EFRI analysis. FCA Consultation Paper CP26/38, “Financial Crime Guide updates”, opened 23 October 2026; responses due 24 December 2026. On the proposed revision of Financial Crime Guide chapter 4 (“Fraud”), draft FCG 4.2.1A–4.2.1L and the deletion of FCG 4.2.5. Policy status checked as at 27 October 2026.
A regulator that treats rising fraud as a trigger to act
By the FCA’s own account, recorded investment-fraud cases rose 26% and losses 40% from 2024 to 2025 (UK Finance data, cited in the consultation’s Question 1). Everything the United Kingdom has built around online fraud over the last three years (mandatory reimbursement, platform duties, a corporate failure-to-prevent offence, and now this rewrite of its supervisory fraud guidance) tries to give a visible, escalating response to those curves.
That is the first thing worth saying plainly, because it is the point of contrast that matters: in the UK, rising fraud numbers produce concrete, operational, firm-facing measures; at EU level, existing instruments and pending reforms still fall short of a reimbursement model that puts victims first.
On 23 October 2026 the FCA opened CP26/38, proposing to rewrite chapter 4 of its Financial Crime Guide. The draft does three things that sit squarely on EFRI’s territory: it pushes fraud control upstream into onboarding, extends it to the receiving side of the crime, and makes the expectation of action on what a firm’s systems detect concrete, not merely the ownership of a monitoring tool. One concept threads through all three: customer vulnerability.
Chapter 4 of the Financial Crime Guide is the Fraud chapter. It is the part of the UK’s architecture that speaks to the everyday systems of individual payment firms: who they onboard, how they watch money arriving, what they do when an alert fires, and how they treat a customer who has been defrauded. That is precisely EFRI’s lane: the receiving account, the money-mule phase, and the victim’s access to redress. The rest of the Guide (and the wider UK response) is context; chapter 4 is where the operational expectations live, so it is where this piece concentrates.
The UK layer underneath everything
CP26/38 is another addition to a layered UK response to the growing scam epidemic: criminal law (the corporate failure to prevent fraud offence, ECCTA 2023, in force 1 September 2025, subject to the reasonable-prevention-procedures defence); platform duties (the Online Safety Act’s illegal-harms duties, in force 17 March 2025); payment controls and reimbursement (Confirmation of Payee across 99% of Faster Payments and CHAPS; the PSR 2017 reg. 86(2A)–(2D) power to delay a suspect outbound payment; and, since 7 October 2024, mandatory APP-scam reimbursement — within 5 (exceptionally 35) business days, cost split 50/50 between sending and receiving firm, up to £85,000); and a Fraud Strategy 2026–2029 committing over £250 million. The reimbursement regime is conditional: it covers qualifying domestic Faster Payments and CHAPS scams, not cryptoassets or cross-border transfers. But it is a working, liability-sharing rule with the receiving institution on the hook. CP26/38 addresses the systems beneath all of this.
Upstream, and on the receiving side
The draft treats onboarding, monitoring and reporting as one continuous system and insists it watch both directions of the money.
Onboarding must build a “holistic view” that gives “a meaningful basis for subsequent monitoring” (draft FCG 4.2.1J), not a box-ticking file. It contains two safeguards EFRI has long argued for. Firms should identify customer vulnerability and assess its effect on fraud risk at onboarding and throughout the relationship; and a historic marker in a fraud database should not trigger a blanket refusal without regard to the wider profile, because, as the draft expressly states, an “unknowingly involved money mule… will often have been deceived by fraudsters” (draft FCG 4.2.1I). The regulator writes the deceived mule into the guidance as a person to be assessed, not automatically excluded.
Monitoring must cover inbound as well as outbound flows (draft FCG 4.2.1, 4.2.1K). Its money-mule indicators are the receiving-side signature: unexpected deposits, rapid dispersal through networks of accounts (often within minutes of receipt), movement to international jurisdictions, dormant-account reactivation, and credential or device changes “potentially indicating that accounts have been sold after opening.” And it tells firms to look beyond the initial receiving account to linked accounts, the broader transaction context and the network. This is the exact anatomy of the receiving-side victim in EFRI’s casework, and of the payment-intermediary enabling that EFRI has documented for years in its money-laundering complaints against EU payment processors and e-money institutions. CP26/38 names, as poor practice, the precise blind spots that let that pattern run.
The heart of it: a duty to act, not a duty to own a system
The most important section is not about detection but about what follows it. A warning has no protective value if it reaches an institution and produces nothing. That is the proposition EFRI exists to press. The draft converts it into supervisory expectations (draft FCG 4.2.1K, 4.2.1L).
Alerts must be worked, not merely closed: investigation by trained staff, then appropriate interventions (proactive contact, the Banking Protocol, limiting activity, delaying payment where PSR reg. 86 conditions are met), with investigation records, and an explicit criticism of “inadequate feedback loops” where alerts close without assessing what must change in systems, rules or thresholds. Warnings must be “risk based, understandable, specific to the customer profile, and timely,” and firms must measure whether they work; a generic warning a customer clicks past is treated as a weak substitute for a considered response. Machine-learning tools do not discharge the duty: key staff must understand, test and integrate them. And intelligence must be acted on promptly: the reporting section marks as poor practice any firm that “fails to act appropriately, and in a timely manner, following… specific intelligence or alert information from… peers, law enforcement agency or other relevant authority,” and criticises delayed contribution of a firm’s own confirmed cases to shared databases. This is the exact gap EFRI was built to close: not the absence of intelligence, but intelligence that arrives and is not acted upon. Finally, monitoring should prevent re-victimisation, not cause it, and the draft names the conflict of interest in allocating account monitoring to staff incentivised to retain business.
Vulnerability: from warnings to the whole customer relationship
Customer vulnerability is the draft’s connective thread, and it is not decorative. At onboarding and throughout the customer relationship, draft FCG 4.2.1J identifies as good practice that firms, where there is reasonable opportunity to do so, identify vulnerabilities and assess whether they increase the risk of APP fraud. Becoming aware of vulnerability only after a fraud has occurred is marked as poor practice. The point is to recognise the risk early enough to change how the firm protects the customer.
During ongoing monitoring, draft FCG 4.2.1K calls for training and support so staff can recognise signs of vulnerability that increase fraud risk. For known victims, firms should consider whether enhanced monitoring, direct engagement or proportionate account restrictions are needed to reduce re-victimisation. EFRI’s point is that recognising vulnerability must change the institution’s response; a warning on a payment screen cannot carry that responsibility alone.
In customer care, draft FCG 4.2.1H expects accessible reporting and complaints channels, appropriate support for victims and compliance with existing reimbursement obligations. It criticises offboarding victims without exploring proportionate alternatives, including tailored controls and targeted support. The chapter connects these expectations with the Consumer Duty where applicable and the FCA’s finalised vulnerability guidance. Vulnerability also appears among the examples of relevant management information in draft FCG 4.2.1B. This is an operational thread across the customer relationship, not merely a communications exercise.
The EU comparison must recognise that Article 84 of the pending PSR compromise already addresses the needs of vulnerable customers in fraud warnings, while the EBA’s de-risking Guidelines address access to financial services. The FCA draft adds concrete fraud-specific examples across onboarding, monitoring and customer care. It is also guidance, not a new reimbursement statute. EFRI’s concern is how these protections translate into timely intervention, proportionate treatment and money returned to victims. Neither tailored warnings nor stronger monitoring alone delivers the reimbursement model EFRI demands.
The FCA’s fraud chapter versus the EU’s AML machinery (AMLA)
It is tempting to answer “but the EU has AMLA” — the new Authority for Anti-Money Laundering in Frankfurt, the Union’s flagship financial-crime body. The comparison is worth making precisely, because it reveals a category difference, not a near-equivalent.
CP26/38’s chapter 4 is a fraud-and-victim instrument: its purpose is to stop customers becoming victims, to stop firms being used to move proceeds, to protect the vulnerable, and to support victims rather than offboard them. AMLA is an anti-money-laundering compliance supervisor: it directly supervises selected high-risk obliged entities operating across several Member States, coordinates national supervisors and FIUs, harmonises AML/CFT standards, and can impose large pecuniary sanctions, and it begins direct supervision only in 2028. Its object is the integrity of the obliged entity’s AML controls and the reporting of suspicious flows; its subject is the firm’s compliance, not the fraud victim. Nothing in the AMLA/AMLR package asks a firm to identify customer vulnerability, to calibrate consumer warnings, to avoid offboarding a defrauded account-holder, or to reimburse anyone.
That difference is not academic, and EFRI’s own casework proves it: AML compliance can coexist with mass victim harm (the whole premise of EFRI’s money-laundering complaints against EU payment processors and EMIs), and the AML system’s characteristic reflex (freeze, report, de-risk the suspicious account) is exactly what falls on the receiving-side victim. The EU’s biggest new financial-crime authority polices the laundering of proceeds; it does not do, and is not designed to do, what the FCA proposes UK firms must do for fraud victims. No EU body holds that fraud-and-victim supervisory brief. Pointing to AMLA as the European answer confuses an AML compliance regime with fraud-victim protection — and that confusion is precisely how the impression arises that “the EU already has this covered.”
Do not offboard the victim — and the EU instruments, in their place
The draft gives customer treatment its own section and marks as poor practice firms that “offboard victims of fraud rather than exploring… proportionate… alternatives, such as enhanced monitoring, tailored controls or targeted support” (4.2.1H) — read with the anti-blanket-refusal safeguard (4.2.1J) and the re-victimisation point (4.2.1K). This is not an absolute ban on closure; the draft expressly allows risk-based restrictions and offboarding for suspected or confirmed mule activity. It is a supervisory expectation against making account closure the default response to victimisation. This is the clearest bridge to EFRI’s casework: the person defrauded, then used as a conduit, then de-banked and marked.
The EU is not inert, and fairness requires naming what exists, but the honest effect of listing it is to show that it is the wrong tool, unfinished, or overdue, not a working answer:
Verification of Payee runs into the sand. The Instant Payments Regulation ((EU) 2024/886) requires free name/IBAN matching for euro-area PSPs from 9 October 2025. But it protects the payer against a mismatch — and the receiving-side fraud it must catch increasingly uses virtual IBANs issued by EMIs in the victim’s own name. When the mule account genuinely bears the manipulated customer’s name, the check returns a match and reassures everyone, exactly as EFRI’s casework shows. VoP addresses misdirection; it is structurally blind to the conduit account in the victim’s own name.
The PSR strengthens controls. It still leaves victims fighting for reimbursement.
The pending PSR compromise contains substantive improvements. Article 83 strengthens monitoring on both the sending and receiving side, links failures to liability and reimbursement, and places the burden of proving compliance on PSPs. Article 83a(5) guards against account decisions based solely on unassessed information from other PSPs. Article 84 requires fraud warnings that consider vulnerable customers. These provisions deserve accurate recognition. PSR compromise text.
But, as EFRI explained in its analysis of enhanced transaction monitoring, stronger controls are not the same as reimbursement by default. The new burden-of-proof rules matter. They do not create a general refund right simply because a consumer was deceived into authorising a payment. EFRI’s concern remains that victims will face disputes over monitoring quality, the significance of accumulated warning signs and the point at which intervention became mandatory—with the relevant evidence held by the institutions they must challenge.
Article 84’s attention to vulnerable customers is welcome, but tailored warnings cannot substitute for an effective remedy after the money has gone. EFRI’s shared-liability proposal therefore demands a different starting point: reimbursement at the payer’s PSP, subject to narrowly defined exceptions, followed by recourse between the professional actors responsible for the failed safeguards. The victim should not have to reconstruct and litigate the entire payment chain to obtain redress.
Delayed implementation compounds the problem. Even after implementation, stronger monitoring duties alone will not deliver the victim-first reimbursement model EFRI demands.
AML and security law exist, but for other ends. Ongoing transaction-monitoring duties (AMLD) and fraud-detection requirements in the strong-customer-authentication framework are real, but they are AML-integrity and payment-security rules, not a fraud-victim supervisory standard connecting onboarding, inbound monitoring, intelligence and proportionate victim treatment.
The flagship has not arrived. The Commission’s Action Plan on fighting online fraud remains unpublished; its own initiative page still shows adoption as upcoming (a Q2 2026 indication), a date now passed. The instrument that could carry a proactive, victim-facing response is overdue.
As EFRI has argued, accountability can and should attach to the intermediary through which the money moved. The UK is now proposing to supervise for exactly that. The EU’s emerging framework still leaves victims fighting over whether an intermediary breached its duties.
Our Assessment
The strongest contribution of the proposed chapter is that it treats fraud control as one process and makes the expectation of action concrete: understand the customer, watch money in as well as out, work every alert to a conclusion and a lesson, act promptly on intelligence, protect the vulnerable, and support victims instead of offboarding them. Its recognition of the receiving side, of mule networks beyond the first account, and of the unwitting mule as a deceived victim is precisely aligned with online investment fraud as EFRI encounters it.
The proposed chapter has its limits. First, it is guidance, not rules (CP26/38, para. 1.5): it can expose weak controls, but publication alone does not change a firm’s conduct, trigger an investigation, or return a euro. Those depend on supervision, enforcement and a redress route behind the guidance, and as EFRI has put it, a fine without compensation is not justice; it is only a receipt issued to the regulator. Second, the deletion of FCG 4.2.5 risks losing investment-specific expertise; the FCA’s own Question 1 invites views, and EFRI will press, by 24 December 2026, for that detail to be retained and made explicit for prolonged, multi-payment, crypto-enabled investment scams and their mule phase.
The comparison is not flattering to Brussels. The FCA’s proposed fraud chapter addresses how financial institutions should prevent, detect and respond to fraud across the customer relationship. It connects onboarding, incoming and outgoing payment monitoring, action on fraud intelligence, the identification of mule networks and the treatment of victims. Vulnerability runs through onboarding, monitoring and customer care. The PSR’s payment-specific safeguards matter, but they do not provide the breadth and operational detail of this proposed supervisory response.
The Commission itself recognised the need for a broader European response. On 16 March 2026, Commissioner Brunner announced an EU action plan against digital fraud before summer. Yet in its strategy in combating trafficking in human beings published on 16 October, the Commission was still describing that plan as a future initiative. The promised comprehensive response is overdue.
That is the gap EFRI is pointing to: a coherent European response that connects prevention, intervention, supervision, investigation, victim support and recovery of funds. The PSR addresses parts of that problem. It cannot substitute for the action plan the Commission promised. While the FCA is consulting on concrete expectations for how financial institutions should confront fraud and treat its victims, Brussels still owes Europeans the wider response it announced.
Sourcing note: principal source FCA CP26/38, “Financial Crime Guide updates” (para. 1.5; chapter 2; Question 1; Appendix 1, proposed FCG chapter 4, in particular 4.2.1A–4.2.1L and the deletion of 4.2.5). EU instruments cited to their official texts; EFRI’s positions and prior reporting are its own. EFRI’s assessments and recommendations are identified separately from the FCA’s proposals. Status checked 27 October 2026.
