REP-CRIM Explained: The Annual Financial Crime Report
REP-CRIM is the FCA’s annual financial crime data return. It asks firms for a structured set of figures on their customers, their higher-risk relationships, their suspicious activity reporting, their sanctions exposure and the resources they put into fighting financial crime. For the firms that must submit it, it’s one of the main ways the FCA sees their financial crime risk, and it lands on the MLRO’s desk every year. This guide explains what REP-CRIM is, who has to submit it, what it asks for, how the FCA uses it, and how to run the return so the data stands up to scrutiny.
What REP-CRIM Is
REP-CRIM, formally the Annual Financial Crime Report, was introduced by the FCA in 2016. Its purpose is to give the regulator consistent data on financial crime risk across the firms it supervises, so it can compare firms, spot outliers and target its supervisory work. The rules sit in the FCA Handbook at SUP 16.23, and the return is submitted through the FCA’s RegData system.
The return is due annually, linked to the firm’s accounting reference date. The FCA’s rules set the submission window, which has generally been within 60 business days of the firm’s accounting reference date. Check SUP 16.23 and RegData for your firm’s current due date, because deadlines and reporting schedules can change.
REP-CRIM is a data return, not a narrative report. It doesn’t replace the annual MLRO report to the board or the business-wide risk assessment, but the three should tell a consistent story. If they don’t, supervisors notice.
Which Firms Must Submit It
REP-CRIM doesn’t apply to every FCA-regulated firm. When it was introduced, it applied broadly to firms subject to the Money Laundering Regulations that met a revenue threshold, generally total revenue of £5 million or more, together with certain types of firm regardless of size, such as banks, building societies and some other deposit-takers. The FCA has since consulted on and extended the scope of the return to bring more firms in, including payment and e-money firms and other categories it regards as higher risk.
Because the population has changed over time, don’t rely on what applied when the return was first introduced. Check SUP 16.23 for the current scope, and look at your firm’s reporting schedule in RegData, which lists the returns the FCA expects from you. If you’re unsure whether REP-CRIM applies, ask your supervisor or take advice rather than assuming you’re out of scope.
| Firm situation | What to do |
|---|---|
| Bank, building society or other deposit-taker | Expect REP-CRIM to apply; confirm in RegData |
| Firm subject to the MLRs with revenue at or above the threshold | Expect REP-CRIM to apply; confirm the current threshold in SUP 16.23 |
| Payment institution, e-money institution or other firm type brought into scope | Check whether the extended scope covers your firm and from which reporting period |
| Small firm below the threshold and outside the specified categories | May be out of scope; confirm in RegData rather than assuming |
| Newly authorised firm | Check your reporting schedule as soon as authorisation is granted |
What REP-CRIM Asks For
The return asks for quantitative data covering the firm’s financial crime risk and controls over the reporting period. The exact fields are set out in the FCA’s form and guidance notes, which you should use when preparing the return. In broad terms, it covers:
- Customers and risk: the number of customers, and how many are rated high risk, or fall into specific categories such as politically exposed persons.
- Geography: customers and business connected to high-risk jurisdictions and countries subject to sanctions or other measures.
- Suspicious activity reporting: the number of internal suspicion reports raised, and the number of suspicious activity reports made to the National Crime Agency.
- Sanctions: matches and other sanctions-related activity.
- Refused and exited relationships: customers declined or exited for financial crime reasons.
- Fraud: fraud-related information, depending on the version of the return.
- Resources: the staff and resources the firm devotes to financial crime compliance.
- Top risks: the financial crime risks the firm considers most significant.
Our guides to politically exposed persons, sanctions screening and suspicious activity reports and the nominated officer explain the underlying obligations.
How the FCA Uses REP-CRIM
The FCA uses REP-CRIM data to support risk-based supervision. Consistent data across a large population of firms lets the regulator compare firms with their peers, identify those whose risk profile or reporting looks unusual, and decide where to focus its financial crime work. A firm that reports large numbers of high-risk customers but very few internal suspicion reports, for example, or a sharp change from one year to the next without explanation, is more likely to attract questions.
That has two consequences for firms. First, the numbers matter: an inaccurate return can trigger supervisory attention the firm doesn’t deserve, or hide a problem it should be dealing with. Second, the return has to be consistent with what the firm says elsewhere, including its risk assessment, its MLRO report and anything it tells its supervisor.
Who Owns REP-CRIM
At most firms, the MLRO owns the return. Under the SMCR the MLRO is usually approved as SMF17 and accountable for the firm’s anti-money laundering systems and controls, and REP-CRIM is a direct report on how those controls are operating. Many firms record ownership of the return in the MLRO’s Statement of Responsibilities.
The MLRO rarely produces the data alone. A typical return draws on:
| Data | Usually comes from |
|---|---|
| Customer numbers and risk ratings | Onboarding systems, CRM and the customer risk model |
| PEPs and high-risk jurisdictions | Screening tools and the KYC team |
| Internal reports and SARs | The MLRO’s case management records |
| Sanctions matches | Sanctions screening and alert handling |
| Exits and refusals | Onboarding, operations and the financial crime team |
| Revenue and resources | Finance and HR |
A deputy MLRO or financial crime manager often coordinates the data gathering, with the MLRO reviewing and signing off. Our guide to who supports your SMF16 and SMF17 on regulatory reporting covers the wider reporting team, and FCA regulatory reporting explained sets out how returns fit together.
A Practical Timeline
Firms that leave REP-CRIM until the deadline approaches tend to submit figures they can’t fully support. A simple plan, starting at the end of the reporting period, avoids that:
- Before the period ends. Confirm the return still applies, check for any changes to the form or guidance, and agree definitions for each field with the teams that hold the data.
- Weeks 1 to 3 after period end. Extract the data from each source system, using the same definitions and cut-off dates as the previous year unless there’s a documented reason to change.
- Weeks 3 to 6. Reconcile the figures: customer numbers against finance and CRM records, SAR counts against the MLRO’s case log, screening matches against alert records.
- Weeks 6 to 8. Compare with last year’s return and the business-wide risk assessment. Investigate and document significant movements.
- Weeks 8 to 10. MLRO review and sign-off, with a short note of the key judgements and any limitations in the data.
- Before the deadline. Submit through RegData, keep a copy of the submitted return and the working papers, and report the headline figures to the board or risk committee.
Adjust the timing to fit your firm’s deadline, but keep the sequence: definitions, extraction, reconciliation, review, sign-off.
Data Quality and Governance
The FCA expects firms to submit accurate regulatory returns, and errors can lead to resubmissions and supervisory questions. Good governance over REP-CRIM looks like this:
- a documented definition and source for every field, reviewed each year
- consistent cut-off dates and counting rules from year to year
- reconciliations between sources, with differences explained
- a year-on-year comparison, with significant movements investigated
- consistency checks against the business-wide risk assessment and the annual MLRO report
- clear MLRO sign-off, with evidence of review
- working papers retained so the figures can be explained later
- a process for correcting errors found after submission
How REP-CRIM Fits With the MLRO Report and Risk Assessment
REP-CRIM, the annual MLRO report and the business-wide risk assessment describe the same thing from three angles. The risk assessment explains what the firm’s financial crime risks are; the MLRO report tells the board how well the controls are working; and REP-CRIM gives the FCA the numbers. Many MLROs now prepare them from a common data set, so the customer numbers, risk ratings and SAR figures match across all three. Where they differ, for example because of different reporting periods, the reason should be documented.
Scenario: A growing e-money institution submits its first REP-CRIM after the return’s scope reaches firms like it. The operations team pulls customer numbers from the onboarding platform, while the MLRO’s annual report used figures from the finance system, and the two differ by several thousand accounts because dormant customers are counted differently. The firm’s high-risk customer count is also far lower than its risk assessment implies. The MLRO pauses the submission, agrees a single definition of an active customer, reconciles the figures, corrects the risk rating data and documents the changes. The return is submitted on time, and the following year’s MLRO report uses the same data set.
Common Mistakes
- Assuming the return doesn’t apply. The scope has changed over time. Check RegData rather than relying on old assumptions.
- Changing definitions without saying so. A new counting method can make figures look very different from last year.
- Figures that contradict the risk assessment. A low-risk return from a firm whose own assessment describes high risk invites questions.
- Last-minute production. Rushed returns are where errors creep in.
- No audit trail. If the MLRO can’t explain how a figure was produced, it will be hard to defend.
- Treating it as a compliance-only task. Finance, operations and technology all hold data the return needs.
The People Behind the Return
A well-run REP-CRIM depends on an MLRO with the authority to get data from across the business and the judgement to explain it, supported by someone with the analytical skills to reconcile it. Firms that struggle with the return often find the underlying issue is capacity: an MLRO who is also the compliance officer, or a financial crime function without anyone comfortable with data. Our pages on MLRO recruitment and financial crime leadership recruitment cover how we help firms strengthen those roles, and our SMCR glossary explains the terms used throughout this guide.
MLRO and Financial Crime Recruitment
The people who own the numbers. Every SMF search is led personally by Adrian Lawrence FCA
Financial Crime Team
Deputies and specialists.
→ Financial crime leadership → Deputy MLROsBusiness-wide risk assessment →
Combined Role
Compliance officer and MLRO.
→ Joint SMF16 and SMF17 → Interim coverWhen to split the role →
Reporting
Getting returns right.
→ FCA regulatory reporting → Who supports your SMF16/17SMCR glossary →
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
What does REP-CRIM stand for?
It’s the FCA’s reference for the Annual Financial Crime Report, a data return on financial crime risk and controls.
When is REP-CRIM due?
Annually, linked to the firm’s accounting reference date. The FCA’s rules set the submission window; check SUP 16.23 and your RegData reporting schedule for your exact deadline.
Does every FCA firm have to submit REP-CRIM?
No. It applies to specified firms, based on firm type and a revenue threshold, and the FCA has extended the scope over time. Check RegData to confirm whether it applies to you.
Who should sign off REP-CRIM?
Usually the MLRO, as the Senior Manager accountable for anti-money laundering systems and controls, after review of the underlying data.
Is REP-CRIM the same as the annual MLRO report?
No. REP-CRIM is a data return to the FCA; the MLRO report is a narrative report to the board. They should be consistent with each other.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally. View Adrian’s ICAEW profile.
Strengthening Your Financial Crime Function?
Whether you need an MLRO who can own your regulatory returns or a deputy to run the data, tell us about your firm. We’ll come back to you the same working day.