The FCRisk Financial Crime Control Failure Framework.
A back-tested analytical model for understanding where Financial Crime controls fail — and how failures propagate across scope, data, technology, decisions, governance and remediation.
Eight lenses for understanding how Financial Crime controls fail.
The framework is not a regulatory standard and it is not a rigid process flow. It is an FCRisk analytical model for locating failure across the complete Financial Crime control chain.
It has been back-tested against the 25 reconstructed enforcement actions in the private Control Failure Knowledge Matrix. Each case can map to several lenses, but the framework asks where the primary failure sits and which dependencies allowed it to become consequential.
Back-test conclusion
All 25 reconstructed actions mapped defensibly to one or more of the eight lenses. No ninth failure category was required.
Important: this is an analytical fit test within a selected evidence set. It is not a claim that these cases represent the prevalence of failure across the industry.
From risk definition to sustainable remediation.
Risk & Scope
Failure to identify, assess or include the relevant risk, customer, product, channel, geography or exposure in the control architecture.
Population & Boundary
Failure of relevant customers, accounts, transactions, events or external reference populations to enter the effective control perimeter.
Data & Context
Failure of information to be complete, correct, current, semantically accurate or usable for the control decision.
Design & Configuration
Failure of rules, scenarios, models, thresholds, matching logic or workflows to address the intended risk.
Operation & Capacity
Failure to operate the designed control consistently, timely or at sufficient scale, including staffing, backlogs and growth-driven capacity constraints.
Decision & Escalation
Failure to interpret outputs, investigate, decide, restrict, escalate, disclose or report appropriately.
Governance & Assurance
Failure of ownership, oversight, challenge, testing, MI, audit, verification or accountability to demonstrate and sustain effectiveness.
Remediation & Sustainability
Failure to remove the underlying cause, assess retrospective impact, evidence closure or maintain the fix after an issue is identified.
Different defects can produce the same failed outcome.
A functioning control can receive the wrong population.
Metro, Danske and Starling show why completeness of the effective control perimeter needs to be tested separately from the operation of the downstream system.
The record can arrive but still carry the wrong risk meaning.
NatWest and Santander illustrate how classification or missing customer context can change the control decision even when records are present.
Issue completion is not the same as risk removal.
UBS, Santander and GT Bank illustrate why remediation requires evidence that underlying weaknesses have been removed and remain removed.
Three propositions that follow from the evidence.
Primary-source anchors
The framework is derived from cross-case synthesis rather than any single regulator. Representative evidence includes FCA findings on Metro, HSBC, Monzo, Starling and Santander; FinCEN's UBS action; and AUSTRAC's Crown matter.
Cross-Case Failure Intelligence
See how the framework is used to synthesise recurring mechanisms across independent enforcement actions.
Control Failure Library
Trace the analytical lenses back to reconstructed case-specific regulatory findings.