MONZO BANK LIMITED

Assessment

Core identity is VERIFIED against an authoritative registry. Business activity, regulated status and regulatory identifiers are NOT VERIFIED because no FCA Register retrieval was performed.

Evidence

Key Findings

• Jurisdiction confidence. The brief records jurisdiction as 'user-provided'. It is independently corroborated by the Companies House record, which places the entity in England & Wales. Jurisdiction is therefore treated as VERIFIED, not merely asserted.
• Regulated status is inferred, not confirmed. The retrieved items describe the FCA issuing a Final Notice against the entity and the PSR naming it in a payment-services data collection. Both are consistent only with a regulated firm. That is a sound inference, but it is an inference from third-party reporting — not a primary register confirmation.
• Registered address quality. Broadwalk House, 5 Appold Street is a substantive commercial address in the City of London. There is no indication of a formation-agent or mail-forwarding arrangement. No address-reuse check across other entities was performed.
• Name-matching integrity. Every adverse item names 'Monzo Bank Limited' exactly, matching the registered legal name. There is no identity ambiguity between the registry subject and the subject of the adverse reporting.

Risk Implication

Identity resolution is strong enough to support onboarding of the correct legal person. The material identity-layer gap is regulatory: under FCA SYSC 6.3 and standard counterparty practice, a firm relying on a UK credit institution's regulated status must evidence that status from the FCA Register. Doing so also discloses any imposed requirement — directly relevant given the enforcement history described in Section 6. Until that check is run, the file records a UK-incorporated limited company whose banking authorisation is presumed rather than evidenced.

Assessment

The control structure as filed is conventional and non-opaque: a full board, a named secretary and a single corporate PSC. However, the ownership chain does not terminate in identified natural persons within this evidence set. No ultimate beneficial owner has been identified or verified.

Officers and controllers as registered

CONFIRMED here means the appointment appears on an authoritative registry. It does not mean identity documents have been verified, nor does it evidence any individual's executive/non-executive status, independence, appointment date, tenure or committee role — none of which is present in the evidence.

What is missing

• The 25% threshold. Under the UK PSC regime, a person is registrable where they hold, directly or indirectly, more than 25% of shares or voting rights, or the right to appoint/remove a majority of the board, or otherwise exercise significant influence or control. The evidence does not state which condition Monzo Bank Holding Group Limited satisfies, nor any percentage. That is a gap, not a nil return.
• The chain above the PSC. No registry extract for Monzo Bank Holding Group Limited was retrieved: no company number, no PSC register of its own, no shareholder list. The ultimate natural-person beneficial owners are therefore UNIDENTIFIED.
• Appointment and resignation history. No director appointment or resignation dates were retrieved. Board churn around the period of the reported enforcement action — an ordinary supervisory indicator — cannot be assessed.
• Nationality, date of birth, country of residence for any officer: NOT RETRIEVED. These are standard PSC/officer fields and are required inputs to both PEP and sanctions screening (Sections 3 and 4).

Correction to the pre-synthesis brief

The brief characterises the board as 'dominated by names consistent with independent non-executive appointments', citing an audit/risk-committee profile, a former financial-services chief executive and a venture investor. The supplied evidence contains no role descriptors or biographical data whatsoever. These characterisations are unsupported and must not be carried into a customer file. Named natural persons have standing in respect of mischaracterisation.

Risk Implication

Under FATF Recommendation 24, UK MLR 2017 reg. 28(3)–(4) and the transparency principles reflected in EU 5AMLD Art. 30, a firm must take reasonable measures to identify the beneficial owner and understand the ownership and control structure. The current file satisfies the first layer only. For a regulated bank operating under a holding-company structure this is a common and low-suspicion pattern, and it materially supports the low Transparency Risk factor (8/100) in Section 11. It nonetheless leaves a one-step-deep ownership trace that must be extended before the ownership limb of CDD is treated as complete. The absence of nationality and date-of-birth data also degrades the reliability of any subsequent PEP or sanctions screen on these individuals (Sections 3 and 4).

Assessment

Screen status: LIST-BASED SANCTIONS SCREENING — NOT RUN

No consolidated sanctions list source appears in the source ledger. The domain labelled 'Sanctions & Watchlists' was populated exclusively by Google Programmable Search. The three items it returned are news and law-firm commentary on the FCA fine — they are not designations, not list entries and not possible name matches.

What the 'sanctions' hits actually are

Totals returned for the domain: 10 results — 3 adverse, 0 positive, 7 neutral; severity: 3 HIGH, 0 critical/medium/low.

Required disclosures

• Lists screened: None. No OFSI (UK) Consolidated List, no OFAC SDN/Consolidated, no UN Security Council Consolidated List, no EU Consolidated Financial Sanctions List, and no PEP/watchlist vendor was queried.
• Entities screened against lists: None. Neither MONZO BANK LIMITED, nor Monzo Bank Holding Group Limited, nor any of the ten named individuals/entities in Section 2 has been screened against a designation list.
• Date of screening: No list screening date exists. The web searches underlying this file were executed for a report dated 18 August 2026, but the results themselves contain no item later than 6 October 2025.
• Match confidence: Not applicable — no name-matching operation was performed.

Risk Implication

The Sanctions factor scored 5/100 and carries the heaviest applied weight in the model (34.1%), contributing approximately 1.7 points to the composite. That score suppresses the composite on the basis of an unrun control. It must be read as 'no adverse sanctions news was returned by a general web search', not as 'no designation exists'.

Under UK financial sanctions law, compliance is strict-liability in character and is not discharged by web search. Under MLR 2017 reg. 28 and FCA SYSC 6.3, the firm must screen the customer and its beneficial owners against applicable designation lists. This is a blocking gap identified in Section 12.

Separately, the Norton Rose snippet's reference to 'sanctions systems and controls' is analytically relevant in a different way: if the FCA's findings extended to sanctions screening controls, the counterparty's own screening reliability is reduced — which bears on any arrangement where reliance is placed on it. That remains UNVERIFIED pending retrieval of the primary Final Notice.

Assessment

Screen status: NOT RUN

The source ledger records: 'No PEP screening provider configured [PEP] → SKIPPED'. The coverage statement confirms PEP is a 'risk domain NOT reflected in the composite score'.

No person named in this report has been assessed for PEP, family-member or known-close-associate status. No conclusion of any kind — positive or negative — may be drawn.

Population that remains unscreened

Required fields — political position, jurisdiction of the position, period held, RCA linkage, HIO status — are all NOT DETERMINED for every party above.

Correction to the pre-synthesis brief

The pre-synthesis brief identifies one board member as a 'prominent venture-capital figure who, on general public knowledge, has held UK government advisory appointments' and describes that person as a 'high-probability screening candidate'. No such information appears anywhere in the supplied evidence. Attributing a public-office or advisory association to a specifically identifiable named individual without evidence is precisely the mischaracterisation this report's evidence rules prohibit, and it carries direct legal exposure. The correct treatment is the one applied above: screen the entire officer population as a class, assert nothing about any individual.

Risk Implication

• MLR 2017 reg. 35(1) requires appropriate risk-management systems and procedures to determine whether a customer or beneficial owner is a PEP, a family member or a known close associate, and mandates EDD and senior management approval where they are. That determination has not been made.
• FATF Recommendation 12 imposes the equivalent obligation.
• FCA SYSC 12.1 and the FCG expect group-wide systems capable of identifying such exposure.

The practical consequence: the 45/100 composite in Section 11 is structurally incomplete. It is arithmetically incapable of reflecting PEP risk because the factor carries no weight and no score. Treating that composite as a final risk rating would itself be a control failure. Note that a domestic-PEP finding in respect of a director of a UK bank would not, standing alone, be a negative indicator — domestic PEPs in low-risk jurisdictions typically attract proportionate rather than maximal EDD under FCA guidance. The problem is not an anticipated adverse result; it is the absence of any result at all.

Assessment

Adverse media scored 73/100, but the volume is misleading. Ten results were returned in this domain (6 adverse, 0 positive, 4 neutral; all six adverse rated HIGH). Five of the six adverse items report the same FCA Final Notice; the sixth is a regulator publication that is not an allegation at all.

Adverse items — full inventory

URLs preserved: http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/ ; https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings ; https://www.int-comp.org/insight/the-real-lesson-from-the-monzo-fine-industry-s-broken-approach-to-money-laundering-risk-assessment/ ; https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls ; https://www.lexology.com/library/detail.aspx?g=74fe36f4-28d6-42e9-845b-e414d3ef34d1 ; https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/

Corroboration analysis

Six distinct publishers — two international law firms (Norton Rose Fulbright; Mishcon de Reya), a professional compliance institute (ICA), a legal-intelligence platform (Lexology), a financial-crime news outlet, and a second Norton Rose channel (regulationtomorrow.com, indexed under Regulatory) — converge without contradiction on: date 7 July 2025; issuing authority FCA; subject Monzo Bank Limited; penalty £21,091,300; 30% settlement discount; subject matter AML systems and controls.

No source contradicts another on any material particular. Confidence in the underlying facts is accordingly HIGH — subject to the standing caveat that the FCA Final Notice itself was not retrieved and every detail is reported-by-source rather than primary-verified.

Thematic content (attributed, not asserted)

• Business-customer CDD — thefinancialcrimenews.com states the FCA found business-customer CDD procedures did not meet UK MLR requirements. Snippet truncated.
• Financial crime risk assessment — ICA's commentary frames the case as illustrating an industry-wide problem with money laundering risk assessment. This is the publisher's editorial thesis, not a regulatory finding.
• Fraud alerts — ICA's snippet references fraud alerts. Truncated; the surrounding claim cannot be reconstructed.
• Sanctions systems and controls — Norton Rose Fulbright's snippet references this phrase. Whether it describes an FCA finding or general context is not determinable from the snippet.

The pre-synthesis brief's conclusion that the failings span 'three principal pillars' (onboarding CDD, transaction monitoring/fraud alerting, sanctions screening) is a plausible but unconfirmed reconstruction from truncated snippets. It should be held as a hypothesis for verification against the primary Notice, not recorded as fact.

Time span and recency

• Adverse cluster: 7 July 2025 – 6 October 2025 (three months).
• Outlier: PSR publication, 31 October 2023.
• No item post-dates 6 October 2025, against a report date of 18 August 2026. Two readings are equally consistent with the evidence: (a) the matter concluded and left the news cycle; (b) the search did not extend into 2026. The evidence does not distinguish between them, and absence of later coverage is not evidence of no later events.

Risk Implication

The reputational exposure is real but narrow and bounded: one regulatory matter, publicly resolved by settlement, with no retrieved evidence of criminal proceedings, customer class actions, insolvency, fraud by the entity, or director misconduct. The Adverse Media score of 73/100 overstates breadth because the model counted duplicative coverage of one event and treated a neutral regulator dataset as HIGH adverse. The score should be read as reflecting severity of one matter, not accumulation of many.

Assessment

This is the highest-scoring domain (79/100) and the analytically dominant one. Ten results, 4 adverse, all HIGH — and all four report the same matter.

The matter as reported

Sources: http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/ (2025-07-09); https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings (Jul 22, 2025); https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls (Oct 6, 2025); https://www.regulationtomorrow.com/2025/07/financial-crime-controls-in-the-spotlight-lessons-learned-in-relation-to-fca-supervisory-powers-and-expectations/ (2025-07-23).

Characterisation — precision required

An FCA Final Notice imposing a financial penalty is a regulatory determination, not an allegation, not an investigation and not a criminal charge or conviction. It is an administrative enforcement outcome under FSMA 2000. The reported 30% discount is consistent with the FCA's standard executive-settlement reduction for early resolution; it reflects procedural cooperation, not mitigation of the seriousness of the conduct.

Derived figure — flagged as arithmetic, not source-stated: £21,091,300 ÷ 0.7 implies a pre-discount penalty of approximately £30.1m. No source states this figure and it should not be quoted as reported.

Unsupported comparative claim rejected. The pre-synthesis brief states the penalty falls 'in the upper tier of UK AML enforcement'. The only supporting material is a financialcrimenews snippet offering 'a comparison of UK AML fines since 2017' — the comparison content itself was not retrieved. The ranking claim is unsupported and must not be repeated.

Second regulatory item — PSR

The Payment Systems Regulator's 'first APP scams performance report' (https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/, snippet dated 31 October 2023) is a comparative data publication, naming Monzo Bank Limited among firms from which the PSR collected data. It is not an enforcement action, not a finding of wrongdoing and not an allegation. The snippet does not disclose the subject's ranking or performance. It is retained in the file only as an indicator of an authorised-push-payment fraud exposure theme, which is contextually relevant to the fraud-alert reference in the ICA commentary (Section 5).

Critical gap — no primary regulatory source

Screen status: FCA FINANCIAL SERVICES REGISTER — NOT RUN

Not retrieved: Firm Reference Number; authorisation status and date; scope of permissions; any imposed requirement (VREQ/OIREQ) or restriction; SMF holders under the Senior Managers & Certification Regime; and the Final Notice itself.

The pre-synthesis brief asserts that in 2020 the FCA had imposed a requirement on the subject relating to high-risk customer onboarding. No such item exists in this evidence set. It is unsupported and is excluded from this assessment.

Risk Implication

For a counterparty that is itself an AML gatekeeper, an enforcement outcome against its own control framework is a first-order signal — it reduces the reliance that correspondent banks, payment partners and regulators can place on its onboarding, monitoring and screening. That justifies the elevated domain score and directly defeats any Simplified Due Diligence treatment under MLR 2017 reg. 37, which requires an affirmative low-risk determination.

Equally, the matter is historic, publicly resolved and settled, with no retrieved indication of ongoing proceedings, licence restriction or repeat action. The correct posture is enhanced monitoring with a defined verification list (Section 12), not escalation to full EDD on the current evidence.

Assessment

Screen status: COURT RECORDS — NOT SEARCHED DIRECTLY

The Litigation domain scored 66/100 on the basis of ten Google Programmable Search results (2 adverse, 8 neutral). No court record database was queried — not the Business and Property Courts / King's Bench Division listings, not the Insolvency Service register, not the Judicial Committee registers, not a commercial litigation data provider.

What the two adverse 'litigation' items actually are

Both items are the same FCA matter already recorded in Sections 5 and 6. The Litigation score of 66/100 is derived entirely from duplicated regulatory coverage and reflects no identified court proceeding.

One detail is of positive evidential value: the Norton Rose structured summary states 'Related decisions. No related decisions.' — indicating, on that publisher's presentation, no linked regulatory decisions attached to the Final Notice.

Required fields — status

Risk Implication

No litigation risk has been identified — but equally, no litigation search has been performed, so no litigation clearance may be recorded. The distinction matters for a consumer-facing bank of this profile, where group claims (for example in connection with APP fraud reimbursement, a theme raised by the PSR item in Section 5) are a realistic category. The correct file entry is 'court records not searched', not 'no litigation found'.

The practical effect on the composite in Section 11 is that the Litigation factor (66/100 × 11.4% ≈ 7.5 points) is double-counting the FCA matter already scored under Regulatory & Enforcement — inflating the composite by an amount that would otherwise be attributable to genuinely independent legal exposure.

Assessment

Screen status: NO DEDICATED ESG DATA SOURCE CONSULTED

No ESG rating provider, sustainability disclosure database, modern slavery statement registry, employment tribunal source, ICO enforcement register or whistleblowing dataset was queried. The source ledger contains only Companies House and Google Programmable Search across five thematic queries. Everything below is derived from those searches, not from ESG-specific coverage.

Coverage by ESG dimension

Governance and conduct — what the evidence does show

Governance (adverse). The reported FCA Final Notice of 7 July 2025 (Section 6) is a governance finding in substance: it concerns the adequacy of the firm's financial crime systems and controls and, per the ICA commentary, its money laundering risk assessment methodology. Under any ESG framework, a regulator-imposed penalty for control failings is a material 'G' event. This is the principal ESG-relevant fact in the file.

Governance (mitigating). The registry structure described in Section 2 is orthodox — a nine-member board, a named company secretary, and a single corporate PSC in a bank-holding configuration. There is no nominee, shell or concealment indicator. No assessment of board independence, committee structure or tenure is possible, because the evidence contains no role descriptors or appointment dates. Any statement about the independence or composition quality of this board would be unsupported.

Conduct. The PSR's first APP scams performance report (https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/, snippet dated 31 October 2023) names Monzo Bank Limited among firms in a sector-wide data collection on authorised push payment fraud. This is not a finding, a criticism or an allegation, and the snippet discloses no performance figure or ranking. It is recorded here solely as evidence that consumer-fraud exposure is a live sector theme for this entity type, which connects to the fraud-alert reference in the ICA commentary (Section 5).

Risk Implication

ESG risk is UNDETERMINED overall, with one evidenced adverse governance event. ESG does not appear as a weighted factor in the scoring model (Section 11) and therefore contributes nothing arithmetically to the 45/100 composite; the governance dimension reaches the score only through Regulatory & Enforcement and Adverse Media.

For institutional clients with ESG-linked onboarding policies, reputational or supply-chain screening obligations, or CSRD/TCFD reporting dependencies, this file is not sufficient to support an ESG determination. The specific unchecked exposure most relevant to a bank is data protection: no ICO enforcement or breach history was searched, and a personal-data breach at a retail bank would be both a conduct and an operational risk event.

Assessment

Screen status: NO FINANCIAL DATA EXTRACTED

The Financial domain search ran and returned ten results, all classified neutral (0 adverse, 0 positive). No figure of any kind — revenue, turnover, total assets, capital position, profitability, deposit base, funding round or investor identity — appears in the supplied evidence.

Required fields — status

Source of wealth / source of funds

For a corporate counterparty of this type, source of funds is structural rather than personal: deposit-taking and banking operations funded by shareholder equity through the holding company identified in Section 2. This is an inference from the entity type, not an evidenced finding. The shareholders of Monzo Bank Holding Group Limited are unidentified in this file, so the equity source is untraced.

Red-flag screen

The standard financial red flags could not be tested:

• Negative net worth — untested (no balance sheet)
• Rapid unexplained growth — untested (no time series)
• Opaque funding — partially indicated only structurally: the ownership chain terminates at a declared corporate PSC with no identified natural persons (Section 2). This is typical of a bank holding structure and is not, in itself, an opacity red flag; but it is not resolved either.

Risk Implication

This is a due diligence deficiency, not a clean result. For a regulated deposit-taking institution, audited accounts and capital adequacy are ordinary counterparty inputs, and their absence limits assessment of financial resilience — a live consideration where a firm has recently absorbed a reported penalty of £21,091,300 (Section 6) and any associated remediation cost. Note that the Financial domain does not appear as a weighted factor in the scoring model (Section 11); its absence therefore has no arithmetic effect on the composite and reaches the score only indirectly, if at all. That is a structural limitation of the model and must be understood when reading the 45/100 output.

Assessment

Jurisdictional exposure, on the evidence available, is confined to the United Kingdom and is low-risk. However, the assessment rests on a narrow evidence base: no jurisdictional reference dataset was actually consulted.

Evidence

Analysis

• The model assigned Jurisdiction Risk 35/100 at an applied weight of 6.8%. The evidence set contains no reference dataset supporting that figure — no FATF list check, no CPI value, no EU high-risk list check with a publication date. The figure is a model default rather than an evidenced determination and should be treated as such.
• All identified activity, regulation and enforcement is domestic UK. There is no indicator of high-risk-third-country exposure, offshore structuring or complex cross-border ownership in the retrieved record.
• The unassessed dimension is operational, not structural. A UK retail and business bank will have customer-side exposure to a wide range of jurisdictions through payments and correspondent relationships. That exposure is invisible in this file. It is directly relevant because the FCA matter described in Section 6 concerns the very controls (CDD, monitoring, potentially sanctions screening) that manage cross-border risk.

Risk Implication

The jurisdictional profile is a mitigating factor: a firm incorporated and supervised in a mature, FATF-member jurisdiction with a public enforcement regime, an accessible beneficial ownership registry and an independent regulator. That underpins the low Transparency Risk factor (8/100) in Section 11 and supports the MEDIUM rather than HIGH overall band.

The qualification is that this conclusion is drawn from general jurisdictional knowledge and the incorporation record, not from a consulted, dated reference dataset. For a regulatory-grade file, the FATF and EU high-risk lists should be checked and dated at the point of assessment rather than assumed.

Composite score as produced by the model

45/100 — MEDIUM. Coverage: PARTIAL.

Scoring table (scores and applied weights taken verbatim from the supplied RISK SCORE block)

Applied weights sum to 99.9% as supplied (rounding).

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

• Sanctions & Watchlists: 5 × 0.341 = 1.705
• Adverse Media: 73 × 0.227 = 16.571
• Regulatory & Enforcement: 79 × 0.204 = 16.116
• Politically Exposed Persons: UNDETERMINED × no weight = 0.000 (excluded — screen not run)
• Litigation: 66 × 0.114 = 7.524
• Jurisdiction Risk: 35 × 0.068 = 2.380
• Transparency Risk: 8 × 0.045 = 0.360

Sum = 1.705 + 16.571 + 16.116 + 7.524 + 2.380 + 0.360 = 44.656 → 45/100 (MEDIUM)

The arithmetic reproduces exactly.

What actually drives the score

Approximately 40.2 of the 44.66 points (90%) come from three factors — Adverse Media, Regulatory & Enforcement and Litigation — all three of which are scoring the same single event: the FCA Final Notice reported as published on 7 July 2025.

Two offsetting distortions

Distortion 1 — upward: event duplication. One regulatory matter is counted three times across three weighted domains totalling 54.5% of the applied weight. Genuinely, the file contains two matters (the FCA Final Notice and the PSR data publication), of which only one is adverse. Removing the Litigation duplicate alone would reduce the composite by roughly 7.5 points.

Distortion 2 — downward: unrun screens scored as low. The Sanctions factor carries the single largest applied weight (34.1%) and scored 5/100 on the basis of a general web search that performed no list-based name matching. This suppresses the composite by a large margin relative to a genuinely verified position, in either direction. Additionally, the PSR item's HIGH classification inflates Adverse Media; correcting it downward would reduce the composite further.

These distortions partially cancel, which is why the MEDIUM band remains defensible. They do not cancel in a principled way, and the 45 should be treated as an indicative band, not a precise measure.

Incompleteness of the composite

• PEP is unscored and unweighted. The composite is arithmetically incapable of reflecting PEP exposure for any of the ten named parties.
• Identity, Beneficial Ownership, Financial Profile and ESG are not weighted factors in this model. Their analysis in Sections 1, 2, 8 and 10 reaches the score only indirectly through Transparency Risk (4.5% weight). The complete absence of financial data (Section 8) therefore has no arithmetic effect whatsoever on the 45.

Conclusion

The MEDIUM band is supported: one corroborated, material, publicly-resolved regulatory enforcement outcome against a UK-incorporated entity with a transparent registry profile and no sanctions, criminal, insolvency or ownership-opacity indicator retrieved. Confidence is MEDIUM, not HIGH, because two screens central to any AML file — PEP and list-based sanctions — did not run, and because no primary regulatory source was retrieved. Under the coverage rules, this is a partial score and must not be presented as a complete risk rating.

Recommendation

Standard CDD with mandatory Enhanced Monitoring — conditional approval only.

This aligns with the model output ('Standard CDD with Enhanced Monitoring'; 'EDD required: NO'), but with an important qualification the model cannot express: no final onboarding or continuation decision should be recorded until the three blocking screens below are completed. The model's 'EDD required: NO' output is generated from a composite that excludes PEP entirely and rests on a sanctions score derived without list screening.

Rationale

Simplified Due Diligence is not available. MLR 2017 reg. 37 permits SDD only where the firm determines the relationship presents a low degree of risk. Although a UK-supervised credit institution would ordinarily be a strong SDD candidate under reg. 37 and FATF R.10, that determination cannot be made where six independent professional sources report an FCA Final Notice penalising the counterparty's own AML systems and controls (Section 6). SDD is expressly ruled out.

Full EDD under reg. 33 is not currently triggered by the retrieved evidence: the entity is not established in a high-risk third country, no sanctions designation has been identified, no PEP has been identified (because none has been screened for), and the transaction context is not identified as complex or unusually large. EDD becomes mandatory on any of the trigger events listed below.

Enhanced Monitoring is warranted because the adverse finding concerns the counterparty's gatekeeping function itself. Where a firm relies on this counterparty for onboarding, monitoring or screening — for example in a correspondent, agency, payment-partner or introducer capacity — the reported control failings directly reduce the reliability of that reliance, and reliance arrangements under MLR 2017 reg. 39 should be reassessed.

Outstanding information gaps

Required Actions

1. 1.Run PEP screening against a configured provider for all ten named parties in Section 2. Where a domestic PEP or RCA is identified, apply reg. 35 EDD and obtain senior management approval. Do not record 'not a PEP' on the basis of name recognition or role inference.
2. 2.Run list-based sanctions screening of MONZO BANK LIMITED, Monzo Bank Holding Group Limited and all ten named parties against the OFSI Consolidated List, OFAC SDN/Consolidated, UN Security Council Consolidated List and EU Consolidated Financial Sanctions List. Record list versions and screening date. Distinguish exact matches from possible name matches.
3. 3.Retrieve the FCA Financial Services Register entry: confirm authorisation status, Firm Reference Number, scope of permissions and — critically — any imposed requirement or restriction on permission. A live restriction converts this file to EDD.
4. 4.Retrieve the primary FCA Final Notice (referenced in a URL fragment as 'monzo-bank-limited.pdf' within the financialcrimenews snippet, but not retrieved). Establish the relevant period, the precise control failings, whether sanctions-screening and fraud-alerting controls were in scope, and any remediation or skilled-person obligations.
5. 5.Extend the ownership trace to Monzo Bank Holding Group Limited: obtain its Companies House record, PSC register and shareholder structure, and identify the ultimate natural persons or confirm a diversified-shareholding position.
6. 6.Refresh open-source searches for the period 7 October 2025 to the assessment date to close the recency gap.
7. 7.Obtain latest audited statutory accounts from Companies House filing history and confirm filing compliance.
8. 8.Search court and insolvency records directly for the entity and its directors.
9. 9.Purge unsupported assertions. The pre-synthesis brief's claims regarding a 2020 FCA onboarding requirement, director roles and independence, a director's asserted UK government advisory appointments, and the penalty's ranking in UK AML enforcement are not supported by this evidence and must not enter the customer file.

Trigger events for immediate review

• Any new FCA, PRA or PSR publication naming the entity.
• Discovery of an imposed requirement, restriction or variation of permission on the FCA Register.
• Any positive PEP or sanctions screening result on the entity or any named officer.
• Change of PSC, or any change in the holding-company structure.
• Resignation or removal of the MLRO or any SMF holder with financial crime responsibility, if identified.
• Commencement of any group claim or insolvency proceeding involving the entity.
• Any credible report of a repeat AML, sanctions or fraud-control failing.

Monitoring frequency and review date

• Monitoring frequency: QUARTERLY (as per model output), justified by the enforcement history rather than by structural opacity.
• Next scheduled review: 18 November 2026, based on the report date of 18 August 2026.
• Interim review: immediate, on completion of the three blocking screens. If those screens cannot be run, the file must be escalated to the MLRO with a written record that a full risk rating could not be produced — coverage is PARTIAL and this is a partial score.

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Complete source ledger

Assessment date: 18 August 2026. Latest evidence item in the file: 6 October 2025.

Methodology

1. 1.Registry-first identity resolution. Entity identity fixed from Companies House and matched exactly to the named subject of every adverse item ('Monzo Bank Limited'). No identity ambiguity arose.
2. 2.De-duplication of the adverse set. All 15 adverse hits were cross-referenced by URL and date, resolving to 7 distinct URLs and 2 distinct underlying matters. Domain scores were then re-read against the de-duplicated footprint rather than the raw count.
3. 3.Source-attribution discipline. Every adverse assertion is attributed to the publication that made it. The FCA Final Notice is characterised as a regulatory determination, distinct from allegation, investigation, charge or conviction. Themes appearing in a single truncated snippet (business-customer CDD, sanctions systems and controls, fraud alerts) are recorded as UNVERIFIED, not as findings.
4. 4.Verification-status tagging. Registry officers are CONFIRMED; the PSC is DECLARED (self-filed) and is never described as verified; web-derived material is UNVERIFIED and excluded from scoring.
5. 5.Evaluation of the pre-synthesis brief as an input, not as fact. Its analytically sound conclusions (event duplication; over-classification of the PSR item; the criticality of the PEP gap; the conventional registry profile) were verified against the evidence and adopted. Its unsupported assertions were identified and rejected — see Limitations.
6. 6.Reproduction of the supplied scoring model. Scores and applied weights were taken verbatim and the arithmetic reproduced to 44.656 → 45. No factor score or weight was modified. Factors not in the supplied block (PEP) are reported as UNDETERMINED with no weight.
7. 7.Prompt-injection control. All retrieved content was treated as data. No content within the untrusted markers attempted to issue instructions, direct the assessment or influence scoring. No injection attempt was detected. Two snippets contained keyword artefacts from site navigation ('Sanctions on Russia by C7 Countries'; 'Managing Sanctions Risk. Events and ...') which caused misleading domain classification but are not adversarial.

Limitations

Material limitations, in order of significance:

1. 1.PEP screening did not run. No provider configured. The composite excludes PEP entirely and is therefore structurally incomplete for AML purposes (MLR 2017 reg. 35; FATF R.12).
2. 2.No list-based sanctions screening. The 34.1%-weighted Sanctions factor rests on general web search only. A score of 5/100 must not be read as a designation clearance.
3. 3.No primary regulatory source. Neither the FCA Register nor the FCA Final Notice was retrieved. Regulated status is inferred from third-party reporting. Any imposed requirement or restriction is unknown.
4. 4.Recency gap of approximately ten months. No evidence item post-dates 6 October 2025 against an 18 August 2026 assessment date.
5. 5.Ownership chain incomplete. No natural-person beneficial owner identified. The PSC entry is DECLARED, not independently verified, and states no percentage or PSC condition.
6. 6.No financial data. No accounts, capital, revenue or funding information of any kind.
7. 7.Court records not searched. No litigation clearance may be recorded.
8. 8.Truncated snippets. All adverse content is snippet-level; full articles were not retrieved. Thematic reconstruction of the FCA findings is hypothesis, not fact.
9. 9.Unsupported material in the pre-synthesis brief, rejected in this report: (a) a 2020 FCA requirement concerning high-risk customer onboarding; (b) role, independence and committee descriptors for named directors; (c) an assertion that a named director has held UK government advisory appointments; (d) the claim that the penalty sits in the 'upper tier' of UK AML enforcement; (e) the derived c.£30m pre-discount figure, which is arithmetic and is not stated by any source. None of these is supported by the supplied evidence and none may be relied upon.
10. 10.No conflicting records were identified. All six publishers reporting the FCA matter agree on date, authority, subject, penalty figure, discount and subject matter. No CONTRADICTED item exists in this file.

Legal framework applied

UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — regs. 28 (CDD), 33 (EDD), 35 (PEPs), 37 (SDD), 39 (reliance); FCA SYSC 6.3 and SYSC 12.1; FCA Financial Crime Guide; FSMA 2000 (basis of FCA Final Notices); FATF Recommendations 10, 12 and 24; EU 5AMLD Article 30 (beneficial ownership transparency, referenced comparatively); UK PSC regime (25% threshold).

Confidence

Overall confidence: MEDIUM.

Supporting higher confidence:

• Entity identity is verified against an authoritative registry with an exact name match to the adverse reporting.
• The single material adverse matter is corroborated by six independent professional publishers with no contradiction on any particular — date, authority, subject, figure, discount and subject matter all agree.
• The registry control structure is complete at the first layer and contains no opacity indicator.

Constraining confidence:

• Two screens central to any AML determination — PEP and list-based sanctions — did not run.
• No primary regulatory source was retrieved; regulated status is inferred.
• A ten-month recency blind spot separates the newest evidence from the assessment date.
• Financial and litigation dimensions are entirely unassessed.

Confidence is not LOW because the identity and the principal adverse fact are both well-evidenced. It is not HIGH because coverage is PARTIAL by the system's own statement, and a rating produced without PEP or sanctions-list screening cannot be represented as a complete assessment.