Financial Crime Controls in Private Fund Firms: The FCA’s Findings and What Private Fund Firms Should Do Now

Client Alert | July 28, 2026

On 22 July 2026 the Financial Conduct Authority (the FCA) published the findings of its latest review of financial crime systems and controls in the asset management and alternatives sector. The review is addressed to the sector as a whole, but its focus falls squarely on private markets. The FCA’s own data show that firms active in private markets, whether in private equity, private credit, infrastructure, real assets or secondaries, carry materially higher inherent financial crime risk than the rest of the sector. Those are the firms that attract the sharpest findings and the closest supervisory attention.

This note approaches the findings from a private markets perspective. It explains why the FCA treats private markets firms as the higher-risk cohort, where it found them falling short, and what managers of private capital should do in response. The review draws on engagement with 242 firms during 2025/26, 87% of which completed the FCA’s questionnaire, together with interviews of senior staff. The FCA has said it will use that data to decide where to direct its supervision.

Why this is aimed at private markets firms

None of this is new. The review delivers on a commitment the FCA gave in its February 2025 portfolio letter to the sector, in which it identified financial crime as an area for targeted work and said it would examine the effectiveness of firms’ systems and controls, with a supervisory focus on anti-money laundering controls in private markets funds. The letter stressed the identification of ultimate beneficial owners through proportionate, risk-based due diligence on investors. The July findings are the evidence behind that focus, and they bear out what the letter asserted: private markets is where both the inherent risk and the control weaknesses are concentrated.

The review is consistent with the FCA’s November 2025 multi-firm review of business-wide and customer risk assessment, and forms part of the financial crime workstream under the 2025–30 strategy. The common message is that risk assessments and controls must be built around the firm’s actual business. For a private markets manager that means built around complex ownership, cross-border fund flows and a high-risk investor base, not around a generic asset-manager template. Firms that set the portfolio letter aside as background reading now have a documented, data-backed gap to close, and they should assume the FCA will test their questionnaire answers against what it sees on a visit. Where those answers cannot be stood up, the firm has a candour problem on top of a control problem.

The inherent-risk profile of private markets

The FCA’s central point is that inherent financial crime risk varies widely across a sector of some 2,500 firms, and that private markets firms sit at the top of the range. Three features of private capital account for this.

Complex, multi-layered and cross-border ownership. Around a fifth of private markets firms reported that more than 30% of their customers use complex ownership structures. Among firms not active in private markets, 85% reported no such customers at all. Investor chains that run through feeder and parallel vehicles, aggregators, nominees, trusts, foundations and holding companies across several jurisdictions are ordinary in private markets, and they are the structures most often used to hide ultimate ownership, move illicit money and evade sanctions.

A high-risk investor base. Politically exposed persons appeared in the customer base of 32% of private markets firms, against 9% of the rest. That reflects an investor population that includes family offices, sovereign and quasi-sovereign money and high-net-worth individuals, for whom source of wealth and PEP status call for enhanced scrutiny.

International fund flows. Half of all firms reported that more than 60% of their investors are domiciled overseas, and private markets firms were the more likely to move money across borders, through capital calls, distributions, secondary transfers and co-investment flows that often touch several jurisdictions and third-party accounts.

A firm with this profile is expected to hold a framework built for it, as the MLRs and SYSC require. The striking part of the review is the gap between that risk and how firms have responded, shown most clearly by the 18% of private markets firms whose business-wide risk assessment did not specifically cover private-markets risk.

What the FCA measured, and against what

The FCA assessed controls against the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs), the Financial Crime Guide, the systems and controls provisions in SYSC, and JMLSG and FATF guidance. It looked at two questions: how well firms understand their inherent risk, and how well they identify, mitigate and manage it. The findings that matter most for private markets firms are set out below.

Where private markets firms fell short

The FCA grouped its findings under seven headings. Together they describe a sector in which most firms have the architecture of a financial crime framework, while a significant minority have gaps the FCA regards as serious.

Business-wide risk assessment (BWRA)

Just over a fifth of all firms had either not carried out a business-wide risk assessment or had one that was incomplete, and some had a BWRA that was inadequate because it failed to capture the inherent risk arising from the firm’s own activities. The private markets failure is pointed: 18% reported that their BWRA did not specifically cover private-markets risk. A current, formal BWRA is required by Regulations 18 and 18A of the MLRs and is the foundation for everything else, including the assessment of proliferation financing risk under Regulation 18A, which firms tend to overlook despite its obvious relevance to cross-border and sanctions-adjacent structures. The FCA expects the 2025 National Risk Assessment of money laundering and terrorist financing and the 2021 National Risk Assessment of proliferation financing to be reflected in a firm’s own work. The good practice it saw was straightforward: firms that ran and documented a regular review cycle, even where the platform was stable.

Investor (customer) risk assessment and beneficial ownership

This is the core private markets issue. 18% of firms had no formal customer risk assessment methodology, and a number of private markets firms had no process for verifying beneficial ownership within multi-layered or offshore structures, the very structures the inherent-risk data flag as the sector’s main vulnerability. Some firms with close relationships or a small investor base were relying on informal, real-time knowledge in place of a documented assessment. The FCA accepted the value of that knowledge, but was clear that it does not replace the formal assessment the MLRs require: without a risk assessment at onboarding, a firm cannot show compliance with Regulation 28(12) and (13). In practice this calls for a look-through, through feeder vehicles, nominee holdings and holding structures, to the individuals who ultimately own or control the investor, evidenced in a way that will withstand review.

Outsourced onboarding and administrator oversight

Around 40% of firms outsource part of their CDD and EDD. In private markets that usually means investor onboarding delegated to a fund administrator, often in the fund’s domicile, or to a compliance consultant. Yet only 36% of the firms that outsource had full oversight of the third party’s onboarding, and some could not describe the process at all. The FCA’s position here is well established, and readers will recognise it from its enforcement record: outsourcing the task does not outsource the responsibility. The manager or AIFM remains accountable under Regulations 28 and 33 whoever performs the work, and cannot evidence what it does not oversee. Administrator oversight should be run as a third-party and operational-resilience matter, with defined sampling, reporting and escalation, rather than treated as settled by the administration agreement. Separately, 10% of firms did not verify source of wealth for high-risk customers, a real exposure where investors are PEPs or high-net-worth individuals.

Ongoing monitoring, transfers and secondaries

Most firms monitor their relationships, and over half carry out periodic reviews, but more than a quarter, 29%, had no formal transaction monitoring, and 7% had no systematic post-onboarding monitoring of any kind. Private markets firms often justify a light or manual approach by pointing to low transaction volumes. That argument is hard to sustain once you look at the transactions that matter in private capital: capital calls and distributions routed through third-party accounts, redemptions, transfers of limited-partner interests and GP-led secondaries, each of them a recognised route for illicit funds and sanctions exposure. Where monitoring is manual, the FCA expects defined, documented triggers rather than the informal judgement of one or two people. Ongoing monitoring, including scrutiny of transactions, is mandatory under Regulation 28(11). More encouragingly, 84% of firms reviewed or audited their internal suspicious activity reports for quality.

Screening across the fund life

A minority of firms showed weaknesses in screening for PEPs, sanctions and adverse media, and 7% did not carry out repeat screening at all. Private markets funds are long-dated, often ten years or more, and an investor’s PEP or sanctions status can change over that life. Screening only at onboarding will not discharge the obligation to identify PEPs under Regulation 35(1) or the strict-liability, ongoing UK sanctions regime, and it must reach through ownership and control, applying OFSI’s 50%-and-control tests, rather than stopping at the named investor. That matters all the more given the volume of designations since 2022.

Governance and resourcing

The governance findings should give the boards and investment committees of larger platforms most pause. Over half of money laundering reporting officers (MLROs) worked part-time or in a shared role, which is often reasonable at a smaller firm. But more than a quarter of firms with over £10 billion under management also had a part-time or shared MLRO, despite wider investor bases and more complex activities. Almost all firms collect financial crime management information, yet only a little over a third discuss AML risk regularly at a governance forum, and 36% do so annually or less. Half of all firms had made no investment in remediation or systems uplift in the previous two years, and 18% had no formal quality assurance process. The contrast was firms that actually used their financial crime management information, which 88% did.

Placement agents and introducers

The review does not itself address fundraising intermediaries, but the point follows naturally from its findings and, in our view, belongs in any serious private markets analysis. Capital is routinely raised through placement agents and introducers who bring in limited partners for a fee. Those relationships carry both money-laundering and bribery risk, and the FCA has taken enforcement action against firms for poor oversight of introducers and finders. A manager’s financial crime framework should therefore extend to due diligence on its placement agents and introducers, a recorded commercial rationale for each relationship, appropriate contractual protections and continuing oversight, applying the same discipline the FCA expects for investor onboarding.

Training

Most firms train staff on financial crime, usually once a year, and the better examples tailor the content to the firm’s own risk and test it. The FCA still found MLROs who may not have been trained on their own legal responsibilities, and firms with little awareness of legal and guidance developments. In a private markets firm, training that does not reach the deal teams and investor-relations staff who first meet investors and counterparties is unlikely to be enough.

Our observations

Three points are worth drawing out for boards and senior managers.

The first is that this is as much a personal-accountability document as a systems one. The MLRO is a senior management function, SMF17, and the finding that a quarter of the largest platforms run it part-time or on shared responsibility raises the question whether the allocation holds up under the Senior Managers and Certification Regime, particularly where AML risk rarely reaches the board or the investment committee.

The second is that the FCA has told firms how it will use what it has gathered. It will work the questionnaire data to target its supervision and step in where firms fall short. The cost of leaving a gap unaddressed has gone up accordingly: a firm that sees a shortfall against these findings and does nothing is effectively on notice, and the FCA has in past enforcement cases treated a failure to act on its published findings as an aggravating factor.

The third is beneficial ownership, which runs through all of this. From the portfolio letter, through the November 2025 review, to these findings, the FCA keeps returning to the identification of ultimate beneficial owners in complex structures. For private markets firms it is the control most likely to draw scrutiny.

Non-UK-headquartered managers with a UK adviser or arranger

A common structure is a non-UK-headquartered manager whose UK presence is an FCA-authorised adviser or arranger. For those groups the starting question is one of scope. The main message for a non-UK group is not to run the UK entity off the global programme. The FCA’s recurring criticism, familiar from its enforcement record, is over-reliance on group policies that are not tailored to the UK firm’s own activities and legal obligations. A group that treats its UK adviser as an outpost of a non-UK compliance function, applying the global manual behind a UK cover page, is the case the FCA has in mind. The UK firm needs its own business-wide risk assessment built around its activities, a UK MLRO of adequate seniority, and its own governance and management information.

Where the investor relationship, the KYC and the money sit with the US manager, the fund and an administrator rather than the UK entity, the paper does not fall away; it changes where the risk lands. Reliance on a US affiliate or an administrator for customer due diligence is reliance under Regulation 39, or outsourcing under Regulations 28 and 33, and responsibility stays with the UK firm. The finding that 40% of firms outsource but only 36% have full oversight is the exposure in plain terms: a UK MLRO who cannot explain or evidence the affiliate’s onboarding, and simply trusts the non-UK process, has the gap the FCA is looking for. It also pays to be precise about who the UK entity’s customers actually are. An adviser to an affiliated manager may have a short list, its affiliate and perhaps a few counterparties; an arranger that touches transactions takes on counterparty due diligence and, importantly, UK sanctions exposure under the OFSI regime, which applies to the UK firm’s conduct independently of OFAC and on different tests. In every case the risk assessment has to be built around what the UK entity does, not lifted from a manager’s template.

What private markets firms should do now

We suggest firms treat the findings as a supervisory benchmark and work through the following, prioritising by inherent risk:

Re-read the questionnaire response. Retrieve what the firm told the FCA in 2025/26 and test whether it remains accurate and can be substantiated on a visit. Address any material divergence and consider whether a Principle 11 notification is warranted.
Make the BWRA a private-markets BWRA. Confirm it is current, formally approved and built around the firm’s real risk drivers, namely complex and cross-border ownership, PEP and high-risk investors, and international fund flows, and that it addresses proliferation financing under Regulation 18A. Reflect the 2025 NRA and the 2021 proliferation-financing NRA.
Fix beneficial-ownership look-through. Ensure a documented investor risk-assessment methodology is applied at onboarding and on review, and that ownership can be traced through feeders, nominees, trusts, foundations and multi-jurisdictional holding structures, not only simple direct holdings. Informal knowledge of the investor base is a complement, not a substitute.
Bring administrator and consultant onboarding under real oversight. Map every outsourced onboarding activity and satisfy the board that the firm exercises, and can evidence, enough oversight to demonstrate compliance with Regulations 28 and 33, with defined sampling, management information and escalation. Verify source of wealth for high-risk investors.
Monitor the transactions that matter. Do not rely on low volumes. Put documented triggers around capital calls, distributions, redemptions, transfers of interests and secondaries; where monitoring is manual, record the rationale and confirm it is defensible.
Screen across the whole fund life. Ensure PEP, sanctions and adverse-media screening is repeated over the life of long-dated funds and reaches through ownership and control, not only the named investor.
Extend the framework to placement agents and introducers. Apply due diligence, a recorded commercial rationale, contractual protections and continuing oversight to third-party fundraisers, viewed through both an AML and an anti-bribery-and-corruption lens.
Escalate financial crime to the board or investment committee and resource it. Make AML a standing agenda item supported by meaningful management information; review whether the MLRO’s seniority, time and resourcing match the platform’s scale and complexity, and record the rationale; revisit the case for systems and quality-assurance investment where there has been none.
For non-UK-headquartered groups, confirm the UK position on its own terms. Do not assume the global programme discharges the UK entity’s obligations. Confirm the UK firm’s status under the MLRs and the Handbook, its own BWRA and MLRO arrangements, and the oversight it exercises over any affiliate or administrator on which it relies.
Document the exercise. Record the firm’s consideration of the findings against its own model and the decisions taken, so that it can show the FCA it engaged.

The following Gibson Dunn lawyer prepared this update: Michelle Kirschner and Martin Coombes.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact the authors or any leader or member of Gibson Dunn’s Financial Regulatory practice group:

Michelle M. Kirschner – London (+44 20 7071 4212, mkirschner@gibsondunn.com)

Martin Coombes – London (+44 20 7071 4258, mcoombes@gibsondunn.com)

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

Financial Crime Controls in Private Fund Firms: The FCA’s Findings and What Private Fund Firms Should Do Now

Related Capabilities