Abdulali Jiwaji examines the FCA’s fine against Monzo in Financial Regulation International

It is four years since the FCA brought its first criminal prosecution under the UK’s anti-money laundering (AML) regulations. Following convictions for failing to prevent the laundering of circa GBP 365m by Fowler Oldfield, a jewellery business client, NatWest was fined GBP 264.8m: without a substantial discount resulting from guilty pleas, it would have been GBP 397m.

Although NatWest initially understood it would not handle cash for Fowler Oldfield, GBP 264m of cash was deposited with the bank during their relationship. Having identified multiple failures in monitoring and scrutiny of these transactions, the FCA noted that some NatWest employees had reported suspicions internally, but no appropriate action was ever taken. Red flags identified by the FCA included:

• A significant amount of Scottish bank notes deposited throughout England
• Deposits of notes with a musty smell
• Individuals acting suspiciously when depositing cash in NatWest branches.

NatWest’s systems also recognised some cash deposits as cheque deposits, thereby lowering the money laundering risk, which the FCA referred to as part of “serious systems failures”.

In July 2025, the FCA imposed another regulatory fine of just under GBP 40m on Barclays for failing to adequately manage money laundering risks in providing services to Stunt & Co, which received GBP 46.8m from Fowler Oldfield.

The FCA found that Barclays failed to properly consider money laundering risks despite:

• Receiving information from law enforcement in August 2016 that Fowler Oldfield may have laundered the proceeds of suspected money laundering, and that Stunt & Co was a principal recipient of electronic credits from Fowler Oldfield.
• Prominent media coverage in September 2016 about police raids on both Stunt & Co and Fowler Oldfield.

Following a KYC refresh in January 2017, Barclays certified that all necessary due diligence had been conducted. It was only after learning of the NatWest prosecution that Barclays launched a significant investigation.

Both cases demonstrate the FCA’s intent: taking criminal and regulatory enforcement action involving two major banks, and identifying where failings have occurred.

In 2021, the FCA conducted a review of financial crime controls at a sample selection of six challenger retail banks, covering eight million customers. The authority’s key findings, published in April 2022, included examples of good practice: non-traditional approaches to identify, verifying and monitoring customers, regularly updating policies and procedures and using the Credit Industry Fraud Avoidance System (CIFAS).

But, the FCA confirmed, much more was needed to ensure that every challenger bank was identifying and managing financial crime risk. Although these banks depend on rapid customer growth, the FCA emphasised that this must not come at the expense of complying with customer due diligence (CDD) obligations, as outlined in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

Weaknesses at challenger banks identified by the FCA included: not obtaining details about customer income and occupation; inconsistency in applying enhanced due diligence in higher-risk circumstances; customer risk assessment frameworks that were poorly developed and lacked sufficient detail; ineffective management of transaction monitoring alerts; and concerns about the quality of suspicious activity reports (SARs), alongside an increase in the volume of such reports.

This latter point calls into question the quality of checks at the onboarding stage: if effective, there should be less risk of subsequent irregularity in account activity. Where circumstances require it, filing an SAR is mandatory, but filing too many SARs may result in an investigation into potential weaknesses in onboarding processes.

Following its review of financial crime controls, the FCA then levied a series of fines on prominent challenger banks.

In September 2024, Starling Bank was first: a GBP 29m fine for stark failings in relation to financial sanctions screening. An internal Starling review identified systemic failings in its automated system which screened customers against only a fraction of those subject to financial sanctions.

The FCA noted that it took just 14 months to achieve an outcome in the Starling case, compared to a 42-month average for cases closed in 2023/2024: an example of how the authority has accelerated the pace of its enforcement investigations.

Next came Metro Bank, which was fined GBP 16m last November. Although Metro had automated the monitoring of customer transactions, the FCA identified that its systems did not work as intended. Despite junior staff raising concerns, some transaction data was not monitored over four and a half years.

Fined GBP 21m in July 2025, the most recent example is Monzo Bank. As Monzo’s customer base grew from 600,000 in 2018 to 5.8m in 2022, there was a clear breach of an FCA imposed requirement not to open accounts for high-risk customers.

Noting that Monzo’s financial crime controls failed to keep pace with its growth, the FCA identified systemic failings. In particular, Monzo failed to design, implement and maintain adequate customer onboarding, customer risk assessment and transaction monitoring systems to mitigate the risk of financial crime.

The FCA stated that some of Monzo’s onboarding led to customers being accepted on the basis of manifestly implausible information, such as customers using London landmarks, including 10 Downing Street, as an address.

As banking models change, we will continue to see regulatory actions of the type taken against Starling, Metro and Monzo.  Rapidly evolving technology can sometimes be unreliable and periodically unable to cope with spikes in customer volume.  While technology can be an essential part of financial crime controls, to remain fit for purpose systems must also be reviewed regularly.

If a bank voluntarily agrees to a restriction in recognition of an apparent weaknesses, strict compliance must follow.  Starling failed to comply with the voluntary requirement not to open new accounts for high-risk customers, opening 50,000+ such accounts between September 2021 and September 2024.

Notably, many cases involving banks settle: early settlement and resolution qualifies the institution for a 30% discount, creating a significant reduction in the total fine. Invariably, the FCA takes proactive self-reporting and significant remediation into account, as in the Barclays case.

Against this background, fraudulent activity continues to grow, including authorised push payment frauds and other types of payment scams.  Effective AML controls serve as a primary defence to this kind of activity.  Bank systems need to be robust enough to withstand AI-powered cyberattacks, which are increasingly difficult to police.

Banks face another dilemma. Regarded as a front line of defence against money laundering and fraud, they must also consider their customers. If a customer’s account is frozen, for example, there may be losses and arguments that the bank acted unjustly, resulting in claims for damages for breach of mandate.  If banks are over restrictive to the point where it impacts on the ordinary operation of accounts, they could face a wave of customer complaints.

This may seem a difficult balance, but regulators are likely to be unforgiving.

In its work programme for 2025/2026, fighting financial crime is one of the FCA’s four strategic priorities. This must be balanced against another competing priority: helping consumers navigate their financial lives.

The FCA specifies that it will focus “on proactive assessments of anti-money laundering systems and controls for those firms [deemed] high risk” and continue to engage with firms to strengthen sanctions systems and controls. Banks face a challenging time.