Weak data undermines transformation

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoring

Exit & de-risking

The data exists. The usable risk intelligence doesn’t.

In May 2026, the FCA published its review of sanctions systems and controls across more than 150 firms. It found firms had materially improved since 2022, with repeated examples of strong controls in practice, but it also found third-party due diligence arrangements firms couldn’t properly evidence, screening configurations built on vendor defaults nobody had tested against their own risk, and reference data too stale to catch obfuscated or variant names.

Separate industry analysis of 22 FCA Final Notices between 2020 and 2025, together covering more than £430 million in fines, found that 68% featured data deficiencies as a material contributing factor: outdated or missing customer records, unverified beneficial owners, weak source-of-funds verification, and declarations that didn’t match public records. It lines up with what the FCA’s own review found directly.

The EU is building on the same assumption. The AMLR relies on central beneficial ownership registers, cross-border data exchange and harmonised data formats: mechanisms that only work if the underlying data can be trusted at source.

In practice, ownership of the data feeding a control rarely sits with one person end to end: the team that sources a customer record isn’t the team that relies on it months later, and neither has “keep this current” written into their job. A screening engine is only as good as the list it checks against, and a risk assessment is only as good as the record it assesses. When either goes stale, nobody notices, because staleness isn’t anyone’s problem to notice. The control built on top keeps looking like it’s working, right up until a review or enforcement case proves otherwise.

The control is only as good as what feeds it

Because no single control owns its own data supply, a data problem rarely announces itself directly. It surfaces sideways: a different control gets reviewed for an unrelated reason, and the root cause traces back to the data underneath. A remediation that follows often fixes the symptom the review was actually looking at, while the underlying data problem survives it and resurfaces somewhere else.

A control depends on three things going right, not one. The data has to be complete and current when it goes in. The system has to read and weigh it the way the firm believes it does. And the result, an alert, a score, a cleared file, has to reach someone able to interpret it and act. A gap at any one of those points can leave a control looking like it works when it doesn’t, and the three compound: incomplete ownership data means a screening engine can only ever assess the customer named, not the structure behind them; a configuration nobody has revisited since go-live can mean a genuine match never surfaces; a genuine alert can still be closed by an investigator who was never given the context to recognise what it meant. At every stage, the firm can reasonably say the system did what it was built to do. The control still failed.

The same compounding effect is why a data weakness rarely stays contained to one kind of problem.

A customer who looks unremarkable in isolation can look very different once ownership, geography and transaction behaviour are actually connected.

How we support you

We work across the full chain from data to decision, not just the data sitting underneath it.

Typical engagements include:

Defining what data a control actually needs and where it should come from

Assessing whether customer, transaction and watchlist data is complete, correctly linked, and fit for the controls that depend on it

Tracing a control failure back to its data root cause, rather than only fixing the visible symptom

Testing whether a system reads and weighs that data the way the firm believes it does, not only whether the data arrived

Making sure an alert or output reaches someone with the context to interpret it and act, so the resulting decision holds up to scrutiny

Building the technical uplift that keeps data ready on an ongoing basis, not remediated once and left to decay again

Where the underlying data is the root problem, we deploy our own tooling to fix it: Compass to keep country-risk data current and evidenced, and RegSight to keep obligations and reference data aligned to what the regulator expects, so the fix lands as a live capability, not another remediation the firm has to repeat in eighteen months.

See our full list of services

Our experience

A UK retail group

Why we were brought on: fraud data was inconsistent across its detection systems, undermining the models and rules built on top of it.

What we did: we standardised and enriched the fraud data across systems, then rebuilt the management information at both system and rule level.

Outcome: a measured reduction in fraud losses against baseline, with a second phase now under way targeting further savings from the same data foundation.

A UK retail bank

Why we were brought on: customer risk assessment data for a large population of files existed only in thousands of standalone spreadsheets, with no way to see the risk picture across them.

What we did: we built a data extraction engine and centralised database, starting with retail CRA files and scaling to non-personal files in a second phase, with dashboards showing risk distribution, risk-driver contribution and override patterns.

Outcome: a working, dashboarded CRA data asset in place of the disconnected spreadsheets it replaced.

A global corporate and institutional bank

Why we were brought on: internal name-screening watchlists were fragmented and manually maintained, with inconsistent data quality across a large population of records.

What we did: we built a governance framework for internal watchlist management, remediated around 15,000 records against it, and put management information, quality assurance and periodic review standards in place to keep the fix from decaying.

Outcome: 70% of records enhanced and a 37% reduction in matching hits on the remediated population, with the governance framework left in place to sustain it.

£16,675,200

FCA fine, November 2024

60m+

transactions bypassed monitoring entirely

£51bn+

in transaction value went unchecked

4.5 years

undetected, until the bank’s own review caught it

A recent industry example shows how far a data gap can travel before anyone catches it. In November 2024, the FCA fined a UK retail bank £16,675,200. From 2016, a data feed error in its automated transaction monitoring system meant that transactions made on the day an account was opened, and everything after until the record updated, bypassed monitoring entirely. Over 60 million transactions worth more than £51 billion went unchecked, a data completeness failure rather than a process failure, undetected for four and a half years until the bank’s own review caught it.