Monzo FCA Fine: When Growth Outran Financial Crime Controls

In July 2025 the Financial Conduct Authority fined Monzo Bank £21,091,300 for failings in its anti-money laundering systems and controls. The case is a modern textbook example of what happens when a fast-growing digital bank's financial crime controls do not keep pace with its customer growth. It is useful reading for anyone who works in onboarding, compliance or audit, and for accountants who advise fintech clients. This case study draws on reporting of the FCA's final notice by Mishcon de Reya, Payment Expert and Financial Reporter. We could not read the final notice itself, so details below are attributed to those summaries and should be checked against the FCA's publication before being quoted.

The headline facts

• The FCA issued its final notice on 7 July 2025, and the fine was reported on 8 July 2025.
• According to Mishcon de Reya, the penalty was £21,091,300 after a 30% discount for early settlement, which means the penalty before the discount would have been about £30.1 million.
• The FCA found a breach of Principle 3, which requires a firm to organise and control its affairs responsibly and effectively with adequate risk management systems.
• The period of failings ran from October 2018 to June 2022, according to Mishcon de Reya, with the second part of that period involving a breach of a requirement the FCA agreed with the bank in August 2020.

What went wrong

The reports describe several connected weaknesses:

• Thin information at onboarding. Mishcon de Reya reports that Monzo did not collect key information such as the purpose of the account, expected activity, occupation or source of wealth, and that business accounts were opened without full verification of beneficial owners.
• Unverified addresses. Payment Expert reports that implausible addresses, including well-known London landmarks, were accepted, and Mishcon de Reya names examples such as 10 Downing Street and Buckingham Palace.
• Weak risk assessment. Mishcon de Reya reports that most personal customers defaulted to a "no identified risk" rating.
• Politically exposed persons. Both sources report weak policies for identifying politically exposed persons and inadequate enhanced due diligence in many high-risk cases.
• Transaction monitoring. Alerts were handled by staff who were under-trained or inexperienced, according to Payment Expert. Mishcon de Reya adds that nearly half of alerts were closed as "undecided".

Our guide to politically exposed persons and our guide to transaction monitoring and adverse media screening explain the controls that were reported as weak.

The requirement that was breached

In August 2020 the FCA put a requirement on Monzo, alongside an independent review of its financial crime framework. It barred the bank from opening accounts for new high-risk customers, as defined by a risk matrix. Reports say the bank still opened more than 33,000 accounts in breach of it, at least 26,325 of which were for high-risk customers. Payment Expert reports that Monzo failed to test its compliance with the requirement and did not adequately identify or fix breaches as they happened, and Mishcon de Reya points to technical failures and weak governance as causes. The requirement was lifted in February 2025.

Growth outran the controls

The FCA's message, as reported, was that controls did not keep pace with growth. Reports of the case describe a very large increase in customers over the period, although the exact figures differ between summaries, so we have not quoted them. The FCA's Therese Chambers is quoted as saying that "Monzo fell far short of what we, and society, expect" and that banks are a vital line of defence in the fight against financial crime. Financial Reporter also notes that this was the tenth FCA fine on a bank for financial crime control failings in four years. The FCA acknowledged that Monzo cooperated with the investigation, and the bank has since reported improvements to onboarding and monitoring.

Lessons for compliance teams and accountants

1. Scale the controls with the customer base. A control framework designed for a small customer base can fail quietly as volumes grow. Review the framework at each growth milestone.
2. Collect the basics at onboarding. Purpose of account, expected activity, occupation and source of wealth are the information later monitoring depends on.
3. Do not default to low risk. If almost every customer is rated low risk, the risk assessment is probably not doing its job.
4. Test your own restrictions. If a regulator or the board imposes a limit on high-risk onboarding, build a way to prove that it is working and run it regularly.
5. Resource and train alert handlers. Alerts closed without a clear decision are a signal that the monitoring function is under strain.
6. Clear ownership matters. Weak governance and unclear responsibilities were reported alongside the technical failures.

Compare the case with the earlier enforcement action covered in our Danske Bank case study, which involved a much larger scale of suspicious flows but a similar theme: controls that did not match the business.

Frequently asked questions

How much was Monzo fined?

£21,091,300, according to reporting of the FCA's final notice, after a 30% discount for early settlement.

Did the FCA find evidence of money laundering by Monzo?

The fine was for failing to have adequate systems and controls, which the FCA treats as a breach of Principle 3. It does not mean every account was used for laundering.

Why does this matter to accountants?

Accountants advise and audit fintech and payment clients, and the same control weaknesses appear in smaller firms. See Learnsignal's CPD courses for finance professionals for training.