Introduction
Two enforcement actions in 2025 made the stakes clear. The FCA fined Monzo £21,091,300 in July for inadequate financial crime controls and a voluntary requirement breach that allowed 26,325 high-risk accounts to be opened between August 2020 and June 2022. Weeks earlier, the Bank of Lithuania fined Revolut Bank UAB €3.5 million after a planned inspection found persistent shortcomings in AML monitoring and suspicious transaction identification.
These aren't outliers. They're signals.
The features that make neobanks competitive — frictionless onboarding, cross-border access, real-time payments — are the same ones drawing the most regulatory scrutiny. What drew even more attention: the assumption that a sponsor bank's regulatory standing would cover a fintech partner is now firmly off the table.
Regulators in the US, UK, and EU expect neobanks to own their compliance programs independently.
This guide breaks down what's changed in 2025, what regulators now expect, where programs most often break down, and how to build compliance infrastructure that holds up at scale.
TL;DR
- The FCA fined Monzo £21M and Lithuania fined Revolut €3.5M in 2025 — growth-stage neobanks are now held to the same standards as large institutions
- Regulators across the US, UK, EU, and Canada hold neobanks directly accountable for AML, KYC, and transaction monitoring — sponsor banks are no longer a shield
- Core requirements include a written AML program, layered KYC, real-time sanctions screening, consumer protection disclosures, and proper licensing
- Fractional compliance leadership gives early-stage neobanks named CCO, BSA Officer, CAMLO, or MLRO credibility without a full-time executive hire
The 2025 Regulatory Landscape: What's Changing for Neobanks
The broad shift is this: regulators globally have moved from passive monitoring to active enforcement, and the gap between how traditional banks and neobanks are supervised is closing fast.
United States
The US regulatory picture for neobanks operating under BaaS models has grown more complex. Three developments define the current posture:
- FinCEN's July 2024 AML/CFT NPRM adds a formal risk-assessment process, pushing fintechs toward documented, risk-based programs rather than checkbox compliance.
- FDIC, Federal Reserve, and OCC joint statement (July 2024) confirmed that a bank's responsibility is not reduced by third-party arrangements — and that fintechs within those arrangements carry direct obligations through their MSB status, consumer protection duties, and sanctions requirements.
- CFPB's larger-participant rule for digital consumer payment apps was finalized in 2024, then repealed by Congress under the Congressional Review Act in 2025. The agency's broader Section 1024 supervisory authority over non-bank financial firms remains in force.
United Kingdom
The Monzo fine is the clearest signal of where UK supervision is heading. The FCA's action covered control failures between 2018 and 2022, with enforcement landing in July 2025 — demonstrating that historical gaps carry present-day consequences.
Growth-stage neobanks should not assume their scale provides any buffer from FCA scrutiny. Regardless of customer count, the FCA expects:
- Robust transaction monitoring with documented methodology
- Sanctions screening with complete audit trails
- Evidence of ongoing control effectiveness, not just initial program setup
European Union
Under Regulation (EU) 2024/1624, electronic money institutions and payment institutions are classified as obliged entities subject to the full EU AML/CFT framework. AMLD6 establishes criminal liability for legal persons where AML failures occur, and PSD2 remains the core payment services directive. The EU's open finance framework (FIDA) is still developing but will expand data-access obligations for payment institutions.
Canada
Neobanks operating as money services businesses must register with FINTRAC and comply with PCMLTFA obligations, including client identification, ongoing monitoring, beneficial ownership, and PEP/HIO requirements. A formal compliance program with a designated compliance officer is mandatory. Neobanks working through Canadian federally regulated financial institution partnerships should also account for OSFI's Guideline B-10 on third-party risk management.
Core Compliance Requirements Every Neobank Must Meet
AML Program and Transaction Monitoring
Every neobank must maintain a written AML program with four core elements:
- Internal controls tailored to the business model and risk profile
- A designated compliance officer (BSA Officer in the US, CAMLO in Canada, MLRO in the UK/EU)
- Ongoing staff training
- Independent testing and review
Transaction monitoring can't be a generic bank ruleset applied wholesale. Rules must reflect the neobank's actual customer base, transaction types, and geographic exposure. Thresholds, triggers, and escalation paths need documented review cycles — quarterly at minimum — not a one-time configuration left to run indefinitely.
KYC and Customer Due Diligence
KYC is layered and continuous, not a one-time onboarding check. A functional framework includes:
- Identity verification at onboarding (document checks, biometric verification)
- Risk scoring to segment customers by risk level
- Beneficial ownership verification for business accounts (25% ownership threshold under US FinCEN rules, with a control-prong individual)
- Enhanced due diligence (EDD) for PEPs, high-volume cross-border clients, and money service businesses
- Ongoing monitoring to detect changes in customer behavior or risk profile
Sanctions Screening
Sanctions screening must cover customers, beneficiaries, and counterparties — not just account holders. Standard watchlists to cover include:
- OFAC SDN List (US)
- HMT Consolidated List (UK)
- EU Consolidated Sanctions List
- UN Security Council Sanctions List
Static or infrequently updated screening consistently ranks among the most cited enforcement triggers. Dynamic screening integrated directly into payment flows is the standard — a periodic manual review won't satisfy regulators.
Consumer Protection and Licensing
Sanctions and AML obligations address financial crime risk. Consumer protection rules address a different but equally enforced category: how neobanks treat their customers. Regulation E (US), FCA Consumer Duty (UK), and EU equivalents all require clear disclosure of fees, overdraft policies, and deposit insurance status. The CFPB has issued seven-figure penalties for Reg E violations; the FCA's Consumer Duty framework, effective since July 2023, gives UK regulators direct grounds to act on buried fee structures and misleading marketing.
Licensing requirements vary by jurisdiction and business model:
| Jurisdiction | License Type | Key Requirement |
|---|---|---|
| United States | Money Transmitter License (state-by-state) | Named compliance officer, written AML program |
| European Union | EMI or Payment Institution License | AML obliged entity status under EU 2024/1624 |
| United Kingdom | EMI or Authorised Payment Institution | FCA authorization, MLRO designation |
| Canada | MSB Registration (FINTRAC) | Compliance officer, risk assessment, two-year review |
The Biggest Compliance Challenges Neobanks Face in 2025
Scaling Faster Than Compliance Infrastructure
The most consistent enforcement pattern is straightforward: a neobank grows its customer base rapidly, KYC checks degrade under volume pressure, and transaction monitoring falls behind. McKinsey data shows that traditional rules-based AML systems generate false-positive rates above 90% — an alert fatigue problem that sharpens as transaction volumes scale.
Advanced analytics can cut that rate below 50%, with ML reducing false reports by 20–30%. Those gains only matter if the underlying compliance infrastructure is built to absorb volume growth in the first place.
The Monzo fine illustrates this precisely: the FCA cited weak onboarding and risk assessment during a period of rapid growth. Compliance infrastructure that doesn't scale alongside customer growth creates the exact gaps regulators look for.
BaaS Model Ownership Confusion
Many neobanks still operate under the assumption that their sponsor bank's compliance framework covers them. It doesn't.
The division of responsibility looks like this:
- Sponsor bank: Holds the charter, maintains regulatory standing, remains responsible for legal compliance at the institutional level
- Neobank: Must maintain its own internal AML policies, manage onboarding controls, conduct independent monitoring, and support regulatory audits
The July 2024 joint agency statement was explicit: bank responsibility isn't reduced by third-party arrangements. It also placed clear expectations on fintechs to document their own controls, not simply rely on contractual pass-through protections.
Cross-Jurisdictional Regulatory Fragmentation
Neobanks operating across the US, UK, EU, and Canada face materially different reporting obligations. For example:
- US MSBs must file SARs for suspicious transactions of $2,000 or more within 30 calendar days (up to 60 if no suspect is identified), reporting to FinCEN
- EU obliged entities report to national FIUs with no fixed minimum amount, and promptly after suspicion arises — not on a calendar deadline
Compliance frameworks built for one jurisdiction routinely create critical gaps in others. Building cross-jurisdictional coverage from the start means mapping each jurisdiction's trigger thresholds, reporting timelines, and FIU destinations before onboarding customers — not after enforcement attention arrives.
Third-Party and Vendor Risk
Neobanks rely heavily on external KYC vendors, payment processors, card networks, and cloud infrastructure — and regulators now expect documented vendor oversight, not contract clauses alone.
The FDIC's 2024 custodial account proposal specifically addressed beneficial owner recordkeeping where third parties maintain records. It requires:
- Documented controls over third-party record access
- Reconciliation procedures for custodial account data
- Demonstrable ability to retrieve records during a regulatory audit
A vendor's compliance failure can become a neobank's enforcement exposure. Documented oversight isn't a best practice — it's what examiners will ask to see first.
Strategies to Build a Resilient Neobank Compliance Framework
Embed Compliance Into Product Design
The neobanks with the strongest regulatory standing build compliance into product design from the start — not as a retrofit. That means:
- Conducting risk assessments before new features are built
- Including compliance sign-off in product launch criteria
- Integrating KYC and sanctions screening directly into onboarding flows from day one
Retrofitting controls after scaling is expensive and creates exactly the kind of control gaps that FCA and FinCEN enforcement actions describe. One Series A neobank that worked with Fraxtional noted: "We used Fraxtional to rewrite our entire AML stack before a funding round. Our investors were impressed with how ready we were."
Adopt a Risk-Based, Tiered Approach
Applying uniform compliance checks to every customer wastes resources and creates operational bottlenecks. A tiered framework assigns scrutiny based on:
- Customer profile and account type
- Transaction volume and frequency
- Geographic risk exposure
- Behavioral signals that indicate elevated risk
Low-risk customers move through streamlined onboarding. High-risk segments — PEPs, cross-border MSBs, high-volume business accounts — receive enhanced due diligence. This approach aligns with FATF guidance, and auditors respond well to it precisely because it shows documented, proportionate decision-making rather than one-size-fits-all controls.
Invest in RegTech for Scalable Monitoring
Regulatory expectations in 2025 have shifted toward demonstrable real-time controls, not just documented policies. A Bank of England/FCA 2024 survey found 75% of financial services firms already use AI, with AML and fraud among the highest-priority use cases.
The tools driving this shift let compliance teams handle higher transaction volumes without adding headcount at the same rate:
- AI-driven transaction monitoring — flags suspicious patterns in real time, cutting manual review queues
- Automated sanctions screening — applies OFAC, UN, and EU lists at the point of onboarding and transaction
- Integrated case management — connects alerts to investigation workflows and SAR filing in one system
- Real-time alert prioritization — reduces false positive rates so analysts focus on genuine risk
Fraxtional helps neobanks assess which of these tools fit their transaction volumes and business model, then validates that monitoring thresholds and escalation workflows align with regulatory expectations before go-live.
Building a Compliance Function Without a Full-Time Hire
For seed-stage and Series A neobanks, the compliance leadership gap is real. Sponsor banks, regulators, and investors increasingly require a named, qualified compliance officer before approving partnerships or completing due diligence. But a full-time CCO, BSA Officer, or CAMLO carries significant cost that early-stage neobanks often can't yet justify.
The risk of under-resourcing compliance at this stage, though, is higher than the cost of getting it right.
Fractional compliance leadership gives neobanks a named, accountable officer — embedded with the team, responsible to regulators — without the overhead of a full-time executive hire.
Fraxtional offers two engagement paths for this: Fractional Advisory places a dedicated Director in the named role with full title use, while Subscription Advisory provides senior oversight on retainer for teams that don't yet need a fully embedded leader. Both models cover CCO, BSA Officer, CAMLO, and MLRO placements across the US, UK, EU, and Canada.
Sponsor banks evaluating fintech partners look for specific evidence of compliance maturity: named officers, documented AML programs, and demonstrable controls. One Series B fintech CEO who worked with Fraxtional put it plainly: "Fraxtional delivered a Director that supported us in discussions with a new sponsor bank and other key stakeholders in our business." A crypto lending client added: "Our sponsor bank required us to appoint a BSA Officer. Fraxtional came in, cleaned up our AML framework, and helped us pass review faster than we expected."
For early-stage neobanks, a fractional compliance officer doesn't just check a regulatory box. It's often the single hire — or near-hire — that determines whether a sponsor bank relationship moves forward at all.
Why Compliance Is a Competitive Advantage, Not a Cost
Neobanks with credible compliance programs gain commercial advantages that compliance-light competitors don't:
- Faster licensing approvals and smoother renewal cycles
- Stronger sponsor bank partnerships and payment network access
- More favorable investor due diligence outcomes
- Shorter paths to new product launches and geographic expansion
Brand trust compounds these commercial gains. In digital banking, switching costs are low and news about security failures or compliance lapses spreads fast. A strong compliance record — audit-ready controls, transparent fee structures, documented data practices — becomes part of the value proposition in a market where customer trust takes years to build and days to lose.
In 2025, regulators are watching neobanks more closely than ever. The firms that move first on compliance infrastructure aren't just avoiding enforcement — they're locking in partnerships, licenses, and investor confidence that slower-moving competitors will spend years trying to catch up on.
Frequently Asked Questions
Are neobanks regulated?
Yes. Neobanks operate under regulatory oversight primarily through the banks they partner with — which are directly supervised by the FDIC, FCA, or equivalent bodies — and increasingly through their own direct obligations as MSBs, payment institutions, or EMIs. In 2025, regulators in the US, UK, and EU expect neobanks to actively maintain their own compliance programs, not rely on their partner bank's standing.
What does ISO 20022 mean for neobanks?
The SWIFT MT/ISO 20022 coexistence period for cross-border payments ends in November 2025, and Fedwire completed its migration in July 2025. For neobanks, adopting this richer messaging standard improves AML screening accuracy by providing more detailed sender and receiver information — directly supporting sanctions screening and suspicious activity detection.
Do neobanks using a BaaS or sponsor bank model still need their own compliance program?
Yes — regulators place direct compliance responsibility on the neobank, not just the charter partner. A BaaS provider grants access to banking infrastructure, not a delegation of AML, KYC, or consumer protection obligations. Neobanks must maintain internal policies, monitor transactions, and support regulatory audits independently.
What are the biggest AML compliance risks for neobanks in 2025?
The leading risks in 2025:
- Scaling onboarding volumes faster than KYC and monitoring infrastructure can handle
- Operating across multiple jurisdictions with fragmented regulatory requirements
- Over-relying on third-party vendors without adequate oversight
- Treating transaction monitoring as a one-time setup rather than an ongoing function
How can an early-stage neobank build a compliance program without a full-time CCO?
Fractional compliance leadership — a part-time or advisory CCO, BSA Officer, or CAMLO — provides regulatory credibility and sponsor bank confidence without the full-time cost. The compliance program should be built in proportion to the neobank's transaction volume and risk profile, then scaled as the business grows.
What is the difference between a BSA Officer, CAMLO, and MLRO?
All three are jurisdiction-specific titles for the same core AML leadership role: BSA Officer (US, accountable to FinCEN), CAMLO (Canada, under PCMLTFA, working with FINTRAC), and MLRO (UK/EU, accountable to the FCA and national FIUs). The designation required depends on where the institution is licensed and operates.
