The Financial Conduct Authority imposed about £124 million in fines in 2025, down from about £176 million in 2024, according to its own tables of 2025 fines and 2024 fines. Most of the 2025 total came from four financial crime cases against well-known banks – Nationwide, Barclays (two penalties) and Monzo – which between them account for about £108 million.
For compliance teams these cases show where the FCA is looking, and where your own monitoring needs to hold up.
Here are the four largest fines of 2025 and three other cases worth knowing: what went wrong, and what each means for firms that work with or alongside the organisations involved.
The four largest fines of 2025
1. Nationwide Building Society – £44.1 million
Breach: Anti-financial crime systems and controls (Principle 3, SYSC 6.1.1R and SYSC 6.3.1R)
Nationwide received the largest single fine of 2025 – £44,078,500, after a 30% settlement discount – for inadequate anti-financial crime systems and controls between October 2016 and July 2021. The FCA found that its systems for keeping customer due diligence and risk assessments up to date, and for monitoring transactions, were ineffective across its personal current account customers, including customers it knew were using personal accounts for business. In one case it missed a customer receiving £27.3 million in fraudulent Covid furlough payments.
Lesson for compliance teams: Size and reputation are no protection. The FCA expects controls to keep pace with how customers actually use their accounts, and legacy systems are not an excuse.
2. Barclays Bank PLC – £39.3 million
Breach: Failure to manage money laundering risk in a client relationship
Barclays Bank PLC was fined for failing to manage the money laundering risk of its client Stunt & Co, which in just over a year received £46.8 million from Fowler Oldfield, a gold dealer whose directors were later convicted of money laundering. The FCA found that Barclays did not gather enough information at the start of the relationship or monitor it properly, even after receiving information from law enforcement about suspected money laundering through Fowler Oldfield and learning that the police had raided both firms.
Lesson for compliance teams: Ongoing monitoring of existing relationships matters as much as onboarding checks. A counterparty's risk profile can change over time, and your monitoring needs to reflect that.
3. Monzo Bank Limited – £21.1 million
Breach: Financial crime controls that did not keep pace with growth, and breach of an FCA requirement
Between October 2018 and August 2020, the FCA found, Monzo's customer onboarding, customer risk assessment and transaction monitoring were not adequate for a bank whose customer base grew from about 600,000 in 2018 to more than 5.8 million by 2022 – customers could open accounts giving obviously implausible addresses such as Buckingham Palace. In 2020 the FCA imposed a requirement stopping Monzo from opening accounts for high-risk customers; between August 2020 and June 2022 Monzo repeatedly breached it, signing up more than 34,000 of them.
Lesson for compliance teams: Growth does not excuse compliance gaps. And a requirement on the register can be an early signal: Monzo's came five years before its fine.
4. London Metal Exchange – £9.2 million
Breach: Systems and controls failures during extreme market volatility
The LME was fined for failing to have systems and controls adequate to keep trading orderly during the nickel market crisis of March 2022, when the three-month nickel price more than doubled within hours and the exchange suspended the market and cancelled trades. It was the FCA's first enforcement action against a recognised investment exchange.
Lesson for compliance teams: Operational resilience and the ability to manage stress scenarios are firmly on the FCA's agenda. Review your own crisis management and escalation procedures.
Other 2025 cases worth knowing
Barclays Bank UK PLC – £3.1 million
Breach: Account opening failures for a client money account
In a separate case from Stunt & Co, Barclays Bank UK PLC was fined for opening a client money account for WealthTek without gathering enough information to understand the money laundering risk. The FCA pointed out that a simple check of the Financial Services Register would have shown that WealthTek did not have permission to hold client money; £34 million was paid into the account.
Lesson for compliance teams: Check the register before you rely on a firm, and keep checking. Customer due diligence at onboarding remains a fundamental control, and failures at this stage can have consequences years later.
James Edward Staley – £1.1 million and a ban
Breach: Individual Conduct Rules 1 (integrity) and 3 (openness with regulators), and Senior Manager Conduct Rule 4
The former Barclays chief executive approved a letter from Barclays to the FCA that contained misleading statements about the nature of his relationship with Jeffrey Epstein and when they were last in contact. The FCA decided in 2023 to fine him £1.8 million and ban him from senior management roles. In June 2025 the Upper Tribunal upheld the ban and reduced the fine to about £1.1 million, reflecting deferred Barclays shares he would no longer receive; the FCA issued its final notice in July 2025.
Lesson for compliance teams: The FCA holds individuals to account as well as firms under the Senior Managers and Certification Regime (SM&CR), and the Tribunal has backed it on integrity.
Sigma Broking Limited – £1.1 million
Breach: Transaction reporting failures over five years
Sigma Broking was fined for submitting incorrect transaction reports for nearly 100% of its transactions between December 2018 and December 2023 – 924,584 incorrect reports in all. The failures were caused by incorrect system setup that went undetected because of weaknesses in the firm's reporting oversight.
Lesson for compliance teams: Automated systems are only as good as their configuration and ongoing validation. Five years of undetected reporting failures is a reminder that compliance monitoring must include regular testing of automated controls.
Key themes from 2025 enforcement
Financial crime dominates
Financial crime cases made up most of the 2025 total: the Nationwide, Barclays and Monzo penalties together came to about £108 million of the £124 million. Each was penalised for weaknesses in its financial crime systems and controls, which remain a central focus for the FCA.
Fintechs are not exempt
The Monzo case shows the FCA holds challenger banks to the same standard as established ones. Its controls, the FCA found, did not keep pace with its growth.
Individuals are held to account
The Staley case – a fine and a ban from senior roles, upheld by the Upper Tribunal – shows the FCA will pursue senior individuals as well as firms. This matters to anyone subject to the SM&CR regime.
Problems can take years to surface
Several of the 2025 fines relate to conduct years earlier: Nationwide's failings ran from 2016 to 2021 and Sigma Broking's from 2018 to 2023. A firm you work with today could have problems that only come to light years from now, which is why monitoring has to be ongoing.
What this means for your compliance team
If you work with or alongside any FCA-regulated firm, these enforcement trends should inform your monitoring approach:
-
Monitor your counterparties between reviews. Annual or quarterly checks of the FCA register leave long gaps. Regulatory action can land at any time, and the sooner you know, the sooner you can assess the impact on your business.
-
Watch for earlier signals. A final notice is the end of a process, not the beginning. Requirements often come first – the FCA imposed a requirement on Monzo five years before fining it – and the FCA sometimes publishes a warning notice statement before a case is decided.
-
Review your own controls. The themes in these cases – weak transaction monitoring, poor customer due diligence, controls that lag the business – are common across the industry. Use these cases as a prompt to review your own systems.
-
Document everything. A record that shows ongoing monitoring and timely responses to regulatory developments is what you will be asked for if questions are raised about your compliance processes.
Firmwatcher checks the FCA register every morning, reads FCA announcements hourly, and emails your compliance team when a new requirement or disciplinary action appears for a firm or individual on your watchlist. Start a 14-day trial to automate your monitoring.