The FCA's enforcement actions in 2025 sent a clear message to payment firms: weaknesses in systems and controls, particularly those related to financial crime and safeguarding, will attract serious regulatory consequences. The FCA's published fines for 2025 total £124.2 million, down from £176.0 million in 2024. The three largest, against Nationwide, Barclays and Monzo, were all for financial crime control failures that payment institutions and EMIs face in exactly the same form. This article analyses the key enforcement themes and provides practical lessons for payment firms.
FCA Fines in 2025: The Main Cases
| Date | Firm | Fine | Main failing |
|---|---|---|---|
| 11 December 2025 | Nationwide Building Society | £44,078,500 | Anti-financial crime systems and controls |
| 14 July 2025 | Barclays Bank plc and Barclays Bank UK plc | £42,408,300 | Financial crime risk management |
| 8 July 2025 | Monzo Bank | £21,091,300 | Onboarding, risk assessment and monitoring; breach of a restriction on high-risk customers |
| 20 March 2025 | The London Metal Exchange | £9,245,900 | Market conduct obligations |
| 17 February 2025 | Mako Financial Markets Partnership | £1,662,700 | Conduct and financial crime risk rules |
Source: FCA, 2025 fines. The FCA also used tools short of a fine, including requirements to appoint a skilled person (an independent reviewer the firm pays for), restrictions on new business and voluntary requirements (formal limits a firm agrees with the FCA).
No payment institution or EMI appeared on the 2025 list. The most direct precedent for payment firms is CB Payments Limited, an EMI in the Coinbase group, fined £3,503,546 in July 2024. It was the first fine under the Electronic Money Regulations 2011: the firm onboarded 13,416 high-risk customers despite agreeing a voluntary requirement not to.
The regulator's message is consistent: the payments sector has grown rapidly, and the FCA expects firms' compliance frameworks to keep pace with that growth. Firms that scale their business without proportionately scaling their compliance functions will face consequences.
Key Enforcement Themes
Inadequate transaction monitoring. The Monzo, Barclays and Nationwide cases all involved controls that did not keep pace with the business. Monzo grew from about 600,000 customers in 2018 to over 5.8 million in 2022 while its onboarding and monitoring lagged behind. In 2024, Metro Bank was fined £16,675,200 after a data error left over 60 million transactions, worth over £51 billion, outside its automated monitoring. Common failures included monitoring rules that were too narrow to capture relevant typologies, insufficient coverage of high-risk corridors, and failure to tune monitoring parameters as transaction volumes and patterns changed.
Safeguarding deficiencies. FCA supervisory work continued to find weak safeguarding, including commingling of safeguarded and operational funds, failure to reconcile on a timely basis, and inadequate documentation of safeguarding account arrangements.
Suspicious activity reporting failures. Firms were penalised for failure to submit SARs in a timely manner, for submitting SARs of inadequate quality, and for failing to identify reportable activity despite clear indicators.
Governance and oversight. Several cases involved governance failures where the board and senior management lacked visibility of compliance risks, where compliance functions were under-resourced, or where risk escalation processes were inadequate.
Senior manager accountability. The FCA also fined individuals in 2025, including £1,107,306 against former Barclays chief executive James Staley. The Senior Managers and Certification Regime (SM&CR) covers banks and other firms authorised under FSMA. Pure payment institutions and EMIs sit outside it, but their directors and managers must still meet the good repute and experience conditions in the PSRs 2017 and EMRs 2011.
Practical Lessons for Payment Firms
Lesson 1: Transaction monitoring must be dynamic. Static monitoring rules deployed at authorisation and never updated will not meet FCA expectations. Firms must regularly review and tune their monitoring parameters based on changing transaction patterns, emerging typologies, and feedback from SARs and internal investigations.
Lesson 2: Safeguarding must be right every day. Since 7 May 2026, CASS 15 (introduced by PS25/12) requires daily reconciliations, a monthly safeguarding return to the FCA, a resolution pack and, for many firms, an annual safeguarding audit. Firms holding EMI authorisation or API authorisation should be able to evidence each of these.
Lesson 3: Compliance must scale with business. Firms that grow rapidly without proportionately investing in compliance resources will attract supervisory attention. The FCA expects compliance functions to be adequately staffed, funded and empowered.
Lesson 4: Board visibility matters. Senior management must have clear visibility of compliance risks and must be able to demonstrate active engagement with compliance matters. Board packs should include compliance risk reporting with trend analysis.
Lesson 5: Document everything. In enforcement proceedings, the FCA will request comprehensive documentation. Firms that can demonstrate a clear paper trail of compliance activities, decision-making and risk management are in a significantly stronger position than those that cannot.
What Firms Should Do Now
- Review the FCA's 2025 enforcement decisions relevant to payment firms and conduct a self-assessment against the identified failures.
- Review and test your transaction monitoring framework: are rules current, comprehensive and appropriately calibrated?
- Verify that safeguarding arrangements are fully compliant, reconciled daily and properly governed.
- Ensure the board receives regular, meaningful compliance risk reporting.
- Assess whether your compliance function is adequately resourced for your current scale of business.
Regulatory Counsel advises payment firms on enforcement risk mitigation, compliance framework strengthening and regulatory self-assessment. Contact us for a written proposal.
Frequently asked questions
Financial crime control failures. The largest 2025 fines, against Nationwide, Barclays and Monzo, all concerned onboarding, customer risk assessment or transaction monitoring. No payment institution or EMI appeared on the 2025 fines list, but payment firms run the same controls.
Yes. Under SMCR, the FCA can take enforcement action against individual senior managers who fail to take reasonable steps to prevent regulatory breaches within their areas of responsibility.
By conducting regular self-assessments against FCA enforcement themes, maintaining dynamic transaction monitoring, ensuring adequate compliance resourcing, and providing the board with meaningful compliance risk reporting.
No. The FCA uses a range of tools including requirements to appoint skilled persons, business restrictions, voluntary requirement agreements and formal warnings, in addition to financial penalties.
The FCA's published fines for 2025 total £124.2 million, compared with £176.0 million in 2024. The largest single fine was £44.1 million against Nationwide Building Society for anti-financial crime control failures.
Yes. In July 2024 the FCA fined CB Payments Limited, an EMI in the Coinbase group, £3,503,546. It was the first fine under the Electronic Money Regulations 2011 and followed the onboarding of 13,416 high-risk customers in breach of a voluntary requirement.
Not to pure payment institutions and EMIs, because they are authorised under the PSRs 2017 and EMRs 2011 rather than FSMA. It applies if the firm also holds a FSMA permission, such as consumer credit. Directors and managers of all PIs and EMIs must still be of good repute with appropriate knowledge and experience.
Definitive guides on this topic
The permanent reference pages this article relates to.
UK Authorised Payment Institution licence
FCA API requirements, own funds methods, safeguarding, cost and timeline.
UK Small Payment Institution registration
FCA SPI requirements, the EUR 3 million threshold, cost and timeline.
Payment institutions
Licensing and ongoing compliance for UK and international payment firms.