Reading a Final Notice: what recent FCA cases tell us about AML controls
Recent enforcement outcomes across banks, payment institutions and cryptoasset firms point to persistent themes: firm-wide risk assessments that are static rather than dynamic, management information to the board that fails to translate SAR volume into a picture of actual customer risk, transaction monitoring rules whose thresholds were never tested against the firm's own population, and remediation programmes signed off before the underlying root cause was addressed. We synthesise the pattern and the practical inferences a Head of Financial Crime should draw.
The recurring findings
Across the last twelve Final Notices the same failings appear: stale FWRAs, board MI that reports activity without interpreting risk, transaction monitoring rules left at vendor defaults, and remediation closed on evidence of activity rather than evidence of effectiveness.
What a Head of Financial Crime should do
Commission an independent read-back of the last two years of board MI against the FCA's expectation of what 'good' looks like. If the read-back cannot articulate the firm's residual risk in one page, the MI needs to change.
Retire the concept of 'remediation complete' as a milestone. Replace it with 'remediation effective', evidenced by post-implementation testing on live files.