FCA and its views on Business-Wide Risk Assessments (BWRA) and Customer Risk Assessments (CRA).

The Financial Conduct Authority (FCA) has recently published several pieces of feedback and findings that highlight persistent challenges firms face in conducting

• Business-Wide Risk Assessments (BWRA) and
• Customer Risk Assessments (CRA).

Here's a summary of the key insights:

FCA Survey of Corporate Finance Firms (Oct 2025) Full source [fca.org.uk]

• In a survey of 303 corporate finance firms, two-thirds may not be compliant with the Money Laundering Regulations (MLRs) in one or more areas of their anti-financial crime frameworks.
• 11% of firms had no documented BWRA at all, including several principal firms with appointed representatives (ARs).
• 10% lacked documented evidence of Customer Due Diligence (CDD). [fca.org.uk]
• 66% of firms may be non-compliant with Money Laundering Regulations (MLRs).
• 29% of principal firms failed to assess financial crime risks for their Appointed Representatives (ARs).
• 6% did not monitor ARs’ compliance or conduct audits.

Good Practice Identified:

• Regular updates to BWRA to reflect emerging risks.
• Use of detailed Management Information (MI) to strengthen controls.
• 97% of firms report financial crime concerns to senior management.

FCA’s Response:

• Writing to potentially non-compliant firms.
• Part of a 5-year strategy to raise standards in financial crime oversight.

FCA Report on Money Laundering Through the Markets (Jan 2025) Full PDF Report [fca.org.uk]

BWRA Observations:

• Some firms underestimated or poorly documented financial crime risks.
• Lack of understanding across firms about how they could be targeted by criminals.

CRA Observations:

• Increasing use of weighted risk factors and country risk assessments.
• Weak documentation of CRA methodology and rationale.
• Inconsistent treatment of domestic vs foreign PEPs.

Other Key Areas:

• KYC/CDD: Improvements noted, but over-reliance on third parties persists.
• Governance: MI reporting improving, but oversight still varies.
• Transaction Monitoring (TM): Automated systems often ineffective alone; integration with other controls needed.
• SARs Reporting: Limited awareness of UKFIU glossary codes; inconsistent quality.
• Training & Resourcing: Still not tailored to firm-specific risks and roles.

FCA Expectations:

• Robust systems and controls at every stage of the customer and transaction journey.
• Proactive identification, investigation, and reporting of suspicious activity.
• Tailored training, governance, and documentation.

Disconnect Between Risk Assessments and Reality

• Many firms struggle to connect their risk assessments to actual financial crime risks. This includes failing to consider:
• Geographic and customer risk factors
• Product/service delivery channels
• Control effectiveness
• National Risk Assessments (NRAs) [comsuregroup.com]

Common Pitfalls in BWRA Execution

According to a former FCA Skilled Person:

• Over-complicated methodologies that confuse rather than clarify
• Poor data quality and limited availability
• Subjective control assessments lacking objective evidence (e.g., audit reports)
• Inadequate documentation of methodology and findings [dcmoperations.com]

Regulatory Expectations

• The FCA expects firms to:
• Conduct robust, systematic BWRAs
• Use diverse sources (e.g., FATF reports, UK NRA, press, court judgments)
• Ensure assessments are proportionate to the firm’s size and complexity
• Document and test control effectiveness
• Integrate findings into the firm’s AML/CTF/PF policies and procedures [dcmoperations.com]

Case Example: Zeux Limited

The FCA declined Zeux Limited’s crypto registration due to:

• Poor BWRA methodology
• Lack of consideration for product, customer, and geographic risks
• No evidence of control testing
• Misclassification of risks and controls
• Ignoring the UK National Risk Assessment [comsuregroup.com]

Good Practice Recommendations

• Document everything: From methodology to control testing outcomes.
• Use multiple data sources: Don’t rely solely on internal data.
• Tailor assessments: Align with the firm’s business model and risk exposure.
• Train staff: Ensure understanding of financial crime risks and assessment processes.
• Review regularly: Update BWRAs and CRAs in response to changes in risk landscape.

Sources

• https://www.fca.org.uk/news/press-releases/gaps-financial-crime-oversight-corporate-finance-firms
• https://comsuregroup.com/news/fca-enforcement-notice-good-and-bad-practices-on-business-wide-risk-assessment-bwra/
• https://www.dcmoperations.com/insights/business-wide-financial-crime-risk-assessments
• https://www.fca.org.uk/publication/corporate/money-laundering-through-markets-review-january-2025.pdf