MONZO BANK LIMITED

Assessment

Entity identity is VERIFIED against an authoritative registry. There is no name ambiguity, no conflicting registration and no indication of shell characteristics. The material limitation is that Companies House data establishes corporate existence, not regulated status — and no financial services register was queried.

Evidence

Key Findings

• Ten-year operating history (incorporated 18 February 2015; report date 18 August 2026) with continuously active status. Longevity is inconsistent with a disposable or pass-through vehicle.
• Substantive registered office in the City of London (EC2A), not a formation-agent mail-forwarding address on the retrieved record. Note: the registry does not distinguish trading premises from registered office, and no independent premises verification was performed.
• No FCA Firm Reference Number is recorded in this report. Secondary sources describe the entity as a bank subject to FCA enforcement (see Section 6), which is strong circumstantial support for authorised status, but authorisation has not been verified from the Financial Services Register.

Risk Implication

Identity risk is LOW. This feeds the Transparency Risk factor of 8/100 in Section 11.

The unverified authorisation status is a live control gap. Under MLR 2017, whether a counterparty is a UK-authorised credit institution determines the availability of reliance (reg. 39) and affects the correspondent-relationship analysis (reg. 34). A firm cannot rely on secondary journalism to establish that a counterparty is authorised. Required next step: direct FS Register lookup, capturing FRN, permissions, status history and any published requirements or restrictions. That lookup is also the fastest route to confirming the enforcement outcome discussed in Section 6.

Assessment

Control at the officer level is well documented and confirmed from the registry. Control at the ownership level is UNRESOLVED: the chain terminates at a single declared corporate PSC with no ownership percentage, no nature-of-control detail, and no upward chain to any natural person.

Registered Officers — CONFIRMED (Companies House officers register)

Composition: eight directors and one company secretary — nine registered officers in total. (Note for the record: the pre-synthesis brief described a "nine-person board with a company secretary", which would imply ten officers. That is a miscount; the evidence supports eight directors plus one secretary.)

Not retrieved for any officer: appointment date, date of birth (month/year), nationality, country of residence, other directorships, or executive/non-executive designation. The retrieved data does not identify which individuals hold FCA Senior Manager Functions.

Persons with Significant Control

Explicitly not retrieved:

• Ownership percentage or percentage band held by the declared PSC
• The statutory nature-of-control condition relied upon
• The registration number, jurisdiction or status of Monzo Bank Holding Group Limited
• Any onward ownership above that entity, and therefore no natural person has been identified as ultimate beneficial owner
• Any shareholder register, share class or voting-rights information

The 25% Threshold

Under the UK PSC regime and MLR 2017 reg. 5, a beneficial owner of a body corporate includes any individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises control over the management of the entity. Where no such individual can be identified after all reasonable measures, the senior person responsible for managing the entity may be treated as the beneficial owner — but that is a fallback of last resort, and the file must record the reasonable measures actually taken.

On the current evidence, no individual has been identified at or above the 25% threshold, and no reasonable-measures record exists beyond a single registry read.

Risk Implication

• A DECLARED PSC is a self-certified filing. Companies House does not verify the substance of PSC filings, and a declared entry must never be described as a verified UBO (FATF Recommendation 24; EU 5AMLD Article 30 sets the equivalent EU standard).
• A one-layer corporate PSC is a common and unremarkable structure for a UK bank held beneath a holding company. It is not, on its face, an opacity red flag — but it is an unfinished enquiry, and unfinished is not the same as benign.
• This gap contributes to the residual Transparency Risk of 8/100 (Section 11), which in the analyst's view is optimistic given that the ownership chain is unresolved.
• Cross-reference: because no natural persons are identified above the officer layer, the sanctions screening in Section 3 and the (unrun) PEP screening in Section 4 can only be meaningfully applied to the nine named officers and the declared corporate PSC. Any sanctions or PEP exposure sitting in an unretrieved upper ownership layer is unscreened.

Required next steps: (1) obtain the Companies House PSC filing detail including percentage band and control condition; (2) retrieve the Companies House record for Monzo Bank Holding Group Limited and trace its own PSC register upward until natural persons or a regulated/listed exemption is reached; (3) obtain the FCA Register controllers information for the authorised entity.

Assessment

Screen status: RAN — no matches returned. This is a genuine clean result, not an evidence gap. It is the strongest single positive signal in the file and, at 34.1% applied weight, the largest downward pressure on the composite score.

Evidence

Scope and Its Limits

The lists named as screened are OFAC, UK OFSI and UN. The following were not named and must not be assumed to have been covered:

• EU Consolidated Financial Sanctions List
• Other national regimes (e.g. Canada, Australia, Switzerland, Japan)
• Sectoral / capital-market restrictions falling outside asset-freeze lists
• Export-control, debarment and law-enforcement watchlists (e.g. World Bank debarment, Interpol notices)
• Adverse-control screening of the unretrieved upper ownership layer (see Section 2)

The screen appears to have been run against the entity. The evidence does not state whether the nine named officers or the declared corporate PSC were individually screened.

Risk Implication

• No sanctions nexus was identified. Under MLR 2017 and the Sanctions and Anti-Money Laundering Act 2018, this supports proceeding, but the screening record must be dated and retained, and the specific list versions logged, to be defensible on inspection.
• The absence of a recorded screening execution date is a documentation defect. A screening result without a timestamp cannot demonstrate currency at the point of decision. Re-run and timestamp before file sign-off.
• Cross-reference to Section 2: because the ownership chain terminates at a declared corporate PSC, sanctions screening cannot currently be described as covering ultimate beneficial owners. Extend the screen once the chain is traced.
• A clean sanctions result does not attenuate the AML systems-and-controls issue in Section 6. They are different risks: one is exposure to designated persons; the other is the counterparty's own control effectiveness.

Screen status: NOT RUN

PEP screening was not performed. No PEP screening provider is configured. [Source ledger: 'No PEP screening provider configured [PEP] → SKIPPED']

This is a coverage gap, not a negative result. No statement may be made — in this report or in any downstream file note — that the entity, its officers or its controllers are "not PEPs". The correct characterisation is that PEP status is UNDETERMINED.

What This Means Concretely

No role-keyword or name-inference method has been used as a substitute, and none should be. Inferring PEP status from job titles or open-source biography fragments is not screening and would not withstand regulatory challenge.

Regulatory Position

• FATF Recommendation 12 requires firms to have risk-management systems to determine whether a customer or beneficial owner is a PEP, and to apply enhanced measures where they are.
• MLR 2017 regs. 35–36 require EDD, senior management approval and source-of-funds/source-of-wealth measures for PEPs, family members and known close associates — including domestic PEPs on a risk-sensitive basis.
• FCA SYSC 12.1 (cited per instruction) and the FCA's PEP guidance (FG17/6) require proportionate, evidenced determination.

A determination cannot be made where no screening capability exists.

Effect on the Composite Score

The Politically Exposed Persons factor is absent from the weighted model. The remaining six domains were renormalised to 100%, meaning the 44/100 composite in Section 11 is calculated as if the PEP domain did not exist — not as if it were clean. Any reader treating 44/100 as a complete assessment is misreading it.

Risk Implication and Required Action

The realistic PEP exposure here is at the officer layer of a large regulated institution — non-executive directors of UK banks frequently hold or have held public appointments, and RCA relationships are common. That is not an allegation about any named individual; it is a statement about where the screening gap bites.

Required actions:

1. 1.Procure or restore a PEP screening capability and screen all nine named officers (Section 2) plus, once traced, the controllers of Monzo Bank Holding Group Limited.
2. 2.Record the screening date, provider, list coverage and match-threshold settings.
3. 3.Do not record an unqualified CDD sign-off until step 1 is complete; any interim approval must be explicitly conditional and documented as such.

Assessment

The adverse-media search returned 10 results: 6 adverse (all classified HIGH), 0 positive, 4 neutral, via Google Programmable Search. After deduplication, the six "high severity" items resolve to two underlying events, only one of which is adverse on its face.

This is signal echo, not signal accumulation. The Adverse Media score of 73/100 reflects article volume about a single enforcement action, not multiple distinct adverse events.

Deduplicated Event Map

Item Detail

Time span of adverse coverage: 31 October 2023 to 6 October 2025. Concentration: five of six adverse items cluster in July–October 2025, immediately following the reported Final Notice.

The PSR Item — Analytical Correction

The PSR publication is a regulator-published comparative performance dataset covering multiple UK payment firms as part of mandated APP fraud transparency. The retrieved snippet establishes only that Monzo Bank Limited is named among other firms in that dataset. It does not establish where Monzo ranked on reimbursement rates, receiving-bank scam volumes or value metrics.

Being named in a mandatory industry-wide table is a transparency measure, not a finding against the entity. Classifying it HIGH adverse without the underlying ranking inflates the Adverse Media factor on an unsupported basis. It should be treated as contextual pending retrieval of the actual data, at which point it may prove neutral, favourable or genuinely adverse.

What Was NOT Found

• No allegations of fraud, dishonesty or criminality against the entity
• No allegations against any named individual officer
• No consumer group action, mis-selling scandal or product-failure coverage
• No data-breach or cyber-incident reporting
• No coverage of financial distress, resolution or capital shortfall
• The 4 neutral results were not itemised in the evidence and cannot be characterised

Risk Implication

• The reputational profile is narrow and specific: a single, well-publicised AML control failure, extensively commented on by the professional legal and compliance press precisely because it is instructive for the sector.
• Publication in NRF, Mishcon, ICA and Lexology indicates the matter is a reference point in UK financial crime practice, which raises the reputational salience of any association but does not add to the substantive risk beyond the one event.
• Cross-reference: every adverse media item in this section reappears in Section 6 (Regulatory) and two of them in Section 7 (Litigation). Section 11 explains the resulting weighting distortion.
• Search limitation: only Google Programmable Search was used. No specialist adverse-media database (e.g. structured negative-news screening with entity resolution) was queried, and no non-English-language search is evidenced. Coverage of pre-2023 material is unknown.

Assessment

The regulatory search returned 10 results: 4 adverse (all HIGH), 0 positive, 6 neutral. All four adverse items describe the same event. This is the substantive risk in the file — and it is also the finding most compromised by the absence of primary-source retrieval.

The Reported Enforcement Event

Source URLs preserved:

• http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/ (dated 2025-07-09)
• https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings (snippet dated Jul 22, 2025)
• https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls (snippet dated Oct 6, 2025)
• https://www.regulationtomorrow.com/2025/07/financial-crime-controls-in-the-spotlight-lessons-learned-in-relation-to-fca-supervisory-powers-and-expectations/ (dated 2025-07-23)

Evidentiary Caveat — The Central Limitation of This Report

The FCA Final Notice was not retrieved. No fca.org.uk URL appears in the evidence set. The document is referenced only indirectly, via the filename fragment "monzo-bank-limited.pdf" appearing in the Financial Crime News snippet. The FCA Register and FCA enforcement publications were not queried by any configured source.

Six professional publications converging on the same date and the same figure to the pound is strong circumstantial corroboration that the event occurred. It is not a substitute for reading the notice. The following are materially unknown:

1. 1.The relevant breach period. Determines whether the failings are historic or recent.
2. 2.The provisions breached. Whether the FCA proceeded under Principle 3 / SYSC, under specific MLR 2017 regulations, or both, and whether any breach was found to be reckless or deliberate.
3. 3.Whether any requirement was imposed — a voluntary requirement (VREQ), an own-initiative requirement (OIREQ), or a s.166 skilled person review. The Regulation Tomorrow headline refers to "FCA supervisory powers", which may indicate a supervisory intervention component, but the snippet does not establish this.
4. 4.Whether any restriction on onboarding was imposed or has since been lifted.
5. 5.Whether remediation was found to be complete at the date of the notice.
6. 6.Whether any individual was subject to enforcement action. The NRF snippet's "No related decisions" is suggestive of none, but rests on one fragment.
7. 7.Whether the penalty has been paid, and whether any part was referred to the Upper Tribunal.

Inference, flagged as such: the reported 30% discount is consistent with settlement at the earliest stage of the FCA's discount scheme, which would imply the entity did not contest the findings. This is an inference from the discount rate, not a fact stated in the evidence, and should be confirmed against the notice.

Other Regulatory Matters

• The PSR APP scams performance report of 31 October 2023 appeared in the adverse-media domain rather than here. It is a regulatory publication, not an enforcement action. No PSR enforcement, direction or penalty against the entity was identified.
• No PRA enforcement was identified. The PRA was not searched as a distinct source.
• No enforcement by any non-UK regulator was identified. No non-UK regulatory registers were searched.
• No prior FCA enforcement history was retrieved. The absence of earlier matters in a Google search is NOT FOUND, not "none" — the FCA enforcement database was not queried directly.

Risk Implication

• Under MLR 2017 and FCA SYSC 6.3, a documented AML systems-and-controls failure at a counterparty institution is directly relevant to: whether reliance may be placed on that institution under reg. 39; the risk rating of any introduced business; and the adequacy of the firm's own risk assessment of the relationship.
• The severity is real but bounded: this is a systems-and-controls penalty, not a finding of participation in money laundering, and not a criminal matter. There is no evidence of any criminal charge, prosecution or conviction anywhere in this file. That distinction must be maintained in all downstream file notes.
• Cross-reference: this single event drives the Adverse Media score in Section 5, the Regulatory score here, and the entirety of the Litigation score in Section 7 — collectively 54.5% of the applied model weight (Section 11).

Required Actions

1. 1.Retrieve the FCA Final Notice of 7 July 2025 from fca.org.uk and extract the breach period, provisions, requirements imposed and remediation status.
2. 2.Query the FCA Financial Services Register for the entity's current permissions and any published requirements or restrictions.
3. 3.Obtain the entity's own account of remediation (board attestation, s.166 report status if applicable) if the relationship is material.

Assessment

No distinct litigation matter was identified. The litigation domain returned 10 results: 2 adverse (both HIGH), 0 positive, 8 neutral. Both adverse items are articles about the FCA enforcement action already analysed in Section 6.

The Litigation subscore of 66/100 is an artefact of duplication. It does not represent litigation exposure evidenced in this file.

The Two "Litigation" Items

Both are identical to items already counted in Sections 5 and 6. A regulatory Final Notice is an administrative enforcement outcome, not civil or criminal litigation.

What Was NOT Found — and What That Does and Does Not Mean

Critical methodological disclosure: court records were not searched directly. No court registry, no Judiciary/BAILII/National Archives judgment database, no Companies House gazette/insolvency feed and no Registry Trust judgment search was queried. The only tool used was Google Programmable Search. Litigation involving a large UK retail bank frequently does not generate indexed news coverage.

Accordingly, the absence of litigation findings here is a function of search scope, not of verified absence. It must not be recorded as "no litigation".

Pattern Analysis

As required, the file was reviewed for repeat-litigation, class-action and insolvency patterns. No pattern of any kind can be identified from a dataset containing zero distinct litigation matters. The registry status of 'active' (Section 1) is inconsistent with insolvency proceedings, which is a weak but genuine negative indicator.

Risk Implication

• Litigation risk on the current evidence is UNDETERMINED — leaning low, not the 66/100 the model applies.
• The double-counting materially inflates the composite. Section 11 quantifies this: the Litigation factor contributes 7.52 points of the 44-point composite, all of it derived from an event already scored twice elsewhere.
• Recommendation: the risk committee should note the double-count when reading the composite, and a direct court-records search should be commissioned if the proposed relationship is material.

Assessment

No dedicated ESG data source was consulted. No ESG rating provider, sustainability database, modern slavery registry, human-rights screening tool or environmental enforcement register appears in the source ledger. ESG assessment in this report is therefore limited to what incidentally surfaced in general web search.

Domain-by-Domain Position

Governance and Conduct — the Substantive Item

The reported FCA Final Notice of 7 July 2025 (Section 6) is, in ESG terms, a governance failure event. Multiple sources characterise it as concerning anti-money-laundering systems and controls, which is by definition a control-environment and oversight matter rather than a market-conduct or consumer-detriment matter. The ICA commentary snippet refers to "fraud alerts, all while bypassing effective …" — the sentence is truncated in the evidence and no conclusion may be drawn from a fragment.

This is a determined regulatory outcome, not an allegation. It is not a criminal finding and not a finding of dishonesty. No individual director or officer is identified as subject to any action in the retrieved evidence.

Consumer Conduct — Unresolved

The PSR first APP scams performance report (31 October 2023, https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/) is the only retrieved item bearing on consumer fraud outcomes. As set out in Section 5, the evidence establishes only that the entity is named among multiple firms in an industry-wide dataset. Its actual performance on reimbursement rates and receiving-bank scam exposure — which would be genuinely informative for conduct risk — was not retrieved.

Risk Implication

• ESG risk is UNDETERMINED across E and S pillars; elevated but bounded on the G pillar.
• ESG factors carry no weight in the composite model (Section 11). Governance concerns reach the score only indirectly, and in this case are already captured under Regulatory & Enforcement.
• For firms with ESG-linked onboarding policies, UN Global Compact / TCFD / CSRD alignment and UK Modern Slavery Act s.54 statement compliance have not been verified and must be checked separately if policy requires it.
• Required action: if ESG screening is a policy requirement for this relationship, commission a dedicated ESG screen; the current file cannot support any ESG conclusion beyond the governance point already documented.

Assessment

No financial information was obtained. The financial search returned 10 results: 0 adverse, 0 positive, 10 neutral, with no extractable figures. This is a due-diligence deficiency, not a clean bill of health.

What Is Missing

Red-Flag Screen

The standard financial red flags were tested against the available evidence:

• Negative net worth: cannot be assessed — no balance sheet retrieved.
• Rapid unexplained growth: cannot be assessed — no time series retrieved.
• Opaque funding: cannot be assessed — investor and capital-raising data absent. Note that the ownership chain terminates at a declared corporate PSC (Section 2), so the source of the entity's equity is not traced.

None of these flags was raised. None was ruled out.

Source of Wealth / Source of Funds

Source of wealth analysis in the conventional sense applies to natural persons and is not directly transposable to an operating institution. The relevant corporate analogue — the origin and structure of the entity's capital and its funding base — was not established. Under MLR 2017 reg. 28, the firm must understand the ownership and control structure of a corporate customer; a bare declared PSC with no financial context does not discharge that.

Risk Implication

• The entity's 'active' status and ten-year continuous existence (Section 1) provide weak positive assurance of viability. That is the extent of what the evidence supports.
• For any credit-bearing, deposit-placing, correspondent or settlement relationship, this gap is disqualifying until closed. For a purely informational or low-exposure relationship, it is a documented limitation.
• Required action: retrieve filed statutory accounts from Companies House and, if available, published Pillar 3 / annual report disclosures. Confirm audit opinion and capital position. This is a routine retrieval and there is no reason it should remain outstanding.

Assessment

Country of incorporation: United Kingdom (England & Wales) — VERIFIED from Companies House. The jurisdiction was supplied by the user as GB and is independently corroborated by the registry record and the registered office address in London EC2A 2AG.

The model assigns Jurisdiction Risk 35/100 at 6.8% applied weight. The derivation of that figure is not shown in the evidence, and no jurisdiction reference dataset was retrieved in this run.

Reference Datasets — Consultation Status

The United Kingdom is a founding FATF member and is not, to general professional knowledge, on any FATF listing. However, that general knowledge is not sourced from this evidence set, and the report will not present an unretrieved list position as a verified finding. The correct file entry is: UK jurisdiction risk assessed as low on the basis of the firm's standing country-risk methodology; FATF and CPI reference data not retrieved in this screening run.

Operating Footprint

The reported enforcement action (Section 6) is a UK domestic FCA matter. The reported PSR performance report (Section 5) concerns UK payment systems. Both are consistent with a UK-domestic operating profile, but neither confirms the absence of overseas operations.

Risk Implication

• Jurisdictional risk is LOW on the evidence: a UK-incorporated entity with a UK registered office and UK-domestic regulatory interaction.
• The residual uncertainty is structural, not jurisdictional: because the ownership chain terminates at an untraced holding company (Section 2), the jurisdiction of the ultimate controllers is unknown. A UK operating company can sit beneath a non-UK ownership chain. This should be resolved when the PSC chain is traced.
• The 35/100 score at 6.8% weight contributes 2.38 points to the composite (Section 11) — immaterial to the outcome band.
• Required action: record the firm's own country-risk rating for GB with its source and date, and confirm the jurisdiction of Monzo Bank Holding Group Limited.

Composite Score

44/100 — MEDIUM | Coverage: PARTIAL | Confidence: MEDIUM

Scoring Table

Applied weights are renormalised across the six domains that ran and returned data. As listed they sum to 99.9% (rounding). The PEP domain is excluded from renormalisation because it did not run.

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

``` (3 × 0.341) = 1.023 (73 × 0.227) = 16.571 (79 × 0.204) = 16.116 (66 × 0.114) = 7.524 (35 × 0.068) = 2.380 (8 × 0.045) = 0.360

Composite = 43.974 → 44/100 (MEDIUM) ```

The arithmetic reproduces exactly. No factor score or weight has been modified.

What Drives the Score — Evidence per Elevated Factor

Regulatory & Enforcement (79) — the genuine driver. Six professional publications independently report the FCA Final Notice of 7 July 2025 and the £21,091,300 penalty. This is a determined regulatory outcome and the elevation is justified. The qualification is evidentiary depth, not existence: the notice itself has not been read, so breach period, provisions engaged, requirements imposed and remediation status are unknown (Section 6).

Adverse Media (73) — partially inflated. Five of six adverse items are commentary on the Regulatory event. The sixth (PSR) is a regulator transparency publication naming multiple firms; on the retrieved evidence its adverse classification is unsupported (Section 5).

Litigation (66) — an artefact. Both contributing items are duplicates of the Regulatory event. There is no evidence of civil litigation, group action, judgment or insolvency proceeding against this entity in the retrieved data (Section 7).

Structural Distortion — Disclosure to the Risk Committee

One underlying event populates three separately weighted domains carrying a combined applied weight of 54.5% (22.7 + 20.4 + 11.4). The model treats corroborating commentary about a single Final Notice as three independent risk signals. In the analyst's judgement:

• 44/100 sits at the upper end of what the evidence supports.
• If the Litigation factor were treated as UNDETERMINED (which the evidence arguably requires) and its weight redistributed, the composite would fall materially — though it would remain in the MEDIUM band because the Regulatory factor is genuine and heavily weighted.
• The score is not adjusted here. The model output is reported verbatim as required; this paragraph is the analytical caveat that must accompany it in any downstream use.

Countervailing Evidence

• Sanctions: clean, screened, real. No exposure to OFAC, OFSI or UN designations.
• Registry: complete and authoritative. Active status, ten-year history, substantive City of London address, nine identified officers.
• Financial: no distress signals in ten neutral results — though equally no positive financial evidence (Section 8).
• No criminal proceedings, charges or convictions of any kind appear anywhere in this file.

Gaps Not Reflected in the Score

PEP — SCREEN NOT RUN. The composite is calculated as if this domain did not exist, not as if it were clear. The 44/100 is a partial score and must be presented as such (Section 4).

Also outside the model: FCA/PRA Register verification (Section 1), UBO chain resolution (Section 2), direct court-records search (Section 7), financial statements (Section 8), and dedicated ESG screening (Section 10).

Recommendation

STANDARD CDD WITH ENHANCED MONITORING — CONDITIONAL APPROVAL ONLY

Rationale

Supporting Standard CDD:

• Identity is verified from an authoritative registry: active status, incorporated 18 February 2015, substantive London registered office, nine registered officers all CONFIRMED [Source: Companies House].
• Sanctions screening ran and returned no matches across OFAC, UK OFSI and UN — a real clean signal carrying 34.1% of applied weight.
• The adverse profile resolves to one regulatory enforcement event. There are no criminal proceedings, no distinct litigation, no insolvency indicators, and no sanctions nexus.
• The counterparty is, on the strength of the reported FCA action, itself a UK-supervised institution — a category that ordinarily attracts standard rather than enhanced treatment.

Requiring Enhanced Monitoring rather than plain Standard CDD:

• A regulator-determined AML systems-and-controls failure at the counterparty, with a penalty reported at £21,091,300, is directly material to the firm's own SYSC 6.3 obligations and to the reasonableness of any reliance placed on that counterparty under MLR 2017 reg. 39.
• Remediation status is unknown because the Final Notice was not retrieved.

Preventing unqualified sign-off:

• PEP screening did not run. Under FATF R.12 and MLR 2017 regs. 35–36, PEP status must be determined, not assumed. Recording an unconditional approval on a file where an entire risk domain was never screened would not be defensible.

Conditional EDD — When This Escalates

Apply full EDD with MLRO sign-off if any of the following applies to the proposed relationship:

1. 1.Reliance is to be placed on the counterparty's CDD under MLR 2017 reg. 39 — a documented CDD failure in respect of business customers is precisely the defect that undermines reliance.
2. 2.The relationship is correspondent-type or involves payment-message processing (consider MLR 2017 reg. 34).
3. 3.The counterparty acts as introducer or outsourced service provider for customer onboarding.
4. 4.The relationship is credit- or deposit-exposure bearing — Section 8 shows no financial data was obtained.

Outstanding Information Gaps

Required Actions

1. 1.Run PEP screening against the eight named directors and the company secretary, and against the controllers of Monzo Bank Holding Group Limited once traced. Record provider, date, list coverage and match threshold. No unconditional approval until complete.
2. 2.Retrieve the FCA Final Notice dated 7 July 2025 from fca.org.uk. Extract and file: breach period; provisions engaged; whether any VREQ, OIREQ or s.166 skilled person review was imposed; remediation findings; whether action was taken against individuals; payment/appeal status.
3. 3.Verify authorisation via the FCA Financial Services Register: FRN, permissions, status history, published requirements or restrictions.
4. 4.Trace the ownership chain: obtain full PSC filing detail (percentage band, control condition); pull the Companies House record and PSC register for Monzo Bank Holding Group Limited; continue upward until natural persons or a listed/regulated exemption is reached. Apply the >25% threshold test at each layer.
5. 5.Obtain filed statutory accounts from Companies House and any published annual report / Pillar 3 disclosure. Confirm audit opinion and capital position.
6. 6.Commission a direct court-records search (judgments, insolvency, group litigation) if the relationship is material — Section 7 confirms this was never performed.
7. 7.Retrieve the PSR APP scams performance data and reclassify that item on the basis of actual reported performance rather than mere inclusion.
8. 8.Re-timestamp the sanctions screen at the point of decision and retain the evidence pack.
9. 9.Record the coverage limitation explicitly on the customer file: 'Composite 44/100 calculated on PARTIAL coverage; PEP domain not screened; adverse and litigation subscores reflect duplicated coverage of a single regulatory event.'

Trigger Events for Immediate Out-of-Cycle Review

• Publication of any further FCA, PRA or PSR notice, warning notice, censure or requirement concerning the entity
• Any positive PEP or sanctions match on an officer or controller once screening is run
• Any change to registered status, registered office, PSC or board composition
• Any indication that the July 2025 penalty is unpaid, contested, or that remediation remains incomplete
• Any credible report of insolvency proceedings, resolution action or capital shortfall
• Onset of any of the four Conditional EDD circumstances listed above

What Is Not Recommended

Rejection or termination is not supported by this evidence. The adverse profile is a single, publicly resolved, monetarily settled regulatory matter concerning systems and controls. There is no sanctions exposure, no criminality, no litigation and no financial distress in the retrieved data. Declining the relationship on this record would be disproportionate; proceeding without closing gaps 1 and 2 would be unsupportable.

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Complete Source Ledger

Date of assessment: 18 August 2026.

Methodology

1. 1.Evidence-integrity check first. All content within the UNTRUSTEDRETRIEVEDCONTENT markers was reviewed for prompt-injection, embedded directives or attempts to influence scoring. None was found. The retrieved content consists solely of search-result snippets and URLs. This clean negative is recorded for audit purposes. All such content was treated exclusively as data to analyse.
2. 2.Source-tier separation. Registry data (Companies House) was treated as authoritative for identity and officer facts. Search-engine results were treated as secondary reporting and attributed to the publishing source, never asserted as established fact.
3. 3.Verification-status discipline. CONFIRMED (authoritative registry), DECLARED (filed by the company, unverified), CORROBORATED (multiple independent secondary sources), UNVERIFIED, NOT FOUND, NOT SEARCHED, SKIPPED and FAILED were applied distinctly throughout. 'Not found' was never converted to 'none'; 'skipped' was never converted to 'no risk'.
4. 4.Deduplication of adverse signals. Every adverse item was mapped to its underlying event. This identified that six 'high severity' adverse-media items, four regulatory items and two litigation items resolve to two underlying events, only one of which is adverse on its face — a finding that materially qualifies the composite (Section 11).
5. 5.Classification discipline. Allegation, investigation, charge, conviction and regulatory determination were held apart. The FCA matter is characterised as a determined administrative regulatory outcome reported by secondary sources, not as an allegation and not as a criminal matter.
6. 6.Score reproduction. All factor scores and applied weights were taken verbatim from the supplied RISK SCORE block. The arithmetic was reproduced and reconciles to 43.974 ≈ 44. No factor was modified; analytical disagreement with the model's weighting is disclosed narratively in Section 11 rather than by silent adjustment.

Limitations

Material limitations affecting reliance on this report:

1. 1.PEP domain entirely unscreened. No provider configured. The composite excludes this domain. Coverage is PARTIAL.
2. 2.No primary regulatory document retrieved. The FCA Final Notice of 7 July 2025 exists in this file only as described by six secondary publications. No fca.org.uk URL appears anywhere in the evidence. Breach period, provisions, requirements imposed, remediation status and payment/appeal status are all unknown.
3. 3.Source independence not fully established. Six publications report the event. The evidence does not establish the publisher relationship between the 'Norton Rose Fulbright connections' item and the 'Regulation Tomorrow' item; if related, effective independent corroboration is reduced from six sources to five. This should be checked.
4. 4.Beneficial ownership unresolved. The chain terminates at a DECLARED corporate PSC. No natural person has been identified; no percentage is recorded; the >25% threshold test cannot be applied.
5. 5.Litigation coverage is news-only. No court, insolvency or tribunal registry was searched. Absence of findings reflects search scope, not verified absence.
6. 6.No financial data whatsoever. Ten neutral results yielded no figures. Financial soundness is unassessed.
7. 7.Regulated status unverified. No FCA/PRA Register check was performed.
8. 8.Jurisdiction and ESG reference data not retrieved. No FATF, EU high-risk-list or TI CPI dataset; no ESG source.
9. 9.One item is materially misclassified. The PSR APP scams performance report (31 Oct 2023) is scored HIGH adverse on evidence showing only that the entity is named in an industry-wide regulatory dataset alongside other firms.
10. 10.Adverse-media and litigation subscores are inflated by duplication of a single underlying event across three weighted domains totalling 54.5% of applied weight.
11. 11.Sanctions screening execution date not recorded, limiting the demonstrability of currency at the decision point.

Confidence

Overall confidence: MEDIUM

Principal reasons for the MEDIUM rather than HIGH rating: an entire risk domain (PEP) was not screened; the single most consequential finding rests exclusively on secondary reporting; and the composite score is structurally inflated by triple-counting of one event. Principal reasons it is not LOW: identity is authoritatively verified, sanctions screening genuinely ran clean, and the adverse finding — while unverified in detail — is corroborated across six independent professional publications with an exact and consistent penalty figure.

Legal and Regulatory Framework Applied

• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — regs. 5, 18, 27–28, 33–36, 39
• FCA Handbook SYSC 6.3 (financial crime systems and controls); SYSC 12.1 (as cited in the instruction set)
• FATF Recommendations 10, 12, 24; FATF high-risk and increased-monitoring jurisdiction lists (not retrieved in this run)
• UK Persons with Significant Control regime (Companies Act 2006, Part 21A)
• EU 5AMLD Article 30 (comparative beneficial-ownership transparency standard)
• Sanctions and Anti-Money Laundering Act 2018
• UK Modern Slavery Act 2015 s.54; UN Global Compact; TCFD; CSRD (referenced for ESG scope; no ESG source consulted)

Evidence-Integrity Statement

All third-party retrieved content was assessed for prompt-injection and manipulation attempts. No directive, instruction, or claim about how this entity should be scored or treated was present within the untrusted content markers. No content from those markers was executed as an instruction. This is recorded as a clean negative finding.