The Financial Conduct Authority has made two notable moves in August 2026 that could influence how financial firms manage regulation, technology and counterparty risk. On 6 August, the regulator launched an API for the FCA Handbook, allowing regulatory information to be accessed directly by software, while its work on Annex 1 firms has expanded to around 900 businesses as it examines financial-crime controls among unregulated lenders and other financial companies.
The developments come as lending becomes increasingly dependent on APIs, automated underwriting, open banking and digital distribution. Much of the technology used to originate and assess finance can now process information almost instantly, while regulatory monitoring and interpretation still involves substantial manual work. Providing structured access to FCA rules creates scope to automate parts of that process, while the regulator’s examination of Annex 1 firms increases the amount of information financial businesses may need to maintain about the lenders and counterparties they work with.
For SMEs, these changes will largely take place behind the application process. Their effects could nevertheless become visible through the way lenders and brokers classify customers, verify counterparties, monitor regulatory requirements and build compliance checks into increasingly automated finance platforms.
An Annex 1 firm is a business registered with the FCA for anti-money-laundering supervision under the Money Laundering Regulations without necessarily being fully FCA-authorised. Annex 1 firms can include certain unregulated lenders, money brokers, financial-leasing companies and safe-custody providers. Registration means the FCA supervises relevant AML obligations, but it does not provide the same regulatory status or customer protections as full FCA authorisation.
The FCA Handbook API is an application programming interface that provides structured, machine-readable access to FCA Handbook content. It allows financial firms, RegTech providers and other developers to connect FCA regulatory information with their own software, potentially supporting rule mapping, regulatory change monitoring, compliance workflows and AI tools using current FCA information.
Yes. Many legitimate forms of commercial lending fall outside the regulatory framework that applies to consumer credit, particularly where a limited company is borrowing for business purposes. Whether a lender or transaction requires FCA authorisation depends on the activities being undertaken and the circumstances of the agreement. Some unregulated lenders may separately require Annex 1 registration with the FCA for anti-money-laundering supervision.
The FCA Handbook becomes machine-readable infrastructure
The FCA Handbook contains the rules and guidance governing much of the UK’s regulated financial services industry. Compliance professionals use it to establish which requirements apply to products and activities before translating those requirements into internal policies, procedures and controls.
The Handbook API allows another computer system to retrieve FCA content programmatically. An API provides a controlled connection between software systems, allowing businesses to incorporate regulatory information into their own applications rather than depending entirely on employees searching the FCA website and maintaining separate copies of relevant material.
The API builds on a wider modernisation of the FCA Handbook’s underlying technology. Regulatory technology company FinRegE worked with the FCA on the redesigned Handbook infrastructure launched in 2025, including machine-readable regulatory libraries, rule mapping and change-tracking capabilities. The latest API makes that structured regulatory information more directly accessible to firms and technology providers building their own compliance systems.
The FCA has identified potential uses including real-time rule mapping, detecting regulatory changes, integrating requirements into compliance systems, supporting RegTech applications and supplying authoritative current information to artificial intelligence tools. Alex Smith, the FCA’s Head of Cross-cutting Policy & Strategy, said the API was intended to support “better, faster compliance decisions” as part of the regulator’s work to become smarter and make its rules easier to access and use.
A financial firm could maintain a system linking individual Handbook provisions to particular products, customer journeys or internal controls, allowing the relevant compliance team to identify affected processes when the underlying provision changes. Commercial finance businesses already collect information including the borrower’s legal status, purpose of borrowing, facility size and type of agreement, and some of those characteristics can affect the regulatory treatment of a transaction.
Software could identify combinations requiring additional assessment, direct an application into the appropriate workflow and maintain a record of the FCA provisions connected with that decision. A sole trader applying for finance, for example, may require a different regulatory assessment from a limited company borrowing for an equivalent commercial purpose, allowing technology to identify cases requiring additional scrutiny more consistently.
FCA rules interact with legislation, exemptions, definitions, guidance and the circumstances of individual transactions, preventing regulatory interpretation from being reduced to a straightforward software calculation. The API instead provides firms with an authoritative source of current regulatory information that can support internally defined compliance rules while retaining appropriate human oversight.
The Handbook API could accelerate the use of AI in compliance
Financial firms are already experimenting with generative AI across compliance, underwriting and operations, but regulatory work exposes one of the technology’s most significant limitations. A general-purpose AI model can draw upon historical regulations, commentary, superseded provisions and information from sources of varying authority, creating risks when an answer depends on the wording of a rule currently in force.
Direct access to FCA data offers a more controlled model in which AI can assist with retrieving and analysing regulatory information while the underlying source remains the regulator itself. Systems could retrieve relevant Handbook provisions, compare amendments, summarise regulatory changes or identify internal policies that may be affected by an updated rule, leaving compliance professionals responsible for reviewing the source and deciding what changes are necessary.
The approach could also improve auditability because businesses can record the rule used, the version in force, its effective date, the internal control associated with it and the person responsible for approving the firm’s interpretation. The FCA Handbook already contains version information and facilities for examining changes over time, while programmatic access makes it easier to incorporate those records into external compliance systems.
RegTech providers are likely to find uses for the API alongside financial institutions developing their own technology. Smaller firms could ultimately benefit from compliance capabilities that previously required significant internal development, particularly where software providers can incorporate FCA data into products used for regulatory monitoring, customer classification and control management.
FCA expands its examination of Annex 1 firms
The FCA is increasing its scrutiny of businesses registered with it solely for anti-money-laundering supervision under the Money Laundering Regulations. Around 1,200 businesses fall within this Annex 1 population, including certain unregulated lenders, money brokers, financial-leasing companies and safe-custody providers.
Annex 1 registration differs from full FCA authorisation because these firms can undertake activities that do not require conventional authorisation while remaining subject to FCA supervision for relevant anti-money-laundering obligations. They are not subject to the FCA’s wider rulebook in the same manner as fully authorised financial services firms, and registration should therefore not be interpreted as equivalent to FCA authorisation.
The regulator engaged with approximately 300 Annex 1 firms during late 2025 and has now sent information requests to around 900 more, meaning every registered Annex 1 firm will have been contacted. The FCA says the exercise is intended to improve its understanding of firms’ “activities, business models and risks”, with the resulting information used alongside other intelligence to identify and disrupt financial-crime risks.
Among the concerns identified by the FCA are businesses relying on the anti-money-laundering arrangements of a parent company without demonstrating that those controls adequately address the risks of the individual firm. The regulator has also warned against generic or off-the-shelf controls that fail to reflect the customers, transactions and financial-crime risks associated with the business actually being conducted.
Unregulated commercial lending remains a legitimate part of the market
The FCA’s scrutiny does not mean that unregulated commercial lending is inherently problematic. A substantial amount of UK corporate lending legitimately falls outside consumer-credit regulation, with the regulatory position depending on factors including the borrower, agreement and purpose of the transaction.
An unregulated commercial lender can therefore operate legitimately without requiring the consumer-credit permissions that might apply to another type of finance. Annex 1 creates a separate consideration because certain businesses operating outside full FCA authorisation are nevertheless required to register for anti-money-laundering supervision under the Money Laundering Regulations.
Accurate terminology is useful for SMEs comparing finance because FCA authorisation and Annex 1 registration confer different regulatory positions. Annex 1 firms are registered for AML supervision rather than authorised under the broader FCA regime, meaning customers should not assume that the wider protections associated with regulated financial services automatically apply.
The regulator has previously raised concerns about situations in which individuals may be encouraged to establish limited companies to obtain commercial finance that would otherwise fall within a different regulatory framework. Such cases are distinct from conventional corporate borrowing and demonstrate why the legal form of a borrower cannot always be considered independently of the substance and purpose of a transaction.
Regulated firms face greater expectations when dealing with Annex 1 businesses
The FCA expects regulated businesses dealing with Annex 1 firms to conduct appropriate due diligence rather than relying solely on information provided by the counterparty. Its guidance includes obtaining direct confirmation of registration status and independently verifying relevant information, increasing the importance of knowing the legal entity behind a lender or other financial business.
A lender’s trading name does not necessarily identify every entity involved in providing the finance. Modern credit structures can include operating companies, special purpose vehicles, warehouse facilities, investment funds and institutional partners, while forward-flow arrangements allow eligible loans originated by one business to be acquired by another investor.
These structures are widely used across established credit markets, particularly as specialist lenders seek access to institutional capital without funding every loan entirely from their own balance sheets. They can nevertheless create several layers between the brand interacting with a borrower and the entities originating, funding or ultimately holding the credit exposure.
Counterparty records may therefore need to capture the legal lending entity, trading name, Companies House number, FCA Firm Reference Number where applicable and Annex 1 registration where required. Firms may also need clarity over which organisation conducts customer due diligence, sanctions screening and politically exposed person checks, together with any arrangements under which one organisation relies on another to perform those functions.
For businesses maintaining large lender or introducer panels, maintaining this information informally becomes progressively harder as the number and complexity of relationships increase. Structured counterparty records allow regulatory status and AML responsibilities to be reviewed alongside the commercial information already held about each lender.
The regulatory position of business finance is rarely binary
SMEs can encounter regulated and unregulated finance products that appear broadly similar during an application, even though the regulatory treatment behind them differs. Limited companies borrowing for commercial purposes commonly use products outside consumer-credit regulation, while different considerations can apply to sole traders and certain partnerships depending on the agreement and circumstances.
The position can also differ between organisations participating in the same transaction. A broker may be FCA-authorised while distributing a product provided by a commercial lender that does not require equivalent authorisation, or the lender may require Annex 1 registration for AML supervision despite its lending activity sitting outside conventional consumer-credit regulation.
Alternative finance has increased the variety of institutions serving SMEs, with funding now provided by banks, specialist non-bank lenders, asset financiers, invoice finance companies, marketplace platforms, private credit funds and businesses supported by institutional warehouse facilities. Understanding the regulatory and legal identity of each provider becomes more important as finance moves between these organisations through digital distribution channels.
Automated lender matching increases the need for accurate counterparty information because software can potentially assess an application against dozens or hundreds of finance products within seconds. A platform needs an approved universe of lenders before automated systems begin routing customers, making legal entity information, regulatory status and AML checks part of the underlying data required to operate the technology.
Compliance systems are beginning to follow lending into the API economy
Technology has already changed much of the SME lending process. Open banking can provide transaction information without months of bank statements being manually reviewed, accounting integrations can supply financial data directly from business software, automated underwriting can perform initial eligibility assessments, and APIs allow information to move between brokers, lenders and platforms without repeatedly re-entering the same application.
Compliance processes have generally retained a greater degree of manual administration. Regulatory changes are reviewed by compliance teams, policies are updated in documents and operational employees are trained to recognise circumstances that require additional checks, creating a gap between increasingly automated lending infrastructure and the systems responsible for overseeing it.
Machine-readable FCA data gives developers an authoritative regulatory source around which more structured compliance workflows can be built. Firms could maintain links between Handbook provisions and particular customer journeys, automatically identify changes to those provisions and alert the people responsible for determining whether policies or controls need to be amended.
Transaction systems could also identify characteristics requiring further review, while counterparty databases could maintain regulatory and AML information alongside lender pricing, eligibility and product data. None of these applications removes the need for compliance professionals because judgement remains necessary wherever rules, exemptions or the regulatory perimeter require interpretation, but automation can reduce the administrative work involved in finding, recording and monitoring the information used to make those decisions.
What the FCA's changes could mean for SME finance
SMEs are unlikely to experience an immediate change when applying for business funding because most of the work prompted by these developments will occur within lenders, brokers, fintech platforms and compliance providers. Over time, better regulatory data could contribute to faster applications, more consistent checks and clearer records of the businesses involved in providing finance.
Borrowers should continue to establish the identity of the company providing finance, understand the agreement they are entering and check relevant regulatory information where appropriate. FCA authorisation cannot be used as a universal quality test for commercial lending because legitimate business finance frequently operates outside full FCA regulation, while the absence of authorisation should not prevent appropriate checks on the legal entity and its regulatory position.
The Handbook API gives financial businesses a direct route for bringing current FCA material into their technology, while the expanded examination of Annex 1 firms places greater emphasis on maintaining accurate information about counterparties and financial-crime controls. Both developments arrive as SME lending becomes more automated and increasingly dependent on information moving between multiple organisations.
The likely development is a closer connection between lending technology and the systems responsible for regulatory oversight. Financial businesses are gaining better tools for identifying relevant rules, maintaining regulatory records and detecting circumstances requiring review, allowing compliance infrastructure to develop alongside the automated credit and distribution systems already reshaping business finance.
