Compliance Fines and Penalties: What UK Regulators Charge by Sector

In 2025, the FCA imposed over GBP 124 million in fines, with AML and financial crime control failures accounting for the majority. The ICO continued to issue GDPR penalties across healthcare, telecoms, and financial services. This article maps out which UK regulators fine which sectors, how much they charge, and what patterns are emerging from recent enforcement data.

UK regulators and their enforcement powers

The UK regulatory landscape splits compliance enforcement across several bodies, each with distinct sectoral jurisdiction and penalty frameworks. Understanding which regulator covers your sector is the first step in managing compliance risk.

The FCA supervises approximately 42,000 financial services firms and financial markets. The ICO enforces UK GDPR and data protection across all sectors. The PRA regulates around 1,500 banks, insurers, and major investment firms.

HMRC supervises AML compliance for estate agents, accountants, trust and company service providers, and high-value dealers not regulated by another professional body. In 2024-25, HMRC supervisors issued 338 fines totalling over GBP 2 million, more than tripling the total penalty value since 2022 (HMRC AML Supervision Report 2024-25).

Banking and financial services: where the largest fines land

Banking consistently attracts the heaviest regulatory penalties in the UK. AML failures, weak transaction monitoring, and inadequate customer due diligence are the primary triggers.

The landmark NatWest case remains the reference point. In December 2021, NatWest was fined GBP 264.8 million after pleading guilty to three offences under the Money Laundering Regulations 2007 -- the first criminal prosecution brought by the FCA for AML failures (FCA, NatWest Press Release). The bank failed to monitor over GBP 365 million in cash deposits from a single commercial customer between 2012 and 2016.

The FCA's enforcement strategy has shifted toward digital banks and fintechs. The Monzo fine in 2025 signals that rapid customer acquisition does not excuse inadequate compliance infrastructure. When onboarding volumes increase, customer due diligence and transaction monitoring must scale accordingly.

GDPR enforcement: the ICO's sector-by-sector approach

The ICO takes a risk-based approach to enforcement, prioritising sectors that process large volumes of sensitive personal data. Healthcare, financial services, and telecoms face the highest scrutiny.

Since the UK's departure from the EU, the ICO has operated under the UK GDPR framework with a maximum fine of GBP 17.5 million or 4% of global turnover. In practice, fines have remained below these theoretical maximums, but enforcement activity has increased year-on-year.

The ICO has signalled a shift toward larger fines for systemic failures. Repeat offenders and organisations that fail to implement remedial measures after a first warning face significantly increased penalties.

Insurance sector: growing regulatory attention

The insurance sector is subject to dual regulation by the FCA (conduct) and the PRA (prudential). AML obligations apply specifically to life insurance and investment-linked policies, while broader conduct rules cover claims handling, product governance, and treating customers fairly.

PRA fines in the insurance sector tend to focus on governance and risk management failures. The FCA targets poor claims handling, misleading product information, and failures in fraud detection. Insurance intermediaries and managing general agents face increasing scrutiny as the FCA expands its supervisory perimeter.

The 2024-25 enforcement data shows a marked increase in penalties for firms that failed to update their systems after regulatory guidance was issued. The FCA's approach is clear: ignorance of published guidance is not a mitigating factor.

Professional services: accountants and estate agents under HMRC

HMRC's AML supervision of professional services firms reveals a sector with significant compliance gaps. In 2024-25, only 24% of accountancy firms and 29% of legal firms assessed were fully compliant. Among accountancy firms, 17% were found non-compliant, while 26% of legal firms fell into the same category.

These figures translate into enforcement action. HMRC issued 338 fines in 2024-25, representing a threefold increase in total penalty value compared to 2022. The penalties target failures in customer due diligence, record-keeping, and suspicious activity reporting.

Estate agents regulated by HMRC face similar challenges. The AML compliance obligations for property transactions above GBP 10,000 require identity verification, source of funds checks, and ongoing monitoring -- procedures that many smaller agents lack the infrastructure to perform consistently.

EU regulatory comparison: AMLD6 raises the bar

For UK firms operating across borders, the EU's new AML package creates additional compliance requirements. The AMLD6 doubles maximum sanctions to EUR 10 million or 10% of annual turnover and creates the AMLA as a centralised EU supervisory authority.

The UK's own regulatory framework broadly mirrors these standards, but divergence is emerging. UK firms servicing EU clients must comply with both regimes, increasing the compliance burden and the potential for double enforcement. The FCA has indicated it will maintain alignment with international AML standards, but national discretion means penalty levels and enforcement priorities may differ.

Trends shaping 2026 enforcement

Three enforcement patterns are visible across all UK regulators. First, digital-first businesses face the same compliance expectations as traditional institutions. The Monzo and Starling fines demonstrate that rapid growth does not earn regulatory leniency.

Second, the FCA is increasingly willing to pursue criminal rather than civil enforcement for AML failures. The NatWest precedent opened the door to criminal liability for firms, not just individuals.

Third, cross-regulator coordination is increasing. The FCA, ICO, and HMRC share intelligence more actively, meaning a compliance failure flagged by one regulator can trigger investigation by another. Firms that invest in robust document verification and KYC processes reduce their exposure across all regulatory touchpoints simultaneously.

Frequently asked questions

What is the largest AML fine ever issued in the UK?

NatWest's GBP 264.8 million penalty in December 2021 remains the largest single AML fine in UK history. It was also the first criminal prosecution by the FCA under the Money Laundering Regulations, setting a precedent for future enforcement action against firms rather than individuals.

Can the FCA and ICO both fine the same company?

Yes. The FCA and ICO have separate jurisdictions -- the FCA enforces financial services regulations and AML rules, while the ICO enforces data protection law. A firm that suffers a data breach involving customer financial data could face penalties from both regulators for the same incident.

Are small firms exempt from AML fines?

No. HMRC supervises AML compliance for small accountancy firms, estate agents, and trust service providers regardless of size. In 2024-25, HMRC issued fines to sole practitioners and micro-businesses alongside larger firms. Proportionality is applied to the fine amount, not to the obligation itself.

How do UK fines compare to EU penalties?

UK fines for AML failures have historically been higher than most individual EU member state penalties, partly because the FCA's unlimited fine cap allows for proportionate but substantial sanctions. The AMLD6 framework will narrow this gap by standardising EU-wide maximums at 10% of turnover.

---

For deeper context on the document fraud patterns that drive these regulatory actions, read our document fraud statistics overview. You can also explore our AML compliance guide for practical steps to build a compliant programme, or review the AMLD6 obligations for obligated entities. Learn how CheckFile.ai supports compliance workflows, or visit our pricing page.