FCA fines for financial crime and money laundering failings

The FCA fined and prohibited Sanjay Maraj on 25 August 2026 for breaches of APER and COCON in the wealth management/private banking sector — the regulator found he failed to act with integrity, was not open and co‑operative, and was involved in conduct amounting to financial crime and a lack of fitness and propriety. The action arose from a scheme run at Dolfin Financial that between 2016 and 2019 helped clients bypass the UK investor‑visa rules; the FCA says Mr Maraj managed the financial aspects of the scheme. He agreed to settle and received a 30% discount on the penalty. The FCA also banned two other former Dolfin executives; one has referred his decision to the Upper Tribunal.

In December 2025 the Financial Conduct Authority (FCA) fined Nationwide Building Society £44,078,500 for weaknesses in its financial crime controls between October 2016 and July 2021. Nationwide did not keep customer due diligence and risk assessments up to date for its personal current account customers, and its transaction monitoring was ineffective; it also knew some customers were running businesses through personal accounts in breach of its terms but had no proper process to manage the extra risk. In one serious case the society missed chances to spot a customer using personal accounts to receive over £27m in fraudulent Covid furlough payments. Nationwide, which had reported the problems itself and cooperated, agreed to settle and received a 30% discount; the fine would otherwise have been £62,969,297.

The FCA found that Diego Urra committed market abuse and market manipulation and failed to act with integrity, concluding he lacked the fitness and propriety required for his role in the investment bank sector. On 5 August 2025 the regulator fined him £223,400 and imposed a prohibition. The action was taken under the Market Abuse Regulations and the Financial Services and Markets Act 2000. The FCA published a Final Notice setting out the breaches and the sanctions.

On 14 July 2025 the Financial Conduct Authority fined Barclays Bank Plc £39,314,700 for breaching Principle 2 (firms must act with due skill, care and diligence). The FCA found that between 9 January 2015 and 23 April 2021 Barclays failed to identify, assess, monitor and manage adequately the money‑laundering risks arising from the provision of banking services to one corporate banking customer.

In July 2025 the FCA fined Monzo Bank £21,091,300 for inadequate anti-financial crime systems and controls between October 2018 and August 2020, and for repeatedly breaching a requirement it had agreed with the regulator (a "VREQ") not to open accounts for high-risk customers between August 2020 and June 2022. Monzo's customer base grew almost tenfold, from around 600,000 in 2018 to over 5.8 million in 2022, but its onboarding checks, customer risk assessments and transaction monitoring did not keep pace: customers were able to open accounts using obviously implausible addresses such as Buckingham Palace, and more than 34,000 high-risk customers were signed up while the restriction was in force. Monzo agreed to settle and qualified for a 30% discount; without it the fine would have been £30,130,475.

On 30 May 2025 the Financial Conduct Authority issued a Final Notice finding that Toni Fox breached PRIN 1 (which requires firms and individuals to act with integrity and due skill, care and diligence) and provided inappropriate pension transfer advice. The FCA fined her £567,584, withdrew her regulatory approvals and imposed a prohibition order. The action is recorded on the FCA register and the regulator's Final Notice sets out the findings and sanctions.

The FCA fined Mako Financial Markets Partnership LLP £1,662,700 after finding that between 16 December 2013 and 16 November 2015 the firm did not have, and did not adequately apply, policies and procedures to identify and address the risk of being used to facilitate financial crime and money laundering in relation to business introduced by the Solo Group. The regulator concluded Mako breached Principle 2 (firms must act with due skill, care and diligence) and Principle 3 (firms must take reasonable care to organise and control their affairs responsibly and effectively). Mako agreed to resolve all issues of fact and liability; the FCA's action took effect on 17 February 2025 and is set out in the Final Notice linked below.

The FCA found that Arian Financial LLP failed to have effective anti‑financial‑crime systems and controls between 29 January 2015 and 29 September 2015, putting the firm at risk of being used to support fraudulent trading and money‑laundering for clients of four authorised entities (the Solo Group). The FCA imposed a financial penalty but Arian admitted liability and referred the proposed fine to the Upper Tribunal; the Tribunal decided on 11 November 2024 to reduce the FCA’s penalty from £744,745 to £288,962.52, and the FCA’s Final Notice took effect on 9 January 2025. (Principle 2 requires firms to conduct business with due skill, care and diligence; Principle 3 requires firms to take reasonable care to organise and control their affairs with adequate risk management and systems.)

The FCA fined Starling Bank £28,959,426 for failings in its financial crime systems and controls between December 2019 and November 2023 — the regulator's first fine against a digital challenger bank. Starling's customer numbers grew from about 43,000 in 2017 to 3.6 million in 2023 but its safeguards did not keep up: in January 2023 it discovered that since 2017 its automated screening had been checking customers against only a fraction of the full financial sanctions list, and it breached a requirement agreed with the FCA in 2021 not to open accounts for high-risk customers by opening over 54,000 accounts for around 49,000 such customers between September 2021 and November 2023. The FCA described the bank's controls as "shockingly lax". Starling agreed to settle and received a 30% discount; the fine would otherwise have been £40,959,426.

On 23 July 2024 the Financial Conduct Authority fined CB Payments Limited £3,503,546. The FCA’s Final Notice records that CB Payments breached Statement of Principle 2 by failing to comply with a voluntary requirement (a VREQ) imposed on the firm in the e‑money sector. Statement of Principle 2 requires firms to act with due skill, care and diligence. The FCA imposed the financial penalty set out in its Final Notice (no further outcomes are recorded here).

On 29 September 2023 the Financial Conduct Authority imposed a £6,470,600 financial penalty on ADM Investor Services International Limited (FRN 148474) under section 206 of the Financial Services and Markets Act 2000. The penalty was for deficient anti‑money‑laundering systems and controls at the firm during the period 30 September 2014 to 31 October 2016. The FCA's Final Notice on the action is published on its website.

The FCA’s Final Notice (26 June 2023) says Mark Antony Abley gave unsuitable defined‑benefit pension transfer advice and breached APER 2 (the requirement to act with due skill, care and diligence). The regulator imposed a financial penalty of £106,100 and a partial prohibition restricting his regulated activity. The action relates to failings in pensions transfer advice under the APER regime; the Final Notice sets out the FCA’s findings and sanctions.

The FCA fined Barclays Bank £72,069,400 in November 2015 over a £1.88 billion structured investment it arranged in 2011 and 2012 for a group of ultra-wealthy clients who were politically exposed persons, and who should therefore have been subject to enhanced checks. Barclays nicknamed it an "elephant deal" because of its size, but rather than applying its normal anti-money-laundering procedures it cut corners to take the clients on quickly and keep the business. The FCA found Barclays failed to act with due skill, care and diligence between May 2011 and November 2014. The penalty comprised £52.3 million of revenue the bank earned from the deal plus a £19.8 million fine; Barclays settled early for a 30% discount, without which the total would have been £80,542,000. At the time it was the largest financial crime penalty ever imposed by the FCA or its predecessor.

On 2 August 2010 the Financial Services Authority (the FSA) fined four members of the Royal Bank of Scotland Group £5,600,000 for breaches of the Money Laundering Regulations 2007 that took place between 15 December 2007 and 31 December 2008. The breaches were failures in systems and controls to prevent breaches of UK financial sanctions: RBSG did not adequately screen incoming cross‑border payments (and certain sterling and euro payments), missed the majority of trade‑finance SWIFT messages, failed to record and continuously screen directors and beneficial owners, and did not maintain effective ‘fuzzy matching’ parameters in its screening software. RBSG agreed an early settlement so qualified for a 30% (Stage 1) discount (the penalty would otherwise have been £8,000,000); once current management identified the problems they reported them to the FSA, implemented remedial screening and governance improvements and cooperated with the investigation.

On 14 February 2007 the Financial Services Authority (FSA) fined Nationwide Building Society £980,000 for breaching Principle 3 (which requires firms to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk‑management systems) in the period 1 December 2004 to 1 December 2006. The FSA found Nationwide had weak information‑security risk assessment, inadequate procedures, training and controls, and a poor incident response after a laptop containing customer information was stolen, exposing customers to the risk of financial crime. Nationwide qualified for a 30% early‑settlement discount (the FSA said the undiscounted penalty would have been £1.4m) and had taken mitigating steps including disabling remote access, writing to customers, offering to reimburse customers who proved financial loss, increasing anti‑fraud monitoring and commissioning an independent review of its information security.

The FSA fined The Governor and Company of the Bank of Scotland £1,250,000 on 12 January 2004 for widespread failures in keeping customer identification records. A 2002 internal review found a 55% failure rate across the Retail, Corporate and Business divisions; the FSA’s investigation concluded the bank breached ML 7.3.2 (firms must retain a copy of customer identification evidence or a record of where it can be obtained) and ML 2.1.1 (firms must set up and operate arrangements to ensure they comply with the Money Laundering rules). The FSA noted the failings dated back at least to 2000, accepted that the bank promptly implemented remedial plans and co‑operated with the investigation, and said those factors reduced the size of the penalty.

On 12 December 2002 the FSA fined the Royal Bank of Scotland plc £750,000 for widespread failures in anti‑money‑laundering checks when opening retail accounts. An FSA investigation of 181 accounts opened between January and May 2002 found 89 files lacked sufficient evidence that the customer was who they claimed to be (breaching Rule 3.1.3, which requires firms to obtain sufficient evidence of identity) and seven files where RBS could not supply copies or details of the identity documents used (breaching Rule 7.3.2, which requires firms to retain such records) — two files breached both rules, giving 94 problem files in total. The FSA noted RBS had detected KYC weaknesses itself in December 2001, implemented a remedial plan that reduced failures from April 2002, and co‑operated fully with the investigation; the regulator said those factors materially reduced the size of the penalty.