MONZO BANK LIMITED

Assessment

Entity identity is VERIFIED against an authoritative primary registry. The Companies House record is internally consistent and matches the registration number cited in the pre-synthesis brief. There is no identity ambiguity and no indication of a name-matching problem.

However, identity verification is not the same as regulatory status verification. The FCA Financial Services Register was not queried in this assessment. No firm reference number (FRN), no Legal Entity Identifier (LEI) and no permission scope were retrieved.

Evidence

Analysis

• Jurisdiction confidence is recorded as user-provided in the tasking. The Companies House registry hit independently corroborates GB incorporation, upgrading this from user assertion to registry-verified.
• Regulatory permissions are inferred, not verified. The only basis in this evidence set for treating Monzo as a UK-authorised credit institution is third-party reporting that the FCA issued it a Final Notice (Section 6). A Final Notice implies an authorised or formerly authorised firm, but this is inference. The primary confirmation — the FCA Register entry — is absent.
• The date of the Companies House extraction was not supplied. Against a report date of 18 August 2026, officer and PSC data may not reflect the current position.

Risk Implication

Identity risk is low. The material gap is the absence of an FCA Register check. Under MLR 2017 reg. 28 and FCA SYSC 6.3, a firm relying on another regulated institution's status — for reliance, correspondent banking, or safeguarding purposes — must verify that status against the regulator's own record, not press coverage. Required next step: retrieve the FCA Register entry and record the FRN and permission scope on file.

Assessment

Control is partially mapped and unresolved at the ultimate level. Ten officers are CONFIRMED from the Companies House officers register. Control terminates, on this evidence, at a single DECLARED corporate PSC — Monzo Bank Holding Group Limited — with no ownership percentage, no PSC registration number, no control-condition detail and no onward chain to any ultimate natural person.

The 25% Threshold

Under the UK PSC regime (Companies Act 2006 Part 21A, as amended) and MLR 2017 reg. 5, a person with significant control is, in the principal case, one who directly or indirectly holds more than 25% of shares or voting rights, or who otherwise exercises significant influence or control. The evidence set does not state which PSC condition applies to Monzo Bank Holding Group Limited, nor the percentage band held. That detail is normally published on the PSC register and its absence here is an extraction gap, not necessarily a filing gap.

Evidence — Officers and Controllers

What Is Missing

1. 1.The PSC's own registration number — not retrieved. Without it, the parent cannot be reliably distinguished from similarly named entities or traced onward.
2. 2.The PSC's own PSC/ownership register — not retrieved. The chain therefore stops one level up from the subject and no ultimate natural person is identified.
3. 3.Ownership percentages / nature of control — not retrieved for any party.
4. 4.Appointment dates, nationalities and dates of birth for officers — not retrieved. These are the standard discriminators used to disambiguate individuals during PEP and sanctions screening.
5. 5.Whether any officer is also a controller — not established.

Risk Implication

• This is not a UBO opacity red flag of the offshore-nominee type. A UK-incorporated bank held by a UK-incorporated holding company is a conventional and expected structure. The issue is evidential completeness, not structural concealment. The Transparency Risk factor score of 8/100 (Section 11) is consistent with that reading.
• However, no ultimate natural person has been identified, and MLR 2017 reg. 28(4) requires the firm to take reasonable measures to identify beneficial owners and understand the ownership and control structure. That obligation is not discharged by a single declared corporate PSC.
• Direct link to Section 4: the ten named natural persons above are precisely the population that should have been PEP-screened. Because no PEP provider was configured, not one of them has been screened. The confirmed quality of the identity data makes the absence of screening more, not less, remediable.
• Direct link to Section 3: the sanctions screen returned no findings, but the evidence does not confirm whether the individual officers were screened as separate subjects or only the corporate entity.

Assessment

Screen status: RAN — genuinely no findings returned. This is a meaningful clean result and is treated as such in the scoring model (Sanctions & Watchlists: 3/100, the largest applied weight at 34.1%).

Evidence

Analysis

• The distinction that matters here: this is an OK_EMPTY, not a FAILED. The provider executed and returned nothing. That is evidence of absence of a listing, within the scope of the lists queried.
• Scope limitation — lists. Three list families are named: OFAC, UK OFSI and UN. The EU Consolidated List is not named, nor are sectoral/dual-use regimes, export-control denied-party lists, or law-enforcement watchlists. For a UK entity the OFSI list is the primary legal obligation, so the core requirement appears met; the gap is completeness of adjacent screening.
• Scope limitation — subjects. The evidence confirms screening of the entity. It does not confirm that the nine directors, the secretary or the declared PSC (Section 2) were screened as separate subjects. Under UK sanctions law, the ownership and control test means a listed natural person controlling an entity can bring that entity within scope even where the entity itself is not listed.
• No date of screening was supplied. Sanctions lists change continuously; a screen without a recorded timestamp cannot be relied on to evidence a point-in-time control under FCA SYSC 6.3.

Risk Implication

Sanctions exposure appears low on the available evidence, and this factor legitimately suppresses the composite score. Two remediations are required before the result can be recorded as a fully discharged control: (a) re-run screening with a recorded date and an explicit subject list covering all ten named individuals plus the declared PSC; (b) extend list coverage to include the EU Consolidated List. The ownership analysis in Section 2 is directly relevant to (a) — an unresolved onward ownership chain means the ultimate controller has not been sanctions-screened at all.

Screen Status

Screen status: NOT RUN

No PEP screening provider was configured for this assessment. The Source Ledger records: 'No PEP screening provider configured [PEP] → SKIPPED'. The coverage statement confirms: 'Risk domains NOT reflected in the composite score: PEP'.

What This Means — and What It Does Not

No statement in this report should be read as indicating that any named individual is or is not a politically exposed person. No role-keyword inference, no negative-news proxy and no jurisdiction-based assumption has been used as a substitute for screening, and none would be acceptable.

Unscreened Population

The following ten subjects, all CONFIRMED from the Companies House officers register (Section 2), remain entirely unscreened for PEP/RCA/HIO status:

1. 1.MCCULLAGH, Paul (secretary)
2. 2.BURBIDGE, Eileen (director)
3. 3.DIAS, Valerie Michelle (director)
4. 4.KEELEY, Rupert Graham (director)
5. 5.LAYFIELD, Diana Louise Patricia (director)
6. 6.MCBAIN, Fiona Catherine (director)
7. 7.NEWBERY, Mark (director)
8. 8.PALANIAPPAN, Jambu (director)
9. 9.WICKER-MIURIN, Jane Fields (director)
10. 10.Monzo Bank Holding Group Limited (declared PSC — controllers not identified)

Required attributes for reliable screening — date of birth, nationality and appointment dates — were not retrieved (Section 2). These are the standard discriminators; without them, any subsequent PEP screen will carry an elevated false-positive rate and will require manual adjudication.

Regulatory Framework

• FATF Recommendation 12 requires firms to have risk-management systems to determine whether a customer or beneficial owner is a PEP, and to apply enhanced measures where they are.
• UK MLR 2017 reg. 35 requires enhanced due diligence and senior management approval where a customer or beneficial owner is a PEP, family member or known close associate.
• FCA SYSC 12.1 and FG17/6 set expectations for group-wide and proportionate PEP handling.

None of these obligations can be evidenced as met on the current record.

Risk Implication

This is the single largest coverage gap in the report (as distinct from the largest adverse finding, which is the FCA matter in Section 6). Because the domain contributes nothing to the composite, the score of 44/100 is a partial score. It must not be presented to a risk committee as a complete assessment.

Required action: commission PEP/RCA screening on all ten subjects before any material relationship decision. This is a low-cost, single-step remediation.

Assessment

The adverse media profile is concentrated, not diffuse. Ten results were returned by Google Programmable Search: 7 adverse (all classified HIGH), 0 positive, 3 neutral. Six of the seven adverse items are commentary on a single underlying event — the reported FCA Final Notice of 7 July 2025. The seventh is a Payment Systems Regulator publication whose adverse classification is questionable.

This is a legal- and trade-commentary cluster following a regulatory action, not evidence of multiple independent reputational events.

Evidence Table

Time span of adverse coverage: 31 October 2023 (PSR item) to 6 October 2025 (Mishcon). Excluding the contested PSR item, the enforcement-related cluster spans 9 July 2025 – 6 October 2025 — a three-month reactive window following the reported Final Notice.

Neutral items: 3 returned; their content was not extracted and cannot be assessed. Positive items: 0 — this reflects the search configuration, not an absence of favourable coverage.

Critical Analytical Observations

1. 1.Severity inflation risk. Seven items scored HIGH produced an Adverse Media factor of 74/100. Because six of the seven are commentary on one event and one is a data publication, the factor arguably reflects media volume rather than event count. A single enforcement action generating six law-firm alerts is normal for a well-known UK bank and should not be read as six distinct risk events.
2. 2.Attribution discipline — Brabners item. The retrieved snippet reads: '... fraud. The FCA's investigation relating to Stunt & Co was centred around historical money laundering activity and made no findings that the ...'. The article's own title indicates it covers two firms (Monzo and Barclays). Nothing in the retrieved evidence attributes the Stunt & Co matter to Monzo Bank Limited. It must not be recorded against this entity.
3. 3.PSR item — what it does and does not say. The snippet states the PSR 'collected data on three key areas' and lists 'Monzo Bank Limited, National Westminster ...'. Being named in a regulator's published performance dataset on APP fraud reimbursement is a transparency exercise applying to many firms. It is not an enforcement finding, an allegation or a determination against Monzo. Treating it as HIGH adverse is an over-classification.
4. 4.No positive or mitigating coverage was captured, including any Monzo statement in response to the Final Notice. One-sided evidence sets bias reputational assessment; the absence of a firm response in the record is a search-coverage artefact.

Risk Implication

The reputational picture is that of an established UK challenger bank that received significant, well-publicised regulatory criticism of its financial crime controls in July 2025. That is materially relevant to any counterparty assessing Monzo's AML control environment — see Section 6 for the regulatory analysis and Section 10 for the conduct-risk read-across. It is not evidence of criminal conduct, fraud by the institution, or a pattern of unrelated reputational incidents.

Coverage note: searches were run via Google Programmable Search only. No specialist adverse-media database (e.g. structured negative-news screening with entity resolution) was used. The most recent evidenced item is October 2025, leaving roughly ten months to the 18 August 2026 report date unsearched.

Assessment

The Regulatory & Enforcement factor scores 79/100 — the highest factor in the model. It is driven by a single, corroborated, regulator-determined enforcement outcome.

This is an outcome, not an allegation. A Final Notice is the FCA's concluded determination following its decision-making process; where a settlement discount is applied, it reflects early agreement rather than contested findings. That distinction matters: the reported matter is at the determined end of the allegation → investigation → determination spectrum, and should be recorded as such.

The Reported Enforcement Action

URLs preserved:

• http://thefinancialcrimenews.com/uk-challenger-bank-monzo-fined-21-million-by-fca-for-aml-weaknesses/
• https://connections.nortonrosefulbright.com/post/102kv0z/notice-in-a-nutshell-bank-fined-for-financial-crime-failings
• https://www.mishcon.com/news/fca-fines-monzo-21-million-for-failings-in-anti-money-laundering-systems-and-controls
• https://www.lexology.com/library/detail.aspx?g=74fe36f4-28d6-42e9-845b-e414d3ef34d1
• https://www.regulationtomorrow.com/2025/07/financial-crime-controls-in-the-spotlight-lessons-learned-in-relation-to-fca-supervisory-powers-and-expectations/
• https://www.int-comp.org/insight/the-real-lesson-from-the-monzo-fine-industry-s-broken-approach-to-money-laundering-risk-assessment/

The Primary-Source Deficiency

The FCA Final Notice was not retrieved. No source in the evidence set is the Final Notice; several reference a file named monzo-bank-limited.pdf without the document being captured. The FCA's own enforcement page was not directly queried.

Consequences:

• The £21,091,300 figure is corroborated across two independent legal publishers and is very likely accurate — but it remains secondary-sourced.
• Nothing is known about the breach period. Whether the conduct relates to 2018–2020 or to 2023–2024 changes the risk read entirely and cannot be resolved here.
• Nothing is known about remediation status. Whether the control failures have been closed out, are subject to ongoing skilled-person oversight, or carry residual requirements is undetermined.
• No confirmation of current permissions. The FCA Register was not queried (Section 1).

Other Regulatory Signals

• PSR (31 October 2023): Monzo Bank Limited named in the PSR's first APP scams performance report. This is a published dataset covering multiple firms. No enforcement finding against Monzo is evidenced. Its HIGH adverse classification is not supported by the retrieved text — see Section 5.
• PRA: no PRA enforcement or supervisory record was retrieved. The PRA was not among the sources queried. This is NOT FOUND, not a clean result.
• Six neutral regulatory results were returned but their content was not extracted and cannot be assessed.

Risk Implication

For a counterparty, the relevant risk is control-environment reliance risk: a bank found by its regulator to have had deficient AML systems and controls is a weaker candidate for reliance under MLR 2017 reg. 39, and any introduced-business or correspondent arrangement should be assessed on that basis. It is not, on this evidence, an integrity risk of the kind that would preclude a relationship.

Mandatory next step: obtain the FCA Final Notice of 7 July 2025 as a primary document and record breach period, rule breaches, remediation obligations and any restrictions. Until that is done, the highest-weighted adverse factor in this report rests entirely on press summaries.

Assessment

No litigation was identified. The Litigation factor scores 66/100, but this is derived from the same two enforcement-commentary items already analysed in Section 6 — not from any court proceeding.

Screen status: COURT RECORDS NOT SEARCHED DIRECTLY

No court registry, judgments database, insolvency register or claims database was queried. The litigation domain was searched via Google Programmable Search only.

Evidence

Required fields not obtainable: jurisdiction, court, case type, parties, case number, status and outcome — because no actual case was identified. No case number appears anywhere in the evidence and none has been constructed.

Analytical Note on the Score

The Litigation factor of 66/100 is, on inspection, double-counting the regulatory finding. The two adverse litigation items are the identical Norton Rose Fulbright and Financial Crime News articles that drive the Regulatory factor (79/100) and the Adverse Media factor (74/100). One enforcement event is therefore contributing to three of the seven weighted factors.

This is a property of the scoring model as supplied and has not been adjusted — the arithmetic in Section 11 uses the supplied scores verbatim. It is flagged here so that reviewers do not read the litigation score as independent corroboration of a separate legal exposure.

Pattern Analysis

• Repeat litigation: no evidence either way — court records not searched.
• Class actions: none identified; none searched for in a claims database.
• Insolvency: the Companies House status is active, which is inconsistent with formal insolvency proceedings but does not exclude a pending petition. The Companies House filing history and any gazette notices were not retrieved.

Risk Implication

No litigation risk can be affirmed or excluded. Under FCA SYSC 6.3 and MLR 2017 reg. 28, a counterparty risk assessment for a material relationship would normally include a direct check of the relevant court registers. Required next step: search the England & Wales judgments and insolvency registers directly for MONZO BANK LIMITED (09446231) and record the search date. The absence of findings from a news search is not a litigation clearance.

Assessment

Screen status: NO DEDICATED ESG DATA SOURCE WAS CONSULTED

No ESG rating provider, sustainability database, modern-slavery register, environmental regulator record, employment tribunal database or ICO data-breach register was queried. ESG is not a weighted factor in the scoring model (Section 11) and contributes nothing to the composite score.

What can be assessed is conduct risk, and only through the regulatory evidence already analysed in Section 6.

ESG Domains — Coverage Status

No ESG finding — positive or negative — is asserted, because none was searched for.

Conduct Risk — What the Evidence Does Support

Governance and financial crime control conduct is the one area where evidence exists:

1. 1.Reported FCA Final Notice, 7 July 2025 — penalty of £21,091,300 for AML systems and controls failings, including reported deficiencies in business-customer CDD procedures under the UK Money Laundering Regulations. CORROBORATED across multiple secondary sources; primary document not retrieved. See Section 6.
2. 2.Commentary characterisation — the International Compliance Association piece (https://www.int-comp.org/insight/the-real-lesson-from-the-monzo-fine-industry-s-broken-approach-to-money-laundering-risk-assessment/) refers to 'fraud alerts, all while bypassing effective ...'. This is the author's characterisation in an opinion piece, not a regulatory finding, and the snippet is truncated. It should not be recorded as a determined fact.
3. 3.PSR APP scams performance report, 31 October 2023 (https://www.psr.org.uk/news-and-updates/latest-news/news/psr-publishes-first-app-scams-performance-report/) — Monzo named among firms in a published dataset on authorised push payment fraud. This is a transparency publication, not a conduct finding against Monzo. See Section 5.

Risk Implication

• The evidenced conduct concern is narrow and specific: financial crime systems and controls, as determined by the FCA. It is directly material to any counterparty relying on this entity's AML framework.
• The evidenced conduct record contains no finding of consumer detriment, mis-selling, environmental harm, labour abuse or data protection failure — because those areas were not searched. Their absence from this report must not be read as a clean result.
• Governance question left open: the evidence does not disclose whether any individual accountability outcome (Senior Managers Regime) accompanied the corporate penalty. That would be a material governance signal and should be checked against the primary Final Notice and the FCA's individual enforcement records.

Required next step: if ESG exposure is material to the relationship, commission a dedicated ESG and regulatory-conduct screen covering the ICO register, employment tribunal decisions, and the firm's published modern slavery statement.

Assessment

No financial data was obtained. This is a material due diligence deficiency, explicitly flagged as such.

The financial search executed successfully and returned ten results, all classified neutral (0 adverse, 0 positive). However, no content, figures or extracts from those results were carried into the evidence set. The result is a domain that ran but yielded nothing analytically usable.

What Is Missing

No figure of any kind appears in this section because no figure appears in the evidence. No estimate, industry benchmark or inferred value has been substituted.

Source of Wealth / Source of Funds

For a corporate customer that is itself a deposit-taking institution, source-of-wealth analysis normally rests on: capital structure, shareholder base, funding history and audited financial statements. None of these is available. The declared PSC (Monzo Bank Holding Group Limited, Section 2) is the natural starting point for a capital-structure trace, but that entity's registration number, accounts and own ownership register were not retrieved.

Red-Flag Screening

The standard financial red flags cannot be tested:

• Negative net worth — cannot be tested; no balance sheet data.
• Rapid unexplained growth — cannot be tested; no time series.
• Opaque funding — cannot be assessed; funding history not retrieved.

None of these red flags is asserted, and none is excluded. The correct position is that the tests were not performed.

Risk Implication

• The absence of financial data means the Financial domain contributes nothing to the composite score (it is not a weighted factor in this model — see Section 11) and contributes nothing to the analysis either.
• Under MLR 2017 reg. 28(3)–(4), a firm must understand the nature of the customer's business. For a bank counterparty, that includes financial standing and capital position. That obligation is not met on this record.
• The connection to Section 6 is direct: a firm that has been penalised for AML systems and controls failings, and whose financial position is simultaneously unknown to the reviewing firm, presents a compounded information deficit for any material or credit-bearing relationship.

Required next step: retrieve the most recent filed statutory accounts for MONZO BANK LIMITED (09446231) from Companies House, and the consolidated accounts of Monzo Bank Holding Group Limited, together with any published Pillar 3 disclosures.

Assessment

Jurisdictional exposure, as evidenced, is single-jurisdiction United Kingdom. The model assigns a Jurisdiction Risk score of 35/100 (applied weight 6.8%).

Evidence

Reference Datasets — Not Consulted

Screen status: NO JURISDICTIONAL REFERENCE DATASET WAS QUERIED

The following were not consulted in this assessment, and no value from them is reproduced here:

• FATF list of Jurisdictions under Increased Monitoring ('grey list') — not queried; no publication date available.
• FATF list of High-Risk Jurisdictions subject to a Call for Action ('black list') — not queried.
• EU list of High-Risk Third Countries — not queried.
• Transparency International Corruption Perceptions Index — not queried. No CPI score is stated in this report because none was retrieved.
• UK HM Treasury high-risk third country list — not queried.

The Jurisdiction Risk score of 35/100 was produced by the scoring model. The evidence set does not disclose the reference data or methodology behind that value, so it is reported verbatim but cannot be independently reproduced by this analyst.

Analysis

• No offshore, secrecy-jurisdiction or high-risk-country nexus is evidenced. Equally, none has been excluded — the search did not extend to subsidiary or branch structures. A UK bank of this profile may hold overseas entities or serve customers in multiple jurisdictions; the evidence set is silent.
• The ownership chain does not leave the evidenced record. The single declared PSC bears a name consistent with a UK entity, but its jurisdiction of incorporation is not confirmed (Section 2). If the chain extends offshore above that entity, this assessment would not detect it.
• Customer-base geography is unknown. The reported FCA finding concerning business-customer CDD (Section 6) implies a business banking operation, but nothing in the evidence indicates the geographic distribution of that customer base.

Risk Implication

Single-jurisdiction UK exposure is, on its face, at the lower end of the geographic risk spectrum. That conclusion is provisional, because the group structure above the subject and any overseas operations were not mapped. This gap connects to Section 2 (unresolved ownership chain) and to Section 11, where the low jurisdiction score contributes to suppressing the composite.

Required next step: map the corporate group of Monzo Bank Holding Group Limited to identify any non-UK entities, and confirm whether the subject operates or holds permissions outside the UK.

Composite Result

Composite score: 44/100 — MEDIUM Coverage: PARTIAL — the Politically Exposed Persons domain did not run and is excluded from the score.

Weights below are the applied (renormalised) weights supplied in the risk-score block, redistributed across the six domains that actually ran. They sum to 100%.

Scoring Table

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

• Sanctions & Watchlists: 3 × 0.341 = 1.023
• Adverse Media: 74 × 0.227 = 16.798
• Regulatory & Enforcement: 79 × 0.204 = 16.116
• Politically Exposed Persons: did not run — contributes 0, carries no weight
• Litigation: 66 × 0.114 = 7.524
• Jurisdiction Risk: 35 × 0.068 = 2.380
• Transparency Risk: 8 × 0.045 = 0.360

Σ = 1.023 + 16.798 + 16.116 + 7.524 + 2.380 + 0.360 = 44.201 → 44/100

Weight check: 34.1 + 22.7 + 20.4 + 11.4 + 6.8 + 4.5 = 99.9% ≈ 100% (rounding).

Band: MEDIUM. The arithmetic is reproducible and no score or weight has been modified.

What Drives the Score — and Three Structural Caveats

Upward drivers (specific evidence):

• Regulatory & Enforcement 79/100 — the FCA Final Notice reported at 7 July 2025, penalty £21,091,300, AML systems and controls, corroborated by Norton Rose Fulbright, Mishcon de Reya, Lexology, Financial Crime News and Regulation Tomorrow.
• Adverse Media 74/100 — seven HIGH-classified items, 9 July 2025 to 6 October 2025 (plus one 2023 PSR item).
• Litigation 66/100 — no independent litigation; score derived from duplicate enforcement commentary.

Downward drivers (specific evidence):

• Sanctions 3/100 at 34.1% weight — a clean, genuinely-executed screen on the heaviest-weighted factor.
• Transparency 8/100 — authoritative registry coverage.
• Jurisdiction 35/100 — UK single-jurisdiction.

Caveat 1 — Weight concentration. The single largest weight (34.1%) sits on the one factor that scored near-zero. Two factors scoring 74 and 79 together carry only 43.1%. Arithmetically, a clean sanctions result is doing more to lower the composite than the enforcement action is doing to raise it. The MEDIUM band is correct under the model but should be read with that structure in mind.

Caveat 2 — Single-event triple-counting. One enforcement event (the 7 July 2025 Final Notice) is contributing to three separate factors: Regulatory (79), Adverse Media (74) and Litigation (66) — a combined 54.5% of applied weight. The model therefore reflects media and search volume around one event, not three independent risk events. No adjustment has been made, as scores are taken verbatim.

Caveat 3 — This is a PARTIAL score and must not be presented as complete. PEP risk is entirely unmeasured. Financial and ESG data are absent (though these are not weighted factors). If PEP screening returns any match among the ten named subjects, the composite and the CDD posture would both require immediate re-assessment.

Confidence

MEDIUM. Identity and control data are registry-verified and of high quality. The principal adverse finding is corroborated across five independent publishers but rests entirely on secondary sources. One domain (PEP) did not run at all, and one domain that ran (Financial) yielded no usable content. The most recent evidence is approximately ten months older than the report date.

Recommendation

Standard CDD with Enhanced Monitoring — consistent with the model output for a composite of 44/100 (MEDIUM). Full EDD is not mandated by the model output, but two named remediations must be completed before any material relationship decision is finalised, and EDD should be applied if either produces an adverse result.

Rationale

Supporting a proceed-with-conditions posture:

• Identity is registry-VERIFIED against Companies House (09446231, active, incorporated 2015-02-18) — Section 1.
• Sanctions screening ran and genuinely returned no findings across OFAC, UK OFSI and UN — Section 3. This is a real clean signal on the heaviest-weighted factor.
• Control structure is transparent at the officer level: ten subjects CONFIRMED from an authoritative registry — Section 2.
• The adverse profile is one corroborated regulatory event, not a pattern of unrelated incidents — Sections 5 and 6.

Requiring conditions rather than unconditional acceptance:

• The PEP domain did not run. Ten named natural persons and one declared corporate PSC are unscreened. MLR 2017 reg. 35 and FATF R.12 obligations cannot be evidenced as met — Section 4.
• The primary FCA Final Notice was not retrieved. Breach period, rule breaches, remediation status and any residual restrictions are all unknown — Section 6.
• No financial data exists in the evidence set — Section 8. Financial standing cannot be assessed.
• The ownership chain to ultimate natural persons is unresolved above the declared PSC — Section 2.

Not supporting rejection: no sanctions match, no criminal proceeding, no insolvency indicator, no evidence of concealment. Rejection on the basis of unavailable information would not be proportionate on this record.

Outstanding Information Gaps

Required Actions

1. 1.Commission PEP/RCA screening on all nine directors, the company secretary and the declared PSC named in Section 2. Record the provider, screening date and adjudication of any hits. Do not finalise onboarding until complete.
2. 2.Retrieve the FCA Final Notice dated 7 July 2025 from the FCA website as a primary document. Record: penalty amount (verify £21,091,300), breach period, specific MLR 2017 / Principle breaches, any skilled-person or remediation requirement, any restriction imposed or lifted, and any individual accountability outcome.
3. 3.Verify current regulatory status on the FCA Financial Services Register; record FRN and permission scope on file.
4. 4.Obtain statutory accounts for MONZO BANK LIMITED (09446231) and, if available, consolidated accounts for Monzo Bank Holding Group Limited.
5. 5.Map the ownership chain above the declared PSC to identify ultimate natural persons and confirm the 25%+ control position.
6. 6.Search court and insolvency registers directly for the entity; record search date and result.
7. 7.Refresh all open-source searches to cover 6 October 2025 to the review date, closing the ten-month evidence gap.
8. 8.Correct the internal file record to note that the Stunt & Co matter referenced in the Brabners article is not attributed to Monzo in the retrieved evidence, and that the PSR APP scams report is a data publication, not an enforcement finding.

Trigger Events for Immediate Review (outside the quarterly cycle)

• Any PEP, sanctions or watchlist match against any named officer or the PSC.
• Publication of any further FCA, PRA or PSR enforcement, restriction or public censure concerning the entity.
• Disclosure in the Final Notice of ongoing restrictions, an incomplete remediation programme or a live skilled-person review.
• Any change in Companies House status from 'active', or any insolvency filing or gazette notice.
• Any change in the PSC entry or the emergence of a new controller.
• Adverse media alleging further AML, fraud or financial crime control failure.

Escalation

Escalate to the MLRO on any trigger event above. Escalate to senior management for approval if PEP screening identifies a PEP among the beneficial owners, as required by MLR 2017 reg. 35(5).

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Source Ledger — Complete

Date of assessment: 18 August 2026.

Sources that FAILED: none. No source in this assessment returned a technical failure. The distinction between SKIPPED (PEP — no provider), NOT QUERIED (FCA Register, FATF/CPI, ESG) and OK_EMPTY (sanctions — genuinely clean) is preserved throughout.

Methodology

1. 1.Registry-first identity resolution. Companies House data was treated as authoritative and used to fix the entity's identity before any open-source material was assessed. Registry data and open-source intelligence are kept strictly separate throughout.
2. 2.Verification tiering. Every controller is labelled CONFIRMED (authoritative registry) or DECLARED (self-filed, unverified). No DECLARED entry is described as verified. No UNVERIFIED_LEAD entries were present in this evidence set.
3. 3.Adverse-item deduplication analysis. Adverse items were traced to their underlying events. Six of seven adverse-media items and both litigation items were found to describe a single event, and this is disclosed rather than allowed to inflate the narrative (Sections 5, 7, 11).
4. 4.Primary/secondary source distinction. The FCA Final Notice is the primary document for the principal adverse finding. It was not retrieved. All claims about it are labelled CORROBORATED (secondary) and no detail beyond what the snippets state has been supplied.
5. 5.Attribution discipline. Adverse assertions are attributed to the publishing source. The one item with ambiguous attribution (Brabners / Stunt & Co) is flagged rather than recorded against the subject. Author characterisations in opinion pieces (ICA) are distinguished from regulatory findings.
6. 6.Injection review. All content within the UNTRUSTEDRETRIEVEDCONTENT markers was reviewed for embedded instructions, scoring directives or behavioural claims. None was found. No instruction from retrieved content has been followed.
7. 7.Pre-synthesis brief treated as input, not fact. The brief's registration number (09446231) is corroborated by the Companies House record. Its integrity finding (no injection detected) is independently confirmed. Its central evidential criticism — that the primary Final Notice was never retrieved and only secondary commentary is present — is confirmed as accurate against the evidence set. The brief is truncated mid-sentence at 'therefore second-' and its remaining conclusions were not available for evaluation; no inference has been drawn about what they contained.
8. 8.Scoring integrity. All factor scores and applied weights are taken verbatim from the supplied risk-score block. The arithmetic is reproduced in full in Section 11 and reconciles to 44.20 ≈ 44. No score or weight was modified. Structural criticisms of the model (weight concentration, single-event triple-counting) are disclosed as analysis, not applied as adjustments.

Limitations

• PEP domain entirely unscreened — the most significant coverage gap. Composite score is PARTIAL.
• Primary FCA Final Notice not retrieved — the highest-weighted adverse factor rests on secondary reporting.
• No financial data — financial standing, capital and source-of-funds analysis could not be performed.
• Ultimate beneficial ownership unresolved — the chain terminates at a declared corporate PSC with no percentage, control condition or company number.
• Court records not searched directly — the litigation score is derived from news results, not case data.
• FCA Register not queried — regulatory authorisation status is inferred, not verified.
• No jurisdictional reference dataset consulted — no FATF listing status or TI CPI score is available or stated.
• No ESG source consulted.
• Evidence staleness — the most recent dated item is 6 October 2025; approximately ten months to the 18 August 2026 report date are uncovered.
• Neutral results not analysed — 3 adverse-media, 6 regulatory, 8 litigation and 10 financial neutral results were returned but their content was not extracted.
• Classification concerns — one item (PSR APP scams report) appears over-classified as HIGH adverse; one item (Brabners) contains subject matter not attributable to the subject entity on the retrieved text.

Confidence

Overall confidence: MEDIUM.

• Raising confidence: identity and officer data come from an authoritative primary registry and are internally consistent; the sanctions screen genuinely executed and returned nothing; the principal adverse finding is corroborated across five independent specialist publishers with a consistent date and a consistent penalty figure.
• Limiting confidence: one full risk domain (PEP) was not screened at all; the primary enforcement document was not obtained; no financial data exists in the record; ultimate beneficial ownership is unresolved; and the evidence set is approximately ten months stale relative to the report date.

Confidence would rise to HIGH on completion of Required Actions 1–3 in Section 12 (PEP screening, retrieval of the FCA Final Notice, and FCA Register verification).

Legal and Regulatory Framework Applied

• UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — regs. 5, 27, 28, 33, 35, 39
• FCA Handbook SYSC 6.3 (financial crime systems and controls) and SYSC 12.1
• FATF Recommendations 10, 12, 20, 24
• Companies Act 2006 Part 21A (PSC regime); EU 5AMLD Article 30 (comparative beneficial ownership standard)
• UK Modern Slavery Act 2015 s.54 (referenced in Section 10 as not assessed)
• EU 6AMLD (comparative reference)