How enhanced due diligence strengthens financial crime controls

The FCA’s 2026 review illustrates how sound financial crime controls can connect risk assessment, proportionate due diligence and ongoing monitoring.

The Financial Conduct Authority’s (FCA) 2026 review of financial crime controls in asset management and alternative firms highlights a practical theme: firms should be able to show how their controls work in practice, not only how they are described in policy. The review presents findings and examples of good and poor practice to help firms consider whether their frameworks identify, manage and mitigate the risks in their business models. The FCA engaged with 242 firms and notes that not all findings will apply to every firm.

Enhanced due diligence (EDD) is an important part of this framework. The aim is not to run more checks indiscriminately, but to apply additional scrutiny that is proportionate to the identified risk.

A risk-based approach begins before an individual customer is assessed. Under FCA Handbook SYSC 6.3.1R, a firm within scope must maintain systems and controls that enable it to identify, assess, monitor and manage money-laundering risk, and that are comprehensive and proportionate to the nature, scale and complexity of its activities. In practice, a business-wide risk assessment may consider factors such as products, transactions, geographies and delivery channels. These findings can then inform the customer risk methodology and the circumstances in which EDD is considered.

For higher-risk relationships, a firm may tailor its research to the relevant risk drivers rather than simply collect more documents. Clear escalation criteria, documented decisions and appropriate compliance review can help demonstrate that due diligence is proportionate. The FCA’s 2026 customer due diligence (CDD) review identifies clearly documented enhanced measures and senior-management oversight as examples of good practice, while noting that good practice may go beyond minimum regulatory requirements.

The FCA’s review of asset management and alternative firms identifies a lack of source-of-wealth (SOW) verification for higher-risk customers as an example of poor practice. The FCA Financial Crime Guide also explains that establishing source of funds and source of wealth can support ongoing monitoring and due diligence by helping a firm consider whether the level and type of transaction are consistent with its knowledge of the customer.

A proportionate SOW review may seek to understand the customer’s overall wealth journey, identify material drivers of net worth and assess whether the explanation is reasonable and internally consistent. The depth of review should reflect the risks identified and the evidence available. Where greater scrutiny is appropriate, firms may need to test customer-provided information against reliable independent evidence and consider the relevant industry, geographic and market context.

For a corporate customer, beneficial ownership work can include identifying the natural persons who ultimately own or control the entity, verifying their identities and assessing relevant sanctions and financial crime risks.

In complex or opaque structures, a firm may need to look beyond a single official registry and reconcile information from corporate filings, regulatory disclosures, litigation and insolvency records, credible media and other reliable sources. Depending on the structure, the analysis may consider legal ownership, voting rights, control mechanisms and other forms of influence.

Where firms find it difficult to determine upstream ownership or interpret complex control relationships, they may supplement ownership research with risk-based questionnaires and discussions between relevant compliance teams. Any approach should remain aligned with the firm’s policies, risk appetite and applicable requirements.

The FCA reported that around 40% of the firms in its sample outsourced some or all CDD and EDD checks. Outsourcing can help firms scale their capabilities, but it does not remove the regulated firm’s responsibility for compliance or its customer-risk decisions.

When outsourcing EDD to a vendor, firms may wish to consider factors such as source coverage, research methodology, analyst expertise, quality controls, escalation routes, auditability and how the output will be integrated into the firm’s own decision-making process.

Artificial intelligence (AI) can help organisations process information more efficiently, identify connections and improve consistency across EDD workflows. However, the quality of an AI-supported investigation depends on the breadth, reliability and accessibility of its underlying sources.

Important EDD information may sit in subscription databases, local court and company records, regulatory filings, official documents or information obtained through local enquiries. An output may still contain material gaps where relevant evidence is unavailable or falls outside the technology’s reach.

Human review can help validate sources, contextualise findings, conduct investigative follow-up and assess whether a finding is credible and material to the customer’s overall risk. Governance controls can also define where analysts should intervene and how conclusions trace back to evidence.