Introduction
When a digital bank is fined for financial crime failings, the coverage often carries an unspoken message that fintechs move too quickly to take compliance seriously. When a large traditional bank is fined, the explanation usually points to legacy systems and the sheer size of the organisation. There is some truth in both, and read together they suggest something more useful. Traditional banks and fintechs work under the same Money Laundering Regulations and are measured against the same FATF standards. For AML purposes they are also supervised by the same regulator, the FCA. What differs is the pace at which they operate, and that pace shapes where each of them is most likely to fail.
My own career has been spent in traditional banking, first in trade finance and middle office operations and later in risk and compliance at a smaller UK bank. I have not worked inside a fintech, so for that side of the comparison I have relied on public enforcement findings. Even so, I find the comparison instructive. The weaknesses that appear in fast-growing digital firms often mirror, in reverse, the ones I have seen in established institutions.
In this article, I use the term fintech broadly to cover digital banks, electronic money institutions and payment firms. By traditional banks I mean established institutions with branch networks or long-standing corporate books. The article looks at the foundation both models share, where each tends to struggle, and what each could learn from the other.
The same foundation
The legal obligations do not change with the business model. A digital bank or electronic money institution in the UK is subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) in the same way as a high street bank. Under regulation 18 it must assess its money laundering and terrorist financing risks, and under regulation 19 it must maintain policies, controls and procedures that are proportionate to its size and nature. It must also apply customer due diligence and ongoing monitoring, and report suspicion. Regulation 19 goes further for new products, business practices and technologies, requiring firms to assess and, where necessary, mitigate their risks in preparation for and during their adoption. The FCA’s Financial Crime Guide sets out the same expectations of governance, senior management responsibility and risk assessment for every firm it supervises (FCA, no date). The FATF Recommendations, for their part, ask firms to understand their risks and apply proportionate measures, and they do not prescribe any particular technology or structure (FATF, 2012).
Proportionality is where the two models begin to diverge. A control framework proportionate to size sounds straightforward, but size does not stay still. A traditional bank usually grows slowly, and its controls have been built up over many years around a fairly stable customer book. A fintech’s customer base can grow almost tenfold within four years, as Monzo’s did, and controls that were proportionate at launch may be badly out of proportion by the time the firm is established. Both work from the same rulebook. The difference lies in how fast each has to move to keep its controls in step with its business.
Where traditional banks struggle
Systems built for an earlier era
Most traditional banks run their AML controls on top of core systems designed long before current monitoring expectations existed. Customer and transaction data typically sits in several places. There is the core banking platform, there are separate systems for trade finance, treasury and payments, and there are the screening and monitoring tools that draw on all of them. Every interface between these systems is a point where data can be lost, truncated or misread.
The FCA’s action against HSBC in 2021 shows how this can play out at scale. The FCA found serious weaknesses in the bank’s transaction monitoring over a period of eight years. Until 2014 the bank did not consider whether its monitoring scenarios covered the relevant risks, and after 2016 it did not carry out timely risk assessments for new scenarios. It also did not appropriately test and update the parameters within its systems, or check the accuracy and completeness of the data being fed into them. The FCA added that the systems were ineffective for a prolonged period despite the issue being highlighted on numerous occasions, and that remediation took a long time (FCA, 2021). HSBC had monitoring technology in place, but it had not kept that technology aligned with its risks or its data.
Change that takes too long
In an established bank, even a small change to a monitoring rule or a screening configuration usually goes through a change request, a vendor release, testing and formal approval before it reaches production. Those steps exist for good reasons. They also mean a control can stay out of date for months after a weakness has been found. Having worked alongside a UAT team testing trade systems against business requirements, I saw how long the path from an agreed requirement to a working change could be, and how easily a change could be pushed back when it competed with commercial priorities. A compliance team may understand a new typology or product risk well before the system is able to respond to it.
Manual workarounds that become permanent
When systems cannot do what a control requires, people fill the gap. Spreadsheets, manual checks and email approvals are brought in as temporary fixes and often stay in place for years. They can work well while experienced staff run them. The trouble is that they are hard to evidence and depend heavily on individuals, and they rarely scale. From what I have observed, a surprising number of important controls in smaller traditional banks sit in this category.
Where fintechs struggle
Growth that runs ahead of controls
Recent fintech enforcement cases follow a consistent pattern. Starling Bank grew from around 43,000 customers in 2017 to 3.6 million in 2023, and the FCA found that its financial crime controls had not kept pace with that growth. Since 2017, its automated sanctions screening had checked customers against only a fraction of the full list of persons subject to financial sanctions. The bank also opened more than 54,000 accounts for 49,000 high-risk customers in breach of a requirement it had agreed with the FCA (FCA, 2024).
Monzo’s customer base grew from around 600,000 in 2018 to more than 5.8 million in 2022. The FCA found that between 2018 and 2020 it had failed to design, implement and maintain adequate onboarding, customer risk assessment and transaction monitoring systems. It later opened more than 34,000 accounts for high-risk customers in breach of a restriction the FCA had imposed alongside an independent review of its financial crime framework (FCA, 2025).
Both firms had technology. In each case, the technology, the people and the governance around it had been designed for a smaller business than the one the firm became.
Onboarding designed for speed
A fast and simple account opening journey is central to the fintech model. In many respects it is a genuine improvement on traditional processes, which can be slow and frustrating for legitimate customers. The risk is that the checks within that journey are tuned for conversion, with risk given less weight. In the Monzo case, the FCA noted that customers had been able to open accounts using obviously implausible details, including well-known London landmarks given as home addresses (FCA, 2025). An automated journey will accept whatever it has not been designed to question.
Capacity behind the automation
Monitoring tools in a digital firm may generate alerts efficiently, but every alert still needs a person with the right experience to review it. When customer numbers grow faster than compliance headcount and expertise, backlogs build up and the quality of investigation tends to fall. There is a calibration problem as well. Rules set for a few hundred thousand customers and a single current account product may stop reflecting the business once the firm has millions of customers and offers lending, savings and business accounts.
An illustrative case
Consider a hypothetical small business, an online electronics reseller, that opens an account with a traditional bank and, separately, with a digital bank. At onboarding it tells both banks that its customers pay by card through a payment processor. Within three months its turnover rises from a few thousand pounds a month to several hundred thousand. Most of the money, however, arrives as direct bank transfers from many unrelated individuals, often in round sums, and goes out in regular transfers to overseas accounts.
At the traditional bank, onboarding took three weeks. The relationship manager collected documents and recorded the expected activity, including the card processor arrangement. Some months earlier, the compliance team had asked for a new monitoring scenario for business accounts that receive many personal transfers and pay them out overseas. The request had been approved, but it was waiting for the next vendor release, which had already been delayed once to make room for a commercial change. Until then, the account was monitored only against the generic value thresholds applied to all small business customers. An alert was eventually generated when the outgoing payments crossed one of those thresholds, six weeks after the activity began.
At the digital bank, onboarding took less than ten minutes. Identity and company registration were verified automatically, and the declared turnover fed directly into the monitoring model, which raised an alert within days. However, a recent marketing campaign had doubled new business sign-ups, and the alert queue had grown to several weeks. When the alert was finally reviewed, it was closed with a short note because the analyst was working to a daily throughput target.
Both institutions detected the activity, and neither acted in time. The traditional bank knew what it needed to detect but could not change its system in time. The digital bank failed in the human capacity behind its system. A supervisor looking at either case would ask the same question, which is whether the controls matched the business as it actually was.
Why the differences are often missed
Enforcement cases record failures, so they say little about what is typical, and many firms in both groups manage these risks well. They are still useful because they show where pressure tends to build in each model. Comparisons between banks and fintechs tend to focus on technology, as though better tools would solve the problem. The enforcement record points somewhere else. HSBC operated large monitoring systems, and Starling and Monzo operated modern platforms. In each case the weakness lay in how the controls were governed, tested and resourced.
Each model also tends to measure itself in ways that hide its own weakness. Traditional banks often report completed reviews and the existence of policies, which says little about whether the systems behind them still fit the risk. Fintechs often report onboarding times and automation rates, which say little about whether controls are keeping up with growth. As I argued in my earlier article on measuring compliance effectiveness, activity is a poor substitute for evidence that a control works.
Governance decisions are also often made without a financial crime view. In a growing firm, a board may approve an ambitious customer acquisition target without asking whether onboarding, monitoring and investigation capacity can absorb it. In an established bank, a board may approve a remediation programme that runs for several years without asking what risk stays open in the meantime.
What each could learn from the other
Neither model needs to become the other, but each could borrow from the other’s strengths. Traditional banks usually have experienced investigators and deep product knowledge, and their governance has been tested over many years. Fintechs usually have cleaner data and a single customer view, and they can change controls quickly. In practical terms, institutions should consider the following measures.
Traditional banks could:
- treat the data path as a control, mapping how customer and transaction data travels from onboarding to screening and monitoring, and testing that path regularly, particularly after system changes;
- give urgent rule, threshold and list changes a defined, faster route with proportionate testing, so that they do not wait in the general change queue;
- retire manual workarounds deliberately, recording each one with an owner, a reason and a target date for replacing it with a system control.
Fintechs could:
- link growth plans to control capacity, so that every significant growth target, product launch or marketing campaign comes with an assessment of its effect on onboarding checks, alert volumes and investigation resources;
- add friction where the risk justifies it, so that higher-risk applicants face additional checks within the journey instead of passing through the same process as everyone else;
- invest in experienced judgment, supporting automation with investigators who understand typologies and testing the quality of alert closures as well as their speed.
Both should give the board forward-looking indicators. Alert ageing, backlog trends, the coverage of monitoring rules across products and the ratio of customers to compliance staff tell a board far more than completion rates do.
Conclusion
Traditional banks and fintechs often describe each other in caricature, one too slow to change and the other too quick to grow. The enforcement record suggests that both descriptions are partly right, and that neither model is safer by nature. The obligations are identical. So is the question a supervisor will eventually ask, which is whether the controls fit the business as it stands today or as it stood when the controls were designed.
For a traditional bank, answering that question well usually means finding ways to change faster without losing control. For a fintech, it usually means slowing down in the places where speed creates risk. In my view, the institutions that manage this best treat their own pace of change, whether too slow or too fast, as a financial crime risk in its own right, and govern it accordingly.
References
Financial Action Task Force (FATF) (2012, as updated) International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation: The FATF Recommendations. Paris: FATF.
Financial Conduct Authority (FCA) (no date) Financial Crime Guide: A Firm’s Guide to Countering Financial Crime Risks (FCG). FCA Handbook. London: FCA.
Financial Conduct Authority (FCA) (2021) FCA Fines HSBC Bank plc £63.9 Million for Deficient Transaction Monitoring Controls. Press release, 17 December. London: FCA.
Financial Conduct Authority (FCA) (2024) FCA Fines Starling Bank £29m for Failings in Its Financial Crime Systems and Controls. Press release, 2 October. London: FCA.
Financial Conduct Authority (FCA) (2025) FCA Fines Monzo £21m for Failings in Financial Crime Controls. Press release, 8 July. London: FCA.The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). London: The Stationery Office.
Leave a Reply