Starling Bank FCA Fine: High-Risk Accounts and Sanctions Screening Failures

In September 2024 the Financial Conduct Authority (FCA) issued a final notice fining Starling Bank Limited 28,959,426 pounds, with the announcement following on 2 October 2024. The FCA found two separate failings: the bank opened accounts for high-risk customers in breach of a restriction it had agreed with the regulator, and its automated sanctions screening checked customers against only a small part of the sanctions list for more than five years. The case is useful because it shows how fast growth, a control that looks reasonable on paper and a configuration error can combine. It also shares a theme with our guide to the CB Payments final notice, where a similar restriction was breached.

The headline facts

According to the final notice, dated 27 September 2024, the penalty reflects a 30 per cent settlement discount, and the figure before the discount was 40,959,426 pounds. The FCA found a breach of Principle 3, which requires a firm to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems, and a contravention of the restriction the bank had agreed in 2021. The overall period examined ran from 1 December 2019 to 30 November 2023. The FCA's press release says the customer base grew from about 43,000 in 2017 to about 3.6 million in 2023, and that the case took 14 months to resolve.

Failing one: the restriction on high-risk customers

The notice says the restriction was imposed on 17 September 2021 after Starling applied for it. In essence the bank agreed it would not accept or process new account applications from high-risk or higher-risk persons while it fixed its controls. The FCA found that the bank went on to open 54,359 accounts for 49,183 customers it should not have taken on. In July 2022 a control failure meant 294 customers who had previously been exited opened new accounts, of whom 161 had a prior suspicious activity report against them and 112 had a full or partial match on the CIFAS fraud database. A further review in November 2022 found 309 more accounts.

The notice also records that the bank's own financial crime risk was rated red in November 2022. It says Starling failed to consider several high-risk factors, and gives sanctions risk as an example: it was rated low despite factors such as payments linked to crypto platforms and multicurrency accounts. Remediation began with daily testing from January 2023 and automated daily controls by May 2023, and April 2024 was the first month with no breaches.

Failing two: sanctions screening that covered a fraction of the list

The notice says a system misconfiguration meant that from 20 July 2017 customers were checked only against designated persons with a UK link, which was 39 of 3,088 designated persons on the list. Customers were screened only every 14 days and only after onboarding, and not all cross-border payments were screened. The FCA noted that at least one designated person opened an account during the period.

The problem came to light when a second line of defence sanctions screening review identified it on 30 January 2023. Starling reconfigured the system on 10 February 2023 and told the FCA on 16 February 2023. The notice adds that an internal audit report in November 2018 had flagged gaps in financial crime controls and recommended fixes within a year.

The clean-up

Starling screened its whole customer base of about 3.5 million in February 2023, which produced roughly 48,000 alerts. It then reviewed 3,988,143 payments made between 2017 and 2023, which produced 795,712 alerts, completing the review in September 2024 and reporting potential breaches to the relevant authorities. It moved to daily customer screening and introduced a new payments screening system, which third-party testing found effective in 2023 and 2024.

How the FCA weighed it

The FCA rated seriousness at level 4 on its five-level scale, citing serious or systemic weaknesses in controls and a significant risk that financial crime would occur, and noted that the breaches were negligent or inadvertent rather than deliberate and carried little risk of loss to consumers. It reduced the figure before settlement to 40 million pounds to avoid a disproportionate penalty, and made no deterrence uplift. It treated as aggravating that Starling had received an FCA letter in February 2022 reminding firms about sanctions controls, and as mitigating the bank's remediation, increased resourcing and full cooperation. In the press release, the FCA's Therese Chambers described the sanctions screening controls as shockingly lax.

Lessons for firms

1. Build a restriction into the system, then test it daily. A promise to the regulator is only as good as the control that enforces it.
2. Prevent re-registration of exited customers. Previously exited or reported customers should be blocked or reviewed before an account opens.
3. Test screening configuration against the full list. Sample known names from every part of the list and confirm they alert.
4. Screen at onboarding and keep screening. A 14-day cycle that starts after onboarding leaves gaps.
5. Scale the controls with the customer base. A fivefold or hundredfold increase in customers needs a matching increase in monitoring and resource.
6. Close audit findings. The 2018 audit warning is part of the story the FCA tells.

Our guide to sanctions screening and alert resolution covers the control side, and our case study of the Monzo FCA fine shows a similar growth pattern. For structured training, take a look at our CPD courses.

What we could not confirm

We worked from the FCA's press release and final notice, read through a summarising tool. The notice does not describe the exact matching configuration, and the text of the restriction was only partly quoted in what we could read, so we do not go further than the sections above. Check figures and dates against the notice before you quote them.

Frequently asked questions

How much was Starling Bank fined?

28,959,426 pounds, after a 30 per cent settlement discount.

What were the two failings?

Opening accounts for high-risk customers in breach of an agreed restriction, and automated sanctions screening that covered only part of the sanctions list.

How long did the screening problem last?

From 20 July 2017 until the system was reconfigured on 10 February 2023.

Did customers lose money?

The FCA noted little risk of consumer loss, but found a significant risk that financial crime would occur.