Starling, the online bank that previously banned all crypto-related transactions, has been fined £29 million ($38.5 million) by the UK’s Financial Conduct Authority (FCA) for its “shockingly lax” sanction controls.

Starling banned crypto transactions in 2022, describing them as “high risk and heavily used for criminal purposes.” However, the FCA found today that Starling left the financial system “wide open to criminals and those subject to sanctions.”

In 2021, the watchdog raised “serious concerns” with Starling’s anti-money laundering and sanctions framework and the bank agreed not to open accounts for high-risk customers until it addressed these issues.

But despite this, the FCA found “Starling failed to comply and opened over 54,000 accounts for 49,000 high-risk customers between September 2021 and November 2023.”

Starling also discovered in January 2023 that for six years, its sanctions screening system had been screening only a small fraction of sanctioned individuals. Indeed, at one point, it failed to cross-check against 3,049 designated individuals.

Read more: Chase Bank tells UK crypto users to take their business elsewhere

A report of Starling’s Sanctions Screening Review also found it didn’t adequately assess its sanctions risk and failed to consider high-risk factors including “payments from crypto-related platforms and multicurrency accounts.”

Starling was initially handed a £41 million fine. However, the FCA allowed for a 30% discount since the bank agreed “to resolve these matters.”

The FCA claims Starling has “established programmes to remediate these breaches and to enhance its wider financial crime control framework.”