The FCA handed out more than £124 million in fines in 2025, and most of it wasn't for creative fraud or exotic misconduct. It was for firms whose compliance function simply wasn't built to keep up.
The fines tell you exactly what regulators actually check
Nationwide picked up £44.1m for governance and oversight gaps in its AML framework. Barclays took a £39.3m hit for failing to properly assess money laundering risk in corporate banking relationships. A separate Barclays entity paid £3.1m over account opening control deficiencies, proof that even basic onboarding checks get punished when nobody owns them properly. The FCA's own language on this is blunt: ineffective systems and controls are no longer tolerated.
Growth is exactly when compliance breaks
The most instructive case here is Monzo's £21.1m fine, where the regulator's finding was essentially that the firm's compliance infrastructure lagged its rapid growth. That's not a story about a reckless firm. It's a story about a good business that scaled its product and its customer base faster than it scaled the function meant to keep it safe. If you're growing right now and compliance is still one person's part-time responsibility, or something you outsource to consultants who don't know your business day to day, that's the exact gap regulators are finding and fining.
What keeps showing up in enforcement findings
Across these cases, the recurring failures are strikingly similar: transaction monitoring that wasn't adequate for the actual risk, risk assessments that hadn't been updated as the business changed, weak governance and oversight, and manual processes standing in where proper controls should be. Every one of those is a resourcing problem as much as a policy one. A document sitting in a shared drive doesn't monitor anything. A person does.
The real cost of not having one
A dedicated risk and compliance team isn't an overhead you carry until you're big enough to justify it. It's what stops a £3.1m fine over something as basic as account opening controls, and it's what an underwriter, an investor, or an acquirer will ask about before they'll trust your numbers. Treating compliance as a side project is the expensive option, it just doesn't look that way until the fine lands.
If you're building out a risk and compliance function properly, direct-employer hiring gets you in front of specialist candidates faster than going through an agency layer. Post your vacancy on Direct Compliance and reach people who already understand exactly what this function needs to look like.
Read next: How to Hire for AML Analyst Vacancies (Without Losing the Best Candidates), Remove the Bottlenecks Costing You Your Best Compliance Candidates and Why Job Boards Outperform Recruitment Agencies in Today's Market.