The regulator found that BOS failed to be open and cooperative and failed to disclose information appropriately to the then regulator, the Financial Services Authority (FSA).

Mark Steward, executive director of enforcement and market oversight at the FCA, said: “Bank of Scotland failed to alert the regulator and the police about suspicions of fraud at its Reading branch when those suspicions first became apparent. 

“BOS’s failures caused delays to the investigations by both the FCA and Thames Valley Police. 

“There is no evidence anyone properly addressed their mind to this matter or its consequences. 

“The result risked substantial prejudice to the interests of justice, delaying scrutiny of the fraud by regulators, the start of criminal proceedings as well as the payment of compensation to customers.”

BOS identified suspicious conduct in the IAR team in early 2007. 

The director of the Impaired Asset Team at the Reading branch, Lynden Scourfield, had been sanctioning limits and additional lending facilities beyond the scope of his authority undetected for at least three years, the FCA says. 

BOS knew by 3 May 2007 that the impact of these breaches would result in substantial losses to BOS.

Over the next two years, on numerous occasions, BOS failed properly to understand and appreciate the significance of the information that it had identified despite clear warning signs that fraud might have occurred. 

There was insufficient challenge, scrutiny or inquiry across the organisation and from top to bottom. 

At no stage was all the information that had been identified properly considered. 

The FCA says the was “no evidence anyone realised, or even thought about, the consequences of not informing the authorities, including how that might delay proper scrutiny of the misconduct and prejudice the interests of justice”.  

It was not until July 2009 that BOS provided the FSA with full disclosure in relation to its suspicions, including the report of the investigation it had conducted in 2007.

BOS also did not report its suspicions to any other law enforcement agency. 

The FSA reported the matter to the National Crime Agency (then the Serious Organised Crime Agency) on 26 June 2009.

In 2017, following an investigation by Thames Valley Police, six individuals including Lynden Scourfield and another BOS employee, Mark Dobson, were sentenced for their part in the fraud committed through the IAR.

Commercial lending was and still is largely unregulated in the UK which meant that the activities of IAR were not subject to specific rules imposed by the FSA. 

For example, conduct of business rules and complaints handling rules did not apply.  

However, BOS was required to be open and cooperative with the FSA, and the FSA would reasonably have expected to have been notified of BOS’s suspicions that a fraud may have been committed in May 2007.

The regulator says that if BOS had revealed its suspicions to the FSA in May 2007, as it should have done, the criminal misconduct could have been identified much earlier.

The delay also “risked prejudice to the criminal investigation conducted by Thames Valley Police”. 

Full disclosure would also have allowed the FSA, at an earlier opportunity, to assess BOS’s response to the issue and its approach to customers and complaints, the FCA said.

BOS agreed to resolve the matter and qualified for a 30% discount. 

Were it not for this discount the FCA would have imposed a financial penalty of £65m.

The FCA has also today banned four individuals from working in financial services due to their role in the fraud at HBOS Reading. 

These are Lynden Scourfield, Mark Dobson, Alison Mills and David Mills.