Fincrime Compliance Audits Reveal Rising Risks as Firms Struggle to Prove Control Effectiveness

Regulated fintechs are struggling to prove the effectiveness of financial crime controls as they scale, according to fscom’s 2026 fincrime compliance report. With audit findings increasing in both frequency and severity, the data suggests that established frameworks are failing to keep pace with jurisdictional expansion and technological complexity, creating significant regulatory risk for growing firms.

What was announced

The 2026 fincrime compliance report marks the tenth anniversary of the study by compliance maturity specialists fscom. The findings are based on 104 anti-money laundering (AML), counter-terrorist financing (CTF), and anti-financial crime (AFC) audits conducted between July 2025 and June 2026. This represents a significant increase from the 73 audits analyzed the previous year. The scope included e-money and payment institutions, merchant acquirers, investment and FX firms, cryptoasset firms, and money service businesses across the UK and 16 other jurisdictions.

The report identified 484 total findings, with the average number of findings per audit rising from 4.26 to 4.65. High-impact findings also saw an uptick, increasing from 1.01 to 1.14. A primary concern highlighted is the Whole Firm Risk Assessment (WFRA), which generated 64 findings; 20 of these related to firms treating the assessment as a static, annual exercise rather than a dynamic document that evolves with the firm's risk profile.

Operational failures were also prominent. Sixteen findings involved screening tool calibration—including systems failing to identify known sanctions matches—while 14 findings revealed compliance monitoring programs that failed to independently verify automated systems. Additionally, 15 findings addressed AML training assessments that allowed unlimited attempts, undermining the ability to prove genuine staff understanding. Multi-jurisdictional groups faced specific challenges, with recurring issues in periodic customer review backlogs and centrally set transaction monitoring rules that were not sufficiently tailored to individual entity risks.

"Most of the firms we audit have established financial crime frameworks in place. The next stage of maturity is being able to demonstrate that those controls continue to work effectively in practice."

Nicola Hanratty, UK Payments Specialist at fscom

The companies involved

fscom is a specialist consulting firm focused on compliance and regulatory requirements for the financial services sector. Based in the UK and Ireland, the company provides audit, advisory, and outsourced compliance services to a broad spectrum of fintechs, including payment service providers and cryptoasset firms. The firm is currently owned by Bridgepoint, a major private equity group, which acquired the business to support its international growth and service expansion.

The leadership team includes Co-Founder and Executive Director Philip Creed, alongside specialists like Nicola Hanratty and Stuart Smith, who focus on the UK and EU payment landscapes respectively. fscom has positioned itself as a key intermediary between regulated firms and supervisors, particularly as the UK and EU regulatory environments diverge and become more stringent. By focusing on compliance maturity, the firm aims to move clients beyond basic regulatory adherence toward robust, scalable operating models. This approach is particularly relevant for the diverse range of institutions—from merchant acquirers to FX firms—that now fall under the scrutiny of financial crime regulators across multiple jurisdictions.

What FF News has reported before

FF News has closely followed fscom’s growth and its insights into the evolving regulatory landscape. Recently, we covered how the fscom 10th Anniversary Report: Proving Control Effectiveness is the New Frontier in Financial Crime Compliance highlights the shift from design to operational proof. The firm has also been active in leadership changes, as seen when fscom Appoints Former PwC Partner Lynne Rainey as Executive Chair to Lead Strategic Growth. Earlier this year, we reported on the company’s technological expansion through the fscom Strengthens Compliance Offering with the Integration of ComplianceGuard. Furthermore, fscom’s data previously warned of industry-wide gaps, noting that 78% of Financial Firms Still Unprepared for New UK Payment Safeguarding Rules.

What this means

The rise in high-impact audit findings suggests that the "honeymoon period" for fintech compliance is over. Regulators are no longer satisfied with the existence of a policy; they demand proof of its performance. This puts immense pressure on mid-tier firms that have scaled rapidly but neglected to update their legacy screening and monitoring tools. The trend toward multi-jurisdictional findings also indicates that "copy-paste" compliance models are failing. Firms must now decide whether to invest heavily in bespoke local monitoring or risk group-wide contagion when a single entity fails an audit. The sector is moving toward a zero-tolerance environment for automated systems that lack independent oversight.