Overseas banks in the UK: Governance, culture and risk

Overseas banks operating in the UK often look robust on paper. They have global policies, established reporting lines, central technology, and experienced headquarters teams. But that does not always translate into good outcomes in the UK. When things go wrong, the problem rarely points to the absence of a framework. It is more often the gap between what the UK business is formally responsible for and what it is practically able, or culturally willing, to challenge.

The UK model expects firms to exercise judgement, escalate issues early, challenge evidence, and maintain clear local accountability. The FCA has made clear that overseas firms must continue to meet UK standards once authorised, and that structures which create a higher risk of harm will attract closer attention. This is important for overseas banks because many enforcement issues begin as unresolved tensions in governance, language, authority and reliance on head office.

The most common tensions in overseas banks are easy to identify; they are visible in the gap between:

• principles-based judgement and rules-based approval;
• speak up and hierarchy;
• local accountability and central control;
• direct and indirect communication; and
• transparency and saving face.

These gaps determine whether concerns are raised early, whether challenge is taken seriously, and whether the UK business can act before a weakness becomes a regulatory issue. Whether the UK business can make good decisions when there is uncertainty, time pressure, incomplete information or disagreement with head office determines how quickly culture becomes a risk issue.

Where overseas banks get caught out

Why reliance on group technology can create risk

Firms often assume that a global system is stronger. Sometimes it may be. However, reliance on group technology can become a weakness if the system is not built for the UK market and its associated risks, not calibrated to UK regulatory obligations, or not properly overseen locally. The FCA has repeatedly shown that technology dependence is not a defence. Local entities remain responsible for the outcome as they would if the activity were outsourced to a third-party.^[1]https://www.fca.org.uk/publications/our-approach-international-firms

The TSB enforcement is a useful reminder of the risks of importing group technology. The FCA found serious failings in TSB’s migration to Sabadell’s Proteo technology platform. Sabadell had experience with its existing Spanish platform, but the UK version was being newly built, had not yet been proven in the UK market, and involved major dependencies on group build and delivery. The FCA concluded that the programme was inadequately managed and caused significant detriment to some customers when the migration failed.^[2]Final Notice 2022: TSB Bank plc

The same issue arises in financial crime controls. In its 2026 sanctions systems and controls thematic findings^[3]Sanctions systems and controls in our firms: our findings | FCA: Poor practice – Firms relying on group entities to provide sanctions risk compliance services, with limited oversight of these … Continue reading, the FCA said some firms remain reliant on group arrangements that are not aligned with the UK sanctions regime and are not able to provide senior management with sufficient information about their UK exposure. The FCA has been banging the same drum for some time now: in 2023, in relation to relying on group sanctions frameworks that did not properly reflect UK requirements^[4]Sanctions systems and controls: firms’ response to increased sanctions due to Russia’s invasion of Ukraine | FCA and in 2021, in relation to the ownership of key controls for UK-regulated branches and subsidiaries by group or Head Office functions^[5]Dear CEO Letter: (Retail Banks portfolio only) common control failings identified in anti-money laundering frameworks in retail banks (2021).

For overseas banks, the lesson is straightforward. Group tools are not enough without UK comprehension, UK calibration, UK management information, and UK oversight.

Why issues fail to escalate early

Issues are not necessarily hidden, but they are softened, held back, or routed through too many layers before reaching the people who need to act. This is a predictable outcome in firms where hierarchy is strong, challenge is culturally sensitive, or local teams feel they need informal approval from elsewhere before saying anything.

The FCA’s enforcement work shows the cost of delay. The FCA found long-standing weaknesses in Commerzbank AG, London Branch’s AML systems and controls, including overdue periodic due diligence on a large number of clients and significant flaws in the automated transaction monitoring tool. In 2015, the branch identified that 40 high-risk countries were missing from the tool and that 1,110 high-risk clients had not been added, yet the weaknesses persisted. The FCA’s point was not only that the controls were poor, but that the firm failed to take reasonable and effective steps to fix known issues despite repeated warnings.^[6]Final Notice 2020: Commerzbank AG

That pattern is familiar in overseas banks. Problems are discussed, socialised, revisited, and escalated again. What is often missing is ownership, urgency and a clear route to a decision.

Challenge is present in theory, but constrained in practice

Most banks will say they welcome challenge. The more important question is what challenge looks like in real meetings, real committees and real decisions. In mixed cultural environments, hierarchy and seniority can easily outweigh expertise. Direct challenge may be seen as disrespectful. Dissent may be expressed indirectly or not at all. That creates a control weakness which is rarely visible in formal governance maps but often obvious in outcomes.

The Canara Bank^[7]Final notice 2018: Canara Bank enforcement demonstrates the consequences of senior management and oversight committees routinely accepting internal assurances about the effectiveness of systems and controls without challenge. This is an example of where the real question is not whether there was a process for assurance, but whether the oversight of the process carried enough challenge and follow-through to stop the problem earlier.

In overseas banks, this issue is often compounded by the meeting dynamic itself. If the effective authority sits offshore, if English is not the first language of key decision makers, or if disagreement is expressed indirectly, control functions can struggle to land difficult messages with the force the UK regime expects. The risk is that challenge exists in the governance structure, but not with enough weight to change the outcome.

Local accountability is weakened by informal offshore influence

Another recurring problem is the gap between formal accountability and real authority. On paper, UK branches and subsidiaries may have clear local responsibility through the management responsibilities map^[8]FCA Handbook – SYSC 25.2 Management responsibilities maps: Main rules. In practice, decisions may be heavily influenced or informally controlled by Head Office. The result is that local management can end up accountable without being fully empowered.

The regulator will assess how overseas firms meet minimum standards in practice and will consider situations where overseas structures create higher risks of harm. That includes questions about how the UK business is governed, how local decision-making works, and whether risks created by wider group arrangements are adequately mitigated.

This is especially acute where there is a branch model, strong centralisation, or a short-term expat rotation model. If the real decision maker is elsewhere, or if local teams are waiting for offshore comfort before acting, the UK entity can become too slow, too cautious, or too unclear about ownership. That is the point at which structure becomes a conduct and control issue.

What overseas banks should do differently

Another broad culture programme or staff survey may be of limited use. What’s required is a more disciplined look at where the operating model breaks down in practice, starting with a few hard questions first:

• Can the UK business explain and evidence where it has exercised local judgement or pushed back on head office requests that do not align with UK requirements?
• Can it show real challenge in papers, minutes, decisions and action tracking, rather than assuming it happens because governance committees exist?
• Are Risk, Compliance and Internal Audit listened to and their findings acted on in a timely manner, including by group stakeholders?
• Are group technology solutions, sanctions tools and monitoring systems calibrated to UK obligations and tested for UK effectiveness?
• If the bank uses an expat or rotation model, can it demonstrate that incoming leaders understand UK regulatory expectations around culture, challenge, accountability and escalation from the outset?

The practical interventions are usually quite specific. Firms need clearer onboarding for expats and secondees. They need explicit role descriptions that set out UK expectations around challenge and accountability. They need a better defined early response to emerging issues so that problems are surfaced in the first 48 hours rather than after a cycle of internal comfort seeking. They need issue logs that show progress, ageing and dependency on group entities, not just action lists. And they need someone who can act as a cultural translator between head office and the UK business, not as a language interpreter, but as someone who can explain why the UK regulatory model requires different behaviours in practice.

The point is to move the discussion from culture as a broad theme to culture as an operating risk: who can decide, who can challenge, who can escalate, and how quickly the UK business can act when the answer from Head Office is uncomfortable.

Firms should also be cautious about over-reliance on staff surveys as a measure of culture. Surveys can help identify themes, but they do not demonstrate whether challenge is effective, issues are escalated promptly, or accountability works in practice. In some firms, repeated surveys identify the same concerns year after year without visible action. That can create cynicism and disengagement, with employees becoming less willing to provide honest feedback because they do not expect meaningful change. Culture is better assessed through evidence of behaviour, decisions, escalation, challenge and outcomes than through survey results alone.

Final thoughts

Overseas banks in the UK do not need to dilute their identity or culture to meet UK expectations. What matters is whether they understand where group norms may pull against local regulatory obligations, and whether they deal with that tension openly before it becomes a control issue.

In practice, the warning signs are usually visible long before they become enforcement findings. Escalation slows down. Challenge becomes softened. Ownership becomes blurred. Local teams rely too heavily on group systems or hesitate to act until offshore stakeholders are comfortable.

The FCA’s enforcement cases and the use of business restrictions show the cost of allowing those patterns to persist. Firms that manage this well are not necessarily the ones with the longest policy manuals. They are the ones who can demonstrate, through real decisions and real outcomes, that UK businesses have the authority, clarity and control to do the right thing when it matters.

How HKA can help

HKA works with international banks to turn UK regulatory expectations into practical improvements in governance, culture, risk oversight and financial crime controls. We can help boards and senior leaders strengthen challenge, oversight and decision-making in areas where local and group responsibilities intersect. Contact us about strengthening your UK governance and risk framework.

About the author

Priya Giuliani is a Chartered Accountant with 30 years of experience in investigations, regulatory compliance, governance, and risk management. She has provided expert witness evidence in civil and criminal proceedings, including matters before the UK High Court and HMRC tribunals. Her work has included complex investigations involving fraud, misconduct, regulatory breaches, asset tracing, confiscation proceedings, and financial analysis, as well as advising organisations on regulatory expectations, controls, and compliance frameworks.

Priya specialises in helping organisations respond to regulatory, operational, and integrity related risks through investigations, independent reviews, compliance assessments, and dispute resolution support. She has extensive experience working with regulated firms, corporates, legal advisers, regulators, and law enforcement agencies in the UK and internationally.