What happened
It was reported in the FCA’s Final Notice that UK banks must screen customers against financial sanctions lists to avoid providing services to sanctioned people or organisations.
Starling Bank grew rapidly. The FCA reported that its customer base increased from about 43,000 to 3.6 million in six years. It found that the bank’s financial crime controls failed to keep pace.
During an internal review in January 2023, Starling discovered something unusual. Its automated system had not produced a single sanctions alert for an individual customer in seven months.
The FCA reported that a configuration error was responsible. For more than five years, the system had checked customers only against people on the Consolidated List with UK citizenship or residency. That meant just 39 of the 3,088 designated people on the list.
The FCA found that this created a material risk that sanctioned people could open accounts or keep existing accounts after being added to the list. Starling identified at least one designated person who had opened an account during the period examined.
What an auditable version would have shown
The FCA found that Starling had no formal method for testing or calibrating its sanctions screening system. There was no record of testing when the system was introduced or at any point afterwards.
The bank also lacked management information showing how many alerts the system produced or whether those numbers were changing. The FCA found that this information would have helped Starling check whether its screening was working.
Seven months without a single alert should have raised questions. A record of alert numbers, the sanctions list used and the system configuration could have helped identify the problem much earlier. It would have shown what the system was checking and whether its results had changed.
Where the gap was
It was reported in the FCA’s Final Notice that concerns about Starling’s sanctions screening had been raised well before the problem was discovered.
The FCA had warned Starling that its written policy did not match what happened in practice. The policy said customers were screened against UK, EU, UN and US sanctions lists. In reality, screening covered only records for people known to live in or have links to the UK.
The regulator later reminded Starling and thousands of other firms to use current sanctions lists, test their screening systems and ensure senior management oversaw those checks. The FCA treated this warning as an aggravating factor when calculating the penalty.
Starling’s own review found that an independent compliance consultancy had also raised concerns about its sanctions screening. The FCA found that the bank had not carried out second-line assurance reviews until early 2023.
The FCA identified three further problems:
- Customers were screened only once every 14 days, using a process left over from when the bank was much smaller. Screening happened only after accounts had been opened.
- Not all international payments were checked against the Consolidated List.
- The bank used a tool designed for customer screening to check payments.
A VerificationGate is designed to check a system’s output against a trusted reference before it is relied on. Here, that reference was the full Consolidated List.
A ConductRecord is designed to keep a record of which list and configuration were used for each screening run, along with the results. This could help identify gaps between what a system was supposed to check and what it actually checked.
VerificationGate and ConductRecord are Headlights designs.
What governance should have looked like
The FCA reported that Starling corrected and tested its screening system in February 2023. When it screened its 3.5 million active customers again, the system generated about 48,000 alerts.
The bank also reviewed about four million historical payments and reported potential sanctions breaches to the relevant authorities.
Starling moved to daily customer screening, introduced a new payments screening tool and developed a testing method. It also began monitoring alert volumes. The FCA reported that third-party testing later found its customer and payment screening systems effective.
The FCA found that Starling breached Principle 3 of its Principles for Businesses, which requires firms to maintain adequate risk management systems.
The 28,959,426 pound penalty also covered a separate breach of a voluntary requirement not to open accounts for high-risk customers. The FCA found that Starling had opened 54,359 accounts in breach of that requirement. The bank received a 30% discount for settling.
The FCA recorded that Starling agreed to settle and cooperated fully. Starling admitted and accepted the failings identified in an independent consultancy’s report on the separate high-risk accounts breach. It also invested in improving its controls.
Best practice would be to test automated screening systems against known positive matches before they go live and regularly afterwards. Alert numbers should also be monitored. A sudden change, including a fall to zero, should trigger an investigation.
Failure Pattern: an automated sanctions screen was misconfigured at launch, was never tested, and checked customers against about 1% of the list for more than five years.
Governance Principle: an organisation relying on an automated control should be able to demonstrate that it works, that it has been tested and that it continues to check what it was designed to check.
The reference implementation of VerificationGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.