A UK bank’s anti-laundering checks come down to one comparison. The bank learns who a customer is and what their business should look like, then watches whether the money in the account fits that picture. The Financial Conduct Authority requires firms to monitor every customer continuously, so that transactions stay consistent with what the firm knows of the customer, their business and their risk.

The clearest example of the pattern comes from a case where a bank saw the warning and did not act on it.

A translation business that took in millions

In one case the FCA described, a new customer of Santander opened an account as a small translation business, expecting deposits of about £5,000 a month. Within six months it was taking in millions and moving the money quickly on to other accounts.

That is the mismatch the rules are built to catch. The bank’s own anti-money laundering team spotted it and recommended closing the account in March 2014. Weak processes meant nothing happened until September 2015, so millions more passed through. Mark Steward, the FCA’s enforcement director, said the bank’s poor management of its systems created a prolonged and severe risk of financial crime.

The FCA fined Santander £107.7m. It found serious and persistent gaps in how the bank checked information from business customers and monitored the money moving through their accounts. The failings touched more than 560,000 business customers between December 2012 and October 2017, and more than £298m went through the bank before it closed the accounts.

What the rules require first

Monitoring only works if the bank knows what normal looks like. The Money Laundering Regulations of 2017 and the Proceeds of Crime Act 2002 are the main UK laws behind the checks, according to the FCA.

Under them, a supervised firm has to do several things:

  • assess the money laundering risks its own business faces
  • put systems and controls in place to match those risks
  • carry out due diligence on its customers
  • appoint a Money Laundering Reporting Officer
  • give a director or senior manager overall responsibility for the controls

The due diligence scales with the risk. For customers who may pose more risk, firms must apply a more intrusive check, called enhanced due diligence. That includes politically exposed persons, on whom the FCA updated its guidance in July 2025.

Controls also have to fit the firm. The FCA says they must suit its size, the parts of the world it works in and the kinds of customer it serves. Firms must screen their own staff too. Before launching new technology, a firm has to assess the risks it brings and take steps to manage them.

Cash, and what it reveals

Cash is the oldest route and still a live one. The FCA has a programme of work on laundering through cash deposited at the Post Office.

The largest UK fine at the time of the Santander case shows why. NatWest paid £265m in December 2021 after admitting three offences under the money laundering regulations between 2012 and 2016, the BBC reported. It failed to stop nearly £400m being laundered by a gold trading business in Bradford, which once paid £700,000 in cash into a branch in black bin bags.

Fines elsewhere in the sector

HSBC paid £64m in December 2021 after the FCA found unacceptable failings in its systems between 2010 and 2018. It had earlier paid £1.4bn after a US Department of Justice investigation found it had failed to stop Mexican drug cartels laundering money.

Santander’s chief executive, Mike Regnier, apologised for the failings. He said the bank had overhauled its financial crime technology, systems and processes, and that more than 4,400 of its staff now work on preventing financial crime.