FCA fines for systems and controls failings

The FCA fined Dinosaur Merchant Bank Limited £338,000 for failing to have effective systems and controls to detect and report suspicious trading in its contracts for difference (CFD) business. A new order system introduced in June 2024 led to a sharp rise in CFD trading (about $3.05bn of trades between June and October 2024) that was not captured by the firm’s automated surveillance; DMBL identified the issue in October 2024 but did not fully remedy it until May 2025 and stopped selling CFDs in May 2025. The FCA found breaches of Article 16(2) of UK MAR (the duty to detect and report suspicious orders/transactions), SYSC 6.1.1R (requirement to maintain adequate systems and controls) and Principle 3 (take reasonable care to organise and control its affairs), and applied a 30% cooperation discount (the fine would have been £482,900 without the discount).

The FCA fined former Carillion finance director Richard Adam £232,800 on 7 January 2026 for being knowingly concerned in Carillion’s publication of misleading information. The regulator found he was aware of serious problems in Carillion’s UK construction business but failed to ensure that announcements, or the board and audit committee, were properly informed; the breaches included Article 15 of the Market Abuse Regulation (no false or misleading signals), Listing Rule 1.3.3R (don’t publish misleading information), Listing Principle 1 (have adequate procedures, systems and controls) and Premium Listing Principle 2 (act with integrity). Mr Adam — finance director from April 2007 to 31 December 2016 — withdrew his challenge to the FCA’s decision.

On 7 January 2026 the Financial Conduct Authority fined Zafar Khan £138,900 for being “knowingly concerned” in Carillion’s publication of misleading information in late 2016 and 2017. The FCA found Mr Khan — who had been Carillion’s finance director in 2017 — was aware of serious problems in the company’s UK construction business but failed to ensure announcements, and the board’s oversight, reflected that; he was found to have breached Article 15 of the Market Abuse Regulation (prohibits market manipulation / false or misleading statements), Listing Rule 1.3.3R (do not publish misleading information), Listing Principle 1 (requirement to have adequate procedures, systems and controls) and Premium Listing Principle 2 (requirement to act with integrity). The fine followed Mr Khan’s withdrawal of his challenge to the FCA’s decision.

In December 2025 the Financial Conduct Authority (FCA) fined Nationwide Building Society £44,078,500 for weaknesses in its financial crime controls between October 2016 and July 2021. Nationwide did not keep customer due diligence and risk assessments up to date for its personal current account customers, and its transaction monitoring was ineffective; it also knew some customers were running businesses through personal accounts in breach of its terms but had no proper process to manage the extra risk. In one serious case the society missed chances to spot a customer using personal accounts to receive over £27m in fraudulent Covid furlough payments. Nationwide, which had reported the problems itself and cooperated, agreed to settle and received a 30% discount; the fine would otherwise have been £62,969,297.

The Financial Conduct Authority fined Sigma Broking Limited (FRN 485362) £1,087,300 for breaches of MiFIR and Principle 3 (the requirement to act with due skill, care and diligence). Sigma agreed to resolve the matter through the FCA’s executive settlement procedures and qualified for a 30% discount; without that discount the fine would have been £1,553,300. The action appears on the FCA register dated 2025-07-29 and is recorded in the FCA’s final notice linked below.

On 25 July 2025 the FCA issued a Final Notice fining individual Jean‑Noel Alba £1,049,500 and imposing a prohibition. The notice records breaches of APER 1 and 4 (rules in the Appointed Representatives sourcebook governing obligations of appointed representatives and their oversight) and Individual Conduct Rules 1 and 3 — Rule 1 requires acting with integrity and Rule 3 requires dealing with the FCA openly and cooperatively. The action was taken by the Financial Conduct Authority; the FCA Final Notice is published at the link below.

On 16 July 2025 the FCA fined Barclays Bank UK PLC £3,093,600 for failures in its account‑opening procedures for a client money account used by WealthTek, concluding the bank had inadequate risk‑management systems. The FCA said Barclays breached Principle 3 (firms must organise and control their affairs responsibly and effectively) and SYSC 6.1.1R (requirement to have effective systems and controls). Barclays also agreed to make a voluntary payment of £6,281,757 to WealthTek clients and the FCA said the bank’s extensive co‑operation and that redress were taken into account in reducing the penalty.

In July 2025 the FCA fined Monzo Bank £21,091,300 for inadequate anti-financial crime systems and controls between October 2018 and August 2020, and for repeatedly breaching a requirement it had agreed with the regulator (a "VREQ") not to open accounts for high-risk customers between August 2020 and June 2022. Monzo's customer base grew almost tenfold, from around 600,000 in 2018 to over 5.8 million in 2022, but its onboarding checks, customer risk assessments and transaction monitoring did not keep pace: customers were able to open accounts using obviously implausible addresses such as Buckingham Palace, and more than 34,000 high-risk customers were signed up while the restriction was in force. Monzo agreed to settle and qualified for a 30% discount; without it the fine would have been £30,130,475.

The FCA fined the London Metal Exchange £9,245,900 for breaches of REC 2.5.1 (para 3(1) and 3(2)(h)) and MiFID RTS 7 (Article 18(3) and (4)). Broadly, the FCA found the LME failed to have in place and operate adequate arrangements, systems and controls a recognised body must have to prevent or address disorderly trading and to apply suspension/removal safeguards. The penalty is recorded as 'after settlement' on the FCA register (the sanction was agreed with the regulator); the FCA final notice sets out the factual and temporal detail of the breaches.

The FCA fined Mako Financial Markets Partnership LLP £1,662,700 after finding that between 16 December 2013 and 16 November 2015 the firm did not have, and did not adequately apply, policies and procedures to identify and address the risk of being used to facilitate financial crime and money laundering in relation to business introduced by the Solo Group. The regulator concluded Mako breached Principle 2 (firms must act with due skill, care and diligence) and Principle 3 (firms must take reasonable care to organise and control their affairs responsibly and effectively). Mako agreed to resolve all issues of fact and liability; the FCA's action took effect on 17 February 2025 and is set out in the Final Notice linked below.

The FCA found that Arian Financial LLP failed to have effective anti‑financial‑crime systems and controls between 29 January 2015 and 29 September 2015, putting the firm at risk of being used to support fraudulent trading and money‑laundering for clients of four authorised entities (the Solo Group). The FCA imposed a financial penalty but Arian admitted liability and referred the proposed fine to the Upper Tribunal; the Tribunal decided on 11 November 2024 to reduce the FCA’s penalty from £744,745 to £288,962.52, and the FCA’s Final Notice took effect on 9 January 2025. (Principle 2 requires firms to conduct business with due skill, care and diligence; Principle 3 requires firms to take reasonable care to organise and control their affairs with adequate risk management and systems.)

On 12 November 2024 the Financial Conduct Authority fined Metro Bank Plc £16,675,200 for breaching Principle 3 of the FCA’s Principles for Businesses between 6 June 2016 and 17 December 2020. Principle 3 requires a firm to take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk‑management systems. The FCA’s Final Notice setting out the authority’s findings is published on the FCA website.

The FCA fined Starling Bank £28,959,426 for failings in its financial crime systems and controls between December 2019 and November 2023 — the regulator's first fine against a digital challenger bank. Starling's customer numbers grew from about 43,000 in 2017 to 3.6 million in 2023 but its safeguards did not keep up: in January 2023 it discovered that since 2017 its automated screening had been checking customers against only a fraction of the full financial sanctions list, and it breached a requirement agreed with the FCA in 2021 not to open accounts for high-risk customers by opening over 54,000 accounts for around 49,000 such customers between September 2021 and November 2023. The FCA described the bank's controls as "shockingly lax". Starling agreed to settle and received a 30% discount; the fine would otherwise have been £40,959,426.

On 29 September 2023 the Financial Conduct Authority imposed a £6,470,600 financial penalty on ADM Investor Services International Limited (FRN 148474) under section 206 of the Financial Services and Markets Act 2000. The penalty was for deficient anti‑money‑laundering systems and controls at the firm during the period 30 September 2014 to 31 October 2016. The FCA's Final Notice on the action is published on its website.

Bastion Capital London Ltd (in liquidation) was fined £2,452,700 by the Financial Conduct Authority for breaches of Principle 2 (firms must conduct business with due skill, care and diligence) and Principle 3 (firms must take reasonable care to organise and control their affairs responsibly and effectively, including adequate risk-management systems). The FCA’s action related to conduct between January 2014 and September 2015 and the penalty was imposed on 12 July 2023. The action is recorded in the FCA’s final notice for the firm.

The FCA fined Barclays Bank £783,800 in February 2022 for weak oversight of its business customer Premier FX, a small payments firm for which Barclays was the sole UK banker. Premier FX collapsed in 2018 after the death of its sole director, when it emerged it had been taking deposits it was not authorised to take and had not kept client money separate, leaving 167 customers — mostly British expats in Spain and Portugal — with losses of just over £10 million. The FCA found Barclays failed to act with due skill, care and diligence: it did not check that Premier FX's real activity matched what it expected, and it missed signs that the firm's internal controls were deficient. Barclays settled early for a 30% discount and voluntarily paid £10,076,943.75 so that every customer with an accepted claim got all their money back.

On 15 December 2020 the Financial Conduct Authority issued a Final Notice fining Barclays Bank UK PLC, Barclays Bank PLC and Clydesdale Financial Services Limited after finding that between 1 April 2014 and 31 December 2018 the firms failed to treat business and retail customers in arrears or financial difficulty with forbearance and due consideration. The FCA said the firms breached Principle 6 (must pay due regard to customers’ interests and treat them fairly), Principle 3 (must organise and control their affairs responsibly and effectively) and CONC rules on treating customers in default or arrears. The FCA action took effect on 15 December 2020; the regulator’s Final Notice is at the URL you provided. The FCA register entry and Final Notice set out the breaches and the period examined.

The Prudential Regulation Authority (PRA) issued a Final Notice on 19 November 2014 fining The Royal Bank of Scotland Plc, National Westminster Bank Plc and Ulster Bank Ltd £14,000,000 for failures in IT risk management between 1 August 2010 and 10 July 2012. The PRA found the Group‑wide Technology Services function did not manage or plan changes to IT systems adequately, the IT-specific 'three lines of defence' did not control IT risks effectively, and the group had a limited understanding of IT operational risk. The breach was of the FSA’s Principle 3 (now PRA Fundamental Rule 6) — i.e. the requirement to have adequate systems and controls to identify and manage risks. The FCA register records this action on 5 February 2016.

The FCA fined Aviva Investors Global Services Limited £17,607,000 for failures in management and control and conflicts-of-interest rules and breaches of Conduct of Business sourcebook (COBS) rules. The firm failed to put in place adequate systems and controls to manage conflicts created by running hedge funds with high performance fees alongside other funds, creating incentives and a weak control environment that allowed two traders to delay trade bookings, misallocate trades and cherry‑pick in May 2013. Aviva Investors paid £135,000,000 compensation to eight impacted funds, and qualified for a 30% early‑settlement discount, so the undiscounted penalty would have been £25,152,900; the Final Notice was published by the FCA on 2015-02-24.

On 20 November 2014 the FCA fined Royal Bank of Scotland, NatWest and Ulster Bank £42 million for the IT meltdown of June 2012, when a software compatibility problem in the banks' systems left more than 6.5 million UK customers unable to use online banking, see accurate balances at cash machines or make payments — in some cases for several weeks. The FCA found the immediate cause was a software compatibility problem, but the underlying failure was that the banks had not put in place adequate systems and controls to identify and manage their exposure to IT risk, breaching the rule that firms must organise and control their affairs responsibly. The banks settled at an early stage and received a 30% discount. In the first joint enforcement action of its kind, the Bank of England's Prudential Regulation Authority separately fined the banks £14 million for the same incident, taking the total to £56 million.

On 12 November 2014 the FCA fined The Royal Bank of Scotland £217 million as part of a record £1.1 billion settlement with five banks (RBS, Citibank, HSBC, JPMorgan Chase and UBS) over failings in their spot foreign exchange trading. Between 1 January 2008 and 15 October 2013 ineffective controls allowed traders to share confidential information about client orders in chat rooms and coordinate their trading to manipulate benchmark exchange rates, putting the banks' interests ahead of their clients and the wider financial system. RBS settled early and received a 30% discount; without it the fine would have been £310 million. The bank also paid $290 million to the US Commodity Futures Trading Commission the same day, suspended three employees and launched a review of the conduct of more than 50 current and former traders.

The FCA imposed a £37,745,000 penalty on Barclays Bank plc for failures in how it organised and controlled safe custody arrangements and for not arranging adequate protection for client safe custody assets. The breaches (of Principles 3 and 10 and multiple CASS rules) related to about £16.5bn of client safe custody assets held or arranged for between 1 November 2007 and 24 January 2012. Barclays qualified for a 30% early‑settlement discount, so the headline penalty was reduced from £53,921,619 to £37,745,000. The FCA said the failings left clients at risk of extra costs, lengthy delays or loss of assets had Barclays become insolvent during the Relevant Period.

On 28 July 2014 the Financial Conduct Authority imposed a combined £105,000,000 penalty on Lloyds Bank plc and Bank of Scotland plc for manipulating submissions to two benchmark rates (the Repo Rate and LIBOR), in breach of Principles 3 and 5. The penalty was split equally between the two firms (so £52,500,000 each) and was discounted from £150,000,000 for early settlement. Principle 5 requires firms to observe proper standards of market conduct; Principle 3 requires firms to take reasonable care to organise and control their affairs responsibly. The FCA final notice is linked below; the register entry does not state the exact period of the misconduct.

On 28 July 2014 the FCA fined Lloyds Bank plc and Bank of Scotland plc a total of £105,000,000 (split £52.5m each), a figure discounted from an original aggregate penalty of £150,000,000 for early settlement. The FCA found the firms breached Principle 3 (firms must take reasonable care to organise and control their affairs) and Principle 5 (firms must observe proper standards of market conduct) by manipulating submissions used to calculate two benchmark reference rates — the sterling Repo Rate and LIBOR — in order to seek to influence those rates. The penalty and the settlement discount are recorded in the FCA final notice dated 28 July 2014.

On 23 May 2014 the FCA fined Barclays Bank PLC £26,033,500 for breaches of Principles 3 and 8 relating to the London Gold Fixing. The FCA found that between 7 June 2004 and 21 March 2013 Barclays failed to manage conflicts of interest and had inadequate systems, controls, policies and training around staff participation in the Gold Fixing while the bank also sold options that referenced the fixed gold price. The regulator highlighted a specific incident on 28 June 2012 when a Barclays trader who was responsible for risk-managing a customer option participated in the 3:00pm Gold Fixing and placed orders intended to increase the chance the fix would be below a level, putting his interests ahead of the customer’s. The FCA noted Barclays did not formally record Gold Fixing orders until 5 February 2013 and did not identify Gold Fixing transactions separately from spot trades until 21 March 2013; the fine was reduced from £37,190,800 because of a Stage 1 settlement discount.

On 10 December 2013 the FCA fined Lloyds TSB Bank plc and Bank of Scotland plc a combined £28,038,800 for breaches of Principle 3 (firms must act with due skill, care and diligence). The breaches arose from serious deficiencies in systems and controls over financial incentives for branch advisers who sold protection and investment products between 1 January 2010 and 31 March 2012 — incentives included variable pay, bonus thresholds and a strong bias toward protection sales that created a significant risk of inappropriate recommendations. The firms settled early and received a 20% settlement discount (the penalty would otherwise have been £35,048,500); they are reviewing sales by higher‑risk advisers in the Relevant Period and will provide redress to customers where appropriate.

The FCA fined Lloyds TSB Bank plc and Bank of Scotland plc £28,038,800 on 10 December 2013 for breaches of Principle 3 (firms must take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk management systems). Between 1 January 2010 and 31 March 2012 the banks had serious failings in systems and controls over sales incentives for branch advisers: pay structures (variable salaries, bonus thresholds) and a bias towards protection products created a material risk of inappropriate advised sales. Monitoring and governance were inadequate (including a flawed competency control that allowed advisers with identified sales issues to receive pay rises/bonuses) and senior management collectively failed to give incentives robust oversight. The firms settled early and received a 20% settlement discount (Stage 2), and are reviewing sales by higher‑risk advisers and will provide customer redress where appropriate.

On 15 February 2013 the FSA (the FCA's predecessor) imposed a single Final Notice fining Lloyds TSB Bank Plc, Lloyds TSB Scotland Plc and Bank of Scotland Plc (together Lloyds Banking Group) £4,315,000 for failing to pay PPI redress promptly during 5 May 2011–9 March 2012. The firms had sent 582,206 decision letters agreeing redress but failed to make payment within 28 days in up to 140,209 (24%) cases; 24,589 payments inadvertently dropped out of the process and required remedial action. The FSA found breaches of Principle 3 (must organise and control affairs responsibly and effectively) and DISP 1.4.1R(5) (must comply promptly with accepted offers of redress); Lloyds settled early and received a 30% executive‑settlement discount (the fine would otherwise have been £6,164,327), carried out a full reconciliation, paid interest where appropriate and implemented process fixes including a PPI payment validation tool.

On 15 February 2013 the Financial Services Authority (the FSA, the FCA’s predecessor) imposed a final notice and a £4,315,000 penalty on Lloyds TSB Bank Plc, Lloyds TSB Scotland Plc and Bank of Scotland (together Lloyds Banking Group) for failing to pay PPI redress promptly to complainants between 5 May 2011 and 9 March 2012. The FSA said LBG sent 582,206 decision letters agreeing to pay redress but failed to make payments within its 28‑day target in up to 140,209 (24%) cases; 24,589 cases had inadvertently dropped out of the payments process and remedial action was required. The FSA found breaches of Principle 3 (firms must take reasonable care to organise and control their affairs, including adequate risk management systems) and DISP 1.4.1R(5) (firms must comply promptly with offers of redress accepted by complainants); LBG agreed an early settlement (a 30% Stage 1 discount) and carried out a full reconciliation, paid interest at 8% p.a. where appropriate, and implemented process improvements including a PPI payment validation tool.

On 6 February 2013 the Financial Services Authority (the FSA) imposed a £87.5m penalty on The Royal Bank of Scotland plc for misconduct relating to LIBOR. The FSA found that between January 2006 and March 2012 RBS breached Principle 3 (firms must establish and maintain adequate risk management systems and controls) and that between October 2006 and November 2010 it breached Principle 5 (firms must observe proper standards of market conduct). The final notice says RBS sought to manipulate Japanese yen and Swiss franc LIBOR submissions and to influence other banks’ JPY submissions to benefit its derivatives and money‑market trading books, and that RBS did not have adequate systems and controls for its LIBOR submission process until March 2011, with initial measures remaining inadequate.

On 19 October 2012 the FSA issued a Final Notice fining Bank of Scotland plc £4.2m for holding inaccurate records for about 250,000 Halifax mortgage customers. The errors arose because mortgage information was held on two unsynchronised systems (with manual updates in some cases), so customers missed important updates to mortgage terms between 2004 and 2011 and some were wrongly excluded from a redress programme (a Voluntary Variation of Permission). The errors led the firm to contact 33,700 customers who should not have been included and to make £20.4m of goodwill payments to 22,700 of them; the FSA reduced an initial proposed penalty of £6m to £4.2m after applying a Stage 1 discount. The breach was of Principle 3 (firms must take reasonable care to organise and control their affairs).

On 27 June 2012 the Financial Services Authority (FSA), the FCA's predecessor, fined Barclays Bank £59.5 million — its largest ever fine — for misconduct in the way it submitted rates for LIBOR and EURIBOR, the benchmark interest rates that underpin trillions of pounds of loans and financial contracts. Between 2005 and 2009 Barclays' submissions took account of requests from its own derivatives traders who stood to profit, it tried to influence other banks' EURIBOR submissions, and during the financial crisis it lowered its LIBOR submissions because senior managers were worried about negative media comment on the bank's health. The FSA found Barclays lacked adequate controls over the process and failed to act with due skill and care when concerns were raised internally. Barclays settled early for a 30% discount (the fine would otherwise have been £85 million) and paid a further $360 million to US authorities, bringing the total to about £290 million; within days chairman Marcus Agius and chief executive Bob Diamond had resigned.

On 9 March 2012 the FSA issued a Final Notice publicly censuring Bank of Scotland plc for breaching Principle 3 of the FSA’s Principles for Business during January 2006 to December 2008. Principle 3 requires firms to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk‑management systems. The FSA found the bank’s Corporate Banking Division pursued an aggressive growth strategy in high‑risk, sub‑investment grade lending without taking reasonable steps to assess, manage or mitigate the risks, maintained weak controls and oversight as markets deteriorated in 2007, and between April and December 2008 failed to take reasonable care over high value transactions showing signs of stress. The FSA said a financial penalty would have been merited and substantial but, in the exceptional circumstances of the case, decided not to impose one and issued a public censure instead.

On 25 May 2011 the FSA fined Bank of Scotland plc £3.5m for breaches of Principle 3 (management and control) and Principle 6 (customers' interests) arising from failings in its complaint‑handling arrangements between 30 July 2007 and 31 October 2009. The firm agreed an early settlement and received a 30% stage‑1 discount (the headline sanction would otherwise have been £5m). The FSA found a significant number of complaints about BOS’s investment advice were wrongly decided: BOS reviewed a sample of 275 rejected complaints and overturned 45% (of those it will now uphold, 77% were by inexperienced customers and 55% were aged over 60), and the FSA’s own review reached consistent findings. During the Relevant Period BOS received 2,592 complaints; it has paid £2.4m in compensation to date, the FSA expected further compensation of around £15m, and BOS agreed to review all rejected complaints from 1 Feb 2004 to 31 Dec 2009 and to target a review of sales to 8,000 customers classed as ‘cautious’, proactively paying compensation where due and improving its sales and complaints processes.

On 20 January 2011 the Financial Services Authority (the FSA) fined City Index Limited £490,000 for failures in transaction reporting between 5 November 2007 and 21 September 2009. The firm breached SUP 17 (transaction reporting requirements) and Principles 2 and 3 (Principle 2 requires firms to conduct business with due skill, care and diligence; Principle 3 requires firms to take reasonable care to organise and control their affairs). The FSA found City Index failed to report about 55,000 transactions and submitted roughly 1,970,000 reports with one or more data fields completed incorrectly (nearly 60% of its reportable transactions), primarily because it did not identify fundamental errors after implementing a new trading platform and had inadequate reporting processes and controls; the FCA register entry records the financial penalty and does not record other consequences such as redress, a settlement discount or an appeal.

On 11 January 2011 the FSA fined Royal Bank of Scotland Plc and National Westminster Bank Plc £2,800,000 for failings in complaint handling by their RBS UK Retail branch network between 1 December 2008 and 25 March 2010. The firms breached Principle 3 (management and control — firms must organise and control their affairs responsibly) and Principle 6 (customers' interests — firms must pay due regard to customers' interests) and qualified for a 30% early‑settlement discount (the undiscounted penalty would have been £4,000,000). The FSA found monitoring focused on process not customer outcomes, poor quality investigations and guidance for complaint handlers, weak use of Financial Ombudsman Service decisions, delays in responses and correspondence that did not fully address customers' concerns. The notice records that the firms cooperated, engaged a skilled person review, increased use of specialist handlers and reassessed complaint files; no further remedies or appeals are specified in the text provided.

On 2 August 2010 the Financial Services Authority (the FSA) fined four members of the Royal Bank of Scotland Group £5,600,000 for breaches of the Money Laundering Regulations 2007 that took place between 15 December 2007 and 31 December 2008. The breaches were failures in systems and controls to prevent breaches of UK financial sanctions: RBSG did not adequately screen incoming cross‑border payments (and certain sterling and euro payments), missed the majority of trade‑finance SWIFT messages, failed to record and continuously screen directors and beneficial owners, and did not maintain effective ‘fuzzy matching’ parameters in its screening software. RBSG agreed an early settlement so qualified for a 30% (Stage 1) discount (the penalty would otherwise have been £8,000,000); once current management identified the problems they reported them to the FSA, implemented remedial screening and governance improvements and cooperated with the investigation.

On 19 August 2009 the Financial Services Authority (FSA) fined Barclays Bank plc and Barclays Capital Securities Limited £2,450,000 (reduced from £3,500,000 for early settlement) for breaches occurring between 1 October 2006 and 31 October 2008. The FSA found Barclays failed to submit accurate transaction reports (SUP 17) in relation to an estimated 57.5 million transactions. The regulator also concluded Barclays breached Principle 2 (to conduct business with due skill, care and diligence — here, by not sufficiently reviewing its transaction‑reporting systems) and Principle 3 (to take reasonable care to organise and control its affairs, including adequate risk management systems, to meet reporting requirements).

The FSA found that Morgan Stanley & Co. International Plc breached Principles 2 and 3 of the FSA’s Principles for Businesses (Principle 2: conduct business with due skill, care and diligence; Principle 3: take reasonable care to organise and control its affairs) during the period November 2007 to May 2008. A Decision Notice dated 1 April 2009 imposed a financial penalty of £1.4 million under section 206 of the Financial Services and Markets Act 2000; the action is recorded on the FCA register on 13 May 2009. The register entry does not record any customer redress, settlement discount or subsequent appeal.

On 14 February 2007 the Financial Services Authority (FSA) fined Nationwide Building Society £980,000 for breaching Principle 3 (which requires firms to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk‑management systems) in the period 1 December 2004 to 1 December 2006. The FSA found Nationwide had weak information‑security risk assessment, inadequate procedures, training and controls, and a poor incident response after a laptop containing customer information was stolen, exposing customers to the risk of financial crime. Nationwide qualified for a 30% early‑settlement discount (the FSA said the undiscounted penalty would have been £1.4m) and had taken mitigating steps including disabling remote access, writing to customers, offering to reimburse customers who proved financial loss, increasing anti‑fraud monitoring and commissioning an independent review of its information security.

The FSA found that on 2 August 2004 Citigroup Global Markets Limited (CGML) ran a large, technology‑enabled trading strategy in European government bonds—building very substantial long positions and then exiting them quickly via many simultaneous trades on the MTS platform—which caused short‑term disruption to MTS volumes and sharp price falls. The FSA concluded CGML breached Principle 2 (to conduct business with due skill, care and diligence) and Principle 3 (to organise and control its affairs and have adequate risk management) because the trade was not escalated to senior management, control functions were not consulted, clear size parameters were not set or reviewed, and trader supervision was inadequate. The FSA imposed a penalty made up of a relinquishment of profits of £9,960,860 and an additional penalty of £4,000,000; the decision was recorded on 28 June 2005.

The Financial Services Authority (FSA) fined City Index Ltd £35,000 (recorded 23 March 2005) for producing misleading financial promotions for spread betting and CFDs that were communicated between September and November 2003. The promotions, run in national newspapers, magazines and on carrier bags, failed to give a clear, simple and prominent warning that a customer’s liability may exceed their initial deposit; a carrier‑bag promotion offering a “free £25 bet” required an initial spread bet (so was not free). The FSA also found that City Index had ineffective systems and controls for approving financial promotions; the register entry records only the financial penalty and does not record any redress, settlement discount or appeal.

The FSA fined The Governor and Company of the Bank of Scotland £1,250,000 on 12 January 2004 for widespread failures in keeping customer identification records. A 2002 internal review found a 55% failure rate across the Retail, Corporate and Business divisions; the FSA’s investigation concluded the bank breached ML 7.3.2 (firms must retain a copy of customer identification evidence or a record of where it can be obtained) and ML 2.1.1 (firms must set up and operate arrangements to ensure they comply with the Money Laundering rules). The FSA noted the failings dated back at least to 2000, accepted that the bank promptly implemented remedial plans and co‑operated with the investigation, and said those factors reduced the size of the penalty.

On 9 December 2003 the FSA fined Abbey National Asset Managers Limited (ANAM) £320,000 for failures in senior management arrangements, systems and controls between December 2001 and June 2003. The regulator found ANAM did not have appropriate systems and controls, was slow to address divisional compliance concerns arising from its Risk Mitigation Programme and from two dealing desks, and had insufficient compliance resource and management information. The breaches were of FSA Principle 2 (which requires firms to act with due skill, care and diligence) and SYSC rules on senior management arrangements; ANAM paid about £300,000 in compensation to clients, implemented detailed systems and controls in June 2003, and the FSA said ANAM’s early agreement of facts and settlement were taken into account when deciding the penalty.

On 12 December 2002 the FSA fined the Royal Bank of Scotland plc £750,000 for widespread failures in anti‑money‑laundering checks when opening retail accounts. An FSA investigation of 181 accounts opened between January and May 2002 found 89 files lacked sufficient evidence that the customer was who they claimed to be (breaching Rule 3.1.3, which requires firms to obtain sufficient evidence of identity) and seven files where RBS could not supply copies or details of the identity documents used (breaching Rule 7.3.2, which requires firms to retain such records) — two files breached both rules, giving 94 problem files in total. The FSA noted RBS had detected KYC weaknesses itself in December 2001, implemented a remedial plan that reduced failures from April 2002, and co‑operated fully with the investigation; the regulator said those factors materially reduced the size of the penalty.