Metro Bank FCA Fine: £16.7m for Transaction Monitoring That Missed 60 Million Transactions

On 12 November 2024 the Financial Conduct Authority (FCA) fined Metro Bank plc 16,675,200 pounds because its automated transaction monitoring system did not monitor a significant share of customer transactions. There was no sophisticated scheme behind it. The cause was a data feed that rejected records, a design that nobody tested end to end, and staff warnings that did not turn into action. The FCA's press release says more than 60 million transactions worth over 51 billion pounds went unmonitored. If your firm relies on a monitoring system, this case is a checklist of the questions to ask about it. It pairs well with our guide to the Nationwide final notice, which also turned on monitoring that was weaker than it looked.

The headline facts

According to the final notice, the relevant period ran from 6 June 2016 to 17 December 2020. The penalty of 16,675,200 pounds reflects a 30 per cent settlement discount, and the figure before the discount was about 23.8 million pounds. The FCA found that Metro breached Principle 3, which requires a firm to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems. The notice also sets out the financial crime rules in SYSC 6 and the Money Laundering Regulations 2007 as the standards the firm was expected to meet.

How the monitoring system failed

The monitoring system went live on 6 June 2016 and took its data from a near real-time copy of the bank's core banking records. The notice describes a chain of dependencies that made it fragile. A customer record could be rejected because of a problem with a field such as an address, a postcode or a country. A rejected customer record then blocked the matching account record, and a missing account record blocked the transactions on that account. The system could not replay the transactions it had missed. A separate timestamp coding error meant that when an account was opened and used on the same day, the account record was excluded from the feed, and its transactions were rejected too.

The result, according to the notice, was that at least 60,483,951 of 1,008,426,668 transactions, about 6 per cent, were rejected, with a value of at least 51.25 billion pounds out of 675.8 billion. Partnerships were hit hardest: the bank's April 2018 report on bad data found they made up 62 per cent of rejected customer records. The notice also describes a separate problem in which internal ledger transactions were fed into the system and rejected, which obscured the true picture of customer transactions.

Warnings that were not acted on

This is the part of the notice that governance teams should read closely. It records that:

• Staff raised concerns in mid to late 2017.
• In January 2018 a financial crime steering group agreed to a review, but the action was removed from the final minutes as lacking context and not yet substantiated.
• A working group formed in March 2018 and a report on bad data followed.
• Between May and August 2018 an operations risk board ranked bad data among its top five risks, but the actions were then reassigned and dropped from tracking after 16 August 2018.
• No management information or periodic reporting on bad data existed during the period.

The FCA found no formal record of escalation and no substantive action until the bank engaged an outside firm in December 2018. The timestamp error was found on 17 April 2019 during testing, the FCA was told on 29 May 2019, and a tactical fix was applied on 21 July 2019.

A fix that could not be proved

The July 2019 fix worked: rejected transaction records fell from 1,352,665 in that month to 438 in August 2019. But the bank had no reconciliation control, so it could not show that its monitoring matched its source data. The notice says it only learned after the period that monitoring had been at least 99.7 per cent consistent since the fix. A reconciliation control was not put in place until 17 December 2020, and the fix for internal transactions arrived on 14 December 2020.

The look-back review

Metro ran a look-back over transactions that had gone unmonitored. The notice says the exercise covered about 212,000 customers and about 528,000 accounts, and more than 46.6 million previously unmonitored transactions worth about 31.6 billion pounds. An audit of the look-back found a coding error that had excluded some customers, which led to further alerts. In total, the notice says the remediation led to 153 suspicious activity reports and 43 account closure notices. That is a reminder that gaps in monitoring have a human cost to detection: some activity was only found years later.

How the FCA weighed it

The FCA rated seriousness at level 4 on its five-level scale, citing serious or systemic weaknesses and a significant risk that financial crime would be facilitated, while noting little or no loss or risk of loss to consumers. It reduced the figure for proportionality. It counted as aggravating factors that it had published guidance on automated transaction monitoring in 2008 and 2011, that it had issued earlier notices against other firms for anti-money laundering failings, and that Metro had a previous fine of 10,002,300 pounds for a separate Listing Rule breach. It treated as mitigating Metro's cooperation, which it said was materially above expectations, and its remediation programme.

Lessons for firms

1. Reconcile what you monitor to what exists. Compare transaction counts in the source system to the monitoring system on a regular basis.
2. Treat data quality as an anti-money laundering control. Rejected records are unmonitored customers.
3. Test the whole chain, not the rules. A monitoring rule is worth nothing if the data never reaches it.
4. Escalate junior staff concerns to a named owner. Actions that drop out of tracking are lost.
5. Report data failures to management. No management information meant no one saw the trend.
6. Prove a fix worked. Build the reconciliation control with the fix, not after.

Our guide to AI in AML transaction monitoring covers the technology side, and our guide to the Starling Bank final notice shows how a configuration error can go unnoticed for years. For structured training, take a look at our CPD courses.

What we could not confirm

We worked from the FCA's press release and final notice, read through a summarising tool. The notice we could read was cut off near its end, and its figures differ slightly between paragraphs, so we use rounded numbers and the headline penalty. Check figures and dates against the notice before you quote them.

Frequently asked questions

How much was Metro Bank fined?

16,675,200 pounds, after a 30 per cent settlement discount.

What was wrong with the monitoring system?

A data feed rejected customer and account records, so a share of transactions never reached the monitoring system, and the bank had no reconciliation control to show it.

How many transactions went unmonitored?

At least 60 million transactions worth at least 51 billion pounds, according to the FCA.

How did the FCA treat staff warnings?

It found staff had raised concerns from 2017, but there was no formal record of escalation and no substantive action until December 2018.