What makes fintech accounts attractive for money laundering?
Monzo onboarded customers "on the basis of limited, and in some cases, obviously implausible information", such as "well known London landmarks as an address", the FCA said when it fined the bank £21,091,300 on 8 July 2025. Its customers grew from around 600,000 in 2018 to over 5.8 million in 2022. Its financial crime controls did not keep pace.
EU supervisors see the same anti money laundering gap across fintech. In the EBA's 2025 Opinion on money laundering and terrorist financing risks, 70 percent report high or increasing risk in the sector and worry that rapid growth may have outrun controls (para 6). They also flag outsourcing: 55 percent rate complex arrangements such as wide reliance on outsourced services a significant or very significant risk, while 52 percent name transaction monitoring among the controls they find inadequate (para 32).
Criminals also need money mules. In an FCA survey of 35 banks, building societies, payment institutions and electronic money institutions, 238,396 suspected mules had their accounts closed in 2025, against 184,935 in 2023. Funds usually cashed out at the second to fifth account in a chain.
The EBA adds two fintech channels: virtual IBANs that hide the end user (para 39), and white labeling, where a brand that may not itself be an obliged entity under AML regulations sells a licensed firm's product (para 34).
What do red flags look like in neobank and fintech accounts?
Four of these eleven show at onboarding, and each comes from a supervisor's own finding, a fine or a guideline.
| Red flag | Where it shows | Source |
|---|---|---|
| Limited or implausible onboarding data, such as a landmark given as the home address | Onboarding | FCA, Monzo Bank, 8 July 2025 |
| Accounts opened for high risk customers while a restriction on such accounts applies | Onboarding | FCA, Starling Bank, 2 October 2024; Monzo, 8 July 2025 |
| Customers screened against only a fraction of the full sanctions list | Screening | FCA, Starling Bank (since 2017, found in January 2023) |
| Funds moved through several accounts and cashed out, usually at the second to fifth | Payments | FCA mule review, 23 September 2026 |
| A photo or video not taken during the verification, or a face the algorithm cannot match to the ID document | Onboarding | EBA/GL/2022/15, paras 39, 41 |
| Virtual IBANs that hide who uses the account | Payments | EBA Opinion 2025, paras 36, 39 |
| White label partners that are not obliged entities onboarding customers | Onboarding | EBA Opinion 2025, paras 34, 36 |
| More alerts than the staff can analyze | Monitoring | EBA Opinion 2025, para 33 (review of FinTech supervisory colleges) |
| Suspicious transaction reports filed late, systematically | Reporting | BaFin, N26 Bank, 21 May 2024 |
| Non face to face deposits, withdrawals and electronic transfers that do not fit the customer's financial profile | Monitoring | Türkiye, Regulation on Measures art. 20(2) |
| A risk assessment that never says how a product could be used for laundering | Governance | FI Sweden, Klarna Bank, 11 December 2024 |
Which licenses bring a fintech under AML rules, market by market?
A fintech is caught by AML law through its license. A payment app with its own electronic money license is an obliged entity; a brand that sells a partner bank's account may not be, and then the partner carries the duty. The FATF glossary counts money or value transfer services and issuing means of payment, electronic money included, as financial institution activities, and R.15 asks for a risk assessment before a new product launches.
| Jurisdiction | Law (in force, November 2026) | Supervisor | Fintech licenses caught |
|---|---|---|---|
| FATF standard | FATF Recommendations, updated June 2026: R.10 (CDD), R.15 (new technologies), R.17 (reliance) | National authorities | Financial institutions in the FATF glossary, including money or value transfer services and issuing and managing means of payment |
| EU (national example: AML in Germany) | AMLR, Regulation (EU) 2024/1624, art. 3(1), (2), from 10 July 2027 (art. 90); national laws transposing the AML directives until then | National supervisors; AMLA took over the EBA's AML/CFT mandates on 1 January 2026 and supervises selected firms directly from 2028 | Credit institutions; financial institutions (art. 2(1)(6)), including EMIs and payment institutions; account information services excluded |
| UK | Money Laundering Regulations 2017 (MLR), reg. 8(2)(a), (b), as amended to 30 June 2026 | FCA | Credit and financial institutions, including banks, EMIs and payment institutions |
| US | Bank Secrecy Act; 31 CFR Part 1020 (banks), Part 1022 (money services businesses) | OCC, Federal Reserve, FDIC and state regulators examine banks; FinCEN administers the BSA | Partner banks; fintechs that are money services businesses, which register with FinCEN (31 CFR 1022.380) |
| Türkiye | Law No. 5549; Regulation on Measures (RoM) art. 4(1)(e) | MASAK for AML; TCMB licenses payment and electronic money institutions (Law No. 6493 arts. 14(1), 18(2)); BDDK supervises banks | Payment institutions, electronic money institutions, banks |
| UAE | Cabinet Resolution No. 134 of 2025 (CR 134), the executive regulations of Federal Decree by Law No. 10 of 2025 | CBUAE (banks, finance companies, stored value facilities, retail payment and card schemes); DFSA and FSRA in the financial free zones | Stored value facility providers, payment service providers, banks |
Are neobanks, EMIs and BaaS platforms obliged entities?
Yes, when they hold the license. A neobank with a banking license is a credit institution under AMLR art. 3(1) and MLR reg. 8(2)(a). An EMI or payment institution is a financial institution (AMLR art. 2(1)(6); MLR reg. 8(2)(b)), and Türkiye names both in RoM art. 4(1)(e).
A BaaS platform or white label brand without a license sells a licensed provider's product, and whatever their contract says, providers "remain ultimately responsible" for AML duties (EBA Opinion 2025, para 34). In the US, a fintech that transmits money may be a money services business that must register with FinCEN, while the partner bank runs its customer identification program for the accounts it opens.
What AML obligations does a fintech carry in each market?
Eight duties carry most of a fintech's program, from customer due diligence and ongoing monitoring to outsourcing and reliance. Picture two electronic money institutions (illustrative) with the same app, one in Istanbul and one in Dublin. The Istanbul firm has 10 business days to report a suspicion. It keeps identity records for eight years. Once the AMLR applies, the Dublin firm reports "promptly" and keeps records for five.
| Duty | EU (AMLR, from 10 July 2027) | UK (MLR 2017; in force, November 2026) | US (BSA rules; in force, November 2026) | Türkiye (RoM; in force, November 2026) | UAE (CR 134; in force, November 2026) |
|---|---|---|---|---|---|
| CDD trigger | Every relationship; occasional transactions of €10,000 or more, linked ones counted together; occasional transfers of funds of €1,000 or more; any suspicion (art. 19(1), (2)) | Every relationship; occasional transfers of funds above £800; occasional transactions of £12,000 or more; any suspicion (reg. 27(1), (2)) | Identifying information before an account opens; verification within a reasonable time after it opens (31 CFR 1020.220(a)(2)) | Every relationship; transactions of 370,000 TL or more and electronic transfers of 30,000 TL or more, linked ones counted together (art. 5(1), as amended 7 October 2026) | Every relationship (art. 7(1)); occasional transactions from AED 55,000; occasional wire transfers from AED 3,500 (CR 134 art. 7(2)) |
| Remote identification | eID at eIDAS level "substantial" or "high" (art. 22(6)(b)); liveness checks on unattended flows (EBA/GL/2022/15 para 41(c)) | Electronic identification counts as an independent source where the process is secure from fraud and misuse and gives the assurance needed that the person is who they claim to be (reg. 28(19)); non face to face business without such safeguards is a higher risk factor (reg. 33(6)(b)(iii)) | Mobile driver's licenses and other verifiable digital credentials under the CIP rule (FinCEN FAQs, 8 September 2026); TIN from a third party (FinCEN order, 27 June 2025) | Remote identification for a continuous relationship where the sector's law allows contracts without meeting (art. 6/A); for banks, a live video call and an ID chip check or, when the chip cannot be read, at least four visual security features and a first payment from the customer's own account at another bank (BDDK regulation arts. 6, 7) | CBUAE guidance on digital ID for customer due diligence (11 January 2023) |
| Beneficial owner | 25 percent or more, indirect stakes multiplied along the chain (art. 52(1)) | More than 25 percent, or control by other means (reg. 5(1)) | 25 percent or more, plus one person with significant responsibility to control (31 CFR 1010.230(d)) | More than 25 percent of shares; if none or in doubt, the person with ultimate control (art. 17/A(2), (3)) | 25 percent or more; if none or in doubt, the person who controls by other means (art. 10(1)) |
| PEPs | Senior management approval, source of wealth and funds, enhanced ongoing monitoring (art. 42(1)) | Senior management approval, source of wealth and funds, enhanced ongoing monitoring; domestic PEPs start from a lower risk (reg. 35(3A), (5)) | Senior foreign political figures' private banking accounts get enhanced scrutiny (31 CFR 1010.620(c)); otherwise risk based due diligence | For a foreign PEP, approval by a senior official, the source of assets and funds, and closer monitoring; for a domestic PEP when the relationship is rated high risk (MASAK General Communiqué No. 21 art. 4(3), (4), 17 November 2022) | Foreign PEPs: senior management approval, source of funds and wealth, enhanced monitoring; domestic PEPs too when the relationship is high risk (art. 16(1)) |
| Monitoring and refresh | Ongoing; customer data refreshed at least yearly for higher risk customers and at least every 5 years for the rest (art. 26(1), (2)) | Ongoing monitoring; documents and information kept up to date (reg. 28(11)) | Ongoing monitoring; customer information kept current on a risk basis (31 CFR 1020.210(a)(2)(v)) | Transactions checked against the customer's profile; records kept current (art. 19(1)) | Transactions scrutinized; documents kept up to date, high risk customers first (art. 8) |
| Suspicious transaction report | "Promptly", attempted transactions included; answers to FIU requests within 5 working days unless the FIU sets another deadline (art. 69(1)) | To the nominated officer or the NCA as soon as practicable (POCA s. 330(4)) | Banks: transactions involving or aggregating at least $5,000, within 30 calendar days of initial detection, up to 60 if no suspect is identified (31 CFR 1020.320(a)(2), (b)(3)); money services businesses: at least $2,000, within 30 calendar days (31 CFR 1022.320(a)(2), (b)(3)) | Within 10 business days of the suspicion (art. 28(2)) | Immediately and without delay, through the FIU's electronic system (art. 18(1)(a)) |
| Records | 5 years from the end of the relationship, the occasional transaction or a refusal (art. 77(3)) | 5 years from the end of the relationship or the occasional transaction; transaction records capped at 10 years (reg. 40(3), (4)) | 5 years (31 CFR 1010.430(d)) | 8 years; account identity records from the account's closing (art. 46(1)) | At least 5 years from the transaction or the end of the relationship (art. 25(1)) |
| Outsourcing and reliance | Supervisor notified before the provider starts; six tasks never outsourced; the firm stays "fully liable" (art. 18); reliance keeps "ultimate responsibility" (art. 48(1)) | The relying firm "remains liable" (reg. 39(1)); agents and outsourcers allowed where the arrangements keep it liable (reg. 39(7)) | Use of third parties "does not diminish" a bank's responsibility (2023 interagency guidance) | The relying financial institution bears final responsibility (art. 21(1)) | The relying firm stays responsible for the accuracy of the measures (art. 20(1)) |
Can a fintech onboard customers remotely?
In an unattended flow, no employee joins the session. For it, the EBA's remote onboarding guidelines, applied since 2 October 2023, say firms should take the photo or video while the customer verifies, run liveness detection and use strong algorithms to match the face to the ID document (para 41).
eKYC is allowed in all five markets, on conditions. The AMLR accepts eID at eIDAS level "substantial" or "high" (art. 22(6)(b)); the UK accepts an electronic identification process that is secure from fraud and misuse and gives the assurance needed that the person is who they claim to be (MLR reg. 28(19)).
In the US, FinCEN's FAQs of 8 September 2026 cover mobile driver's licenses and other verifiable digital credentials under the CIP rule, and a FinCEN order of 27 June 2025 lets banks under the OCC, FDIC and NCUA obtain a customer's TIN from a third party. Türkiye allows remote identification where the sector's law allows contracts without meeting (RoM art. 6/A). Since 7 October 2026, a financial institution may skip the specimen signature on a known customer's later face to face transactions verified through its internet or mobile channels or a one time SMS code to an already verified number, if the check fits the transaction's nature and risk, gives enough assurance that the customer is the one identified before and guards against use by unauthorized persons (art. 16(1)).
Who carries the AML duty when a fintech outsources or runs on BaaS?
The licensed firm, in every market. From 10 July 2027, an obliged entity may outsource tasks once it has notified its supervisor, but it "shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks" (AMLR art. 18(1), (2)).
Six tasks may not be outsourced (art. 18(3)): proposing and approving the business wide risk assessment; approving policies, procedures and controls; deciding a customer's risk profile; deciding to take on a customer or an occasional transaction; reporting suspicions and threshold based reports to the FIU, unless to another obliged entity of the group in the same Member State; and approving the criteria that detect suspicious or unusual transactions. Only some collective investment undertakings may outsource three of them, with the supervisor's approval (art. 18(7)). The firm checks the provider is qualified, signs a written agreement and runs regular controls (art. 18(4)).
Reliance works differently. FATF's interpretive note to R.17 says the reliance rule "does not apply to outsourcing or agency relationships": a relied upon firm usually has its own relationship with the customer and applies its own procedures, while an outsourced provider applies yours, under your control. Under reliance, "ultimate responsibility" for due diligence stays with the relying firm (AMLR art. 48(1)). In the UK the relying firm "remains liable" (MLR reg. 39(1)), and agents and outsourcers are allowed where the arrangements keep it liable (reg. 39(7)). Türkiye and the UAE take the same line (RoM art. 21(1); CR 134 art. 20(1)). US agencies wrote in their 2023 interagency guidance on third party relationships that a bank's use of third parties "does not diminish its responsibility to meet these requirements".
| Stage in a white label or BaaS flow (AMLR, from 10 July 2027) | Who may perform it | Who decides | Who is liable |
|---|---|---|---|
| Business wide risk assessment | The licensed firm, which proposes and approves it (art. 18(3)(a)) | The licensed firm | The licensed firm |
| Policies, procedures and controls | A provider may help draft them | The licensed firm approves them (art. 18(3)(b)) | The licensed firm |
| ID capture and verification | BaaS partner or onboarding vendor, under the firm's procedures (art. 18(4)) | The licensed firm sets the procedure | The licensed firm (art. 18(2)) |
| Customer risk rating | A vendor's scoring may assist | The licensed firm (art. 18(3)(c)) | The licensed firm |
| Accept or decline the customer | The partner's app shows the result | The licensed firm (art. 18(3)(d)) | The licensed firm |
| Detection rules and thresholds | A vendor may propose and run them | The licensed firm approves the criteria (art. 18(3)(f)) | The licensed firm |
| Alert review | The firm's analysts, or a provider under the firm's procedures (art. 18(4)) | The licensed firm decides what goes to the FIU (art. 18(3)(e)) | The licensed firm |
| Suspicious activity report to the FIU | The licensed firm, or another obliged entity of its group in the same Member State | The licensed firm (art. 18(3)(e)) | The licensed firm |
What must a US partner bank do about its fintech partners?
On 14 June 2024 the Federal Reserve took an enforcement action against Evolve Bank & Trust, which "partners with various financial technology companies" that give end customers access to banking products. Examinations in 2023 found no effective risk management framework for those partnerships and AML controls that fell short. The action requires oversight and monitoring of current fintech partnerships, including better recordkeeping.
The 2023 guidance describes a relationship life cycle of planning, due diligence and third party selection, contract negotiation, ongoing monitoring and termination, with oversight, independent reviews and documentation across it. On 15 September 2026 the OCC, the Federal Reserve, the FDIC and the NCUA proposed new guidance on third party risk management. It would tie oversight to the assessed risk of each relationship, and the agencies plan to rescind the existing guidance in its favor. Comments close on 16 November 2026.
What have supervisors fined fintechs for since 2024?
| Date | Regulator | Firm | Outcome | Main failure |
|---|---|---|---|---|
| 21 May 2024 | BaFin (Germany) | N26 Bank | €9.2 million | Suspicious transaction reports filed late, systematically, in 2022 |
| 14 June 2024 | Federal Reserve (US) | Evolve Bank & Trust | Enforcement action | Risk management of fintech partnerships; AML program |
| 2 October 2024 | FCA (UK) | Starling Bank | £28,959,426 | Screening against a fraction of the sanctions list; accounts for 49,000 high risk customers (over 54,000 accounts) opened in breach of a restriction, September 2021 to November 2023 |
| 11 December 2024 | FI (Sweden) | Klarna Bank | SEK 500 million and a remark | General risk assessment; due diligence procedures |
| 15 January 2025 | 48 state regulators (US) | Block, Inc. (Cash App) | $80 million | BSA and AML violations |
| 20 February 2025 | OCC (US) | Patriot Bank | Formal agreement | BSA and AML risk management; payment activities oversight |
| 8 July 2025 | FCA (UK) | Monzo Bank | £21,091,300 | Onboarding, customer risk assessment and transaction monitoring, October 2018 to August 2020; over 34,000 high risk customers signed up despite a restriction |
| 16 October 2025 | FI (Sweden) | Zimpler | SEK 3 million and a remark | Risk assessment of one service; customer risk assessment; purpose of the relationship |
| 6 March 2026 | Bank of Lithuania (Lithuania) | Paytend Europe | License revoked, no services from 3 March 2026 | Alerts not analyzed in time; no suspicious transaction reports despite indicators |
Starling grew from about 43,000 customers in 2017 to 3.6 million in 2023, while its automated screening checked only a fraction of the full sanctions list from 2017 until January 2023. The FCA had already found serious concerns with Starling's AML and sanctions framework in its 2021 review of challenger banks. Türkiye and the UAE have no row: the MASAK decisions and CBUAE releases read for this guide name no fintech since 2024.
Which fintech AML dates matter in 2025, 2026 and 2027?
- 28 July 2025: The EBA publishes its 2025 Opinion.
- 14 December 2025: CR 134, the executive regulations of Federal Decree by Law No. 10 of 2025, takes effect.
- 1 January 2026: AMLA takes over the EBA's AML/CFT mandates.
- 8 April 2026: The FCA publishes its findings on firms' CDD processes and controls.
- June 2026: New FATF Recommendations edition.
- 30 June 2026: UK amendments to the MLR take effect (S.I. 2026/621).
- 15 September 2026: US banking agencies propose new third party risk guidance, with comments open until 16 November.
- 23 September 2026: FCA mule review.
- 7 October 2026: Türkiye raises its identification lines to 370,000 TL and 30,000 TL and lets SMS code verification replace the specimen signature on later face to face transactions (RoM arts. 5(1), 16(1)).
Next: on 10 July 2027 the AMLR applies, and AMLA's reliance guidelines, remote customer due diligence included, are due (art. 50). Direct AMLA supervision starts in 2028.
Which controls go on a fintech AML program checklist?
Thirteen controls follow, each tied to the rule a supervisor will cite, and the PDF turns the outsourcing and partner bank lines into working templates.
| Control | Why | Source |
|---|---|---|
| Assess each new product's risk before launch | The assessment comes before the launch | FATF R.15; MLR reg. 19(4)(c); CR 134 art. 24(2); RoM art. 20(1) |
| List every outsourced task and notify the supervisor before a provider starts | The supervisor must know who does what | AMLR art. 18(1) |
| Name an owner inside the firm for each of the six art. 18(3) decisions | These tasks cannot leave the firm | AMLR art. 18(3) |
| Sign a written agreement with each provider and run regular controls on it | The provider must apply the firm's procedures | AMLR art. 18(4) |
| Assess the remote onboarding tool; capture photo or video during the session and run liveness checks on unattended flows | The guidelines expect both on unattended flows | EBA/GL/2022/15 para 41(b), (c) |
| Accept eID only at "substantial" or "high" | Only these levels count as a means of verification | AMLR art. 22(6)(b) |
| Rely only on regulated third parties that hand over identification data immediately on request | Responsibility stays with the relying firm | FATF R.17; MLR reg. 39(2), (3); CR 134 art. 20(1) |
| Run the partner bank life cycle: planning, due diligence, contract, monitoring, termination | US agencies describe each stage | 2023 interagency guidance |
| Match alert staffing to alert volume | Staff were often too few for the alerts | EBA Opinion 2025, para 33 |
| Test screening end to end against the full list | Starling screened against a fraction for years | FCA, 2 October 2024 |
| Honor and evidence any restriction on high risk onboarding | Starling and Monzo both breached one | FCA, 2 October 2024 and 8 July 2025 |
| Refresh customer data at least every year for higher risk and every 5 years for others | The AMLR caps the gap | AMLR art. 26(2) |
| Set the report clock and record period per market | They run from "promptly" to 30 days and from 5 to 8 years | Obligations table above |
Where does AML software sit in a fintech program?
Picture an electronic money institution (illustrative) that onboards through a partner's app. From 10 July 2027, art. 18 leaves it the risk profile, the onboarding decision, the detection criteria and the report, so its systems must show it made them.
On complead, formerly Sanction Scanner, client screening and ongoing monitoring logs who ran each search, what they searched, when, and the result, even a search with no match. A fuzzy matching threshold can be set for each list type and, where needed, for each list. An API call starts or stops ongoing monitoring for each name. Every name it checks meets 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Payment screening screens both parties to a transfer, sender and receiver, through the API while it is processed. For a corporate customer, KYB and UBO verification traces owners upward through each parent until it reaches individuals, and marks a layer it cannot resolve as unresolved.
In transaction monitoring, the firm writes rules without code and backtests them on 30, 60 or 90 days of history before approving them, the art. 18(3)(f) decision. Agents resolve the routine cases and file the evidence, a narrative and the work log with each, leave the rest to an analyst, and the record names who decided. The fintech solution puts onboarding, screening and monitoring on one engine, so each customer is scored once across them, not tool by tool.
Before 10 July 2027, put a name beside each of the six tasks in AMLR art. 18(3): who in your firm proposes and approves the risk assessment, approves the policies, sets the customer risk profile, takes the onboarding decision, files the report to the FIU and approves the detection criteria. A name that belongs to a partner or a vendor marks a task the AMLR bars from outsourcing, unless it is the report and the name sits in another obliged entity of the group in the same Member State.
What the 2026 PDF adds. Nothing above sits behind the form, and every legal line on this page was read in the official text on 4 November 2026. The PDF turns four parts of the guide into working files: an outsourcing register with the six art. 18(3) tasks kept in house, a partner bank oversight calendar, a test sheet for a remote onboarding flow and a report clock card for the five markets.
