Register scope: Every provision of the instruments listed is accounted for.
Full scope and limitations
Every provision of the instruments listed is accounted for. Each provision has a disposition (obligation mapped, contextual, outside scope, superseded, future or unresolved), and each mapped obligation has an independently reviewed plain-English explanation. FCA Handbook material (SYSC and the Financial Crime Guide) is copyright: the register shows a short excerpt of each provision with a link to the full text on the FCA Handbook. The Sanctions and Anti-Money Laundering Act 2018 is an enabling Act and places no duties on firms directly; the firm duties it enables are in the regulations made under it, such as the Money Laundering Regulations 2017 and the Russia (Sanctions) (EU Exit) Regulations 2019. For the Bribery Act 2010, the Criminal Finances Act 2017, the Economic Crime and Corporate Transparency Act 2023 and the Proceeds of Crime Act 2002, the register covers the sections named on each instrument, and every section in that range is accounted for. The failure-to-prevent offences are offences, not duties: the register records the offence as context and maps the prevention procedures defence as the control a firm builds. The Financial Crime Guide is covered in full: chapters 1 to 3 and chapters 4 to 8 with Annex 1. It is guidance, so a paragraph is recorded as an obligation only where its own text says what the FCA expects a firm to do; self-assessment questions, good and poor practice examples and case studies illustrate those expectations and are recorded as context. Each chapter names its own audience, and the register uses it: the insider dealing and market manipulation chapter, for example, applies only to banks and investment firms subject to SYSC 6.1.1R. One published table in the data security chapter (FCG 5.2.3A) heads its poor-practice list "Examples of good practice"; the explanation of that paragraph says which list is which. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), the UK’s new regime for cryptoassets, are covered in full. They come fully into force on 25 October 2027. Since 25 February 2026 they have been in force only so that the FCA can make rules, give guidance and directions, and so that firms can apply for permission for the new cryptoasset activities. Their firm duties are therefore recorded as future duties with their start date, so a firm can plan for them. These include the ban on public offers outside the listed exceptions, disclosure-document content, the insider dealing, unlawful disclosure and market manipulation prohibitions, systems to prevent and detect market abuse and to report suspicious orders, public disclosure of inside information, insider lists, information sharing, whistleblowing procedures, and the notification an authorised firm must give the FCA when acting as a cryptoasset exchange provider or custodian wallet provider. The transitional notifications are recorded the same way. FCA and Treasury powers are outside scope; the exceptions to the public-offer ban and the defences to compensation liability are context. Chapters 1 to 4 of the JMLSG Guidance Part I are also covered: senior management responsibility (1.1 to 1.65), internal controls (2.1 to 2.24), the nominated officer and MLRO (3.1 to 3.49) and the risk-based approach (4.1 to 4.82, without Annexes 4-I to 4-III), and the first part of Chapter 5 on customer due diligence (sections 5.1 and 5.2, and paragraphs 5.3.1 to 5.3.91 of section 5.3, which end with the standard identification requirement for private individuals; paragraphs 5.3.92 onwards and sections 5.4 to 5.7 are not yet covered). Where the Guidance repeats a duty it has already stated, the repeat is recorded as context pointing to the paragraph where the duty is recorded, so each duty is counted once. The Guidance is industry guidance approved by the Treasury, not law: a paragraph is recorded as an obligation only where it says what a firm should do, and where it restates a legal duty the register links it to the Money Laundering Regulations or SYSC provision that holds the duty itself. Its margin citations that point to provisions not yet in the register (for example parts of SYSC 24 and 25 on the Senior Managers and Certification Regime, and SUP 16.23 on the annual financial crime report) are listed on each paragraph. The register shows short excerpts of the Guidance with a link to the published text. Four further sanctions regimes are covered in full: the Counter-Terrorism (International Sanctions) (EU Exit) Regulations 2019, the ISIL (Da'esh) and Al-Qaida (United Nations Sanctions) (EU Exit) Regulations 2019, the Iran (Sanctions) Regulations 2023 and the Iran (Sanctions) (Nuclear) (EU Exit) Regulations 2019. In each, the asset freeze and the bans on making funds or economic resources available bind everyone, reach entities a designated person owns or controls, and list the specific exceptions and licences that relax them. Under the ISIL and Al-Qaida regime a person is designated automatically for as long as the UN list names them, with no UK decision. Each regime has its own duty on relevant firms to report designated persons and breaches to the Treasury, covering the persons designated under that regime. The two Iran instruments are in force side by side and do not overlap: the 2023 Regulations deal with human rights and hostile activity (internal repression goods, interception and monitoring, and goods of strategic concern such as drone components), and the Nuclear Regulations deal with proliferation (military, missile and nuclear goods, arrangements that let Iranian persons take part in uranium mining and related commercial activity, and the ban on providing specialised financial messaging services, which binds the messaging provider rather than a bank sending its own payments). The financial services, funds and brokering limbs of the trade bans are recorded as obligations; the powers of the Secretary of State, the Treasury and enforcement officers, and the duties of ship masters, port operators and exporters, are outside scope. The Democratic People's Republic of Korea (Sanctions) (EU Exit) Regulations 2019 are also covered in full. Besides the asset freeze, they place duties on UK credit and financial institutions, meaning any firm with FSMA permission and any money service business: not to open accounts, correspondent relationships, joint ventures or ownership interests with DPRK banks (including their branches and subsidiaries anywhere, and banks abroad that DPRK persons own or control), to close any that exist, not to open accounts for DPRK diplomatic missions, and not to transact with DPRK banks. Transfers of funds to or from the DPRK are banned apart from small listed payments. A Treasury licence relaxes the prohibitions, but the duty to close existing relationships is relaxed only by a Treasury direction. A relevant firm that suspects proliferation financing in its business with a DPRK bank must report it to the National Crime Agency and hold the related payments until it has instructions; that is separate from the usual report of designated persons to the Treasury. The finance of trade in the regime's many goods categories is caught by specific bans for military, dual-use and weapons-related items and for gold, precious metals and diamonds, and by a general ban on financing any other trade with the DPRK. The Republic of Belarus (Sanctions) (EU Exit) Regulations 2019 are covered in full. Besides the asset freeze, they ban dealing in new securities and money-market instruments issued by the Belarusian state and Belarus-connected companies, new loans to them, insurance and reinsurance for the Belarusian state, and reserve-management services for the National Bank and Ministry of Finance. The securities, loan and insurance bans reach companies through majority or full ownership, not through control. The finance and brokering bans in the trade rules cover nine of the twelve export categories (not banknotes, luxury goods or tobacco industry goods) and the Belarusian import goods other than arms. Banks and bureaux may not pay out or exchange sterling or EU banknotes for people connected with Belarus beyond a £10,000 traveller allowance, and may not buy Belarusian gold as principal. The duties on social media, internet access and app store providers to block designated persons, enforced by OFCOM, and the designated person's own duty to report its assets, are outside scope. Chapter 19 (Financial crime) of the FCA’s “Payment Services and Electronic Money - Our Approach” is also covered in full. It is the only chapter of that document about anti-money laundering, counter-terrorist financing or financial-crime controls; the chapter on operational and security risks deals with fraud and IT resilience and is not covered. The chapter is FCA guidance addressed to payment service providers and e-money issuers, including small payment and small e-money institutions. Where it restates a legal duty, such as the Money Laundering Regulations duties on policies and procedures and on appointing a compliance officer, the register links it to that provision rather than counting the duty again. Its own expectations are recorded as obligations: financial-crime systems and controls, the risk factors to weigh, risk-sensitive ongoing due diligence and acceptable-use policies, extra risk mitigation for merchant customers, regular review of anti-money laundering policies, managing the financial crime risk that comes from agents, distributors and outsourced providers, the knowledge, authority and resources of the compliance officer, and having regard to the FCA’s guidance on politically exposed persons. Its explanation of when required customer communications are not tipping off is recorded as context, and the FCA’s enforcement powers are outside scope.