How do loans and leases launder money?
On 23 October 2026 the FCA said it had restricted six unregulated lenders, known as Annex 1 firms, over concerns about their AML policies, controls and procedures raised while it assessed their applications. The restrictions, imposed at each firm's request, limit new customers and new business, and all six also limit how the firm may take payments from existing customers. The FCA is still assessing replies from around 900 registered Annex 1 firms to an information request.
A loan can carry dirty money at two points. At payout, criminal money can pose as the lender's own capital: the UK's national risk assessment of 2025 found that "Criminals have set up bridging loan companies to launder their funds, issuing their criminal capital as bridging loans which are then repaid as legitimate investments" (para 3.97). At repayment, dirty money settles clean debt. In trade based schemes, a complicit importer can integrate the proceeds of crime "through structured repayments to the factor" (para 3.83).
So anti money laundering (AML) rules follow a loan past payout: AML in lending checks run from the application to the last repayment, refund or early settlement.
Which lenders must follow AML rules?
| Rulebook | Law (in force, November 2026) | Supervisor | Lenders caught | Not caught |
|---|---|---|---|---|
| FATF | FATF Recommendations, updated June 2026: Glossary, "financial institutions" items 2 and 3 | National authorities, assessed in mutual evaluations | Lending (consumer credit, mortgage credit, factoring, finance of commercial transactions); financial leasing | Financial leasing of consumer products (Glossary footnote 105) |
| EU | Directive (EU) 2015/849 art. 3(2)(a), as transposed, until 9 July 2027; Regulation (EU) 2024/1624 (AMLR) art. 2(1)(6) from 10 July 2027 | National supervisors; AMLA directly supervises selected institutions from 2028 | Lending and financial leasing; from 10 July 2027 also mortgage and consumer credit creditors (AMLR art. 2(1)(6)(g)) and credit intermediaries that hold the funds of a credit agreement (point (h)) | Credit intermediaries acting under the responsibility of a creditor or another intermediary (point (h)) |
| UK | Proceeds of Crime Act 2002 (POCA); MLR 2017 reg. 10, Sch. 2 points 2 and 3 | FCA (reg. 7(1)(a)): authorized lenders, and Annex 1 firms, which must be on the FCA's register (regs. 55, 56(5)) | Consumer credit, deferred payment credit (BNPL), asset finance, bridging and invoice finance lenders | A creditor whose only listed activity is fixed sum credit for its own services under a debtor creditor supplier agreement (Consumer Credit Act 1974 s. 12(a)), repaid within 12 months (reg. 10(3)(b)); operating leases (JMLSG Part II, 11.8) |
| US | Bank Secrecy Act, "loan or finance company" (31 U.S.C. 5312(a)(2)); 31 CFR 1010.100(lll), part 1029 | FinCEN; the IRS examines (31 CFR 1010.810(b)(8)) | Residential mortgage lenders and originators; banks that lend, under part 1020 | Consumer, auto, SME and BNPL lenders that are neither banks nor residential mortgage lenders: no AML program or SAR rule |
| Türkiye | Regulation on Measures art. 4(1)(ç), (ğ), (v), under Law No. 5549; Law No. 6361 | MASAK for AML; BDDK grants operating permits (Law No. 6361 art. 7) | Financing, factoring, financial leasing and savings finance companies | No activity carve out: obliged entities are listed by type |
| UAE | Cabinet Resolution No. 134 of 2025 (CR) art. 2, under Federal Decree by Law No. 10 of 2025; CBUAE Finance Companies Regulation (C 3/2023) | CBUAE | Lending, including consumer and mortgage loans and the purchase of debts; financial leasing; licensed finance companies (retail, mortgage and wholesale finance, including finance and operating leasing, art. 10.1); Restricted Licence Finance Companies (Short-Term Credit only, art. 28.3) | Financial leasing of consumer products (CR art. 2 item 3) |
Outside the US, every rulebook copies the FATF's two activities, lending and financial leasing, so the differences sit in the carve outs. The FATF and the UAE leave out financial leasing of consumer products. The UK leaves out one narrow kind of creditor, and the guidance of its Joint Money Laundering Steering Group (JMLSG) puts operating leases outside the regulations.
The US is the outlier. The Bank Secrecy Act lists "loan or finance company", but FinCEN's program and SAR rules cover only residential mortgage lenders and originators. A US consumer or BNPL lender that is not a bank still reports cash of more than $10,000 received in one transaction or related ones (31 CFR 1010.330).
Do BNPL and leasing firms have AML obligations?
In most markets, yes. The FCA began regulating deferred payment credit (DPC), third party buy now, pay later, on 15 July 2026. A DPC lender needs consumer credit authorization or a temporary permission and, as a lender, is a financial institution under MLR reg. 10(2)(a). The reg. 10(3)(b) carve out covers only a creditor whose sole listed activity is fixed sum credit for its own services, repaid within 12 months (Consumer Credit Act 1974 s. 12(a)); a DPC lender that finances goods, or pays a separate retailer, stays in scope.
In the EU, national laws under the second Consumer Credit Directive (CCD2) apply from 20 November 2026 (art. 48(1)). They cover third party buy now, pay later credit, because the art. 2(2)(h) exclusion for interest free deferred payment needs a supplier giving time to pay with no third party offering credit.
In the UAE, credit of up to 12 months for specified goods or services, with no interest, collateral lien or security deposit, is Short-Term Credit, and the Finance Companies Regulation makes the Restricted Licence Finance Companies that grant it comply with the AML law and report suspicious transactions (art. 28.3).
AML for leasing companies turns on the lease. Outside the US, finance leases of business assets are caught in every rulebook here; operating leases sit outside the UK regulations (JMLSG Part II, 11.8). In Türkiye the duty follows the company, whatever lease it writes.
AML requirements for lenders: which article sets each duty?
Eight duties make up AML for lenders. In the EU the 2015 directive sets them today and the AMLR takes over on 10 July 2027, so the EU cells give both.
| Duty (in force, November 2026) | EU | UK | US (31 CFR part 1029, residential mortgage lenders) | Türkiye (Regulation on Measures) | UAE |
|---|---|---|---|---|---|
| Customer due diligence trigger | Directive art. 11: relationship; occasional €15,000+; transfers of funds over €1,000; AMLR art. 19(1), (2) from 10 July 2027: occasional €10,000+; transfers of funds €1,000+ | MLR regs. 27, 28: relationship; occasional £12,000+, transfers over £800 (since 30 June 2026) | Program obtains "all relevant customer-related information" (1029.210(b)(1)); no CIP rule | Art. 5(1): relationship at any amount; single or linked transactions of 370,000 TL+; wires 30,000 TL+ | CR art. 7: any relationship; AED 55,000+ occasional transactions; AED 3,500+ occasional wires |
| Beneficial owner | More than 25% today (Directive art. 3(6)); 25% or more from 10 July 2027 (AMLR art. 52) | More than 25% (MLR reg. 5) | No owner rule in part 1029 | More than 25% (art. 17/A) | 25% or more (CR art. 10) |
| Politically exposed persons | Directive art. 20; AMLR art. 42 | MLR reg. 35 | No PEP rule in part 1029; risk based within the program | No PEP article in the Regulation | CR art. 16 |
| Ongoing monitoring | Directive art. 13(1)(d); AMLR art. 26 | MLR reg. 28(11) | Within the program (1029.210(b)(1)) | Art. 19(1) | CR art. 8 |
| Third party payments and early repayment | EBA guidelines 9.4, 9.6 (retail banks) | JMLSG Part II 11A.8 to 11A.10 (consumer credit), 11.10 to 11.12 (motor finance) | FFIEC Appendix F (bank examination guidance) | Art. 18: complex, unusually large, or no apparent reasonable legal and economic purpose | CR art. 8(1): monitoring that looks at source of funds where necessary |
| Suspicious transaction report | Promptly, attempted transactions included (Directive art. 33; AMLR art. 69 from 10 July 2027) | POCA s. 330, s. 331: as soon as is practicable | Conducted or attempted, involving or aggregating at least $5,000: 30 calendar days from detection, at most 60 if no suspect (1029.320(a)(2), (b)(3)) | Within 10 business days of suspicion (art. 28(2)) | Immediately and without delay, any value (CR art. 18(1)(a)); finance companies "in a timely manner" (Finance Companies Regulation 15.31) |
| Records | AMLR art. 77 and Directive art. 40: 5 years | MLR reg. 40: 5 years | SAR and supporting documents, 5 years from filing (1029.320(c)) | 8 years (art. 46) | At least 5 years (CR art. 25(1)) |
| Program and officer | Policies and controls, with a management member answerable (Directive arts. 8, 46(4); AMLR arts. 9, 11) | Policies, controls and internal controls (MLR regs. 19, 21) | Written program approved by senior management, compliance officer, training, independent testing (1029.210) | Compliance Program Regulation (2008) | Compliance officer reporting to the board each quarter; board approved compliance policy (Finance Companies Regulation 15.29, 15.30) |
Two rows set lending apart. SME borrowers, guarantors and lessees are often companies, and the owner line differs between rulebooks, so the onboarding file should hold the exact beneficial owner percentage: a stake of exactly 25 percent passes the AMLR and UAE test and fails the UK, Türkiye and 2015 directive test.
In the third party row, the EBA's retail bank guidelines and the JMLSG both treat repayments from unrelated payers and repayment ahead of schedule as risk factors, though the JMLSG rates the inherent risk of consumer credit low (11A.9). In the US, only residential mortgage lenders and originators run a part 1029 program; lending banks follow part 1020.
When is a lender's suspicious transaction report due?
The EU's word is "promptly" (Directive art. 33, kept in AMLR art. 69); the UK's is "as soon as is practicable". A UK lender that wants to go ahead with a suspect transaction, such as an early settlement, can ask the NCA for consent, a defence against money laundering (DAML). No refusal within seven working days counts as consent, and a refusal opens a 31 day moratorium that a court may extend (POCA s. 335, s. 336A). A US residential mortgage lender has 30 calendar days from initial detection, 60 at most when no suspect is identified.
Türkiye's deadline is 10 business days after suspicion arises; the UAE's is "immediately and without delay". Because each clock starts at a different moment, a lender's suspicious activity report file needs three dates: alert, decision, filing.
What warning signs point to laundering through a loan?
Twelve signals cover the life of a loan. Five come from the EBA's guidelines for retail banks, the JMLSG and the UK risk assessment, six from the lending list in Appendix F of the FFIEC BSA/AML Examination Manual and one from Cifas. Most fire after payout, so a lender that monitors only applications misses them. The EBA guidelines call such factors ones that "may contribute to increasing risk".
| # | Signal | What it looks like | Source |
|---|---|---|---|
| 1 | Accelerated repayment | Lump sums or early termination, unexpected and without reasonable explanation | EBA 9.6; JMLSG 11.10, 11A.8 |
| 2 | Unknown payer | Repayments from third parties neither associated with the loan nor identified upfront | EBA 9.4; JMLSG 11A.10 |
| 3 | Refund to a stranger | An overpayment, then a request to refund it to someone other than the customer named on the agreement | JMLSG 11.11, 11A.9 |
| 4 | Pledged assets of others | Loan secured by pledged assets held by third parties unrelated to the borrower | FFIEC Appendix F |
| 5 | Borrowed collateral | Loan secured by deposits or securities, particularly when apparently unrelated third parties own them | FFIEC Appendix F |
| 6 | Cash secured default | Borrower defaults on a cash secured loan, or one secured by assets readily convertible into currency | FFIEC Appendix F |
| 7 | Loan for someone else | Loan made for, or paid on behalf of, a third party with no reasonable explanation | FFIEC Appendix F |
| 8 | Collateral of unknown origin | A certificate of deposit bought with funds of unknown source, often cash or several monetary instruments, to secure the loan | FFIEC Appendix F |
| 9 | Foreign collateral | Lending secured on assets in another jurisdiction where the customer's title or the guarantors are hard to verify | EBA 9.4 |
| 10 | No business purpose | Loan with no legitimate business purpose, or sold at once to a party related to the borrower | FFIEC Appendix F |
| 11 | Paper invoices | Invoice finance against invoices with no movement of goods or services, or with overstated values (trade based money laundering) | JMLSG 21.12; UK NRA 3.83 |
| 12 | No intent to repay | Loan, asset or credit card applications made with no intent to repay | Cifas Fraudscape 2026 |
Where do first party fraud, loan stacking and early repayment meet money laundering?
Picture an SME lender (illustrative) that advances £150,000 over three years to a company formed six months earlier. In month four the loan is settled in full from the account of a company the lender has never seen, and a week later the borrower asks for an £8,000 overpayment to go to a third account. The loan fraud team sees an early payoff; the AML team should see flags 1, 2 and 3.
When does first party fraud become money laundering?
When the borrower never meant to repay, the loan money itself can become criminal property. Cifas recorded 106,497 misuse of facility cases on the UK's National Fraud Database in 2025, up 43 percent and mostly bank account misuse, and evasion of payment up 22 percent, "linked to high volumes of loan, asset, and credit card applications with no intent to repay" (Fraudscape 2026).
Under POCA s. 340(3), property is criminal property if it constitutes or represents a person's benefit from criminal conduct and the alleged offender knows or suspects that it does. Fraudulently obtained loan money can be that benefit; once it moves on, for example through money mules, a UK lender in the regulated sector weighs a report under s. 330.
What is loan stacking?
Loan stacking means borrowing from several lenders within days, so that none of them sees the other loans in a credit file before paying out. Neither the regulators cited above nor Cifas publish a stacking figure. What a lender can see is a cluster of new credit searches, linked applications and fast outflows after payout.
Why is an early repayment or a refund a money laundering risk?
Because the money that settles a loan can be dirtier than the money that funded it. JMLSG guidance for consumer credit puts the main money laundering risks in "the acceleration of an agreed repayment schedule, either by means of lump sum repayments, or early termination or settlement" (11A.8), and notes that lenders normally refund an overpayment only to the customer named on the agreement (11A.9).
In the EU a consumer may repay early "at any time" (CCD2 art. 29(1)). So the lender asks where a lump sum or settlement came from, with a source of funds declaration, and reports when the answer does not hold.
Lender AML enforcement since 2024: who was fined or restricted, and why?
The table holds public actions since 2024 in which a supervisor named or described a lender or finance company and an AML failing. The list is partial: the Bank of Italy alone published at least three more AML sanctions on other intermediaries between July 2025 and February 2026.
| Date | Regulator | Lender | Outcome | Main finding |
|---|---|---|---|---|
| 11 December 2024 | FI (Sweden) | Klarna Bank AB | Remark and SEK 500 million | General risk assessment held no assessment of how its products and services could be used for laundering; due diligence procedures did not capture every situation for customers of the invoice product; period investigated 1 April 2021 to 31 March 2022 |
| 11 June 2025 | Bank of Italy | Elea Finance Spa (factoring and business loans) | €30,000 | AML organization and controls, particularly due diligence, customer profiling and active cooperation (d.lgs. 231/2007); inspection 31 January to 5 April 2024 |
| 21 April to 15 October 2026 (announced 23 October 2026) | FCA | Kingscrown Finance, MOMSB, Momentus Capital, Grosvenor Funding, Grosvenor Funding (North West), Abbital | Voluntary restrictions on new customers and new lending; limits on payments from existing customers; an independent AML review for five; an orderly wind down of Kingscrown's loan book | Concerns about AML policies, controls and procedures, raised while the FCA assessed their applications |
The FCA's six cases show a newer move: a supervisor that stops new lending, limits how repayments come in and, for five firms, orders an independent review. FinCEN's 12 enforcement actions from April 2023 to October 2026 name no loan or finance company, and no MASAK publication found names a fined lender. The missing US and Türkiye rows say nothing about how lenders there comply.
| Rulebook | Ceiling (in force, November 2026) | Basis |
|---|---|---|
| EU | From 10 July 2027, a maximum of at least €10,000,000 or 10% of turnover, whichever is higher; until then at least €5,000,000 or 10% of total annual turnover; both for serious, repeated or systematic breaches by a financial institution | Directive (EU) 2024/1640 art. 55(1), (3)(a); Directive 2015/849 art. 59(1), (3)(a) |
| UK | MLR civil penalty: no stated maximum, the supervisor sets the amount it considers appropriate (reg. 76); criminal MLR breach: a fine, up to 2 years in prison on indictment, or both (reg. 86); failing to disclose: a fine, up to 5 years in prison on indictment, or both | MLR regs. 76, 86; POCA ss. 330 to 332, 334 |
| US | Criminal, willful: up to $250,000, 5 years or both; up to $500,000, 10 years or both where the violation comes with another federal crime or is part of illegal activity totaling more than $100,000 over 12 months. Civil, willful, per violation: the greater of $71,545 or the amount involved, capped at $286,184 (inflation adjusted, 17 January 2025) | 31 U.S.C. 5322, 5321(a)(1); 31 CFR 1010.821 |
| Türkiye | 2026 amounts, doubled for financing, factoring and financial leasing companies and moneylenders: 948,158 TL for each STR breach and 568,898 TL for each identification breach, never under 5% of the transaction. Annual cap per obligation: 379,271,547 TL, itself doubled in the year after a capped fine for the same kind of breach | Law No. 5549 art. 13(1), (5); MASAK 2026 table |
| UAE | Per violation, a fine of AED 10,000 to AED 5,000,000, with warnings, sector bans, suspension or license revocation also open to the supervisor, unless another law sets a more severe sanction | Art. 17(1), Federal Decree by Law No. 10 of 2025 |
What did 2025 and 2026 change for lenders, and what starts in 2027?
- 17 July 2025. The UK's national risk assessment names bridging loan companies set up to launder.
- 14 December 2025. Cabinet Resolution No. 134 of 2025, the UAE's executive regulation, enters into force (published 14 November 2025; art. 71).
- December 2025. The JMLSG updates Part II, its sector guidance.
- 11 February 2026. The FCA publishes its final rules for deferred payment credit (PS26/1).
- 30 June 2026. Most of the UK's S.I. 2026/621 takes effect, including the £12,000 occasional transaction line (MLR reg. 27(2)).
- 15 July 2026. UK deferred payment credit becomes regulated lending.
- 7 October 2026. Presidential Decision No. 11845 doubles Türkiye's identification thresholds to 370,000 TL, and 30,000 TL for wires (Regulation art. 5(1)).
- 23 October 2026. The FCA announces restrictions on six Annex 1 lenders.
Next: CCD2 national laws apply from 20 November 2026, third party buy now, pay later included. The AMLR applies from 10 July 2027 and names creditors directly (art. 2(1)(6)(g)); AMLA's direct supervision of selected institutions begins in 2028.
Lender AML program checklist for 2026: what goes on it?
Thirteen lines, each tied to the rule behind it. Where complead, formerly Sanction Scanner, plays no part, the last column says so: the risk assessment, the register entry, refund decisions and collateral checks are the lender's own work.
| Line | Source | How complead covers it |
|---|---|---|
| Business wide risk assessment that names each credit product | Directive art. 8(1); AMLR art. 10; MLR reg. 18; FI on Klarna | Outside the platform; detection rules can then be scoped per product, segment or jurisdiction |
| Registration or license confirmed | MLR regs. 55, 56(5) (Annex 1); Law No. 6361 art. 7; CBUAE license | Outside the platform |
| Borrower, owner and guarantor due diligence before payout | Table 2 | KYB and UBO verification checks the company against official registers, then follows its owners up the chain to natural persons; layers it cannot resolve are reported as such |
| Screening at onboarding and through the term | FATF R.12, R.6 | 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes |
| Payer checked on every repayment | EBA 9.4; JMLSG 11A.10 | Payment screening runs on each transfer through the API, checking both payer and payee while it is processed |
| Source of funds on lump sums and early settlement | EBA 9.6; JMLSG 11A.8 | Outside the platform for the declaration; repayment rules need no code and can be backtested against 30, 60 or 90 days of history before release |
| Refunds only to the named customer | JMLSG 11.11, 11A.9 | Outside the platform |
| Collateral origin checked | FFIEC Appendix F | Outside the platform |
| Invoice and goods checks for factoring | JMLSG 21.12 | Outside the platform; debtors and clients are screened like any other party |
| Fraud and AML signals on one record | Cifas Fraudscape 2026 | Onboarding, screening, monitoring, fraud and investigation share one engine |
| Report clock tracked per jurisdiction | Table 2 | Each alert names the rule that fired and the signals behind it; reporting support within case management |
| Records kept for 5 years, or 8 in Türkiye | Regulation art. 46; MLR reg. 40; Directive art. 40; AMLR art. 77; 31 CFR 1029.320(c) | Every screening search stays on record: who ran it, for what name, when, and what came back, no match results included |
| DPC, CCD2 and AMLR dates in the change log | FCA PS26/1; CCD2 art. 48; AMLR art. 90 | Rule changes are versioned, recording who changed what, when and why, with a one click rollback |
Which parts of the checklist can complead run?
complead puts a borrower's onboarding, screening, monitoring, fraud checks and investigation on one engine, so the borrower carries a single risk score rather than one per tool. Its AML for lenders and lessors setup runs beside a lender's current tool.
Client screening and ongoing monitoring checks borrowers against the OFAC, EU, UN, UK (HMT), DFAT and SECO lists plus 200+ national regimes, and an API trigger stops screening a name once its loan is repaid. In transaction monitoring, agents close routine repayment alerts and attach the evidence, a narrative and the work log.
Fraud prevention runs on the same engine, so first party fraud signals count toward the same risk score. Each alert shows which rule fired; the MLRO decides what to file, and the case record names who decided.
Back to the FCA's six lenders: all six now have limits on accepting payments from existing customers, and five must commission an independent review of their AML framework. A lender can run the same test on its own early settlements and refunds: who paid, from which account, and who checked.
What the 2026 PDF adds. The articles, thresholds and dates on this page were reread in the official texts and regulator pages on 4 November 2026. Four working templates come with the 2026 PDF in the side panel form: a repayment monitoring rule sheet (payer match, lump sum, early settlement, refund), a source of funds request for early settlement, an Annex 1 and license self check across the five jurisdictions, and a report clock card.
