CB Payments FCA Fine: How High-Risk Customer Onboarding Controls Failed

On 23 July 2024 the Financial Conduct Authority (FCA) fined CB Payments Ltd, the UK e-money firm in the Coinbase group, about 3.5 million pounds for failing to keep to a promise it had made to the regulator. The firm had agreed to a restriction on onboarding certain high-risk customers, and for almost three years its systems let some of them through. The case is a useful lesson for anyone who designs customer onboarding checks, because the failures were not exotic. They were mistakes in how a control was built, tested and monitored. We have also covered a related case from Ireland in our guide to the Central Bank of Ireland's Coinbase Europe settlement, which concerned a different company and a different regulator.

What happened

According to the FCA's final notice, CB Payments agreed to a voluntary requirement, which the notice calls the VREQ, that restricted it from onboarding or serving certain high-risk customers. The FCA found that between 31 October 2020 and 1 October 2023 the firm onboarded or serviced 13,416 customers who should have been caught. It found breaches of the voluntary requirement and of Principle 2, the rule that a firm must conduct its business with due skill, care and diligence. The penalty was 3,503,546 pounds after a 30 per cent discount for settling early.

How the control failed

The FCA's notice sets out a series of design and operating failures. Each is a pattern that appears in other cases:

• The rule logic did not match the requirement. The flag that was meant to stop restricted customers was built from an earlier draft of the requirements, so four of the risk-indicating questions did not trigger it.
• Customers could change their own risk rating. The risk assessment ran on information already held on file rather than at the point of onboarding, so a customer could change an answer and lower their rating.
• Testing was thin. According to the notice, pre-implementation testing covered a single record.
• Some customer groups were never assessed. Customers migrated from other group entities were not checked against the flag, which the notice puts at 1,034 customers.
• Some products sat outside the control. The flag was not applied to the Coinbase Pro product, and a service introduced in June 2022 let flagged customers trade for about four months.
• Manual overrides slipped through. The notice says customer service teams manually credited e-money to 199 flagged customers.
• Monitoring did not track the right thing. The dashboards the firm relied on did not follow flagged customers' access to services.

The notice also records that the breaches went undetected for almost two years and came to light after a complaint to the Financial Ombudsman Service. The firm built a formal control review in December 2022 and a written compliance framework in April 2023, and the FCA acknowledged the work done on remediation, though it did not treat it as mitigation.

The scale of the problem

The FCA's notice describes a large customer base: about 2.8 million customers at the start of the period and about 3.1 million by March 2023, with around 3.9 million customers onboarded across the period. Of the customers affected by the control failures, the notice says 31 per cent made prohibited deposits. It counts 12,912 such deposits worth about 24.9 million US dollars, and says withdrawals and onward cryptoasset transactions totalled about 226 million US dollars. The firm filed 62 suspicious activity reports concerning about 1.75 million US dollars. Those figures show how quickly a control failure compounds when a firm is onboarding customers at volume.

Why the FCA treated it as serious

The FCA considered that the breaches created a significant risk that financial crime would be facilitated. It gave weight to the fact that the voluntary requirement existed precisely to reduce financial crime risk while the firm remediated its controls, and to the firm having been warned in January 2021 that further breaches could lead to enforcement. It also noted that it had published warnings about the sector. The regulator treated the breaches as negligent or inadvertent rather than deliberate, and found little or no profit made directly from them, but added a deterrence uplift because of the firm's size and the duration and persistence of the failings.

Lessons for onboarding and compliance teams

1. Build controls from the final text of the requirement. Keep a traceable line from each clause to each rule or question in the system, and re-check it when the text changes.
2. Do not let a customer's own answers rewrite their risk rating after the fact. Capture the risk at the point of onboarding and log any change with a reason.
3. Test with more than one record. Use realistic cases, including edge cases and each customer route you offer.
4. List every product, entry route and migration path and confirm each one passes through the control. New products and migrated customers are common gaps.
5. Control manual overrides. Any manual credit or exception for a restricted customer needs a recorded approval.
6. Monitor the outcome, not the rule. Track whether restricted customers are actually transacting, rather than only whether the flag fired.
7. Keep records of what you did and when. The FCA noted gaps in the firm's records of its compliance steps.

The same themes appear in our case study of the Monzo FCA fine, and in our guide to money mules and account misuse, because weak onboarding is where mule accounts begin. If your team wants structured training, take a look at our CPD courses.

What we could not confirm

We worked from the FCA's published final notice dated 23 July 2024. We read the notice through a summarising tool, so check exact rule references, figures and dates against the notice itself before you quote them. We have not covered the penalty calculation step by step, and we make no comment on any later events concerning the firm.

Frequently asked questions

Who was fined?

CB Payments Ltd, a UK e-money firm in the Coinbase group, was fined by the FCA on 23 July 2024.

What was the fine?

3,503,546 pounds, after a 30 per cent discount for settling at an early stage.

What rules did the FCA say were breached?

The FCA found breaches of Principle 2 (due skill, care and diligence) and of the voluntary requirement the firm had agreed.

How did the failures come to light?

According to the notice, they surfaced after a complaint to the Financial Ombudsman Service, almost two years after the failures began.