HomeAboutRegulatoryAccountingDigitalRegistrationIndustriesInsightsContact Book Consultation
Global Regulatory Intelligence
Live data — updated July 2026

Four Regulators.
One expert team.

Current compliance intelligence across the FCA, HMRC, FINTRAC and AUSTRAC — the frameworks that matter most to UK, Canadian and Australian payment businesses and MSBs.

50,000+
Firms on FCA Register
~2,000
HMRC Supervised MSBs
C$176M
Largest FINTRAC Penalty
AUD 1.3B
Westpac AUSTRAC Fine
50
MSBs Revoked Q1 2026
FCA
UK
Financial Conduct Authority (FCA)
The UK's primary financial regulator, overseeing 50,000+ firms including Authorised Payment Institutions (APIs), Small Payment Institutions (SPIs), Electronic Money Institutions (EMIs), and cryptoasset businesses. The FCA is the sole authorisation gateway for payment services under the Payment Services Regulations 2017 (PSRs 2017).
fca.org.uk   Financial Services Register
Key statistics — 2025/2026
50,000+
Total firms on the Financial Services Register
~900+
Authorised Payment Institutions currently registered
~400+
Small Payment Institutions currently registered
1 in 5
API applications refused at the FCA gateway (2023–2026)
↑ up from 1 in 14 in 2021
3 months
FCA target for complete application assessment
Up to 12 months if incomplete on submission
4
FCA strategic priorities 2025–2030: fighting crime, supporting growth, helping consumers, smarter regulator
Critical 2026 developments
New Safeguarding Regime (PS25/12) — effective 7 May 2026
A CASS-style supplementary safeguarding regime now applies to all Authorised Payment Institutions and Authorised E-Money Institutions. Requirements include: daily reconciliation of customer funds, monthly safeguarding returns via RegData, annual independent safeguarding audit (for firms holding over £100,000 of relevant funds), and a formal resolution pack. SPIs are not mandatorily in scope but may opt in voluntarily.
PSR absorbed into FCA — April 2026
HM Treasury's April 2026 consolidation package merges the Payment Systems Regulator into the FCA. Firms that previously reported to both regulators will deal with a single point of contact. The FCA now holds PSR-equivalent powers over payment system operators, including the ability to designate payment systems, impose access requirements, and vary agreements.
Buy-Now-Pay-Later regulation — 15 July 2026
BNPL agreements enter the FCA's regulatory perimeter from 15 July 2026. Any lender entering a BNPL agreement from this date must be FCA-authorised or hold temporary permission. The new regime introduces Consumer Credit Act protections for BNPL customers for the first time.
Cryptoasset authorisation regime — live 2026
A comprehensive authorisation framework (not just registration) now applies to a wide range of crypto activities including stablecoin issuance, custody, arranging deals, and operating a trading platform. Overseas firms serving UK consumers directly or indirectly are in scope. The FCA consulted on Part 2 of the Handbook for regulated cryptoasset activities in January 2026.
Consumer Duty — ongoing priority
The FCA's March 2026 Payments Regulatory Priorities letter emphasises Consumer Duty implementation, open banking development, and enhanced payments firm supervision. The FCA has stated that firms demonstrably doing the right thing will face less intensive supervision; those not will face faster enforcement action.
Provisional Authorisation Regime (PAR) — announced December 2025
HM Treasury plans a new Provisional Licences Authorisation Regime for early-stage firms, allowing them to begin building regulated operations before full FCA authorisation is granted. Final legislation and implementation date to be confirmed.
APP fraud reimbursement review — 2026/27
Mandatory reimbursement under Specific Direction 20 returned £173 million to APP fraud victims in its first year. An independent review of the £85,000 cap, the 50/50 split between sending and receiving PSPs, and the consumer-caution exception is underway, with findings due during 2026/27.
SPI vs API — key differences at a glance
Small Payment Institution (SPI)
  • Registration process — lighter-touch assessment
  • No fixed minimum initial capital requirement
  • Monthly transaction cap: €3,000,000 (rolling 12-month average)
  • Cannot provide payment initiation services (PIS) or account information services (AIS)
  • Not mandatorily in scope of PS25/12 safeguarding regime
  • FCA target: 3 months (complete application)
Authorised Payment Institution (API)
  • Full FCA authorisation — assessed against six criteria
  • Minimum capital: £20,000 (remittance only) to £125,000 (execution of payment transactions)
  • No transaction volume cap
  • Full Schedule 1 permissions available including PIS and AIS
  • Mandatorily subject to PS25/12 safeguarding regime from 7 May 2026
  • Typical market: 6–10 months end-to-end

Need FCA SPI or API authorisation support?

ZEM Global prepares end-to-end FCA applications — business plans, AML frameworks, individual registrations, and Connect submissions — led personally by Tahreem Waseem, CEO & Director (CA ICAP, FCCA).
Get in touch
HMRC
MSB
HMRC — Money Service Business Supervision
HMRC is the supervisory authority for UK Money Service Businesses (MSBs) that are not regulated by the FCA, under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLRs 2017). HMRC maintains the Supervised Business Register and ensures MSBs comply with their AML/CTF obligations.
HMRC Supervised Business Register   HMRC website
Key statistics
~2,000
MSBs on HMRC's Supervised Business Register (approx.)
~1,000
Non-bank money remitters in the UK — more than France, Germany, Italy, Netherlands and Spain combined
£1.5B+
Criminal proceeds laundered through UK MSB remittances annually (NCA estimate)
↑ NCA assesses actual figure is likely significantly higher
MLR100
Required registration form — one per MSB premises
MLR101
Fit and proper test form for all beneficial owners, officers and managers (BOOMs)
1 Jul 2026
HMRC's Supervised Business Register last updated — register is actively maintained
Who must register with HMRC
Money transmitters
Businesses that transfer money on behalf of customers, including remittance companies sending funds cross-border. This is the largest single category of HMRC-supervised MSBs in the UK.
Currency exchange providers
Businesses exchanging one currency for another, including bureaux de change operating at physical premises and online foreign exchange platforms where FCA authorisation is not held.
Cheque cashers
Businesses that cash cheques, postal orders, travellers cheques, or similar instruments for customers, whether or not a fee is charged for this service.
Important — dual supervision rule
Some MSBs are supervised by the FCA (Authorised Payment Institutions and Small Payment Institutions) rather than HMRC. A business must register with HMRC only if it is not already FCA-regulated. The two supervision regimes are mutually exclusive. However, the HMRC MLR registration number must be referenced in any associated FCA application as confirmation of AML registration status.
Registration requirements and AML obligations

Registration process

  • Must register before commencing MSB activity — operating without registration is a criminal offence
  • Separate registration fee applies per business premises
  • Annual renewal fee on the anniversary of the registration date
  • All BOOMs must pass the HMRC fit and proper test — updated guidance published 12 February 2026
  • Any change in business details, ownership, or key personnel must be notified to HMRC promptly
  • HMRC can de-register where a BOOM fails the fit and proper test after initial registration

Ongoing AML/CTF obligations

  • Customer Due Diligence (CDD) — verify customer identity before processing transactions
  • Enhanced Due Diligence (EDD) — required for higher-risk customers, transactions, and relationships
  • Ongoing transaction monitoring — detect unusual activity and file SARs with the NCA where required
  • Record keeping — minimum 5 years from transaction date or end of customer relationship
  • Staff training — documented AML/CTF training for all relevant staff
  • Cooperate with HMRC supervisory visits — both scheduled and unannounced

Need HMRC MSB registration or AML compliance support?

ZEM Global prepares and submits HMRC MSB registration applications, AML policy frameworks, fit and proper test documentation, and manages HMRC correspondence.
Get in touch
FINTRAC
Canada
FINTRAC — Financial Transactions and Reports Analysis Centre of Canada
FINTRAC is Canada's financial intelligence unit and AML/CTF regulator under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). All MSBs and Foreign Money Service Businesses (FMSBs) directing services at Canadian residents must register with FINTRAC before operating. Registration is free but ongoing compliance obligations are comprehensive and strictly enforced.
FINTRAC MSB Registry   fintrac-canafe.gc.ca
Enforcement statistics — 2024 to 2026
50
MSB registrations revoked in Q1 2026 alone
↑ 23 revoked on a single day — 24 March 2026
C$176.96M
Largest AMP ever issued — October 2024 (Vancouver crypto platform)
1,068 unreported STRs in a single month
30
Penalties imposed in 2025 — most active enforcement year in FINTRAC history
↑ up from 12 in 2024
C$20M
New maximum AMP per entity — Bill C-12 (Royal Assent 26 March 2026)
↑ 40x increase from previous C$500,000 cap
94%
Of Q1 2026 revoked entities had registered in 2021 — a deliberate enforcement targeting pattern
2 years
FINTRAC registration validity — renewal required every 2 years
Failure to renew = automatic expiry
2024–2026 enforcement timeline
October 2024
C$176.96 million record penalty
Largest AMP in FINTRAC history imposed on a Vancouver-based crypto platform. Violations included 1,068 unreported Suspicious Transaction Reports in one month, 1,518 missed Large Virtual Currency Transaction Reports, and 7,557 Iran-linked transfers unflagged despite a specific Ministerial Directive requiring exactly that.
April 2025
New AML obligations in force
New PCMLTFA amendments take effect, including expanded reporting and verification obligations for MSBs, title insurers, real estate professionals, and acquirers of private automated banking machines. MSBs must now verify agent eligibility and criminal records before engagement.
Full year 2025
30 penalties — record enforcement year
FINTRAC's most active enforcement year. Key sectors: MSBs, crypto/virtual currency platforms, and real estate. Individual penalties ranged from C$24,750 to C$224,235 for smaller entities; a foreign MSB received C$19.5 million for operating without FMSB registration.
January–March 2026
50 registrations revoked — coordinated Q1 enforcement wave
Two coordinated enforcement waves (11 revocations on 6 March; 22 on 16 March; 2 in January). 94% of revoked entities had registered in 2021 — primarily crypto and virtual currency businesses that had allowed their compliance programmes to deteriorate. The Canadian government confirmed in March 2026 that the pace will not slow.
26 March 2026
Bill C-12 — Royal Assent
Maximum Administrative Monetary Penalties rise from C$500,000 to C$20,000,000 per entity (a 40-fold increase), and to 3% of gross global revenue. Non-compliance is now vastly more expensive than the cost of maintaining a robust compliance programme.
October 2025 onwards
Agent verification — mandatory
MSBs must verify agent eligibility and obtain criminal record checks before engagement, and repeat every two years. MSBs that engaged agents before October 2025 must complete initial verification by October 2027. Non-compliance is a criminal offence — fines up to C$500,000 or imprisonment up to 5 years on indictment.
Eight baseline compliance requirements — what FINTRAC expects
Active, current registration
Up-to-date ownership, services, contacts, and addresses on file at all times. Stale registration details are a standalone ground for revocation — FINTRAC has acted on this alone, separately from any substantive compliance failure.
A real Compliance Officer
Not a title held by someone whose primary role is elsewhere. A designated officer with genuine authority, current AML/CTF knowledge, and documented, active involvement in compliance oversight. FINTRAC probes this in examinations — a figurehead MLRO is insufficient.
A complete and documented AML programme
A written, risk-based compliance programme covering customer due diligence, ongoing monitoring, and staff training. The absence of an effective AML regime — not just inadequate policies but a functionally non-existent programme — was cited in multiple 2025 penalties.
Timely STR and LVCTR submission
Suspicious Transaction Reports and Large Virtual Currency Transaction Reports must be filed correctly and on time. The C$176.96M penalty included 1,068 unreported STRs in a single month — FINTRAC treats reporting failures as among the most serious compliance breaches.
Sanctions and Ministerial Directive compliance
MSBs must screen against Canadian and international sanctions lists and comply with any active Ministerial Directives. The failure to comply with the Iran Ministerial Directive contributed directly to the C$176.96M record penalty in October 2024.
Cooperation with FINTRAC — 30-day rule
MSBs must respond to FINTRAC clarification requests within 30 days. Failure to respond is itself grounds for revocation, completely separately from any underlying compliance issues — FINTRAC does not need to prove a substantive violation to revoke for non-cooperation.
Agent verification (mandatory from October 2025)
MSBs must verify agent eligibility and obtain criminal record checks before engagement, and repeat every two years while the agent relationship continues. For agents engaged before October 2025, initial verification must be complete by October 2027.
Registration renewal — every 2 years
FINTRAC registrations expire automatically after 2 years if not renewed. The 2021 registration cohort — which was heavily targeted in Q1 2026 — had registered and then failed to maintain their compliance programmes in the years following initial registration, making renewal a compliance signal as much as an administrative step.

Navigating FINTRAC registration, renewal, or an enforcement response?

ZEM Global provides Canadian MSB registration support, AML/CTF compliance programme development, and cross-border advisory for UK–Canada payment corridors.
Get in touch
AUSTRAC
Australia
AUSTRAC — Australian Transaction Reports and Analysis Centre
AUSTRAC is both Australia's AML/CTF regulator and financial intelligence unit, supervising over 17,000 reporting entities. From 31 March 2026, the most significant reform of Australia's AML/CTF framework since 2006 took effect under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 — expanding AUSTRAC's scope, introducing a mandatory Travel Rule, and shifting to a risk-based outcomes model.
austrac.gov.au   Enforcement actions
Key statistics
17,000+
Reporting entities supervised by AUSTRAC
AUD 1.3B
Westpac penalty (2020) — largest civil penalty in Australian corporate history at the time
AUD 450M
Crown Resorts penalty (2023) for systemic AML/CTF failures across Melbourne and Perth properties
AUD 67M
SkyCity Adelaide penalty (2024) for systemic non-compliance
31 Mar 2026
Effective date — new AML/CTF Rules 2025 apply to all existing reporting entities
2026–2029
Tranche 2: lawyers, accountants and real estate agents to come within AUSTRAC's scope
AML/CTF Amendment Act 2024 — 2026 reform package
New AML/CTF Rules effective 31 March 2026
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 and new AML/CTF Rules 2025 took effect on 31 March 2026 — the most significant reform of Australia's AML/CTF framework since the Act's introduction in 2006. All existing reporting entities are subject to the new requirements from this date. Transitional rules provide staggered deadlines for some obligations where systems updates are needed.
Mandatory AML/CTF Compliance Officer — from 31 March 2026
All reporting entities must appoint a designated, fit and proper AML/CTF compliance officer responsible for implementing the AML/CTF programme. This is now an explicit legal requirement under the amended Act — not just regulatory best practice. Extended timeframes apply for notifying AUSTRAC of the appointment.
Travel Rule — mandatory from 31 March 2026
A mandatory Travel Rule now applies to all domestic and international value transfers. Remittance providers, virtual asset service providers, financial institutions, and some gambling and currency exchange providers must collect, verify, and pass on key identifying information about the parties to a transfer across the entire transfer chain. Businesses providing international value transfers involving virtual assets have until 31 March 2029 to transition.
Risk-based, outcomes-oriented approach replaces prescriptive model
The new framework fundamentally shifts from a compliance-based to a risk-based, outcomes-oriented approach. Firms no longer need to separate their AML/CTF programme into Part A and Part B. Compliance programmes must be proportionate to the actual ML/TF risks the business faces — more targeted, more flexible, but also more demanding of genuine risk analysis.
Virtual Asset Service Providers (VASPs) — automatic registration from 31 March 2026
Digital currency exchange providers automatically became registered as VASPs from 31 March 2026 — no separate re-registration required. VASPs remain among AUSTRAC's highest enforcement priorities in 2025–26. AUSTRAC's July 2025 regulatory priorities explicitly named the digital currency exchange sector as a focus, and this translated into multiple enforcement actions.
Annual compliance report cycle change
AUSTRAC's compliance reporting period is transitioning to financial years. The next reporting period runs from 1 July 2026 to 30 June 2027. Failure to submit compliance reports can result in enforcement action including remedial directions, infringement notices, and civil penalty applications — as demonstrated by the Castra (AUD 50,000) and Princeton (AUD 45,000) decisions in May 2026.
Tranche 2 expansion — 2026 to 2029
AUSTRAC's regulatory scope is being extended to cover "gatekeeper" professions — lawyers, accountants, real estate agents, and company service providers — a gap long criticised by the FATF. Tranche 2 reporting entities have staggered compliance deadlines. AUSTRAC will focus on education and outreach in the first year for newly regulated businesses.
Reporting obligations for remittance providers

Transaction reporting

  • Suspicious Matter Reports (SMRs) — mandatory whenever suspicion arises, regardless of transaction amount or value
  • Threshold Transaction Reports (TTRs) — required for cash transactions of AUD 10,000 or more
  • International Funds Transfer Instructions (IFTIs) — mandatory for all cross-border fund movements
  • Annual compliance report — next period: 1 July 2026 to 30 June 2027

AML/CTF programme requirements

  • Business-wide ML/TF risk assessment — proportionate to actual risk faced
  • Fit and proper AML/CTF Compliance Officer — mandatory from 31 March 2026
  • Customer due diligence (CDD) and ongoing monitoring
  • Staff AML/CTF training programme
  • Travel Rule compliance for all value transfers — from 31 March 2026
  • Independent effectiveness review — staggered deadlines for Tranche 2 entities
Selected major AUSTRAC enforcement actions
Entity Year Penalty (AUD) Key violations Sector
Westpac Banking Corporation 2020 AUD 1.3 billion 23 million+ transaction reporting breaches; failed to report international funds transfers; child exploitation transactions not identified Banking
Crown Melbourne & Crown Perth 2023 AUD 450 million Systemic AML/CTF programme failures; inadequate risk assessments of high-risk customers and junket operators; governance and culture failures Gaming
SkyCity Adelaide 2024 AUD 67 million Serious and systemic non-compliance with AML/CTF laws; inadequate controls Gaming
Entain Group 2024–ongoing Pending (filed December 2024) Alleged serious and systemic non-compliance with AML/CTF laws Gaming
Mount Pritchard & District Community Club 2025–ongoing Pending (filed July 2025) Alleged serious and systemic non-compliance Gaming
Castra 2026 AUD 50,000 + AUD 15,000 costs Failure to lodge annual compliance report for the 2023 calendar year Remittance
Princeton 2026 AUD 45,000 + AUD 5,000 costs Failure to lodge annual compliance report for the 2023 calendar year Remittance

Operating in Australia or expanding into the Asia-Pacific market?

ZEM Global provides AML/CTF advisory aligned to AUSTRAC's 2026 reformed framework, including Travel Rule implementation support and compliance programme development.
Get in touch

Content sourced from FCA, HMRC, FINTRAC and AUSTRAC — verified July 2026. For compliance advice specific to your business, contact ZEM Global Consultants Ltd.

Chat with us on WhatsApp