Asset management and alternative firms’ financial crime controls: our findings

Some firms in our sample are exposed to heightened financial crime risks, especially those firms active in private markets. These risks are increased by features such as:

• complex ownership structures that can cross jurisdictions
• high-risk customers
• international fund flows

The data collected from our questionnaire indicated that firms active in private markets were more likely to exhibit these characteristics than firms undertaking other activities. 

Complex ownership

Customers with complex ownership structures present risks of illicit fund movement, sanctions evasion, and concealment of the origin of funds by obscuring the ultimate beneficial owner.  

When firms encounter complex ownership structures, strong due diligence processes are required to adequately establish ultimate beneficial ownership.  

We found:

• Around a fifth of firms active in private markets reported that over 30% of their customers use complex ownership structures.
• 85% of firms not active in private markets reported no customers using complex ownership structures.

High-risk customers

Politically exposed persons (PEPs) may present a higher risk of money laundering as their position may make them vulnerable to corruption. Firms should be able to identify PEPs and apply enhanced due diligence where appropriate. 

We found that 32% of firms active in private markets reported PEPs in their customer base, compared to 9% for firms not active in private markets.  

International transactions

International transactions can be used to move illicit funds across borders, obscuring the origins of wealth and to evade sanctions. Firms that facilitate them should assess and mitigate the associated money laundering and sanctions risks.

We found that 50% of firms reported over 60% of their customer base is domiciled overseas, with firms active in private markets more likely to engage in international fund transfers.

Most firms showed they understood legal and regulatory requirements through their control framework, but others appeared to underestimate their inherent financial crime risks, resulting in an informal approach to evaluating and managing them.  

In the sections below are examples of gaps we found, as well as instances of good practice:

• business-wide risk assessment
• customer risk assessment
• customer due diligence and enhanced due diligence
• ongoing monitoring
• screening
• governance
• training

In some instances, the findings were concerning and will require firms to review their financial crime frameworks to make sure they are adequately identifying, managing and mitigating the risk to which they are exposed.

Business wide risk assessment (BWRA)

We found just over a fifth of all firms had either not undertaken a BWRA or that it was incomplete.

We also found that some firms had completed a BWRA, but it was inadequate. For example, some didn’t fully consider the inherent financial crime risk from the firm’s activities.

It’s a legal requirement for firms to have a formal, up-to-date BWRA under Regulation 18 and 18A of the MLRs. It is a fundamental tool in a firm’s anti-money laundering (AML), terrorist financing (TF) and proliferation financing (PF) framework to identify and assess the inherent financial crime risks they face. This enables firms to assess the effectiveness of the systems and controls they have in place to mitigate these identified risks. Without robust systems and controls, firms could unknowingly facilitate financial crime.  

Firms should also read publications such as the 2025 National risk assessment (NRA) of money laundering and terrorist financing[8] and the 2021 NRA of proliferation financing[9] – and take account of findings that may affect their individual business risk assessment.

Good practice example

Customer due diligence (CDD) and enhanced due diligence (EDD)

Around 40% of firms told us that they outsource CDD and EDD checks, generally to compliance consultants and fund administrators.

We found that some firms with limited oversight of the work carried out by third parties couldn’t explain CDD/EDD processes or demonstrate that oversight of these activities was being conducted. 

Outsourcing activities is permitted, but firms remain fully responsible for compliance with the MLRs. Without adequate oversight and monitoring of outsourced CDD and EDD processes, firms won’t be able to demonstrate that they’re meeting obligations under Regulation 28 and 33 of the MLRs.

Poor practice examples

Ongoing monitoring

We found that most firms have implemented controls to monitor customer relationships, with over half undertaking periodic reviews, such as quarterly or annual refreshes, to support the effectiveness of ongoing due diligence.  

Over a quarter of responding firms indicated that they did not have a formal transaction monitoring process. Through interviews, we established that some of them undertake monitoring by way of manual review due to low transaction volumes. One or two individuals perform these manual reviews with no documented or defined triggers for identifying suspicious activity. We consider that this approach may affect how consistent and effective their monitoring is.

It’s a mandatory requirement under Regulation 28(11) of the MLRs that firms monitor a business relationship, including the scrutiny of transactions and customer relationships.

The absence of transaction monitoring controls increases the risk that firms may be used for illicit fund movement and that suspicious activity may go undetected.

If they fail to conduct ongoing monitoring of customer relationships, firms may be unable to identify changes in customer behaviour, or in complex ownership structures. They’ll equally be unable to assess whether a customer remains in risk appetite and whether they’re applying the correct level of due diligence.  

Good practice example

Screening

Among a small set of firms, we found weakness in their approach to screening customers for PEPs, sanctions and adverse media. 

Firms have a legal obligation under Regulation 35(1) of the MLRs to identify PEP customers and must also comply with UK sanctions requirements. If a firm does not conduct ongoing screening throughout the customer relationship, it may fail to identify significant risk factors. 

Poor practice example

Governance

Over half of the firms’ money laundering reporting officers (MLROs) reported that they worked part-time or had shared responsibilities. We found this was often commensurate with the size and nature of the business.  

However, more than a quarter of larger firms, with over £10bn in assets under management, also reported they had an MLRO who was part-time or had shared responsibilities. These firms are likely to have a wider customer base and potentially more complex activities.  

Larger firms should consider if their MLRO function is sufficient to ensure effective AML oversight and compliance. If not, it could potentially make them less able to respond to emerging financial crime risks.  

Although nearly all firms are collecting management information, only just over a third discuss AML risk regularly at governance forums. We were concerned about this as these forums should have sufficient management information to:

• Assess the adequacy of their financial crime systems.
• Address risks.
• Report to the Board to help with good decision-making. 

Good practice example

Training

The majority of firms provided some level of financial crime training to staff and most firms we interviewed undertook training on a regular or annual basis. The level of training varied from tailored to more generalised financial crime training.

Investing in regular staff training on financial crime helps ensure firms remain aware of legal and regulatory obligations, and that staff maintain a good overview and understanding of evolving financial crime risks. It also reinforces staff accountability for detecting and reporting financial crime concerns. 

Good practice example