The FCA fines firms for anti-money laundering (AML) failures because weak controls let criminal money into the financial system, whether or not laundering is ever proven. Financial crime failures drove the three largest FCA fines of 2025: Nationwide (£44.1 million), Barclays (£42.4 million) and Monzo (£21.1 million), together about 87% of the £124.2 million the FCA fined that year. The same onboarding and monitoring controls sit at the heart of every money services business and payment institution.
| Firm | Date | Fine | What went wrong |
|---|---|---|---|
| Nationwide Building Society | December 2025 | £44,078,500 | Anti-financial crime systems and controls |
| Barclays (two entities) | July 2025 | £42,408,300 | Financial crime risk management |
| Monzo Bank | July 2025 | £21,091,300 | Onboarding and monitoring; over 34,000 high-risk customers taken on in breach of an FCA restriction |
| Starling Bank | September 2024 | £28,959,426 | Sanctions screening failures; breach of a restriction on high-risk customers |
| Metro Bank | November 2024 | £16,675,200 | Over 60 million transactions left outside automated monitoring |
| CB Payments (EMI) | July 2024 | £3,503,546 | 13,416 high-risk customers onboarded in breach of a voluntary requirement |
Source: FCA fines pages and final notices. This article examines why AML enforcement has intensified, what specific failures are attracting fines, and what firms can do to avoid becoming the next enforcement case.
Why the FCA Takes AML Failures Seriously
Several factors explain the FCA's firm stance on AML. First, the payments and MSB sectors have grown rapidly, creating a larger regulated population with varying compliance maturity. Second, high-profile money laundering cases involving UK-regulated firms have increased political and public pressure on the FCA to demonstrate effective supervision. Third, the FCA's investment in data analytics has improved its ability to identify firms with weak AML controls through pattern analysis of SAR filing rates, complaint data and supervisory intelligence.
The FCA has also adopted a more proactive enforcement strategy. Rather than waiting for evidence of actual money laundering, the regulator is taking action against firms whose systems and controls are inadequate, even where no specific money laundering has been proven. This "systems and controls" approach means that any firm with a deficient AML framework is potentially at risk of enforcement action.
Most Common AML Failures
Customer due diligence. Firms that fail to conduct adequate CDD, including identity verification, beneficial ownership identification and risk assessment, at onboarding and on an ongoing basis. The FCA expects CDD to be proportionate to the risk presented by the customer, with enhanced due diligence applied to higher-risk customers.
Transaction monitoring. Monitoring systems that are inadequate for the firm's business model, including rules that are too narrow, thresholds that are too high, and coverage gaps for particular transaction types or corridors. The FCA expects monitoring to be calibrated to the firm's specific risk profile and regularly reviewed.
Suspicious activity reporting. Failure to submit SARs in a timely manner, submission of SARs without adequate supporting information, and failure to identify reportable activity despite clear indicators. The FCA analyses SAR filing rates as a supervisory indicator: firms with anomalously low filing rates relative to their business volume and risk profile attract attention.
Risk assessment. Business-wide and customer-level risk assessments that are generic rather than tailored to the firm's specific business model, customer types, geographies and transaction patterns.
How to Strengthen Your AML Framework
- Conduct an independent AML framework review. Engage a qualified external reviewer to assess your AML framework against FCA expectations and current enforcement themes. Internal assessments often miss blind spots.
- Tailor your risk assessment. Your business-wide risk assessment must reflect your firm's actual business: the specific customer types you serve, the geographies you operate in, the products you offer and the delivery channels you use.
- Calibrate transaction monitoring. Review your monitoring rules and thresholds against current typologies and your firm's actual transaction patterns. Test the effectiveness of your monitoring system regularly.
- Invest in CDD quality. Ensure that CDD processes are thorough, consistent and documented. Implement ongoing monitoring to detect changes in customer behaviour or risk profile.
- Report promptly. Ensure that SARs are filed promptly when suspicious activity is identified, with adequate supporting information. Train staff on recognition of suspicious indicators and escalation procedures.
- Document and evidence. Maintain comprehensive records of all AML activities, decisions and risk assessments. In enforcement proceedings, the quality of documentation is critical.
What MSBs Should Do Now
The AML supervisor depends on the firm's status. The FCA supervises banks, EMIs, cryptoasset firms and many payment institutions, while HMRC supervises many money service businesses, such as bureaux de change and some money transmitters. Remittance firms also need payment services permission: small payment institution registration or API authorisation. Money services businesses face close scrutiny because of the risks in their business model. MSBs should prioritise independent AML framework testing, enhanced due diligence for high-risk corridors, source of funds verification and regular staff training updates.
Regulatory Counsel advises MSBs and payment firms on AML framework development, independent testing and enforcement risk mitigation. Contact us for a written proposal.
Frequently asked questions
Because weak systems and controls expose the financial system to crime. The FCA acts on inadequate onboarding, monitoring and reporting even where no laundering is proven, and fighting financial crime is a priority in its 2025 to 2030 strategy.
Yes. The FCA can take enforcement action for inadequate AML systems and controls, regardless of whether actual money laundering has been proven.
Inadequate customer due diligence and generic risk assessments that are not tailored to the firm's specific business model and risk profile.
Through independent framework reviews, tailored risk assessments, calibrated transaction monitoring, prompt SAR filing and comprehensive documentation.
Nationwide Building Society (£44.1 million, December 2025), Barclays (£42.4 million across two entities, July 2025) and Monzo (£21.1 million, July 2025). All three concerned financial crime systems and controls.
It follows a five-step framework in its Decision Procedure and Penalties manual (DEPP 6.5A), based on the revenue linked to the breach and its seriousness, adjusted for aggravating and mitigating factors. Firms that settle early receive a 30% discount.
It depends on the firm's status. The FCA supervises banks, EMIs, cryptoasset firms and many payment institutions. HMRC supervises many other money service businesses, such as bureaux de change and some money transmitters.
Definitive guides on this topic
The permanent reference pages this article relates to.