Watchlist Management
The UK government has offered financial institutions a clear direction on where to focus their financial crime resources this year.
The updated System Priorities for 2026, published jointly by the National Crime Agency (NCA), FCA, HMRC, Home Office, and HM Treasury and developed alongside UK Finance under Economic Crime Plan 2 sets out nine primary economic crime threats for regulated firms to address.
Fully endorsed by the FCA and aligned with both the National Risk Assessment and the NCA’s National Strategic Assessment, the document serves as a practical compass for compliance teams.
Notably, the framework is intended to be cost-neutral.
Rather than asking firms to build new layers of controls or take on additional regulatory obligations, authorities are inviting the industry to reallocate existing resources toward the areas of highest impact.
Professional enablers: UK-based or UK-registered professionals facilitating economic crime, including fraud and sanctions evasion
Politically Exposed Persons (PEPs): transaction flows and corporate structures linked to the abuse of political power
Digital assets: criminal exploitation of digital assets, including for fraud, ransomware, sanctions evasion and terrorist financing
Criminal cash: the consolidation, movement and deposit of illicit cash into the UK banking system, including via the Post Office
International money laundering: laundering through UK corporate structures on behalf of overseas criminal groups, including underground banking
International fraud: overseas offenders targeting UK victims, with a focus on scam compounds
Money mule herders: networks recruiting and exploiting mules to move criminal proceeds
Fraud enablers: telecommunications services and online platforms exploited to facilitate fraud
Terrorist financing: money supporting attacks, plots, individuals and groups
On first reading, these look like nine separate problems.
Read together as a framework, however, these nine areas cease to look like isolated challenges.
Three overarching themes emerge.
The first is the relationships and structures that facilitate crime: sanctions evasion sits within the professional enablers priority rather than apart from it, and the PEP priority reaches beyond the office-holder to family members and associates, which suggests the exposure often lies in who and what surrounds a name.
The second is the way illicit funds move across categories. Cash, mule accounts, digital assets and overseas networks can all form stages of the same journey, and the System Priorities themselves note that mule networks enable fraud, tax crime and terrorist financing, and that fraud proceeds can fund further criminality, including terrorism.
The third is the value of shared intelligence. Most of the nine priorities call, in some form, for better risk indicators, data sharing or coordinated disruption, because no single organisation sees the whole picture: a bank sees the payment, a telecoms provider sees the suspicious call or text, and a platform sees the account behind the scam.
Following is the detailed breakdown of the themes:
1. The risk often sits in the relationships around a name
It is telling that sanctions evasion does not have a standalone category in the 2026 priorities; instead, the NCA houses it within professional enablers.
The rationale is straightforward. Effective interdiction requires looking past the designated person to the ecosystem supporting them: the lawyers, formation agents, intermediaries, and opaque corporate structures that conceal assets, obscure ownership, or keep prohibited commercial activity running.
Accordingly, the NCA encourages firms to
- identify complicit or non-compliant professional enablers,
- review customers at high risk of providing services to designated persons, and
- improve investigations into front-company networks, with a focus on Russia but also Iran and the Democratic People’s Republic of Korea.
The PEP priority takes a similar approach. Its definition reaches beyond the office-holder to professional and non-professional enablers, including children, spouses, ex-spouses, in-laws and associates.
The NCA does not spell out what this means for screening, so what follows is our own reading.
A direct match on a sanctions or PEP list tells you who someone is.
On its own, it may not tell you who stands around them: the beneficial owners, associated parties and intermediaries who may carry the real exposure.
2. Criminal money moves across categories
Several priorities describe different stages of the same journey: how illicit funds are generated, moved and hidden.
The NCA estimates that more than £12 billion in criminal cash is generated by criminal enterprises in the UK each year, most of it believed to come from illicit drugs and excise fraud.
The criminal cash priority concerns how that money is moved and fed into the banking system, sometimes through high-street businesses and Post Office branches.
International money laundering adds another layer: international controller networks, informal value transfer systems and underground banking, and the use of UK corporate structures and international financial centres.
Meanwhile, International Fraud adds scale, with the NCA assessing that more than 70% of fraud against UK citizens and businesses originates from, or is facilitated via, overseas jurisdictions, with scam compounds in focus.
The NCA’s own analysis highlights how deeply intertwined these channels have become:
Mule networks are described as playing a significant and growing role in enabling fraud, tax crime and terrorist financing. Banks identified over 39,000 accounts indicative of mule activity in 2022.
Terrorist financing is said to draw on digital assets, money service businesses, electronic money institutions, mules and crowdfunding platforms.
Digital assets are described as a route for proceeds from fraud, ransomware, sanctions evasion and tax crime.
Fraud proceeds, the NCA notes, can fund further criminality, including terrorism.
3. Each organisation holds one piece of the picture
If a single principle unites the government’s proposed actions, it is collaboration. Nearly every priority calls for refined risk indicators, deeper data sharing, or coordinated disruption across sectors:
Digital assets: Sharing datasets and establishing processes to freeze and restrain suspected criminal funds on Virtual Asset Service Provider (VASP) platforms.
Money mule herders: Building an agreed industry methodology and cross-firm data-sharing model.
International money laundering: Developing an international funds-flow data framework and expanding private-to-private intelligence sharing.
Fraud enablers: Bringing telecommunications providers, tech firms, and online platforms into closer alignment with banks and law enforcement.
Terrorist financing: Enhancing intelligence flows, including through more robust TACT SAR reporting.
Even where the priorities lean more heavily on referrals to the NCA, as with professional enablers and PEPs, the underlying philosophy remains the same.
The logic is intuitive. In a modern financial crime scheme, a telecoms provider sees the suspicious call or message, an online platform hosts the fraudulent account, and a bank processes the resulting payment. Viewed in isolation, each institution only sees a fragment.
When those fragments are brought together through established legal and regulatory channels, the wider network comes into focus.
The bigger picture
Overseen by the public-private System Prioritisation Governance Group, the 2026 priorities are designed to be a living framework that will evolve alongside the threat landscape.
The firms that benefit most will assess their own exposure honestly, move resources to match, share intelligence actively, and be able to show their reasoning.
Ultimately, the UK’s 2026 priorities are not nine separate problems to be solved in silos, they represent one connected system of illicit activity, and they call for an equally connected response.
