Nationwide Hit With £44m FCA Fine After Personal Account Controls Fail Financial Crime Test

Nationwide Building Society has been fined more than £44 million by the UK Financial Conduct Authority, FCA, after weaknesses in its financial crime controls left the lender unable to properly understand, assess and monitor risks across its personal current account customer base.

The enforcement action covers a period between October 2016 and July 2021, when Nationwide’s systems for maintaining up to date customer due diligence and risk assessments were found to be inadequate. Its transaction monitoring arrangements were also insufficient to identify and manage financial crime risks effectively.

The regulatory failure was particularly significant because Nationwide knew that some customers were using personal accounts for business activity, contrary to the terms governing those accounts. That created an additional layer of financial crime risk because activity associated with businesses could be passing through accounts that had been assessed and monitored as personal accounts.

For regulators, the issue was therefore not simply whether individual transactions looked suspicious. The deeper concern was whether the institution had a sufficiently accurate and current understanding of its customers to recognise when behaviour departed from the expected risk profile.

The FCA said Nationwide’s deficiencies meant it was unable to identify, assess, monitor and manage financial crime risks posed by its personal customers effectively.

The case also highlights a critical compliance vulnerability for banks and other financial institutions. Customer due diligence cannot be treated as a one-time onboarding exercise. Where customer circumstances, account usage or transaction patterns change, the control framework must be capable of detecting those changes and triggering appropriate review.

The enforcement action carries particular significance for firms operating large retail customer bases. A weakness affecting thousands or millions of ordinary accounts can become a systemic control problem when customer information, risk assessments and transaction monitoring are not sufficiently connected.

The case also reinforces the importance of detecting personal accounts being used for commercial purposes, particularly where the nature and volume of transactions may indicate undisclosed business activity, fraud or other financial crime exposure.

For compliance officers, the Nationwide case offers a familiar regulatory warning. Having policies on customer due diligence and transaction monitoring is not enough. Firms must demonstrate that those controls operate effectively in practice, remain current and provide management with a reliable picture of changing customer risk.

Compliance takeaway

The Nationwide enforcement shows how quickly weaknesses in basic customer controls can become a major financial crime exposure. Know Your Customer is not a form completed at onboarding. It is an ongoing control obligation. Firms need reliable customer data, dynamic risk assessments, effective transaction monitoring and clear escalation processes when account behaviour no longer matches the customer’s known profile.

The lesson for banks across Africa, including Nigeria, is equally relevant. Personal accounts used for business activity can obscure beneficial ownership, source of funds and the true nature of transactions. Weak controls in this area can leave institutions exposed not only to AML failures, but also to fraud, tax evasion and sanctions risks.