I found two documents from the UK's Financial Conduct Authority that carry the same date, 7 July 2025, and point in what looks like opposite directions. One is FG25/3, the regulator's final guidance on how firms should treat a politically exposed person. The other is a Final Notice fining Monzo Bank £21,091,300.
The guidance tells firms to ease off domestic PEPs. The fine punishes a fintech partly for missing them. I spent a long evening working out whether the two documents contradict each other, and I don't think they do.
For anyone buying or investing in a fintech, the space between them is where the due diligence risk sits. That is why I read both of them side by side, with the review that sits behind the guidance.
A politically exposed person, in the FCA's words, is "someone holding a prominent public position who is entrusted with prominent public functions either in the UK or elsewhere in the world". The Money Laundering Regulations require enhanced due diligence on PEPs, their family members and known close associates. That legal duty has not changed at all.
What changed is the starting point. Amendments that took effect on 10 January 2024 made domestic PEPs lower risk by default, and FG25/3 states that "domestic PEPs, their family members and close associates should be treated as lower risk, unless there is a reason otherwise."
FG25/3 also narrows the group. "In practice it is unlikely that a large number of UK customers should be treated as PEPs," it says, and it excludes local government, more junior senior civil servants and all but the most senior military officers. It quotes FATF that these checks are "preventive (not criminal) in nature".
One practical change matters for a fintech's cost base. The money laundering reporting officer no longer has to sign off every PEP account, provided a suitably senior person does it and the MLRO keeps oversight of the whole process.
The guidance came out of a review that Parliament ordered through the Financial Services and Markets Act 2023. I read the FCA's write-up of that review, published on 18 July 2024, because it is the closest thing to an official dataset on how firms treat PEPs.
One line in it stopped me cold. "We contacted over 1,000 UK PEPs and received 65 responses." The review then gathered data from firms in five retail sectors and narrowed to 15 firms for a detailed look.
That reply rate cuts against the story that started the review. Parliamentarians had raised concerns that some firms were applying the PEP guidance "in a disproportionate way". Yet when the regulator wrote to more than a thousand PEPs directly, fewer than one in fifteen answered.
I can't tell what the silence means. It might be apathy, or busy diaries, or a problem smaller than the headlines suggested. What the review did find was that all 15 firms needed to improve, and that some used PEP definitions "wider than those in the regulations and our Guidance".
Now to the Monzo fine itself. The Final Notice covers failings from 1 October 2018 to 30 June 2022, years in which the bank was growing very fast. I went looking for the PEP paragraph before reading the rest.
Most of the notice is about onboarding in general. Customers could give addresses such as "Buckingham Palace" and "10 Downing Street", and Monzo did not check them for most of that period. Between 5 August 2020 and 30 June 2022 it opened 33,039 accounts in breach of a restriction it had agreed with the FCA, 26,325 of them for high-risk customers.
Paragraph 2.10 is the PEP part. Monzo "had no clear internal definition of what constituted a PEP", so some were "not identified at onboarding". Worse, potential PEPs could "open accounts and transact while the identification process, and any resulting EDD, was ongoing", and the weakness was "exacerbated by consistent backlogs in the assessment of PEP flags".
The penalty was £30,130,475 before a 30% discount. Monzo "agreed to resolve this matter and qualified for a 30% (stage 1) discount", in the notice's words.
My first reading was that the regulator wanted it both ways, gentler on PEPs and harsher on firms that miss them. I was wrong about that.
FG25/3 is about proportion once a PEP has been identified. The Monzo notice is about identification itself, and about letting accounts run before the check was done. You can treat a domestic PEP as lower risk only after you know the person is a PEP, so the lighter touch depends on the screening working first.
This is the point I had missed. A light check on a domestic PEP can be perfectly lawful under FG25/3, as long as the firm has actually identified the person. Letting the account trade while the check sits in a queue is what the notice describes, and that is a different failure altogether.
The Final Notice says as much, which I didn't expect. It recalls that the 2017 guidance already expected an "individualised approach", with a UK PEP with no other risk factors treated as a lower risk customer. Monzo's problem was that it had no consistent way of knowing who those customers were.
When I look at a fintech target, I now ask for the PEP flag queue, as well as the PEP policy. I want to know how many flags sit unreviewed, how old the oldest one is, and whether an account can transact while its flag is open. Monzo's backlog was the detail that turned a policy gap into a finding.
Growth is the other number I ask for. Monzo went from about 590,000 customers in February 2018 to 5.8m in February 2022, roughly ten times as many, and the notice describes consistent backlogs in PEP flags across that stretch. A buyer pays for that kind of growth twice if the controls lag behind it.
I also ask how the firm defines a PEP. The FCA's review found some definitions wider than the law, and Monzo's notice shows the cost of having no clear definition at all. Too wide means needless enhanced checks and unhappy customers. Too vague means a Final Notice years later.
Last, I check declassification. FG25/3 keeps enhanced checks for at least 12 months after someone leaves office, and the review found that some firms had no effective way to reassess a PEP after that. A fintech that never declassifies anyone carries cost it doesn't need.
The question I still cannot answer is what the right backlog number is. The FCA says what went wrong at Monzo but not how many open flags a well-run bank of that size should carry, and I have not found a benchmark in anything it has published.
Monzo's 33,039 accounts opened in breach of its restriction give me a sense of scale. They don't give me a target, and a £21,091,300 fine is an expensive way to learn where the line was.