anymore. Each firm within a group has to show its controls are tailored to its own operations, governance, and risk exposure. "Our parent company handles this" is no longer an answer the FCA will accept.

A New Door Opens: Captive Insurance

While the FCA tightens the Annex 1 perimeter, the PRA and FCA are opening a new one — and doing it deliberately.

The regulators have jointly proposed a new captive insurance regime designed to position the UK as a hub for the fast-growing captive insurance market.

Captive insurers — companies set up by a parent business to insure its own risks — have historically gone offshore to jurisdictions with lighter, more tailored regimes. This proposal is an attempt to bring that activity home, with rules built specifically for how captives operate rather than forcing them into a standard insurer framework.

It's a rare example of UK regulators competing for business rather than just controlling it.

Two Signals, One Direction

Put these together and a pattern emerges. UK regulators are getting more precise about who they let in, and more demanding about how those already inside behave.

Entry is being redesigned, not just guarded — the captive regime shows regulators building fit-for-purpose frameworks rather than one-size-fits-all rules.
Existing registration is not permanent safety — Annex 1 firms are learning that being registered doesn't mean being left alone.
Generic compliance is a liability, not a shortcut — inherited or templated controls are now a red flag, not a reassurance.

Firms that assume regulatory status is a fixed asset, earned once and held indefinitely, are misreading the moment.

What Firms Should Actually Do

For Annex 1 firms and those dealing with them, the practical response is straightforward:

Audit your controls now — don't wait for an FCA information request to discover gaps
Document why your framework fits your specific risk profile — not your parent company's
Verify registration status directly when dealing with Annex 1 counterparties, rather than taking it on trust
Build in time for registration applications — the FCA has explicitly said these will take longer

For firms watching the captive insurance proposal, the opportunity is different but the discipline required is the same: engage early, understand the draft rules in detail, and don't assume a UK-based captive will be easier to run than an offshore one just because it's closer to home.

Key takeaways

The FCA is increasing scrutiny of Annex 1 firms, targeting weak financial crime controls and reliance on parent company frameworks
Around 900 firms have received FCA information requests, on top of 300 contacted in late 2025 — nearly all registered Annex 1 firms have now been reached
Registration applications will take longer, and firms must show controls tailored to their own risks, not borrowed ones
Regulated firms dealing with Annex 1 entities are expected to verify registration status directly, not assume compliance
The proposed captive insurance regime shows regulators can also build competitive, fit-for-purpose frameworks — not just tighten existing ones
The common thread: generic, inherited, or assumed compliance no longer holds up under UK regulatory scrutiny