Starling Bank has been fined £29m by the City watchdog for “shockingly lax” financial crime controls that “left the financial system wide open to criminals and those subject to sanctions”.

The Financial Conduct Authority (FCA) said Starling, one of the UK’s most popular challenger banks, had expanded quickly but “measures to tackle financial crime did not keep pace with its growth”.

The online bank, founded in 2014 by the entrepreneur Anne Boden and backed by Goldman Sachs, has grown rapidly from 43,000 customers in 2017 to 3.6 million in 2023.

Banks are required by law to conduct rigorous checks on new customers to prevent fraud and money laundering, but the FCA’s review of financial crime controls at challenger banks in 2021 identified serious concerns with the anti-money laundering and sanctions framework at Starling.

The bank had agreed to a requirement restricting it from opening new accounts for high-risk customers until this improved, but failed to comply and opened more than 54,000 accounts for 49,183 high-risk customers between September 2021 and November 2023, the FCA said. Starling earned £900,000 in interest and fees from them.

In January 2023, the bank became aware that its automated screening system had, since 2017, only been screening customers against a fraction of the full list of those subject to financial sanctions.

An internal review found systemic issues in its financial sanctions framework, and the bank has since reported multiple potential breaches of financial sanctions to the relevant authorities.

Therese Chambers, an executive director at the FCA, said: “Starling’s financial sanction screening controls were shockingly lax. It left the financial system wide open to criminals and those subject to sanctions. It compounded this by failing to properly comply with FCA requirements it had agreed to, which were put in place to lower the risk of Starling facilitating financial crime.”

Starling said it “regrets and apologises” for its failings, and has paid the fine as a full and final settlement. It added that it had rescreened transactions and reviewed its customer accounts in depth, and introduced additional safeguards.

David Sproul, the bank’s chair, said: “I would like to apologise for the failings outlined by the FCA and to provide reassurance that we have invested heavily to put things right, including strengthening our board governance and capabilities.”

The FCA found that Starling’s financial crime risk control had not been updated correctly, resulting in 294 customers that had previously been ditched by the bank for financial crime reasons opening new accounts. Of these customers, 161 had been previously subject to a suspicious activity report, which alerts the authorities to potential instances of money laundering or terrorist financing, and 112 customers had either a full or partial match on the fraud prevention service Cifas.

The bank did not screen its customers against sanctions records for individuals from other countries, including the US, despite payments being made in dollars.

A raft of sanctions have been imposed by the UK, US and EU against various Russians since Moscow’s invasion of Ukraine in February 2022. However, Starling’s customers or prospective clients were only screened against sanctions records for individuals with UK citizenship or residency – accounting for 39 of the 3,088 people on the UK sanctions list.

This meant there was a “material risk” that Russians on the list would have been able to open or maintain accounts. Starling found that at least one person on the sanctions list had opened an account with the bank.

Starling took on an average of 15,000 new business customers a month during the Covid crisis. The bank was in 2022 accused by the former minister Theodore Agnew of failing to properly review borrowers before handing out taxpayer-backed loans. Boden rejected the comments and said she was “shocked” by them.

Starling’s founder stepped down as chief executive in May last year in a surprise move, to shield the online bank from potential concerns over a conflict of interest because she was a major shareholder. She quit as a non-executive director in June to run her venture AI by Boden but retains a stake of less than 5% in Starling.

The bank has talked about its intention to float on the stock market, but Boden said last year that plans had been paused amid depressed interest in the financial markets.

The fine would have been nearly £41m but the FCA said that, as Starling had “agreed to resolve these matters”, it qualified for a 30% discount under its processes.