Nationwide FCA Fine: £44m for Financial Crime Control Failings

In December 2025 the Financial Conduct Authority (FCA) fined Nationwide Building Society 44,078,500 pounds for failings in its financial crime controls over a period of almost five years. The case is not about a single dramatic breach. It is about the slow build-up of ordinary weaknesses: customer files that were not kept up to date, transaction monitoring that ran too late and too bluntly, and a known problem with personal accounts being used for business that was tolerated for years. This guide sets out what the FCA's final notice says and what other firms can take from it. For two other recent UK cases, see our write-ups of the Monzo FCA fine and the CB Payments final notice.

The headline facts

According to the final notice, dated 11 December 2025, the relevant period ran from 1 October 2016 to 1 July 2021. The penalty of 44,078,500 pounds reflects a 30 per cent discount for settling early; the figure before the discount was 62,969,297 pounds. The FCA found that Nationwide breached Principle 3, which requires a firm to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems, as well as the rules in SYSC 6.1.1R and SYSC 6.3.1R on policies and procedures to counter financial crime and to identify, assess, monitor and manage money laundering risk. By the end of the period Nationwide had about 18 million customers and around a tenth of UK current accounts.

Failing one: customer risk information that was not kept current

The notice describes a customer risk assessment system that was not fully operational until early 2019 and that, even after that, relied on data that was incomplete. External consultants who reviewed the position in October 2020 described the number of customers rated high risk, about 2,000 in mid-2020, as exceptionally low for a firm of this size. The notice also describes review policies that called for periodic reviews of customers on a risk-based cycle, with event-driven reviews added in late 2019. The FCA found that for a substantial share of customers Nationwide lacked the systems to carry those reviews out, and that external reviews in October 2020 and June 2021 found no periodic reviews for customers who were not rated high risk, which was a breach of the firm's own policy.

Failing two: transaction monitoring that arrived too late

The notice records that internal and external reviews repeatedly pointed to weaknesses in monitoring. A 2019 review placed Nationwide at stage 2 of 5 on a maturity scale, while peers were at stage 4. Rules were applied uniformly across personal accounts, and individual customer information was used only after a rule had triggered. Monitoring ran in monthly batches, so alerts came after the activity, when funds could already have moved. A February 2021 assessment rated transaction monitoring as needing significant improvement, and a senior financial crime staff member described alert thresholds as very high.

Failing three: personal accounts used for business

Nationwide's terms prohibited business use of personal current accounts, and it did not offer a business current account during the period. An internal audit report in October 2016 estimated about 2,700 accounts were being used for business. In September 2017 a management board tolerated the risk pending a planned small business product. A February 2018 assessment found these accounts generated about 10 per cent of the firm's internal suspicious activity reports and monitoring alerts. The tolerance remained until about April 2020, when the product launch was dropped, and a framework for business use was approved in May 2021. Between August 2020 and August 2024 the firm identified about 16,000 business-use accounts and closed most of them.

The furlough fraud case

The notice illustrates the risk with a customer it calls Customer A. The customer claimed about 27.36 million pounds under the Coronavirus Job Retention Scheme, receiving 24 payments, with 26.01 million pounds arriving over eight days. HM Revenue and Customs later seized about 26.54 million pounds from five accounts, leaving 820,687 pounds unrecovered. The FCA said monthly batch alerts meant that the largest deposits, each over six million pounds, triggered alerts only at the start of the following month. This is the clearest example in the notice of how a design weakness turns into a loss.

Why remediation took so long

The FCA's notice records that Nationwide knew of weaknesses and started improvement work, but did not address them in a timely way. A financial crime transformation programme began around June 2021 and formally ended in June 2024, and a post-period review identified more than 18,000 potentially high-risk customers in addition to those already flagged. The notice says the firm has invested significantly in remediation and cooperated fully with the FCA.

Lessons for firms and advisers

1. Treat a tolerated risk as a decision with an end date. If a known issue is accepted pending a future product, record who accepted it and when it will be revisited.
2. Check whether your customers use products as intended. A personal account used for trading or a business is a different risk from a personal account used for wages.
3. Test whether your high-risk population looks plausible. A very small high-risk number for a large customer base is itself a warning sign.
4. Match monitoring speed to the speed of the money. Batch processing that runs monthly cannot stop a payment made within days.
5. Act on audit findings. The notice shows internal and external reviews flagging the same themes over several years.
6. Make sure policy and system capability agree. A review cycle on paper is worthless if the system cannot run it.

Weak onboarding and monitoring are also where mule accounts begin, which we cover in our guide to money mules and account misuse. For structured training on these controls, take a look at our CPD courses.

What we could not confirm

We worked from the FCA's final notice and press release of December 2025. We read the notice through a summarising tool, and the section on the FCA's reasoning for the size of the penalty and its list of aggravating and mitigating factors was not available to us, so this guide does not cover that. The notice gives slightly different durations for the furlough case in different paragraphs, so we describe it only by its payments and totals. Check figures and rule references against the notice itself before you quote them.

Frequently asked questions

How much was Nationwide fined?

44,078,500 pounds, after a 30 per cent discount for early settlement.

What period did the FCA look at?

1 October 2016 to 1 July 2021.

Which rules did the FCA say were breached?

Principle 3 and the rules in SYSC 6.1.1R and SYSC 6.3.1R.

What was the main example of harm?

A customer who used personal accounts to receive fraudulent furlough payments of about 27.36 million pounds, most of it arriving over eight days.