All 400 wealth managers refresh KYC now, but 26% record no expected activity

The Financial Conduct Authority published its Wealth management survey report 2026 on 18 August. Every firm now says it refreshes its Know Your Client checks. A quarter still record nothing about how often a client is expected to transact, which is the baseline a refresh is measured against.

The short version

• The FCA's Wealth management survey report 2026, published 18 August 2026, draws on survey data from around 400 firms in a sector supporting 5.5 million retail clients and managing almost £1 trillion.
• All firms confirmed they refresh Know Your Client checks. In 2023/24, 8% said they did not refresh at all. The FCA calls this an improvement.
• Gaps in client data: 26% do not collect expected transaction frequency, 13% do not record expected investment amounts, around 10% do not verify source of wealth.
• Gaps in higher-risk checks: around 6% do not check for politically exposed persons and around 7% do not carry out sanctions screening. The FCA notes the second is a criminal offence to get wrong.
• The figures are self-reported. A stated gap is a floor. The FCA's own line: "These gaps matter."

Wealth management holds a trillion pounds for five million people, which is why the FCA calls financial crime central

The Financial Conduct Authority's Wealth management survey report 2026, published on 18 August 2026, covers firms that support more than 5.5 million retail clients and manage almost £1 trillion of assets. The report's financial crime section opens by stating that fighting financial crime is central to the FCA's strategy.

Wealth management, as the report uses the term, is discretionary portfolio management: a firm manages investments on a client's behalf. The clients are worth targeting. A discretionary or advisory client typically holds around £650,000 with the firm. In a sector where individual relationships are that large, the source of a client's money, and whether the client holds public office, are questions with real weight.

That is the reason the FCA asks about financial crime controls in a survey otherwise about portfolios and pricing. Lucy Castledine, the FCA's Director of Consumer Investments, writes in the report's foreword: "But growth must be matched by strong standards. Firms need clear governance, strong financial crime controls and they should provide fair value, effective support for clients as well as responsible use of technology, including AI."

The financial crime section is short, and the interesting thing about it is the shape of what it reports. The headline is progress. The detail underneath is a list of the inputs progress depends on, and how many firms do not have them.

Every firm surveyed now refreshes its KYC checks, up from 92% two years ago

In its 2026 survey the FCA says all firms confirmed they were refreshing Know Your Client checks, and more firms showed a risk-based approach driven by their client risk assessment. In the 2023/24 survey a small minority, 8%, said they did not refresh checks at all. The FCA describes the change as an improvement.

A refresh is a re-check of what a firm holds about an existing client: identity, address, risk rating, and whether anything material has changed. Regulation 28(11) of the Money Laundering Regulations 2017 requires ongoing monitoring of every business relationship, and the refresh is how most firms discharge the part of that duty that concerns records rather than transactions.

The FCA's qualification follows immediately: "Some firms do not refresh checks for higher-risk clients after a trigger event or at least once a year." The two conditions are the ones that matter most. A trigger event is something that should prompt a re-check, such as a change of ownership or an unusual instruction. A yearly floor for higher-risk clients is the same interval the European Union wrote into its anti-money laundering regulation, which we covered when AMLA published its draft guidelines on ongoing monitoring.

So the progress is real, and the report says so. What it does not say is that a refresh finds anything on its own. A refresh compares the client to what the firm expected. Whether the firm recorded an expectation is the next question the report answers.

A quarter of firms record nothing about what a client is expected to do

The FCA's 2026 wealth management survey found that 26% of firms do not collect expected transaction frequency and 13% do not record expected investment amounts. Around 10% do not verify source of wealth. Around 6% do not check whether clients are politically exposed persons, and around 7% do not carry out sanctions screening.

Expected activity is the baseline. When a client is taken on, a firm records how often it expects them to transact and roughly how much, and ongoing monitoring then consists of noticing when reality departs from that. Regulation 28(11)(a) puts it as scrutiny of transactions "to ensure that the transactions are consistent with the relevant person's knowledge of the customer, the customer's business and risk profile". A firm that has recorded no expected frequency has less knowledge to be consistent with.

The FCA's list, in its own words and order:

• 26% "do not collect expected transaction frequency"
• 13% "do not record expected investment amounts"
• Around 10% "do not verify source of wealth"
• Around 6% "do not check whether clients are politically exposed persons"
• Around 7% "do not carry out sanctions screening"
• An unquantified number "do not check adverse media, meaning negative public information that may point to higher risk"

The report draws its own conclusion in three words and then explains it: "These gaps matter. They make it harder to spot suspicious activity, identify higher-risk clients and meet legal duties."

The last of those three, legal duties, is the one that separates the items on the list from each other. Some are good practice. Some are the law.

Three of the gaps are statutory duties, and one is a criminal offence

Under the Money Laundering Regulations 2017, regulation 35 requires a relevant person to have systems to determine whether a customer or beneficial owner is a politically exposed person, and regulation 33 requires enhanced due diligence in higher-risk cases. The FCA's 2026 report states it is a criminal offence not to comply with a financial sanction without an OFSI licence.

A politically exposed person, or PEP, is someone in a prominent public role, along with their family and known close associates. Regulation 35(1) requires "appropriate risk-management systems and procedures to determine whether a customer or the beneficial owner of a customer is" one. Around 6% of surveyed firms told the FCA they do not check. That is a gap against a specific regulation rather than against guidance.

Source of wealth follows from the same regulation. Where a customer is a PEP, regulation 35(5)(b) requires the firm to "take adequate measures to establish the source of wealth and source of funds which are involved in the proposed business relationship or transactions with that person". Regulation 33 requires enhanced due diligence more generally in any case the firm has identified as high risk. Around 10% of firms do not verify source of wealth, and for any of those firms with a PEP on the books, that is the regulation 35 duty unmet.

Sanctions screening sits apart from the rest because of what failure costs. The other gaps are regulatory breaches, addressed through supervision. Dealing with a designated person's funds without a licence from the Office of Financial Sanctions Implementation is, in the FCA's words, "a criminal offence". Around 7% of firms do not screen. The week this was written, the National Crime Agency published its first nationwide alert on the A7 sanctions evasion network, describing shell companies built to reach the UK financial system. A firm that does not screen would not see a designated one.

Expected activity, by contrast, is not a term the regulations use. It is what regulation 28(11)'s ongoing monitoring duty compares transactions against. A firm without it is not in breach of a line in the statute. It is in a position where the duty it does have is harder to perform, which is the FCA's point.

It is a self-reported survey of around 400 firms, and the July review of 242 firms said similar things

The FCA's 2026 wealth management findings rest on survey data from around 400 firms, supported by regulatory returns and other FCA and public data. Firms report on their own controls, so a stated gap is a floor rather than a measured rate. A separate FCA review of 242 asset management firms, published 22 July 2026, reported gaps of a similar shape.

The caveat is the same one that applies to any questionnaire. A firm that tells its regulator it does not screen for sanctions is unlikely to be overstating the problem, so the percentages are best read as the minimum share of firms with each gap. The FCA does not describe the sample as random, and the report does not claim the figures for the sector as a whole.

The July publication is worth setting beside this one, because the two are easy to confuse and are not the same exercise. That one asked 242 asset management and alternatives firms, and we covered it when the FCA published its findings on private markets. This one asks around 400 firms in the wealth management portfolio, which serve retail clients directly. Different firms, differently worded questions.

Two figures nonetheless match. The July review reported 10% of firms with no source of wealth check on high-risk customers and 7% with no repeat sanctions, PEP or adverse media screening. The wealth survey reports around 10% and around 7% for source of wealth and sanctions screening. With different populations and different questions, that is a coincidence worth recording rather than a trend, and the FCA does not present it as one.

What the two reports share is a supervisor asking firms the same category of question in the same year and publishing what they said. The FCA closes the section by stating its intention: "We will continue to work with firms and partners to raise standards, tackle financial crime and build resilience."

Key takeaways

Every firm now refreshes.

All firms in the 2026 survey confirmed refreshing KYC checks, against 8% who did not in 2023/24.

A quarter have no expected-activity record.

26% do not collect expected transaction frequency and 13% do not record expected investment amounts, which is what ongoing monitoring compares against.

Two gaps are regulation 35 duties.

Around 6% do not check for PEPs and around 10% do not verify source of wealth.

One gap carries a criminal offence.

Around 7% do not screen for sanctions. The FCA states non-compliance without an OFSI licence is a criminal offence.

The figures are floors.

Self-reported by around 400 firms, not described as a random sample, and not the same exercise as the July 2026 review of 242 firms.

Using Didit for the gaps the FCA counted

Four of the FCA's six gaps are checks with a defined input and a defined output, which is the kind a firm can buy rather than build.

AML Screening at $0.20 per check covers the two regulation 35 gaps at once. It screens a client against politically exposed person lists and against sanctions lists, the checks that around 6% and around 7% of firms respectively told the FCA they do not run. Ongoing AML Monitoring at $0.07 per user per year is the "at least once a year" the FCA says some firms miss for higher-risk clients, re-running the screen so a client who becomes a PEP or a designated person after onboarding is caught. ID Verification at $0.15 per check is the refresh itself, where a firm re-verifies a document rather than relying on the one it holds. Transaction Monitoring at $0.02 per transaction is where an expected-activity record earns its place, since monitoring is a comparison against it. Current prices are on the pricing page.

Three limits. The FCA is assessing controls and governance, including whether a firm has recorded what it expects of a client and whether it acts on a trigger event; those are decisions inside the firm that no vendor makes. Setting a client's risk rating, and deciding what counts as expected for that client, stays with the firm and its money laundering reporting officer. And the figures above are self-reported to a regulator, so nothing here is a claim about any particular firm.

Frequently asked questions

What is the FCA Wealth management survey report 2026?

A report published by the Financial Conduct Authority on 18 August 2026, based on survey data from around 400 wealth management firms supported by regulatory returns and other FCA and public data. It covers discretionary portfolio management, a sector supporting more than 5.5 million retail clients and managing almost £1 trillion. Section 4 covers financial crime controls.

What financial crime gaps did the FCA find?

26% of firms do not collect expected transaction frequency, 13% do not record expected investment amounts, around 10% do not verify source of wealth, around 6% do not check whether clients are politically exposed persons, and around 7% do not carry out sanctions screening. Some firms do not check adverse media, and some do not refresh checks for higher-risk clients after a trigger event or at least once a year.

Did the FCA find any improvement?

Yes. All firms in the 2026 survey confirmed they were refreshing Know Your Client checks, with more firms showing a risk-based approach driven by their client risk assessment. In the 2023/24 survey, 8% of firms said they did not refresh checks at all.

Which of the gaps are legal duties?

Regulation 35 of the Money Laundering Regulations 2017 requires systems to determine whether a customer or beneficial owner is a politically exposed person, and for PEPs, adequate measures to establish source of wealth and source of funds. Regulation 33 requires enhanced due diligence in higher-risk cases. Regulation 28(11) requires ongoing monitoring that tests transactions against the firm's knowledge of the customer. The FCA states it is a criminal offence not to comply with a financial sanction without an OFSI licence or authorisation.

Is this the same as the FCA's July 2026 financial crime review?

No. The July 2026 publication covered 242 asset management and alternatives firms. The wealth management survey covers around 400 wealth management firms in the FCA's wealth portfolio. Both are self-reported, and both report some similar percentages, but the populations and questions differ.

Related reading

• FCA financial crime review: private markets — 242 asset management firms, the same year, the same kind of question.
• AMLR Article 26: how often must you recheck? — The EU's annual floor for higher-risk customers, and what triggers a review between.
• The UK's first A7 alert — Designated entities reaching UK beneficiaries through shell companies.
• Gambling Commission AML enforcement: Evolution — A risk assessment that was there and was not effective enough.

Sources

1. Wealth management survey report 2026 — Financial Conduct Authority · 18 August 2026 · every figure and quotation about the survey in this post
2. Money Laundering Regulations 2017, regulation 35 — legislation.gov.uk · politically exposed persons; source of wealth and source of funds at 35(5)(b)
3. Money Laundering Regulations 2017, regulation 33 — legislation.gov.uk · enhanced customer due diligence in higher-risk cases
4. Money Laundering Regulations 2017, regulation 28 — legislation.gov.uk · ongoing monitoring at 28(11)(a)

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit.

Last reviewed 1 Sep 2026 against the sources above