What Do FCA AML Monitoring Expectations Require?

FCA AML monitoring expectations focus on whether a firm's controls reflect its money laundering risks and remain effective as its business changes. UK-regulated firms need to demonstrate that transaction monitoring is appropriate for their customers, weaknesses are identified and addressed, and decisions can be explained.

A monitoring system being operational does not automatically make it effective. What matters is whether the controls reflect actual customer activity, support meaningful investigations and provide evidence that identified risks are being managed.

What Should FCA AML Monitoring Expectations Look Like in Practice?

The FCA's Financial Crime Guide, Chapter 3, explains that firms should conduct ongoing monitoring on a risk-sensitive basis. Transactions should be scrutinised against what the firm knows about its customers, while relevant customer due diligence (CDD) information must remain current. Where the risk associated with a business relationship increases, enhanced ongoing monitoring is required.

For compliance leaders, these expectations translate into three practical areas of oversight.

1. Risk Alignment

Do monitoring scenarios reflect the firm's current customers, products, payment flows and money laundering risks? Or are outdated assumptions and thresholds still shaping which transactions receive attention?

Monitoring arrangements should be tailored to the firm's risk profile and reviewed when its business, customer behaviour or relevant financial crime risks change.

2. Control Testing and Effectiveness

Can management demonstrate what has been tested, which weaknesses were identified and whether corrective actions were completed?

Testing should provide meaningful insight into whether monitoring scenarios and thresholds are appropriate. Where shortcomings are found, the firm should be able to explain the steps taken to address them.

3. Customer Information and Context

Can investigators access sufficiently current customer information to assess whether transactions make sense in context?

Monitoring is less meaningful when customer profiles are outdated or when investigators cannot establish how observed activity compares with expected behaviour. Findings from monitoring should also inform customer risk assessments where appropriate.

These areas provide a practical starting point for assessing AML compliance monitoring and the effectiveness of financial crime controls.

From Documented Controls to Effective Oversight

HM Treasury's National Risk Assessment of Money Laundering and Terrorist Financing 2025, published on 17 July 2025, sets out the UK's principal money laundering and terrorist financing risks and how these have changed since the previous assessment.

Firms should consider relevant national findings alongside their own business-wide risk assessments. National risk information provides important context, but it does not replace an institution's responsibility to understand the risks arising from its own customers, products, services and delivery channels.

Read the UK National Risk Assessment of Money Laundering and Terrorist Financing 2025.

A practical way to test whether a control is adequately supported is to select one material risk and trace it through the control environment.

Ask five questions:

• Risk: What specific money laundering risk is the control intended to address?
• Rationale: Why was this monitoring scenario, threshold or approach selected?
• Testing: What evidence shows that the control performs as intended?
• Escalation: How are unusual findings, limitations and control failures escalated?
• Accountability: Who owns remediation, and how is completion verified?

This exercise helps identify gaps between what a firm's policies say should happen and what its monitoring arrangements can demonstrate in practice.

What Evidence Should Firms Retain?

Effective transaction monitoring oversight depends on more than having policies and procedures in place. Firms need records that help them explain the rationale for their controls, assess their performance and demonstrate how weaknesses are addressed.

Depending on the firm's applicable legal and supervisory requirements, useful evidence may include:

• Risk assessments and control rationale: Records explaining the risks considered and why the monitoring approach is appropriate.
• Scenario and threshold documentation: The reasoning behind material rules, thresholds and changes, including relevant approvals and review dates.
• Testing results: Records of control testing, identified limitations, outcomes and the resulting decisions.
• Monitoring and escalation records: Evidence of how significant findings were reviewed, challenged and escalated.
• Remediation tracking: Documented weaknesses, accountable owners, target dates and evidence that corrective actions have been completed.
• Customer information updates: Records showing how monitoring findings prompted appropriate reviews of customer information or risk assessments.

The objective is not to generate documentation for its own sake. It is to make the reasoning behind a control clear enough for management to challenge and its effectiveness sufficiently evidenced for independent review.

The FCA's Financial Crime Guide, Chapter 3, provides further guidance on ongoing monitoring, transaction monitoring, good practice and record-keeping.

What Does This Mean for UK Banks and Payment Institutions?

The FCA's Financial Crime Guide states that Chapter 3 does not apply to payment institutions supervised for compliance with the Money Laundering Regulations by HMRC, although the guidance may still be relevant in the FCA authorisation context. EU payment institutions should assess the requirements applicable in their own jurisdictions rather than assume that FCA guidance directly governs them.

For firms operating across multiple jurisdictions, a clear understanding of applicable obligations is an important part of sound transaction monitoring oversight.

Making AML Monitoring Effectiveness Demonstrable

FCA AML monitoring expectations are not satisfied simply because a system generates alerts or a policy describes the intended process. Effective oversight means understanding the risks being monitored, testing whether controls work as intended, maintaining relevant customer information and addressing identified weaknesses.

For compliance leaders, the key question is whether the firm can explain why its monitoring approach is appropriate and demonstrate what happens when that approach falls short.

For a related perspective on how investigation information affects case handling, read TechnoXander's analysis of banking investigation gaps. You can also explore the TechnoXander AML and financial crime article library for further operational insights.