FCA Proposes Financial Crime Guide Update on APP Fraud and AI Tools

The UK’s Financial Conduct Authority is consulting on changes to its Financial Crime Guide, with new guidance on authorised push payment (APP) fraud and money mules and a reminder that firms stay responsible for the AI and third-party tools they use to fight financial crime.

The regulator published consultation paper CP26/38 on 23 October and is taking comments until 24 December 2026. These are proposals, and none of the wording is settled. The FCA says it will consider responses and then publish its feedback “along with the final amended text of the Guide, in a Policy Statement”.

The Guide itself is not a rulebook. According to the consultation paper, it “does not contain rules nor impose any new requirements”, but the FCA expects firms “to have read and considered it” when setting their own controls. Its self-assessment questions and examples of good and poor practice are, in effect, a guide to what supervisors look for.

Fraud victims are the starting point for the biggest change

The FCA opens its fraud chapter with the people who lose money. “Fraud has significant financial and emotional consequences for victims,” the paper says, adding that it “undermines security and trust in the UK financial system.”

The regulator says it has assessed how payment service providers, including retail banks and payments and e-money firms, detect and prevent APP fraud and money mule activity, and that it has “heard repeated calls from industry for more guidance on fraud”. The proposed new section on APP fraud and money mules is built around three stages: onboarding, monitoring and reporting. Each comes with examples of good and poor practice drawn from the FCA’s multi-firm reviews, including its work on money mules and on romance fraud.

At onboarding, good practice in the draft includes building “a holistic view of the customer”, using fraud databases, identifying customer vulnerability and checking for “synthetic or counterfeit documentation”. Poor practice includes only becoming aware of a customer’s vulnerabilities after a fraud has happened.

For monitoring, the FCA lists warning signs of APP fraud, among them negative Confirmation of Payee results, new payees receiving high-value transactions and customers “using increasingly desperate tones in communications”. Signs of mule activity include unexplained deposits and the rapid dispersal of funds. The paper criticises firms that watch only outbound payments, and those that never check whether their customer warnings work.

On reporting, the FCA encourages firms to share fraud data across the industry, and counts failing “to act after receiving specific intelligence” as poor practice.

Investment fraud would no longer have its own guidance. It would be folded into the APP fraud section, treated as one typology among several. The FCA asks respondents whether that is enough, citing UK Finance data that showed a 26% rise in investment fraud cases and a 40% rise in losses between 2024 and 2025.

Six other areas get updated guidance

Beyond fraud, the consultation covers cryptoassets, financial and trade sanctions, proliferation financing, data security, financial crime systems and controls, and money laundering and terrorist financing.

The crypto changes are timed for the UK’s new regime. From 25 October 2027, firms carrying out certain cryptoasset activities in the UK will need FCA authorisation under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. The draft adds good and poor practice on enhanced due diligence, blockchain analytics and the Travel Rule. TSN covered the FCA’s separate consultations on DeFi guidance and crypto perimeter exclusions earlier this week.

The sanctions chapter would cover trade sanctions alongside financial ones and reflect the creation of the Office of Trade Sanctions Implementation. The data security chapter would be refreshed for “emerging risks associated with AI, synthetic identity fraud and digital assets”, with case studies updated “to reflect modern threats, including deepfakes”. For Banking as a Service and embedded finance, the draft says regulated firms remain accountable for controls “across the delivery chain”, including where work is outsourced or white-labelled.

Buying a screening tool leaves the accountability with the firm

The thread running through the AI and RegTech material is that a firm cannot hand off responsibility along with the work. Paragraph 2.27 of the paper puts it directly: “Firms are increasingly using AI and other third-party tools in their financial crime systems and controls. They must apply governance and oversight to these and remain accountable for managing the financial crime risks they present. The tools must be proportionate to the firm’s risk profile and risk appetite, and subject to testing and validation.”

Sanctions screening shows how far that reaches. The FCA proposes clarifying firms’ responsibilities when they use third-party screening tools, “including oversight of vendor-configured settings” and the timely, accurate loading of sanctions-list data. One draft self-assessment question asks firms using a tool with “limited oversight of vendor-implemented settings” whether they have assessed if that could affect compliance, and whether they “can demonstrate how those risks are mitigated”. In TSN’s reading, a screening tool set up by someone else does not move the risk to that supplier: the firm still has to understand how the tool is calibrated and show it works for its own business.

AI controls will be expected to explain themselves

The draft data security material goes further for machine learning. A new self-assessment question asks how a firm ensures that AI tools used for fraud detection, customer verification or monitoring “are explainable, appropriately governed and subject to independent validation”. Under poor practice, the draft lists deploying “automated, AI-enabled or machine learning controls without understanding, oversight, testing or validation of how they operate”, including whether they stay “resilient to AI-enabled manipulation” over time.

The draft also adds a sixth item to the Guide’s list of fallacies about data loss and identity fraud: “Digital identification is foolproof.” Firms are told to consider “deepfakes, synthetic identities and AI-enabled spoofing”. For fraud victims, the link is onboarding: the draft fraud section already counts checks for “synthetic or counterfeit documentation” as good practice, so weak identity controls are treated as a fraud risk, not only a data security one.

None of this creates a new duty, and the FCA says it expects no significant costs, so it has not produced a cost-benefit analysis. The practical effect is on the evidence firms should be ready to produce. This follows the FCA’s good and poor practice examples on AI published on 19 October, which said firms are responsible for the AI systems they “develop, procure and deploy”. Japan is tightening identity checks in a different way: it will abolish photo-based remote ID checks for regulated businesses from April 2027, and one payment app is already moving to IC chip reading.

Firms, trade bodies and other interested parties can respond through the FCA’s online form or by email until 24 December. TSN follows UK and international rule-making on its AI Regulation hub.

TSN collects fraud-prevention and other public-interest technology stories on its Tech for Good hub and in its weekly Tech for Good roundup.

Sources

• Financial Conduct Authority, “CP26/38: Financial Crime Guide updates”, consultation page, 23 October 2026
• Financial Conduct Authority, “Consultation Paper CP26/38: Financial Crime Guide Updates” (PDF), October 2026

Related stories

• FCA Says Incident Reporting Must Cover AI Failures and Near-Misses
• AI Regulation: EU AI Act, UK Rules and US Moves | TSN Hub
• FCA Proposes DeFi Guidance and New Crypto Exclusions Before 2027 Regime
• PayPay Ends Photo ID Checks, Moves to IC Chip Reading Before 2027 Rule