MONZO BANK LIMITED

Assessment

Legal identity is VERIFIED against the UK statutory registry. The record is internally consistent, the company is active, and there are no indicators of name ambiguity, recent re-registration or dissolution activity. Identity risk is low. Business-activity and regulatory-status verification is, however, incomplete.

Evidence

Key Findings

• The entity has been on the register for over eleven years as at the report date, which is inconsistent with shell-company or recently-formed-vehicle typologies.
• The registered address is a central London commercial address. No evidence was retrieved as to whether it is a substantive operating premises or a registered-office service; this was not tested.
• Business activity is inferred, not verified. No SIC code was supplied in the evidence. That the entity is a bank rests on (a) the legal name and (b) the fact that the FCA issued it a Final Notice concerning AML systems and controls (Section 6). Both are strong indicators; neither is a substitute for the FCA Register.

Risk Implication

Identity verification for MLR 2017 regulation 28(2) purposes is satisfied at registry level: name, number, address, status and legal form are all confirmed from an authoritative source. The unclosed gap is regulatory status. Where a counterparty is treated as a UK-authorised credit institution — which materially affects the permissible CDD approach, any reliance placed on that institution's own CDD, and the applicability of simplified measures — that status must be evidenced from the FCA Financial Services Register, not assumed from the word "Bank" in a company name. The FRN and current permissions must be retrieved before the file is closed.

No alias, transliteration or near-name ambiguity was identified, which strengthens the reliability of the negative sanctions result in Section 3.

Assessment

Control is partially mapped. Nine officers are CONFIRMED from the Companies House officers register. The PSC register discloses a single controller — a corporate parent — which is DECLARED, not verified. The chain to ultimate natural persons is not established. No ownership percentages were retrieved for any party.

Registry-Confirmed Officers

Important characterisation control: these nine individuals are confirmed officers. The evidence does not establish any of them as a beneficial owner, shareholder or PSC. They must not be described as owners. Their appointment dates, nationalities, dates of birth (month/year), other directorships and executive/non-executive designation were not retrieved, so the executive-versus-non-executive composition of the board cannot be stated.

Declared Controller

Not retrieved for this controller: registration number, jurisdiction of incorporation, percentage of shares held, percentage of voting rights held, nature-of-control statement code, date of registration as PSC, and its own PSC / ownership chain.

The 25% Threshold and the Unresolved Chain

Under the UK PSC regime a person is registrable where they hold, directly or indirectly, more than 25% of shares or more than 25% of voting rights, or hold the right to appoint or remove a majority of the board, or otherwise exercise significant influence or control. The register discloses one PSC at the immediate level, and that PSC is a legal person rather than a natural person.

Consequences:

1. 1.No ultimate beneficial owner has been identified. The chain terminates, in this evidence pack, at Monzo Bank Holding Group Limited. Whether any natural person holds >25% indirectly, or whether the ultimate parent is exempt from PSC disclosure (for example by reason of a listing or of holding a UK-registrable-relevant-legal-entity status), is unknown.
2. 2.FATF Recommendation 24 requires that adequate, accurate and current beneficial ownership information be obtainable. The self-declared nature of the UK PSC filing means the disclosure has been made by the company, not tested by the registrar.
3. 3.EU 5AMLD Article 30 is cited here for methodological completeness only; it does not apply directly to a GB entity post-transition, but the equivalent UK obligation under MLR 2017 regulation 28(4) to take reasonable measures to understand the ownership and control structure does apply.

Risk Implication

The transparency risk factor scored 8/100 in the model, which correctly reflects that the company files a populated PSC register and a full officer list — this is not an opaque structure. It is not, however, a completed beneficial-ownership determination.

This gap has a direct effect on Section 3: the negative sanctions screen was run against the entity. Absent identification of the ultimate natural persons and absent a registration number for the declared parent, neither the parent nor any upstream owner can be confirmed as having been list-screened. It also has a direct effect on Section 4: PEP screening did not run at all, so the nine confirmed officers remain unscreened, and PEP exposure at the ownership level cannot even be scoped until the chain is walked.

Required next step: obtain the Companies House record for Monzo Bank Holding Group Limited, extract its registration number and its own PSC register, and repeat until the chain reaches natural persons or a documented exemption.

Assessment

Screen status: RAN — genuine no-match result. Sanctions screening was executed against OFAC, UK OFSI and UN consolidated lists and returned no findings. Under the source-ledger taxonomy this is recorded as OK_EMPTY, meaning the source ran and genuinely found nothing. The sanctions factor scored 3/100, the lowest of the seven factors.

Evidence

Key Findings

• This is an exact-match negative, not a possible-match adjudication. No name variant, transliteration or partial hit required disposition. The distinctive legal name and the absence of retrieved aliases (Section 1) reduce false-negative risk from name-form mismatch.
• Scope limitation. The clean result attaches to the entity. The evidence pack does not demonstrate that the nine registry-confirmed officers or the declared corporate parent were separately screened against the same lists. This must not be presented internally as "all parties clear".
• List coverage limitation. OFAC, OFSI and UN were screened. There is no evidence that EU consolidated, Swiss SECO, Canadian, Australian, or sectoral/SSI and export-control lists (e.g. BIS Entity List, UK Sanctions List sectoral annexes) were screened. Where a client's own sanctions policy requires broader list coverage, this screen does not satisfy it.

Risk Implication

The no-match result is a meaningful positive control outcome and appropriately suppresses the highest-weighted factor in the model (34.1% applied weight, Section 11). It provides no assurance regarding the adverse findings in Sections 5 and 6, which concern the entity's own AML control failings rather than any designation against it — these are entirely distinct risk categories and must not be conflated in the file narrative.

The unclosed items are the officer-level and parent-level screens flagged above. Given that PEP screening also did not run (Section 4), the individual-level screening layer of this assessment is materially incomplete.

Screen status: NOT RUN

Assessment

No PEP screening was performed. The source ledger records: "No PEP screening provider configured [PEP] → SKIPPED". No PEP, RCA (relative or close associate) or HIO (head of international organisation) determination has been made for any person or entity connected to this file.

This is an absence of checking, not a negative result. The coverage statement expressly confirms that PEP is a "risk domain NOT reflected in the composite score".

What This Means Concretely

No political position, jurisdiction of exposure, or period of office can be stated for any individual, because no such data was retrieved. No individual named in this report is asserted to be, or asserted not to be, a PEP.

Explicit Prohibition Observed

This report does not infer PEP status from job titles, board roles, apparent seniority, or the fact that certain names may be publicly recognisable. Role-keyword matching is not a PEP determination and would be an unsound basis for either a positive or a negative conclusion.

Risk Implication

• FATF Recommendation 12 requires risk management systems to determine whether a customer or beneficial owner is a PEP, and mandates enhanced measures where they are. That determination has not been made here.
• FCA SYSC 12.1 and MLR 2017 regulation 35 require EDD, senior-management approval and source-of-wealth/source-of-funds establishment where a PEP, family member or known close associate is involved. Whether regulation 35 is engaged on this file is currently unknowable.
• The composite score of 44/100 is therefore structurally incomplete. Because the model renormalises weights across only the domains that ran, the PEP factor contributed nothing — it was not assumed to be zero-risk, but its absence means the score cannot be represented as a full-coverage assessment.

Required next step: run PEP/RCA/HIO screening against a licensed provider on all nine registry-confirmed officers, and — once the ownership chain in Section 2 has been walked — on every identified ultimate beneficial owner. Record the provider, list vintage and screening date. Until this is done, the file remains PARTIAL coverage.

Assessment

The adverse-media screen ran via Google Programmable Search and returned 10 results: 6 adverse, 0 positive, 4 neutral. Severity distribution: critical 0, high 6, medium 0, low 0. Five of the six adverse items concern a single subject — the FCA Final Notice of 7 July 2025 (analysed in Section 6). The sixth is a Payment Systems Regulator sector publication that does not carry an adverse determination against the entity in the retrieved snippet.

Evidence

Four further results in this domain were classified neutral; their content was not supplied and no conclusion is drawn from them.

Key Findings

1. Time span and concentration. Retrieved adverse coverage spans 31 October 2023 to 6 October 2025. There is no adverse item dated after October 2025, against a report date of 18 August 2026 — a roughly ten-month unevidenced period. This is a coverage limitation, not evidence of a quiet period.

2. The PSR item is materially mis-severitised. Item 6 is a regulator's sector performance report on APP scams data collection. The snippet places "Monzo Bank Limited, National Westminster ..." inside an enumeration of firms. Nothing in the retrieved text states a finding, a sanction, an allegation or a ranking against Monzo. Classifying this HIGH conflates being named in a regulatory publication with being adversely determined against. This is the single largest identifiable source of inflation in the Adverse Media score of 73/100.

3. Correction to the pre-synthesis brief. The brief states that "Eleven of the eleven adverse items ... resolve to one underlying fact set" — the FCA Final Notice. This is CONTRADICTED: item 6 does not concern the Final Notice and pre-dates it by approximately twenty months. The brief's finding of "no contradictions" as to date, amount and authority within the Final Notice cluster is, by contrast, supported by the evidence.

4. Source independence is narrower than claimed. The brief characterises six "independent" sources. Items 2 and the Regulation Tomorrow item in Section 6 are both Norton Rose Fulbright publications; Lexology is a syndication platform that may republish law-firm content already counted. Corroboration remains sufficient, but the number of genuinely independent originating publishers is fewer than six. Analysts should not represent the corroboration as broader than it is.

5. Substantive sub-allegation, partially recoverable. Financial Crime News states that "[i]n respect of business customers, Monzo's CDD procedures did not provide, as required by the UK Money Laundering ...". The snippet truncates before the operative requirement is identified. This is the only glimpse of a specific breach in the entire evidence pack. It is attributable to Financial Crime News's characterisation of the Final Notice; it is not reproduced here as an established regulatory finding, because the Final Notice itself was not retrieved.

6. Absence of positive coverage is not a negative signal. Zero positive items were returned. This reflects search-term construction oriented to adverse discovery, not an absence of favourable coverage.

Risk Implication

All reputational exposure identified in this domain is AML/CTF-relevant and concerns the counterparty's own control environment — precisely the exposure category that matters when assessing whether reliance can be placed on a financial-institution counterparty's CDD. The reputational risk is not of the entity being used as a criminal instrument; it is of the entity having been found deficient in detecting such use.

Adverse media contributed 16.57 points of the 44-point composite (73 × 22.7%, Section 11). Correcting for the PSR over-classification would likely reduce, but not eliminate, that contribution, since five of six items reflect a genuine determined outcome. The recommendation in Section 12 is not sensitive to that correction.

Assessment

This is the most consequential section of the report. The regulatory screen returned 10 results: 4 adverse, 0 positive, 6 neutral, severity high 4, no critical/medium/low. All four adverse items concern one determined regulatory outcome: an FCA Final Notice against Monzo Bank Limited dated 7 July 2025, penalty £21,091,300 after a 30% settlement discount, in respect of anti-money-laundering systems and controls.

The existence, date, amount, issuing authority and subject matter are CORROBORATED. The underlying findings are UNVERIFIED as to detail, because no primary FCA source was queried.

The Determined Outcome

Corroborating Sources

Analytical Observations

1. Evidential quality is high but derivative. A Final Notice is a determined regulatory outcome — not an allegation, not an investigation, not a charge. The characterisation discipline required by this report is satisfied: this is a concluded enforcement action with an imposed penalty, and it may properly be recorded as such. What may not be recorded as established fact is any specific breach description, because every account here is a secondary summary.

2. The primary document was not obtained. The Financial Crime News snippet contains the filename fragment monzo-bank-limited.pdf, consistent with an FCA-hosted Final Notice PDF, but that document was not retrieved. No FCA source appears in the source ledger. The FCA Register, the FCA enforcement/fines page and the Final Notice itself are all unqueried.

3. A publication-date anomaly, not a factual conflict. The Mishcon de Reya item carries an in-snippet date of 6 October 2025 for a 7 July 2025 Final Notice, and its snippet reads "Posted on 6 ...". This is most consistent with republication or re-indexing rather than a second event. No source describes a second or later notice. Treated as a date artefact, not a contradiction.

4. Absence of other enforcement findings is not a clean regulatory history. Six neutral results were returned with content not supplied. No search of the FCA Register, PRA enforcement records, Financial Ombudsman Service decision data, ICO enforcement register or PSR directions/penalties was performed. A statement that Monzo has no other regulatory findings cannot be supported on this evidence.

5. Temporal gap. No regulatory item post-dates October 2025. Any supervisory activity, remediation attestation, or further action between then and 18 August 2026 is unevidenced.

Risk Implication

The Regulatory & Enforcement factor scored 79/100 — the highest of the seven factors — contributing 16.12 points to the composite (79 × 20.4%). That elevation is evidence-based and should not be discounted.

Under MLR 2017 regulation 18 and 19 and FCA SYSC 6.3, a firm must maintain risk-assessment and AML policies proportionate to its business. An FCA finding of deficiency in AML systems and controls at a counterparty bank is directly relevant to:

• whether reliance may be placed on that institution's CDD under MLR 2017 regulation 39;
• the intensity of monitoring appropriate to any correspondent, agency, e-money distribution or intermediated relationship;
• the credibility of the counterparty's own financial-crime attestations.

Crucially, the penalty concerns control weakness, not proven facilitation of money laundering by the entity, and not any sanctions designation (Section 3 returned a genuine no-match). That distinction should be stated explicitly in any internal or client-facing summary, because conflating the two would materially mischaracterise the risk.

Required next step: retrieve the FCA Final Notice dated 7 July 2025 and the FCA Register entry directly, and record the specific breaches, conduct period, remediation obligations and current permissions on file.

Assessment

No litigation was identified. The litigation screen returned 10 results: 1 adverse, 9 neutral. The single adverse item is not a court record — it is the same Norton Rose Fulbright commentary on the FCA Final Notice already analysed in Sections 5 and 6, which the pipeline surfaced in the litigation domain because it contains regulatory-decision language.

Evidence

Analytically Significant Detail

The Norton Rose snippet records "Related decisions. No related decisions." This is a field in the publisher's structured summary of the Final Notice. It indicates that, as summarised by that publisher, the FCA notice was not accompanied by related decisions — for example against connected individuals. This is a third-party publisher's structured field, not an FCA statement retrieved directly, and it should be verified against the Final Notice itself. If accurate, it is mildly risk-reducing: it suggests no parallel SMCR action against named individuals arising from the same matter, which is relevant to the officer-level assessment in Section 2.

Material Limitation — Court Records Were Not Searched

Screen status: COURT REGISTERS NOT QUERIED.

The only litigation search mechanism that ran was Google Programmable Search. None of the following was consulted:

• HM Courts & Tribunals Service / Find a Case; the Business and Property Courts listings
• The Insolvency Service register and the Gazette
• Employment Tribunal decisions database
• Financial Ombudsman Service published decisions
• Upper Tribunal (Tax and Chancery) — the venue for challenges to FCA decisions
• Any non-UK court register

The consequence is precise: the evidence supports "no litigation was found via news and general web search". It does not support "the entity is not party to litigation." For a retail bank with a large customer base, that distinction is significant — such institutions are routinely party to civil claims and ombudsman complaints that never surface in general web search results.

Pattern Assessment

Risk Implication

The Litigation factor scored 66/100, contributing 7.52 points to the composite. That score is driven by the presence of a single HIGH-severity item which, on analysis, is the same FCA event already scored under Regulatory & Enforcement. This constitutes double-counting of one underlying event across two weighted factors, and it inflates the composite. Correcting it would reduce the composite below 44 but would remain within the Medium band.

This is disclosed here as a model limitation, not as a reason to override the score. The stated composite of 44/100 is reproduced faithfully in Section 11 as supplied; senior reviewers should note that the true litigation exposure identified in this evidence pack is nil, and that the 66/100 reflects a domain-classification artefact rather than an independent finding.

Required next step: conduct a direct court-register search across the sources listed above before relying on any statement about litigation exposure.

Assessment

No dedicated ESG data source was consulted. No ESG rating provider, sustainability disclosure database, modern-slavery statement register, ICO breach register or labour-tribunal dataset appears in the source ledger. ESG findings in this report are limited to conduct-risk inferences drawn from the regulatory and adverse-media evidence already analysed.

ESG & Conduct is not a weighted factor in the risk model (Section 11) and did not contribute to the composite score of 44/100.

Evidence by ESG Domain

Key Findings

1. The governance finding is real and it is the substantive ESG exposure. An FCA penalty for AML systems-and-controls deficiency is, in ESG terms, a governance and conduct failure determined by a regulator. It is not an allegation. It belongs in any ESG assessment of this counterparty and should be expected to appear in third-party ESG ratings.

2. The APP fraud item must be characterised with care. Being named in a regulator's sector performance report is not an adverse conduct finding. Any internal write-up that presents the PSR item as an APP-fraud failing by Monzo would mischaracterise the evidence. The retrieved snippet supports only that the PSR collected data across firms and that Monzo was among those named.

3. Truncated commentary must not be reconstructed. The ICA snippet's reference to "fraud alerts, all while bypassing effective ..." is incomplete. This report does not complete that sentence, infer its subject, or attribute the resulting proposition to Monzo. Doing so would be speculation with defamation exposure.

Framework References

Cited for methodological completeness. None of these frameworks was used as a data source in this assessment, and no compliance or non-compliance position is asserted under any of them:

• UN Global Compact — no participation status retrieved.
• TCFD — no climate-related disclosure retrieved.
• CSRD — applicability not assessed; no sustainability statement retrieved.
• UK Modern Slavery Act 2015 s.54 — no transparency statement retrieved; whether the turnover threshold is met cannot be determined because no financial data was recovered (Section 8).

Risk Implication

The conduct-risk profile is characterised by a single determined governance failure in the financial-crime control domain, not by a pattern across ESG pillars. Because the environmental, labour, supply-chain and data-protection pillars were not searched, the ESG picture is one-dimensional by construction. It must not be presented to a risk committee as an ESG assessment.

For institutional relationships with ESG screening obligations, this section is insufficient and requires a dedicated ESG data run, including an ICO enforcement-register check given the entity's likely large-scale personal-data processing.

Assessment

No financial data was recovered. This is a material due-diligence deficiency, and it is not an inference from silence — the financial screen ran and returned results, but their content was not delivered into the evidence pack.

Evidence

What Can and Cannot Be Said

Can be said: the financial screen produced zero adverse and zero positive financial signals. No distress indicator, no going-concern flag, no default, no adverse audit commentary and no negative-net-worth signal was surfaced. Companies House status is active (Section 1), and no insolvency proceeding was identified (Section 7).

Cannot be said: anything about the entity's actual financial condition, scale, profitability, capitalisation or funding history. Zero adverse financial results is not a clean bill of financial health — it is the absence of a retrieved signal from a search whose content was not delivered.

Source of Wealth / Source of Funds

For a corporate customer of this type, the relevant construct is source of funds and business rationale rather than personal source of wealth. Neither can be assessed:

• Business model and revenue composition: not evidenced.
• Capital and funding origin: not evidenced. The declared PSC is a corporate holding entity (Section 2) whose own financial position and funding sources were not examined.
• Ultimate beneficial owners: not identified, so no owner-level source-of-wealth work is possible.

Red-Flag Screen (explicitly negative on retrieved evidence)

Risk Implication

Financial Profile is not a weighted factor in this risk model (see Section 11) and therefore did not influence the composite score of 44/100. Its influence reaches the score only indirectly, via Transparency Risk (scored 8/100), which the absence of financial content arguably understates.

Under MLR 2017 regulation 28(4)(a) a firm must assess the purpose and intended nature of the business relationship, and under regulation 28(11) must keep CDD information up to date. For an institutional counterparty, audited accounts and — where applicable — Pillar 3 disclosures are the ordinary evidential basis. Their absence must be recorded as an open item on the file, not treated as an immaterial gap.

Required next step: obtain the most recent filed statutory accounts from Companies House for MONZO BANK LIMITED (09446231) and, if it is the consolidating entity, for the declared parent. Record the accounts reference period and the audit opinion.

Assessment

Jurisdictional risk is low, and the model's Jurisdiction Risk score of 35/100 reflects a baseline for a well-regulated but high-financial-activity jurisdiction rather than any identified geographic red flag. Operating footprint beyond the jurisdiction of incorporation was not evidenced.

Evidence

Reference Datasets — Disclosure of Non-Consultation

No dedicated jurisdiction-risk reference dataset was queried in this assessment. Specifically:

• FATF public statements ("black list" — Call for Action) and the FATF grey list (Increased Monitoring): not consulted in this run; no list vintage or publication date can be cited.
• UK High-Risk Third Countries list (MLR 2017 Schedule 3ZA, as amended): not consulted.
• EU list of high-risk third countries: not consulted.
• Transparency International Corruption Perceptions Index: not consulted. No CPI score is stated in this report for the United Kingdom or any other jurisdiction, because none was retrieved. A CPI figure quoted from memory would be a fabrication and is deliberately omitted.
• Basel AML Index: not consulted.

The Jurisdiction Risk score of 35/100 was produced by the scoring model, presumably on an internal jurisdiction reference table. That table was not exposed in the evidence pack, so the derivation of the figure cannot be independently reproduced from the evidence supplied.

Analysis

• The United Kingdom is a FATF member jurisdiction. This assessment does not identify it, on retrieved evidence, as appearing on any high-risk or increased-monitoring list; that statement rests on the absence of any such retrieved indication, not on a consulted list.
• No offshore, secrecy-jurisdiction or high-risk-third-country nexus was identified anywhere in the evidence pack — in the registry record, the ownership record, or any of the 40 web results across four domains.
• The material geographic unknown is the entity's operating footprint. A UK-incorporated bank may serve customers, hold correspondent relationships, or operate subsidiaries across multiple jurisdictions. None of that was evidenced. For an institution whose AML controls have been the subject of an FCA Final Notice (Section 6), the geographic distribution of its customer base is directly relevant to the residual risk it presents as a counterparty.

Risk Implication

Jurisdiction Risk contributed 2.38 points to the composite (35 × 6.8% applied weight) — the second-smallest contribution of any factor. It is not a driver of the Medium rating; the AML enforcement history in Section 6 is.

Because the entity is GB-incorporated and no high-risk-jurisdiction nexus was identified, the geographic limb of the MLR 2017 regulation 33(1)(b) automatic EDD trigger (business relationship with a person established in a high-risk third country) is not engaged on the available evidence. That conclusion is stated as conditional on the reference datasets above not having been consulted, and on the operating footprint remaining unevidenced.

Required next step: establish the operating and customer-base jurisdictions and the jurisdiction of the declared parent, and screen both against the current FATF and UK HRTC lists with the list date recorded.

Assessment

Composite: 44/100 — MEDIUM. Coverage: PARTIAL. Confidence: MEDIUM.

The model has exactly seven weighted factors. Weights below are the applied (renormalised) weights supplied in the risk-score block, redistributed across the six domains that actually ran. Politically Exposed Persons did not run and therefore carries no weight and contributes nothing.

Scoring Table

Applied weights as supplied sum to 99.9% owing to rounding at one decimal place.

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

``` Sanctions & Watchlists 3 × 0.341 = 1.023 Adverse Media 73 × 0.227 = 16.571 Regulatory & Enforcement 79 × 0.204 = 16.116 Politicaly Exposed Persons — (screen did not run) = 0.000 Litigation 66 × 0.114 = 7.524 Jurisdiction Risk 35 × 0.068 = 2.380 Transparency Risk 8 × 0.045 = 0.360

Composite = 43.974 → 44/100 ```

Running total: 1.023 → 17.594 → 33.710 → 41.234 → 43.614 → 43.974. The arithmetic reproduces the supplied composite of 44/100 exactly.

Band

What Actually Drives the Score

1. 1.Regulatory & Enforcement (16.12 pts). The single genuine driver. Evidence-based and appropriately weighted.
2. 2.Adverse Media (16.57 pts). Largest single contribution, but five of six items are the same event as (1), and the sixth is probably over-severitised.
3. 3.Litigation (7.52 pts). Contains no litigation. Reflects the same event as (1) surfacing in a third domain.

Concentration observation: approximately 40.2 of the 44 composite points (91%) derive from three factors whose adverse content resolves, in substance, to one underlying regulatory event. The score should therefore be read as "one significant, well-corroborated AML enforcement outcome" rather than as three independent adverse domains. Presenting it otherwise to a risk committee would overstate the breadth of exposure.

Offsetting the above: the highest-weighted factor (Sanctions, 34.1%) scored 3/100 on a screen that genuinely ran, and Transparency scored 8/100. These strongly suppress the composite and are the reason the entity sits at Medium rather than High.

Coverage Qualification

This is a PARTIAL-coverage score and must not be presented as complete.

PEP screening did not run. Its weight was redistributed to the remaining six domains, which means the score is a fully-normalised figure across a reduced factor set — not a figure that accounts for PEP risk at a neutral value. If PEP screening subsequently identifies exposure, the composite will move upward and the CDD conclusion in Section 12 must be re-derived.

Additional non-scored gaps affecting confidence: FCA primary sources unqueried (Section 6), court registers unsearched (Section 7), no financial statement content recovered (Section 8), no ESG source consulted (Section 10), and no retrieved evidence dated after October 2025 against a report date of 18 August 2026.

Recommendation

Standard CDD with Enhanced Monitoring. Consistent with the model output at a composite of 44/100 (Medium). Full EDD is not triggered by the available evidence.

This recommendation is conditional. The file must not be marked complete, and no simplified due diligence may be applied, until the two mandatory items in Required Actions 1 and 2 below are closed. If PEP screening returns a positive determination on any officer or beneficial owner, this recommendation is void and the file escalates to EDD under MLR 2017 regulation 35.

Rationale

Why not Simplified DD: a determined FCA enforcement outcome for AML systems-and-controls deficiency (Section 6) makes low-risk classification indefensible, irrespective of the counterparty's regulated status.

Why not mandatory EDD: none of the automatic triggers in MLR 2017 regulation 33(1) is engaged on the retrieved evidence —

• No high-risk third country nexus identified; GB incorporation (Section 9).
• No sanctions match; screen ran clean against OFAC/OFSI/UN (Section 3).
• No PEP identified — but note this is because no PEP screen ran, not because a screen returned negative (Section 4). This is the single largest reason the EDD conclusion is provisional.
• No complex or unusually large transaction pattern evidenced; no correspondent-banking relationship characterised in the evidence.
• Ownership is registry-disclosed and not opaque, though incomplete to ultimate natural persons (Section 2).

Why Enhanced Monitoring: the adverse profile concerns the counterparty's own capacity to detect and report financial crime. Where that is in question, the appropriate response is intensified ongoing monitoring of the relationship rather than a heavier onboarding evidence burden.

Outstanding Information Gaps

Enhanced Monitoring Measures (applicable notwithstanding the Standard CDD classification)

1. 1.Quarterly re-screening of the entity and all confirmed officers against sanctions and, once configured, PEP datasets.
2. 2.Standing media and regulatory alerts on "Monzo Bank Limited" and the FCA enforcement register, calibrated to capture any further Final Notice, supervisory notice, VREQ/OIREQ or requirement variation.
3. 3.Annual request for the counterparty's AML control attestation, with specific reference to the remediation arising from the 7 July 2025 Final Notice.
4. 4.Where any reliance is placed on this counterparty's CDD under MLR 2017 regulation 39, document explicitly why that reliance remains reasonable given the FCA finding — or withdraw the reliance.

Required Actions

1. 1.[BLOCKING] Commission PEP/RCA/HIO screening from a licensed provider on all nine registry-confirmed officers (MCCULLAGH, BURBIDGE, DIAS, KEELEY, LAYFIELD, MCBAIN, NEWBERY, PALANIAPPAN, WICKER-MIURIN) and on the ownership chain once identified. Record provider, list vintage and screening date.
2. 2.[BLOCKING] Retrieve the FCA Final Notice dated 7 July 2025 from the FCA directly, together with the FCA Financial Services Register entry. Record the FRN, current permissions, the specific rule breaches, the relevant conduct period and any remediation or skilled-person requirement.
3. 3.Walk the ownership chain upward from Monzo Bank Holding Group Limited via Companies House until natural persons above the 25% PSC threshold are identified or a documented exemption is established. Record the parent's registration number.
4. 4.Obtain the latest filed statutory accounts for company 09446231 and, if different, for the consolidating parent; record the accounts period and audit opinion.
5. 5.Conduct a direct court-register search (HMCTS/Find a Case, the Gazette/Insolvency Service, Employment Tribunal decisions, Upper Tribunal Tax and Chancery, FOS published decisions) to replace the news-only litigation position in Section 7.
6. 6.Re-run adverse media and regulatory searches restricted to the period October 2025 to the report date to close the ten-month temporal blind spot.
7. 7.Run an ICO enforcement-register check and a dedicated ESG data pull to give Section 10 substantive coverage.
8. 8.Record on file, in explicit terms, that the FCA matter is a control-deficiency enforcement outcome, not a sanctions designation and not a finding of money-laundering facilitation by the entity.

Trigger Events for Immediate Out-of-Cycle Review

• Any positive PEP or sanctions match on the entity, an officer or an identified beneficial owner.
• Publication of any further FCA, PRA, PSR or ICO enforcement action, supervisory notice or requirement.
• Any change in the PSC register or the appearance of a new controller.
• Any change in FCA authorisation status, permissions or the imposition of a restriction.
• Commencement of insolvency, administration or any class/group action.
• Any credible report of failure to complete the remediation arising from the 7 July 2025 Final Notice.

Monitoring Frequency and Next Review

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Complete Source Ledger

Assessment date: 18 August 2026. Coverage status as supplied: PARTIAL.

Methodology

1. 1.Provenance stratification. Every item was classified as (a) authoritative registry data, (b) determined regulatory or judicial outcome, (c) third-party commentary, or (d) analytical inference. Registry data carried the highest evidential weight; secondary reporting of a determined outcome was treated as corroborative of the outcome's existence but not of its detailed findings.
2. 2.Characterisation control. Allegation, investigation, charge and determined outcome were kept strictly distinct. The FCA matter is recorded as a determined regulatory outcome (Final Notice with imposed penalty). The APP-fraud item is recorded as the entity being named in a regulator's sector publication with no adverse determination in the retrieved text. Truncated commentary was not reconstructed or completed.
3. 3.Ownership taxonomy. CONFIRMED (authoritative registry) versus DECLARED (company-filed, unverified) versus UNVERIFIEDLEAD was preserved throughout. Officers were never described as owners. No UNVERIFIEDLEAD entries were present in this pack.
4. 4.Corroboration and de-duplication testing. The four regulatory and five relevant adverse-media items were tested for whether they constitute independent findings or one event refracted across domains. They were found to be one event. Publisher independence was separately assessed, identifying that two corroborating sources share a single publisher (Norton Rose Fulbright) and that one is a syndication platform (Lexology).
5. 5.Pre-synthesis brief evaluated, not adopted. The brief was treated as an analytical input to test. Two of its assertions were sustained (the corroboration of the Final Notice; the negative prompt-injection finding). Two were qualified or contradicted: the claim that all eleven adverse items resolve to the FCA event is contradicted by the PSR item, and the claim of six independent sources is overstated.
6. 6.Prompt-injection review. All content within the untrusted markers was reviewed for embedded directives, scoring guidance or behavioural instructions. None was found. The monzo-bank-limited.pdf string is a filename fragment in a news excerpt, not a directive. No content from the untrusted block was treated as instruction.
7. 7.Score reproduction. Factor scores and applied (renormalised) weights were taken verbatim from the supplied risk-score block and the arithmetic reproduced independently to 43.974 ≈ 44. No score or weight was modified. Where model artefacts were identified — cross-domain double-counting of the FCA event; probable over-severitisation of the PSR item — these were disclosed as limitations rather than used to silently adjust the composite.
8. 8.Negative-result discipline. OK_EMPTY was reported as a genuine clean signal. SKIPPED and un-queried sources were reported as absence of checking, never as absence of risk.

Limitations

Material and blocking:

• PEP screening did not run. No PEP, RCA or HIO determination exists for any of the nine confirmed officers or the declared parent. The composite score is normalised across a reduced factor set and is not a full-coverage figure.
• No FCA primary source was queried. The specific breaches, conduct period, remediation obligations and current permissions underlying a £21,091,300 penalty are all unverified. Every account of the penalty in this pack is secondary.

Material:

• Beneficial ownership terminates at a declared corporate parent; no ultimate natural person identified; no registration number or percentage holding retrieved.
• No financial data recovered despite the financial screen returning ten results — source-of-funds and financial-standing assessment cannot be performed.
• Court registers were not searched; the litigation position rests on general web search only.
• No retrieved evidence post-dates October 2025, leaving approximately ten months unevidenced.

Model artefacts disclosed:

• The FCA Final Notice is scored across three weighted factors (Regulatory & Enforcement, Adverse Media, Litigation), accounting for roughly 91% of the composite from one underlying event.
• The Litigation factor scored 66/100 on a domain in which no litigation was identified.
• The Jurisdiction Risk score of 35/100 cannot be reproduced from the supplied evidence because the underlying reference table was not exposed.

Not identified (and therefore not asserted either way): any sanctions designation; any high-risk-jurisdiction nexus; any offshore structure; any court proceeding; any insolvency event; any environmental, labour or data-protection enforcement.

Legal and Regulatory Framework Referenced

• UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — regs 18, 19, 28, 33, 35, 39
• FCA Handbook SYSC 6.3 (financial crime systems and controls) and SYSC 12.1
• FATF Recommendations 12 (PEPs) and 24 (beneficial ownership of legal persons)
• UK PSC regime (Companies Act 2006 Part 21A), 25% threshold
• EU 5AMLD Article 30 and 6AMLD — cited for methodological comparison only; not directly applicable to a GB entity
• UK Modern Slavery Act 2015 s.54 — applicability not determined

Confidence

Overall confidence: MEDIUM.

Supporting higher confidence: the registry layer is authoritative, complete on core fields and internally consistent; the sanctions screen genuinely ran and returned a clean exact-match negative on the highest-weighted factor; the central adverse finding is a determined regulatory outcome corroborated across four regulatory-domain sources with zero contradiction on date, amount, authority or subject matter.

Constraining confidence: PEP screening did not run at all; the FCA Final Notice itself was never retrieved, so the most consequential finding in the report rests entirely on secondary summaries; the ownership chain does not reach a natural person; no financial content was recovered; court registers were unsearched; and roughly ten months preceding the report date are unevidenced.

Confidence is sufficient to support the Medium risk classification and the Standard-CDD-with-Enhanced-Monitoring recommendation, but not sufficient to close the file. The two blocking actions in Section 12 must be completed before this assessment can be represented as a complete institutional due-diligence record.