The FCA closed out 2025 having handed out roughly £124 million in fines, with financial crime controls the dominant theme. The largest single penalty of the year — £44 million against Nationwide Building Society — was announced in December, and it is worth firms of every size paying attention to why. 

WHAT WENT WRONG AT NATIONWIDE 

The FCA’s final notice describes AML systems and controls failures running from October 2016 to July 2021: narrow criteria for identifying high-risk customers, and ineffective due diligence and transaction monitoring across personal current accounts. In one case, Nationwide missed opportunities to spot a customer receiving 24 fraudulent furlough payments totalling £27.3 million over 13 months. Therese Chambers, the FCA’s joint executive director of enforcement and market oversight, said Nationwide “failed to get a proper grip of the financial crime risks lurking within its customer base”. It was the 13th FCA fine on a bank for AML systems and controls failings since 2021, with those fines totalling over £300 million. 

The detail that should concern every risk and compliance function is the timeline: roughly a decade between the weaknesses first emerging and the final fine being issued. Financial crime failings do not stay hidden — they surface eventually, usually at the worst possible moment, and the regulatory and reputational cost compounds the longer they go unaddressed. 

THE FCA IS ABOUT TO GET A MUCH BIGGER REMIT 

Alongside enforcement, HM Treasury confirmed in October 2025 that the FCA will become the single AML/CTF supervisor for legal, accountancy, and trust and company service providers — a role currently split across 22 professional body supervisors and HMRC. The change responds to weaknesses identified in the Financial Action Task Force’s 2018 evaluation of UK AML supervision, which identified exactly the kind of fragmented oversight this reform is designed to fix. 

For firms already supervised by the FCA, day-to-day AML obligations under the Money Laundering Regulations don’t change. But it does mean a regulator with more resource, more enforcement appetite, and a consolidated view across sectors that have historically operated in separate silos. Expect more information-sharing, more cross-sector red flags, and less tolerance for “that’s how we’ve always done it” risk assessments. 

WHAT GOOD LOOKS LIKE 

Reading across the FCA’s enforcement notices from 2025, a consistent set of weaknesses recurs: risk assessments that are too generic to catch firm-specific exposure, customer risk scoring that isn’t revisited as circumstances change, and transaction monitoring rules that haven’t kept pace with how the firm’s customer base and products have evolved. None of these are exotic failings — they are basic hygiene that gets deprioritised when risk management is treated as a compliance checkbox rather than a live, owned discipline. 

STRENGTHENING FINANCIAL CRIME CONTROLS WITH REGTECH 

Nationwide had identified a number of weaknesses and put remediation projects in train, but the FCA found that deficiencies in its financial crime prevention systems and controls continued during the relevant period. Slow, poorly tracked remediation is exactly the problem RegTech exists to solve. On the Axiol platform, firms can: 

• Score and evidence the effectiveness of AML controls at regular intervals, rather than relying on point-in-time audits 

• Assign clear ownership for financial crime risks, so gaps are surfaced and actioned rather than left unowned 

• Link customer risk assessment processes directly to the firm’s broader risk register, so shifts in exposure are visible across the business, not buried in one team’s records 

• Maintain an audit-ready trail of evaluations and remediation, giving the board — and the regulator — demonstrable evidence of an active, evolving control environment 

As the FCA’s financial crime remit expands, the firms best placed to withstand scrutiny will be the ones who can already show their working. Get in touch to find out how Axiol can help.