MONZO BANK LIMITED

Assessment

Entity identity is VERIFIED against an authoritative registry. There is no identity ambiguity, no name-matching problem and no indication of a shell or dormant structure. The registration profile is complete on every field the registry extract supplied.

Evidence

Key Findings

• The entity has been on the register for approximately 11 years and 6 months as at the report date of 18 August 2026. Longevity is inconsistent with a short-lived layering vehicle.
• The registered office is a substantive central London commercial address, not a formation-agent or mail-forwarding address on the face of the record.
• The name, and the regulatory record described in Section 6, are consistent with a UK deposit-taking bank.

Material Gaps

• FCA / FS Register: screen status: NOT RUN. No prudential or conduct-authorisation screen was performed. The following are therefore NOT VERIFIED: authorisation status, Firm Reference Number, permitted regulated activities, FSCS deposit-protection status, and whether Monzo Bank Limited is dual-regulated by the PRA. For a counterparty presented as a bank, this is the single most significant identity gap.
• Filing history and accounts were not retrieved. Confirmation-statement currency, accounts filing status, any late-filing history, registered-office change history and previous names are unknown.
• No trading name / LEI / VAT identifier was retrieved.
• SIC code / stated nature of business was not retrieved, so the registry does not itself confirm banking activity in this evidence set.

Risk Implication

Identity risk is low and contributes to the low Transparency Risk factor (8/100) in Section 11. However, the absence of an FCA Register check means the report cannot state as verified fact that the entity is a currently authorised credit institution. Under MLR 2017 Reg 27–28, verification of the customer's regulated status is the gateway to any simplified treatment or CDD reliance; that gateway remains unverified here. See Section 6 for the regulatory record and Section 12 for the required action.

Assessment

Control is partially established. Officer appointments are CONFIRMED from the Companies House officers register. The single Person with Significant Control is DECLARED ONLY — filed by the company and not independently verified — and the chain to ultimate natural persons is NOT ESTABLISHED.

Officers (CONFIRMED — Companies House officers register)

Composition: 8 directors + 1 company secretary = 9 officers. The pre-synthesis brief described a "nine-person board"; on the registry evidence the board comprises eight directors, with the ninth officer being the company secretary. That correction is recorded here as a matter of accuracy discipline.

Persons with Significant Control

The 25% Threshold

Under the UK PSC regime (Companies Act 2006 Part 21A) and MLR 2017 Reg 5, a person is a registrable beneficial owner where they hold, directly or indirectly, more than 25% of shares or voting rights, or hold the right to appoint or remove a majority of the board, or otherwise exercise significant influence or control.

• The specific nature and percentage of Monzo Bank Holding Group Limited's control was NOT retrieved. The evidence records only that it is registered as a PSC.
• No ultimate natural person is identified anywhere in the evidence. A corporate PSC is a Relevant Legal Entity in the UK regime; the register discloses the RLE and stops there. Identifying the natural persons behind it requires walking the chain through the holding company's own PSC register — which was not done.

Material Gaps

1. 1.Holding company registration number NOT retrieved. Without it, the correct Companies House record for "Monzo Bank Holding Group Limited" cannot be identified with certainty, and any onward chain-walking risks matching the wrong entity.
2. 2.No share capital, shareholder register or ownership percentage data retrieved.
3. 3.No director dates of birth, nationalities, occupations or service addresses retrieved — officer-level identity verification and screening cannot be completed to a documentable standard.
4. 4.No group structure chart, no intermediate holding entities, no ultimate parent identified.
5. 5.No verification of PSC declaration against any independent source. Companies House does not verify PSC filings substantively; the declaration is the company's own statement.

Risk Implication

• The structure disclosed is a simple, single-tier corporate parent — the archetype of a UK bank operating subsidiary beneath a holding company. There is no evidence of nominee arrangements, layered offshore vehicles, bearer instruments or circular ownership. That absence of complexity is the reason Transparency Risk scores 8/100 in Section 11.
• Nevertheless, describing the beneficial ownership as verified would be false. Under FATF Recommendation 24 and EU 5AMLD Article 30, registry data is a starting point, not a conclusion; the obligation is to identify the beneficial owner and take reasonable measures to verify identity.
• The officer list directly constrains Section 4: nine named natural persons are exposed to PEP/RCA risk and none has been screened, because no PEP provider was configured.
• The identity of the parent is also relevant to Section 3: sanctions screening evidence relates to the subject entity; there is no evidence that Monzo Bank Holding Group Limited or the individual officers were separately screened.

Assessment

Sanctions screening ran and genuinely returned no results. This is a meaningful clean signal and is treated as such — distinct from a failed or skipped screen. Scope, however, is narrower than the score implies.

Evidence

Detail Not Present in the Evidence

The evidence set contains no sanctions hit, and therefore none of the following fields exists to report: list name of a designation, entry date, designation reason, or match confidence. That is the correct outcome for a no-hit screen. The following process fields, however, are also missing and they matter:

• Screening date not recorded. The report date is 18 August 2026; the evidence does not state when the sanctions query executed. Screening currency cannot be evidenced.
• Match methodology not recorded — no threshold, fuzzy-logic setting, transliteration handling or alias-list configuration is disclosed.
• Lists not covered: the ledger names OFAC, UK OFSI and UN only. There is no evidence of screening against the EU Consolidated List, HM Treasury's separate consolidated list beyond OFSI, Swiss SECO, national or regional lists, law-enforcement/wanted lists, or internal watchlists.
• Screening appears to be entity-level. There is no evidence that the eight directors, the company secretary, or the declared PSC Monzo Bank Holding Group Limited (Section 2) were screened individually. Officer-level and controller-level sanctions clearance is therefore NOT ESTABLISHED.

Risk Implication

• No exact match and no possible name match was returned for the subject entity across OFAC, OFSI and UN. On that basis sanctions risk at entity level is low, and this is the largest single downward driver of the composite score (weight 34.1%, score 3/100 — see Section 11).
• The clean result must not be extended to the natural persons identified in Section 2. Under UK financial sanctions law the prohibition attaches to designated persons including those exercising control; screening only the corporate layer leaves that exposure untested.
• Sanctions screening must be re-run at the point of any onboarding decision and thereafter on the quarterly cycle recommended in Section 12, given the ten-month intelligence blackout described in Section 5.

Screen status: NOT RUN

Assessment

PEP screening was not performed. The source ledger records: "No PEP screening provider configured [PEP] → SKIPPED". No conclusion of any kind — positive or negative — may be drawn about the PEP, RCA (Relative or Close Associate) or HIO (Head of International Organisation) status of the subject entity, its officers or its declared controller.

This report does not state that any named individual is not a PEP. It states that the question was never asked.

Unscreened Population

The following natural persons are CONFIRMED on the Companies House officers register (Section 2) and are entirely unscreened for PEP status:

1. 1.MCCULLAGH, Paul (secretary)
2. 2.BURBIDGE, Eileen (director)
3. 3.DIAS, Valerie Michelle (director)
4. 4.KEELEY, Rupert Graham (director)
5. 5.LAYFIELD, Diana Louise Patricia (director)
6. 6.MCBAIN, Fiona Catherine (director)
7. 7.NEWBERY, Mark (director)
8. 8.PALANIAPPAN, Jambu (director)
9. 9.WICKER-MIURIN, Jane Fields (director)

The declared PSC, Monzo Bank Holding Group Limited, has also not been assessed for state ownership, sovereign-wealth participation or PEP-linked shareholdings — and, as noted in Section 2, its own beneficial owners are unidentified, so any PEP exposure sitting above the holding company is invisible.

What Cannot Be Reported

Because no screen ran, none of the required fields can be populated: PEP/RCA/HIO classification, political position or public function held, jurisdiction of the function, or the time period of exposure (current vs. former, and whether within any applicable look-back).

No role-keyword inference has been substituted. Inferring PEP status (or its absence) from director titles is not a screen and would be an unsupported conclusion.

Regulatory Implication

Effect on the Composite Score

The PEP factor contributes nothing to the 44/100 composite. The coverage statement confirms: "Risk domains NOT reflected in the composite score: PEP." The composite is therefore a partial score covering six of seven weighted domains, with the remaining weight redistributed across the domains that ran. Section 11 records the PEP row as UNDETERMINED with no weight, as required.

Required Next Step

Commission PEP/RCA/HIO screening against all nine named officers and the declared PSC before any onboarding, credit or reliance decision is finalised. Until then the CDD file must be marked incomplete, irrespective of the MEDIUM composite band.

Assessment

The adverse-media set returned 10 results: 6 adverse (all HIGH severity), 0 positive, 4 neutral. Analytically, the six adverse items reduce to two underlying real-world events, one of which is not adverse at all. The dominant characteristic of this evidence set is signal duplication, not signal accumulation — a conclusion advanced in the pre-synthesis brief and confirmed on inspection of the evidence.

Adverse Items — Full Inventory

URLs preserved:

• http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/
• https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings
• https://www.int-comp.org/insight/the-real-lesson-from-the-monzo-fine-industry-s-broken-approach-to-money-laundering-risk-assessment/
• https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls
• https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/
• https://www.lexology.com/library/detail.aspx?g=74fe36f4-28d6-42e9-845b-e414d3ef34d1

Key Findings

• Five of six adverse items describe one event: the FCA Final Notice of 7 July 2025. Reported penalty: £21,091,300 after a 30% settlement discount (Lexology; Norton Rose Fulbright). Reported subject matter: AML systems and controls.
• Source independence is weaker than the count suggests. connections.nortonrosefulbright.com and regulationtomorrow.com (the latter appearing in the Regulatory domain, Section 6) are both Norton Rose Fulbright channels. Lexology is a republication platform rather than an originating publisher. There is no independent investigative journalism in the set, and no mainstream news reporting was returned.
• No allegation of predicate criminality. Nothing in the adverse-media set alleges that Monzo Bank Limited or any named officer laundered money, committed fraud, or was investigated for a criminal offence. The reported findings concern control failures, which is a materially different risk category.
• No named individual is the subject of any adverse allegation anywhere in the set.
• Item 5 is not adverse. Inclusion in a PSR comparative performance dataset alongside other named UK banks is a supervisory transparency publication. Its HIGH severity classification appears to be a keyword-driven error and inflates the Adverse Media factor score of 73/100.
• Four neutral results were returned but are not itemised in the evidence extract; their content is therefore unknown and cannot be assessed.

Time Span and Currency

Most items are marked UNDATED with an in-snippet posting date; those dates reflect publication or indexing, not necessarily the event date. The only anchor event date is 7 July 2025, consistently reported.

Risk Implication

• The adverse-media profile is reputationally significant but narrow in kind: one high-value AML enforcement outcome against the subject's own control framework, extensively covered by professional media because of its precedent value to the wider industry.
• Because the Adverse Media factor (73/100, weight 22.7%) and the Regulatory factor (79/100, weight 20.4%) are driven by the same event, the composite score in Section 11 embeds double counting; adding the Litigation artefact described in Section 7 makes it triple counting. Risk committees should read 44/100 with that qualification.
• The ten-month blackout is the more actionable finding: no evidence exists as to whether further supervisory action, remediation milestones, s.166 requirements, civil claims or consumer-redress developments arose after October 2025.
• No prompt-injection or instruction-like content was present in the retrieved media snippets.

Assessment

This is the most material domain. The evidence supports a finding that a UK regulator issued a Final Notice — a determined enforcement outcome, not an allegation, investigation or charge — against Monzo Bank Limited on 7 July 2025, imposing a financial penalty for failings in AML systems and controls. The finding is consistently reported by four sources in this domain and a further two in the adverse-media domain. The primary Final Notice itself was not retrieved.

Evidence

Regulatory-domain source URLs preserved:

• http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/ (2025-07-09) — "The FCA found that, key elements of Monzo's financial crime ..." and references a document named monzo-bank-limited.pdf
• https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings — "imposing a fine ..."
• https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls — "issued Monzo Bank Limited with a Final Notice, imposing a financial penalty of ..."
• https://www.regulationtomorrow.com/2025/07/financial-crime-controls-in-the-spotlight-lessons-learned-in-relation-to-fca-supervisory-powers-and-expectations/ (2025-07-23) — "provides a number of key takeaways for regulated ..."

What the Sources Specifically Attribute to the Regulator

Attributed claims, reported as claims of the cited publications:

• thefinancialcrimenews.com reports that "In respect of business customers, Monzo's CDD procedures did not provide, as required by the UK Money Laundering [Regulations]" and that "The FCA found that, key elements of Monzo's financial crime ..." (snippet truncated).
• Norton Rose Fulbright reports the sanction as "Fine of £21,091,300 following a 30% settlement discount" and records "Related decisions: No related decisions" — indicating, on that source's own summary format, that no linked enforcement decisions (for example against individuals) were identified alongside the notice.
• int-comp.org references "fraud alerts, all while bypassing effective ..." (snippet truncated). The full sense cannot be reconstructed from the fragment and no inference should be drawn from it.
• Mishcon de Reya and Lexology corroborate the date, the regulator, the penalty and the subject matter.

Critical Evidential Limitations

1. 1.The FCA Final Notice was not obtained. All six references are secondary. The 30% settlement discount indicates the matter was resolved via the FCA's executive settlement procedure (Stage 1), but the actual findings, relevant period, breach provisions cited, remediation undertakings and any ongoing requirements are not in evidence.
2. 2.Source independence is limited. Two of the four regulatory-domain sources are Norton Rose Fulbright channels.
3. 3.No FCA / FS Register screen ran. The evidence therefore does not establish: current authorisation status; permissions; whether a Skilled Person (s.166) requirement, voluntary requirement (VREQ) or own-initiative requirement (OIREQ) is in place; whether any restriction on onboarding remains; or whether any further enforcement action has been opened since.
4. 4.No enforcement action against any individual is evidenced. No prohibition order, no Senior Managers Regime action, no censure of any named officer appears anywhere in the evidence set. Nothing in this report should be read as implying otherwise.
5. 5.No evidence covers November 2025 – August 2026. Any subsequent FCA, PRA, PSR, ICO or Ofcom action in that period is outside the evidence.
6. 6.PRA / prudential record not searched. Capital, liquidity or governance interventions by the PRA are unassessed.

Risk Implication

• A £21,091,300 penalty for AML systems-and-controls failings is a serious, determined regulatory finding. It establishes that the subject's financial-crime framework was assessed by its home regulator as deficient during the relevant (unspecified) period.
• The most direct operational consequence for a third party is CDD reliance. Under MLR 2017 Reg 39, a firm may rely on another regulated person for CDD but remains liable for failure. Where the FCA has determined that the prospective relied-upon firm's CDD procedures for business customers did not meet MLR requirements, reliance should not be granted without evidence of remediation. This is the single most consequential finding in the report for a compliance decision.
• The Regulatory & Enforcement factor scores 79/100 at 20.4% applied weight — the highest factor score in the model (Section 11). That score is justified by the event itself; but its reappearance in Adverse Media (Section 5) and Litigation (Section 7) means the same event is counted three times.
• The PSR item should be reclassified as non-adverse; it evidences supervisory transparency reporting, not misconduct.

Assessment

No litigation was identified. The Litigation domain returned 10 results, of which 2 were classified adverse — and both are the same FCA Final Notice commentary already counted in Sections 5 and 6. The domain score of 66/100 is an artefact of keyword overlap, not evidence of legal proceedings. This confirms the pre-synthesis brief's conclusion on this point.

Evidence

What Is Absent from the Evidence

None of the following appears anywhere in the evidence set:

• Court or tribunal name (no High Court, County Court, Upper Tribunal, Competition Appeal Tribunal or Financial Services and Markets Tribunal reference)
• Case or claim number
• Named claimant or defendant in any proceeding
• Case type (contract, tort, group/class claim, judicial review, regulatory appeal)
• Procedural status or outcome
• Judgment, order, damages award or costs order
• County Court Judgments or statutory demands
• Insolvency proceedings, administration, winding-up petition or liquidation
• Criminal charge, prosecution, indictment or conviction against the entity or any named officer

Coverage Limitation

Direct court-record search: screen status: NOT RUN

The Litigation domain was populated by Google Programmable Search only. No primary court-record source was queried — no UK judiciary/BAILII/Find Case Law search, no Companies Court records, no Insolvency Service register, no Registry Trust CCJ check, no Upper Tribunal (Tax and Chancery) decisions database. Consequently:

• The absence of litigation findings is NOT FOUND, not NONE. Unreported, settled, confidential or first-instance proceedings that generate no press coverage would be invisible to a web search.
• For a retail bank with a large customer base, some volume of small-value consumer claims and Financial Ombudsman Service complaints would be unsurprising; the evidence set does not address FOS complaint data at all.

Pattern Analysis

• No repeat-litigation pattern can be identified — there is no litigation in evidence to form a pattern from.
• No class or group action is evidenced.
• No insolvency indicator is evidenced; the entity's Companies House status is active (Section 1).

Risk Implication

• The Litigation factor's contribution of 66 × 11.4% = 7.5 points to the composite in Section 11 is not supported by litigation evidence. Risk committees should treat this component as unreliable and duplicative, and read the composite accordingly.
• Simultaneously, the domain must not be recorded as clear. A properly evidenced litigation clearance would require a direct court-record and insolvency-register search, which did not occur.
• No named individual has been the subject of any legal proceeding in this evidence set. Any suggestion to the contrary would be unsupported and actionable.

Assessment

Dedicated ESG screen: NOT RUN

No ESG data provider, sustainability database, modern-slavery register, labour-standards source, environmental-enforcement register or data-protection enforcement register was consulted. All ESG-adjacent observations below derive from the general adverse-media and regulatory search results and are limited accordingly. ESG & Conduct Risk is not a weighted factor in the scoring model (Section 11) and reaches the composite only indirectly, through Transparency Risk.

Governance and Conduct — What the Evidence Supports

Key Findings

1. 1.The only substantiated ESG issue is a governance one, and it is the same event analysed in Sections 5 and 6: a regulator-determined failure of financial-crime systems and controls. Under any mainstream ESG taxonomy this is a Governance / business-ethics finding of high materiality for a financial institution.
2. 2.The PSR item is a conduct-transparency datapoint, not a conduct finding. The evidence does not state how Monzo performed. Any characterisation of its APP-fraud performance as good or poor would be unsupported.
3. 3.No environmental, social, labour or data-protection issue was identified — and none was screened for. These are unexamined domains, not clean domains.
4. 4.No ESG-related allegation against any named individual appears in the evidence.

Reference Frameworks (not applied to evidence — no ESG source ran)

• UN Global Compact — no participation status retrieved.
• TCFD / CSRD — no climate or sustainability reporting retrieved.
• UK Modern Slavery Act 2015 s.54 — no transparency statement retrieved.

Risk Implication

• For ESG-sensitive counterparties, investment committees or reputational-risk assessment, the FCA finding creates a documented governance blemish that will surface in third-party ESG and controversy screening. It should be disclosed proactively in any internal approval paper.
• For AML purposes, the ESG gap is not itself a financial-crime risk driver; it is a completeness gap.
• If the institution's policy requires ESG or reputational-risk sign-off, the file is not sufficient for that purpose: a dedicated controversy screen would be needed.

Assessment

No financial profile could be constructed. The financial screen ran and returned 10 results, all classified neutral, with zero extractable figures. No revenue, turnover, asset, capital, liquidity, profitability, funding-round or investor data is present in the evidence set. This is a material due-diligence deficiency for a counterparty presented as a bank.

Evidence

Source of Funds and Source of Wealth

• Structurally, a UK-incorporated bank's funding derives from customer deposits, shareholders' equity injected via its holding company, wholesale funding and retained earnings. However, none of this is evidenced. No figure, no capital instrument, no investor and no funding event appears in the evidence.
• The declared PSC, Monzo Bank Holding Group Limited (Section 2), is the presumptive equity conduit, but no capital-flow evidence, no shareholder list and no investor identity was retrieved, and the holding company's own beneficial owners are unidentified. Source of wealth at ultimate-owner level is therefore UNDETERMINED.

Red-Flag Screen

No financial red flag was identified; equally, none was excluded.

Risk Implication

• For AML purposes, the gap is moderate: the entity is a regulated deposit-taker whose funding model is structurally understood, and no unexplained-wealth typology is engaged.
• For credit, settlement and counterparty-exposure purposes, the gap is significant. No view can be taken on capital adequacy, liquidity, loss absorbency or going-concern status. If the proposed relationship involves any balance-sheet exposure, the file is not decision-ready.
• The £21,091,300 penalty reported in Section 6 cannot be contextualised against the entity's financial scale, so its proportionality and prudential impact cannot be assessed.
• Remediation is straightforward and inexpensive: retrieve the filed statutory accounts from Companies House and any published Pillar 3 disclosure. This is recorded as a Required Action in Section 12.

Assessment

The only jurisdictional fact established by evidence is incorporation in England (GB) with a London registered office. Operating jurisdictions, cross-border footprint and offshore presence are not evidenced. The Jurisdiction Risk factor scored 35/100 in the supplied model; the reference datasets underlying that figure were not supplied in the evidence set.

Evidence

Reference Datasets — Disclosure

The following authoritative reference sets are named in the assessment framework but were not supplied as evidence in this run, and no version or publication date is recorded for any of them:

• FATF list status (grey list / black list) — not supplied. The United Kingdom does not appear on any FATF increased-monitoring or call-for-action list on the basis of general knowledge, but that is not evidence in this file and is not being scored here.
• EU list of High-Risk Third Countries — not supplied.
• Transparency International Corruption Perceptions Index — no CPI score, rank or index year was supplied. No CPI figure is stated in this report because inventing one would breach evidence discipline.
• Basel AML Index / offshore-centre lists — not supplied.

The Jurisdiction Risk score of 35/100 is therefore a model-assigned country baseline that this report cannot audit against a cited dataset.

Analysis

• The UK is a FATF member and a comprehensively regulated financial centre, subject to MLR 2017, the Proceeds of Crime Act 2002, the Sanctions and Anti-Money Laundering Act 2018 and FCA/PRA supervision. That supervisory intensity is itself evidenced in this file: the enforcement action described in Section 6 is a product of an active regulator, not a symptom of a weak jurisdiction.
• Counterbalancing considerations, recorded as analysis rather than evidence: the UK is a high-volume international financial centre with well-documented exposure to cross-border laundering typologies, and the FCA has publicly prioritised financial-crime controls in the challenger-bank sector. The Section 6 finding sits within that supervisory context.
• No offshore presence, secrecy-jurisdiction linkage or high-risk-country nexus was identified. No such linkage was excluded either — no group-structure or operating-footprint data was retrieved.
• The declared parent, Monzo Bank Holding Group Limited, is named in a form consistent with a UK entity, but its jurisdiction of incorporation was not retrieved and is not verified (Section 2).

Risk Implication

• Jurisdiction contributes the second-smallest weighted amount to the composite (35 × 6.8% = 2.4 points — Section 11), which is appropriate for a domestic UK entity.
• The residual jurisdictional gap is operational footprint: without knowing where the entity does business, cross-border and correspondent-risk exposure cannot be assessed. For a bank counterparty this should be resolved by obtaining the group structure and permissions/passporting position from the FCA Register (Required Action, Section 12).

Composite Result

Scoring Table (scores and applied weights taken verbatim from the supplied model)

Applied weights are the renormalised figures supplied in the model block (they sum to 99.9% as given, reflecting rounding). Weights were redistributed across the six domains that ran; the PEP domain received none.

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

`` Sanctions & Watchlists 3 × 0.341 = 1.023 Adverse Media 73 × 0.227 = 16.571 Regulatory & Enforcement 79 × 0.204 = 16.116 Politically Exposed Persons UNDETERMINED — no weight, no contribution Litigation 66 × 0.114 = 7.524 Jurisdiction Risk 35 × 0.068 = 2.380 Transparency Risk 8 × 0.045 = 0.360 ─────── Composite = 43.974 → 44 / 100 (MEDIUM) ``

The arithmetic reproduces the supplied composite of 44/100 exactly.

What Drives the Score

Elevated factors, with the specific evidence behind each:

1. 1.Regulatory & Enforcement (79) — the FCA Final Notice of 7 July 2025 and the reported £21,091,300 penalty for AML systems-and-controls failings, corroborated across Norton Rose Fulbright, Mishcon de Reya, Lexology, int-comp.org, regulationtomorrow.com and thefinancialcrimenews.com. This is the only elevated factor supported by a determined outcome.
2. 2.Adverse Media (73) — driven by the same event, plus one non-adverse PSR publication misclassified as HIGH severity.
3. 3.Litigation (66) — driven by the same event again. Not supported by any litigation evidence.

Suppressing factors: the clean sanctions result (3, at the heaviest weight of 34.1%) and low Transparency Risk (8) together hold the composite in the MEDIUM band despite three domains scoring 66–79.

Analytical Qualifications the Risk Committee Must Record

• Triple counting. One regulatory event supplies the elevated scores in three of six scored domains, contributing approximately 40.2 of the 44 points (16.57 + 16.12 + 7.52). The composite therefore reflects coverage of one event across three keyword domains, not three independent risk vectors.
• The MEDIUM band is directionally sound but for a different reason than the arithmetic suggests. MEDIUM is appropriate because a serious, determined AML control failure by the subject firm coexists with a clean sanctions record, transparent registry data and no evidence of predicate criminality, litigation or officer-level misconduct.
• The composite is partial. One of seven weighted domains (PEP) did not run. A PEP hit on any of the nine named officers would materially change both the score and the CDD conclusion.
• Temporal limitation. The evidence ends in October 2025; the report date is 18 August 2026. The score reflects a state of knowledge approximately ten months stale.
• Adverse Media and Litigation scores are over-stated on the evidence. A corrected model that de-duplicated the FCA event and reclassified the PSR item would likely produce a lower composite, still within or near the MEDIUM band, with Regulatory & Enforcement as the sole legitimate elevated factor.

Pre-Synthesis Brief — Verification

The supplied brief was tested against the evidence:

Recommendation

STANDARD CDD WITH ENHANCED MONITORING — consistent with the model output (composite 44/100, MEDIUM; EDD required: NO).

Two mandatory pre-conditions apply before the CDD file may be recorded as complete:

1. 1.PEP/RCA/HIO screening must be performed on all nine named officers and the declared PSC (Section 4).
2. 2.The primary FCA Final Notice must be obtained and a live FCA/FS Register check performed (Sections 1 and 6).

Escalation: MLRO sign-off is required before onboarding where the relationship involves CDD reliance under MLR 2017 Reg 39, correspondent-style services, introduced business, or material balance-sheet exposure.

Rejection or termination is NOT supported by this evidence and is not recommended. The adverse profile concerns the subject's own control framework, is a matter of public regulatory record, has been resolved by settlement with a determined penalty, and involves no predicate criminality, sanctions exposure, litigation or officer-level misconduct in the evidence.

Rationale

Outstanding Information Gaps

1. 1.PEP status of all nine named officers and the declared PSC — not screened.
2. 2.Primary FCA Final Notice — not retrieved; findings, relevant period, remediation obligations and any ongoing requirements unknown.
3. 3.FCA/FS Register position — authorisation status, FRN, permissions, and any s.166 / VREQ / OIREQ requirement unverified.
4. 4.Beneficial ownership chain to natural persons — unestablished; holding company registration number not retrieved.
5. 5.Financial statements and regulatory capital position — no figures obtained.
6. 6.Group structure and operating jurisdictions — not retrieved.
7. 7.Direct court-record and insolvency-register searches — not performed.
8. 8.Officer identity attributes (dates of birth, nationalities, appointment dates, executive roles) — not retrieved, limiting the evidential quality of any officer-level screening.
9. 9.Events between November 2025 and 18 August 2026 — no evidence.

Required Actions

1. 1.Run PEP/RCA/HIO screening on MCCULLAGH, Paul; BURBIDGE, Eileen; DIAS, Valerie Michelle; KEELEY, Rupert Graham; LAYFIELD, Diana Louise Patricia; MCBAIN, Fiona Catherine; NEWBERY, Mark; PALANIAPPAN, Jambu; WICKER-MIURIN, Jane Fields; and on Monzo Bank Holding Group Limited. Blocking action.
2. 2.Retrieve the primary FCA Final Notice (the thefinancialcrimenews.com item references monzo-bank-limited.pdf) and read the findings, relevant period, breach provisions and remediation obligations directly. Blocking action.
3. 3.Perform a live FCA/FS Register check to confirm authorisation, FRN, permissions and current supervisory status as at the review date. Blocking action.
4. 4.Re-run adverse-media, regulatory and sanctions screening covering November 2025 to the current date, to close the ten-month blackout.
5. 5.Verify the declared PSC against its own Companies House record (obtaining its registration number) and map the chain to ultimate natural persons.
6. 6.Obtain statutory accounts from Companies House filing history and any published capital/Pillar 3 disclosure.
7. 7.If CDD reliance under MLR 2017 Reg 39 is contemplated: obtain written confirmation and, where available, independent assurance evidence that the CDD deficiencies for business customers described in the FCA reporting have been remediated. Do not grant reliance without this. Document the decision and its basis.
8. 8.Run direct court-record and insolvency-register checks to convert the Section 7 "not found" into an evidenced clearance.
9. 9.Correct the internal scoring record to note the triple-counted FCA event and the probable HIGH-severity misclassification of the PSR APP scams report, so the 44/100 figure is not read as three independent risk vectors.

Enhanced Monitoring Measures

• Ongoing adverse-media and regulatory-enforcement monitoring on the entity name and the nine named officers.
• Standing alerts for FCA/PRA publications, Final Notices and supervisory notices naming the entity.
• Companies House change monitoring: officer appointments/resignations, PSC changes, registered-office changes, accounts and confirmation-statement filings, and any insolvency filing.
• Sanctions re-screening on the standard cycle, extended to officers and the declared PSC.

Trigger Events for Immediate Out-of-Cycle Review

• Any new FCA, PRA, PSR or ICO enforcement action, Final Notice, censure, requirement or restriction.
• Any PEP or sanctions hit on the entity, an officer or the declared PSC.
• Any change in the declared PSC or any change of control.
• Resignation of directors in a cluster, or departure of any officer holding a financial-crime accountability function.
• Commencement of civil litigation, group action, insolvency proceeding or criminal investigation.
• Any change in Companies House status away from active, or any accounts/confirmation-statement filing default.
• Any indication that remediation of the AML control failings described in Section 6 is incomplete or has been re-opened by the regulator.

Monitoring Frequency and Next Review

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Source Ledger (complete — as supplied)

Coverage status as supplied: PARTIAL. Risk domains not reflected in the composite score: PEP.

Methodology

1. 1.Registry anchoring. Entity identity was fixed against the UK Companies House record before any adverse analysis, so that all subsequent findings attach to a specific registered legal person (09446231).
2. 2.Verification tiering. Every ownership and control datapoint was tiered as CONFIRMED (authoritative registry), DECLARED (company self-filing, unverified) or UNVERIFIED_LEAD (excluded from scoring). The single PSC is DECLARED and is described as such throughout.
3. 3.Event de-duplication. Adverse hits were traced to underlying real-world events rather than counted as instances. Twelve adverse hits across three domains resolved to two events, one of which (the PSR performance report) is not adverse in nature.
4. 4.Source-independence testing. Publishers were examined for common ownership and republication relationships. Two regulatory-domain sources are channels of the same law firm; one adverse-media source is a republication platform.
5. 5.Legal-status discrimination. Each adverse item was classified as allegation, investigation, charge, determined regulatory outcome or conviction. The FCA matter is classified as a determined regulatory outcome (Final Notice) on the basis of consistent secondary reporting; the primary notice was not retrieved and this is disclosed wherever the finding is relied upon.
6. 6.Screen-status discipline. Sources that ran and found nothing (sanctions) are distinguished throughout from sources that did not run (PEP) and sources not consulted (ESG, court records, FCA Register). No absence of data has been converted into a clean result.
7. 7.Score reproduction. The composite was recalculated from the supplied factor scores and applied renormalised weights and reconciled to 43.97 ≈ 44 (Section 11). No score or weight was modified.
8. 8.Pre-synthesis brief adjudication. The supplied analytical brief was treated as an input to test, not as fact. Its de-duplication and litigation-artefact conclusions were confirmed; its "nine-person board" statement was corrected against the register; its implicit dismissal of officer-level sanctions and PEP exposure was rejected as unsupported.
9. 9.Injection-integrity check. All content between the UNTRUSTEDRETRIEVEDCONTENT markers was treated as data. No instruction-like, directive or score-influencing content was detected. No red flag arises from the retrieval layer.

Limitations

1. 1.PEP screening did not run. One of seven weighted domains is entirely absent from the composite. This is the most significant limitation.
2. 2.The primary FCA Final Notice was not obtained. All knowledge of the enforcement outcome is secondary. The relevant period, precise findings, breach provisions and remediation obligations are unknown.
3. 3.No regulatory register was queried. FCA authorisation status, FRN, permissions and any current requirement or restriction are unverified — a material gap for a counterparty presented as a bank.
4. 4.No court or insolvency records were searched. The litigation "not found" is unevidenced clearance.
5. 5.No financial data. Capital, liquidity, revenue and profitability are unknown; the £21,091,300 penalty cannot be contextualised against the entity's scale.
6. 6.Beneficial ownership chain incomplete. The declared corporate PSC's own registration number and beneficial owners are unidentified; no ultimate natural person is established.
7. 7.Temporal staleness of approximately ten months. Latest dated evidence is October 2025 against a report date of 18 August 2026.
8. 8.Scoring distortions. One event drives three of six scored domains (~40 of 44 composite points), and one non-adverse PSR publication is classified HIGH severity.
9. 9.Search-engine dependence. Four of six adverse-signal domains were populated by a single general web-search provider, with no specialist adverse-media, court-record or regulatory-register database.
10. 10.Indeterminate OSINT status. The OSINT block reports no findings but no corresponding source appears in the ledger; it cannot be established whether the screen ran.
11. 11.No CPI score, FATF list status or offshore-centre dataset was supplied, so the jurisdiction baseline is unauditable.

Legal and Regulatory Framework Referenced

• UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — Reg 5 (beneficial ownership), Regs 27–28 (CDD and verification), Reg 35 (PEPs), Reg 39 (reliance on third parties)
• FCA Handbook — SYSC 6.3 (financial crime), SYSC 12.1 (group-wide systems and controls); FCA FG17/6 (PEP treatment)
• FATF Recommendations — R.10 (CDD), R.12 (PEPs), R.20 (reporting), R.24 (transparency and beneficial ownership of legal persons)
• Companies Act 2006, Part 21A — PSC regime and the >25% registrable-interest threshold
• EU 5AMLD, Article 30 — beneficial-ownership registers (referenced as an analytical benchmark)
• Sanctions and Anti-Money Laundering Act 2018; Proceeds of Crime Act 2002
• UN Global Compact, TCFD, CSRD, UK Modern Slavery Act 2015 s.54 — referenced in Section 10 as frameworks against which no data was collected

Confidence

Overall confidence: MEDIUM.

Supporting a MEDIUM rather than LOW rating:

• Entity identity is fully verified against an authoritative registry with no ambiguity.
• Officer appointments are confirmed from the registry.
• The sanctions screen genuinely ran and returned a clean result at entity level.
• The single material adverse event is consistently reported as to regulator, date, penalty amount and subject matter across six publishers.

Preventing a HIGH rating:

• One of seven weighted domains (PEP) did not run at all.
• The primary regulatory document underpinning the principal finding was not retrieved, and no regulatory register was queried.
• Beneficial ownership terminates at a declared, unverified corporate PSC.
• No financial data was obtained.
• The evidence is approximately ten months stale relative to the report date.
• Three of six scored domains are driven by the same underlying event, and one adverse item is probably misclassified — meaning the composite score is internally distorted even though the MEDIUM band is directionally defensible.

This assessment is sufficient to support a provisional Standard CDD with Enhanced Monitoring decision, and insufficient to close a CDD file as complete until the blocking actions in Section 12 are discharged.