Barclays probed by UK financial watchdog over AML failings

The AML crackdown continues, this time targeting one of Britain’s biggest banks

The UK’s Financial Conduct Authority (FCA) has launched an investigation into Barclays for suspected ongoing failings in compliance and anti-money laundering (AML) systems.

The Financial Times reported that the FCA issued a notice last spring requiring an independent review of the bank’s financial crime detection and prevention systems. The review was triggered by concerns over the amount of know-your-customer (KYC) and AML cases at Barclays.

The process is known as a Section 166 — or “skilled person review.” It usually involves an external investigator who provides a report with recommendations for improvements. While this is one of the FCA’s supervisory tools, the review can be referred to its enforcement division if there is evidence of financial abuse. 

The bank is due to report its annual earnings next week and has not disclosed the Section 166 requirement in previous filings, raising questions as to just how clued in customers and investors are to its AML operations.

Getting tough on financial crime

The move comes as authorities in the UK have been trying to implement stronger financial controls at top banks. London’s status as a global financial centre makes it a prime target for financial crime and it has recently received criticism as a hub for financial wrongdoings.

The FCA, under its new chief executive, Nikhil Rathhas, has said that it was taking a more aggressive approach to enforcement. It has repeatedly warned banks operating in the UK that their oversight and reporting systems are not sufficient.

Among the FCA’s recent fines:

  • HSBC received a £64mn fine for “serious weaknesses” in its AML controls between 2010 and 2018, including maintaining an account for the leader of a criminal gang.
  • NatWest was fined £265mn for failing to prevent a £365mn money-laundering scheme, which involved £700,000 being carried through a shopping centre in black bin liners.
  • Santander UK paid a £107.8mn fine for failing to manage its systems properly and missing red flags on suspicious cash flows through its accounts.

Barclays’ recent missteps

For Barclays, the FCA review is the latest in a series of clashes with regulators and compliance struggles in recent years:

  • Former CEO Jes Staley was forced to step down in November 2021 amid a probe into his past relationship with Jeffrey Epstein. Staley is appealing the decision.
  • Last year, Barclays agreed to pay $361m to the US Securities and Exchange Commission and set aside £450m to compensate investors after accidentally selling $17.7b of structured financial products it did not have authorisation for.
  • Barclays was one of a large group of banks fined $200m by the SEC and the Commodity Futures Trading Commission for employees’ unauthorised use of encrypted messaging services such as WhatsApp and Signal.
  • In June 2021, Barclays had to pay compensation of £48mn to almost 1,500 customers who were improperly sold timeshare loans in Malta. Barclays Partner Finance, the trading name of Clydesdale Financial Services Limited, had a partnership with the now-defunct timeshare operator Azure Resorts.
How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.