Legal, compliance and regulatory risk · RiskAtoms Academy

By the end you will be able to

1Tell legal, compliance and regulatory risk apart, and describe what the compliance function does as a second line.
2Decide whether a legal matter is a provision, a contingent liability or remote under IAS 37, and measure the provision.
3Rebuild a regulatory fine from the FCA's five-step penalty framework.
4Explain why legal and regulatory losses are booked years after the conduct that caused them.

Why it matters

In May 2016 RiskAtoms Bank began opening business accounts without the checks the money laundering rules require. Nobody noticed for 4.9 years. When it was found, in March 2021, the bank could say it would probably be fined but not by how much. It took another 842 days before the fine, £26.5m, could be booked. The accountants, the lawyers and the risk team all needed an answer to the same question in the meantime: what do we put in the accounts?

Core explanation

Three risks and one function

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025: 1,107 records of losses of £10,000 or more and near misses over 2016–2025 (£240.5m of net operational losses), an RCSA of 17 key risks and 29 controls, ten key risk indicators, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

The bank's legal category holds 24 losses over ten years, £1.66m net: settled contract claims and data protection compensation. The large legal outcomes sit with their causes: the AML fine under financial crime (£28.05m in all) and redress under conduct (L3.7.12: Conduct risk and customer outcomes).

Basel's definition of operational risk includes legal risk, and Basel has made clear that fines, penalties and punitive damages from regulatory actions count as legal risk. So every fine in this lesson is an operational loss, recorded under “clients, products and business practices”.

Three related risks

The compliance function

Compliance is a second-line function: it does not run the business, it sets standards, advises and checks. Under the UK Senior Managers and Certification Regime a bank names a senior manager for compliance oversight (SMF16) and a Money Laundering Reporting Officer (SMF17). Each year compliance runs a monitoring plan that tests whether the business follows the rules, and it tracks new rules coming.

Sort itWho does this?

Sort each activity to the line of defence it belongs to (L3.7.01).

A relationship manager collects ownership documents before opening a business account
Testing a sample of business account files against the due diligence standard
Deciding whether an investigator's suspicion goes to the National Crime Agency
Telling product teams what a new FCA rule will require and by when
Reporting to the audit committee on whether compliance monitoring is effective

The money laundering risk now scores 12 inherent and 6 residual (Medium): due diligence and transaction monitoring were rebuilt after the fine and both test effective. The customer data breach risk is the one legal risk still rated High (12 to 12): its data loss prevention control is only partly effective in operation, because the rules were not applied to a new file-sharing tool (finding F08).

Booking a legal matter: IAS 37

When a claim is open, the accounts must reflect it. IAS 37 asks two questions. Is an outflow probable, meaning more likely than not? And can the amount be estimated reliably? Yes to both: book a provision at the best estimate. Possible but not probable, or (in what IAS 37 calls extremely rare cases) not yet estimable: disclose a contingent liability in the notes. Remote: say nothing. IAS 37 sets no number for remote; the bank uses 5%.

The best estimate depends on the kind of matter. For a large population of similar claims it is the expected value. For a single obligation it may be the most likely outcome, adjusted if the other outcomes are mostly higher or mostly lower.

Extra for this lessonThe bank's legal register at 31 December 2025 (illustrative)

Six open matters, each with counsel's view of the outcomes. Provisions booked: £4.24m. Expected cost of all six: £11.67m. Disclosed as contingent liabilities: up to £14m.

Matter	P(pay)	Expected	IAS 37	Provision	Disclosed
LM1 Corporate client says it was mis-sold an interest rate hedge Counsel's view after disclosure of documents; settlement talks have started	80%	£3.22m	Provision	£2.50m	–
LM2 Customers whose letters went to the wrong address claim compensation 40,000 similar claims. A 2024 supplier mailing error; take-up and payout from the first 2,000 cases	100%	£1.50m	Provision	£1.50m	–
LM3 Former software supplier sues for early termination of its contract The contract allowed termination for poor service; the bank has the service records	30%	£1.20m	Contingent liability	–	£4.0m
LM4 Employment tribunal claims from branch closures 12 similar claims. Twelve similar claims, each roughly an even chance	100%	£0.24m	Provision	£0.24m	–
LM5 Regulator's review of how collections treated customers in difficulty Early stage: the scope and the period are not yet agreed, so no reliable estimate	55%	£5.50m	Contingent liability	–	£10.0m
LM6 Scam victim sues the bank as the receiving bank of the mule account Counsel sees little prospect of a duty to a non-customer on these facts	3%	£0.01m	Remote	–	–

The hedge claim (LM1) is the interesting one: its expected value is £3.225m but its provision is £2.5m, the settlement, because that is the single most likely result. The regulator's review (LM5) is more likely than not to cost money, but with the scope not yet agreed there is no reliable estimate, so it is disclosed, not booked.

The formal version

A matter has outcomes $x_1, \dots, x_n$ (cash paid) with probabilities $p_1, \dots, p_n$ :

\begin{aligned} E[X] &= \sum_i p_i\,x_i \qquad\qquad P(\text{outflow}) = \sum_{i:\,x_i>0} p_i \\ \text{treatment} &= \begin{cases} \text{provision} & P(\text{outflow}) > 0.5 \text{ and reliable estimate} \\ \text{contingent liability} & \text{otherwise, unless } P(\text{outflow}) \le 0.05 \\ \text{nothing} & P(\text{outflow}) \le 0.05 \end{cases} \\ \text{provision} &= \begin{cases} N\,p\,x & \text{large population (expected value)} \\ \text{most likely payment} & \text{single obligation} \end{cases} \end{aligned}

For the hedge claim:

\begin{aligned} E[X] &= 0.35 \times 6 + 0.45 \times 2.5 + 0.20 \times 0 = \text{£}3.225\text{m} \\ P(\text{outflow}) &= 0.35 + 0.45 = 0.80 > 0.5 \;\Rightarrow\; \text{provision at the most likely payment, £}2.5\text{m} \end{aligned}

The FCA's penalty (DEPP 6.5A) takes back the benefit $D$ , applies a seriousness level $\ell$ (0%, 5%, 10%, 15% or 20%) to relevant revenue $R$ , adjusts by $a$ for aggravating or mitigating factors, adds any deterrence uplift $U$ , and discounts by $s$ for settling:

\text{Penalty} = \underbrace{D}_{\text{step 1}} + (1 - s)\Big[\underbrace{\ell R}_{\text{step 2}}\,\underbrace{(1 + a)}_{\text{step 3}} + \underbrace{U}_{\text{step 4}}\Big]_{\text{step 5}}

Try it

Change counsel's view of the hedge claim. Watch the treatment switch at 50% and the provision jump, while the expected value moves smoothly.

Try itProvision, disclose or ignore? The hedge claim

Lose at trial (pay £6.0m)35%

Settle (pay £2.5m)45%

Reliable estimate?

Lose 35%Settle 45%Win 20%

P(the bank pays something)80%

IAS 37 treatmentProvision

Expected value£3.225m

Most likely outcomeSettle (45%)

Provision booked£2.5m

Disclosed in the notesnothing

Above 50% and estimable: a provision at the most likely payment (£2.5m to settle unless losing is likelier). Between the bank's remote line of 5% and 50%, or with no reliable estimate: a contingent liability, disclosed but not booked. At 5% or below: nothing. Notice how the provision jumps from zero to £2.5m as the chance of paying crosses 50%, while the expected value moves smoothly.

Worked example

The AML fine, from discovery to the accounts

Extra for this lessonThe steps behind the book's £26.5m (illustrative)

The book records the fine and its dates. The revenue, seriousness level and adjustment below are this lesson's reconstruction through the FCA's framework, chosen to give the book's figure.

Seven years from breach to booking

Step 1 of 5

1
May 2016 to March 2021: the breach runs
Business accounts are opened without checking who owns and controls the customer. Nothing is lost yet, so nothing reaches the loss data for 1,774 days.

Public dataA real case: Starling Bank, FCA Final Notice of 27 September 2024, published 2 October 2024

The FCA fined Starling £28,959,426 for financial crime failings, including screening payments against only a fraction of the sanctions list from 2017. Step 1 took back £959,426. Step 2 was level 4 (15%) of £1,119,042,195 of relevant revenue, £167,856,329, which the FCA reduced to £40,000,000 as disproportionate. Nothing changed at steps 3 and 4, and the 30% settlement discount gave £28,000,000. Total £28,959,426, or £40,959,426 without the discount.

What the legal and compliance teams note

A fine is the last link in a long chain: a control gap, years of exposure, an investigation, then a number. The number is set by revenue and seriousness, not by any money lost, so the cheapest time to manage it was 2016.

Regulatory lens

Enforcement in public. The FCA publishes Final Notices with the facts and the penalty steps, and the DEPP 6.5A framework is the same for every firm. That makes fines unusually easy to model, and their reputational cost hard to avoid.
Personal accountability. Under the Senior Managers and Certification Regime, named senior managers hold responsibility for compliance oversight (SMF16) and anti-money-laundering (SMF17), and can be sanctioned personally.
Data protection. The UK GDPR's higher maximum fine is the greater of £17.5m and 4% of annual worldwide turnover. The bank's data breach scenario puts a breach with its fine at once in 20 years, typically £12m and £100m in a severe case: £0.91m a year expected.
Accounts and capital. Provisions and contingent liabilities follow IAS 37. Fines and settlements are operational losses: they enter the loss data and, under the Basel standard, the loss component of capital (M4.4: Counterparty, operational and large exposures).

Spark Atoms

Spark AtomThe formula said £168 million

For Starling, 15% of relevant revenue came to £167,856,329. The FCA judged that disproportionate to the breach and used £40m instead. The framework allows this: step 2 is a starting point, not an answer.

Spark AtomFrom £183 million to £20 million

In July 2019 the Information Commissioner said it intended to fine British Airways £183.39m for a 2018 breach affecting more than 400,000 customers. The final penalty, in October 2020, was £20m. Most of the cut came from the ICO's reassessment after BA's representations and from mitigation; the pandemic's effect on the airline accounted for only £4m. A provision made on the first figure would have been nine times too large.

Key takeaways

Legal risk is claims and contracts, compliance risk is breaking existing rules, regulatory risk is the rules changing; fines and settlements are operational losses.
Compliance is a second line: it sets standards, advises, monitors and owns reporting decisions such as the MLRO's; the business owns the risk.
IAS 37: probable and estimable gives a provision; possible or not yet estimable gives a disclosed contingent liability; remote gives nothing.
The best estimate is the expected value for many similar claims and can be the most likely outcome for one (£2.5m against £3.22m for the hedge claim).
An FCA fine is benefit + (1 − discount) × [level × revenue × (1 + adjustment) + deterrence]; the book's £26.5m came 2,616 days after the breach began.

Reaction

Check what stuck

Question 1 · objective 2

A claim against the bank could be lost at trial (£8m, 30%), settled (£3m, 40%) or won (nothing, 30%). What is its expected value, in £m?

£m

Question 2 · objective 2

Under IAS 37, what provision does the bank book for that single claim, in £m?

£m

Question 3 · objective 2

2,000 customers have similar small claims. About 10% will be paid, at £5,000 each. What provision does the bank book, in £m?

£m

Question 4 · objective 3

A firm gained £1m from a breach. Relevant revenue was £100m, the breach is level 3 (10%), aggravating factors add 20%, and it settles early (30% off). What is the penalty, in £m?

£m

Question 5 · objective 2

A regulator has opened a review. The bank thinks it is more likely than not to pay something but cannot yet estimate how much. What does it do?

ABook a provision at the largest possible amountBBook a provision at zeroCDisclose a contingent liability in the notesDNothing until the regulator decides

Glossary

Legal risk: Legal risk: the risk of loss because a contract cannot be enforced, a claim is brought against the firm, or the firm is fined or ordered to pay for breaking the law.
Compliance risk: Compliance risk: the risk of legal or regulatory sanctions, financial loss or damage to reputation because the firm fails to comply with laws, rules and its own standards.
Regulatory risk: Regulatory risk: the risk that changes in laws or rules, or in how supervisors apply them, raise a firm's costs or limit its business.
Provision: Provision: a liability of uncertain timing or amount, booked on the balance sheet at the best estimate of what it will cost (IAS 37).
Contingent liability: Contingent liability: a possible obligation, or one that cannot be measured reliably, that is disclosed in the notes to the accounts but not booked.
Best estimate: Best estimate: the amount a firm would rationally pay to settle the obligation, or transfer it, at the balance sheet date (IAS 37).
DEPP 6.5A: DEPP 6.5A: the part of the FCA Handbook that sets out the five steps the FCA uses to set a financial penalty on a firm.
Final Notice: Final Notice: the FCA's published decision in an enforcement case, setting out the breaches, the facts and how the penalty was worked out.
MLRO (SMF17): MLRO (SMF17): the Money Laundering Reporting Officer, the senior manager responsible for a firm's anti-money-laundering systems, and the person who decides whether to report suspicions to the National Crime Agency.

Deep Dives & Origins

Deep Dives

IFRS Foundation, IAS 37 Provisions, Contingent Liabilities and Contingent Assets, paragraphs 14 to 40. Intermediate.
Financial Conduct Authority, Final Notice to Starling Bank Limited, 27 September 2024. Intermediate.

Origins

Australian Accounting Standards Board, AASB 137 Provisions, Contingent Liabilities and Contingent Assets (the IAS 37 text), paragraphs 36 to 40; IFRS Foundation, IAS 37 (bound volume text), paragraphs 14, 23, 25, 26, 28, 39 and 40.
Financial Conduct Authority, FCA fines Starling Bank £29m for failings in their financial crime systems and controls, press release, 2 October 2024, and Final Notice to Starling Bank Limited, 27 September 2024.
Birketts, ICO fines British Airways £20m for data breach, 19 October 2020; Lewis Silkin, BA's jumbo fine significantly reduced, 21 October 2020; nibusinessinfo.co.uk, GDPR penalties and fines.
FD Capital, SMF17 explained: the MLRO function in FCA-regulated firms, 2026; Risk.net, Regulatory fines moved into legal risk definition; Basel Committee, OPE10, paragraph 10.1, footnote 1.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.