FSA fines and enforcement actions in 2007

On 14 February 2007 the Financial Services Authority (FSA) fined Nationwide Building Society £980,000 for breaching Principle 3 (which requires firms to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk‑management systems) in the period 1 December 2004 to 1 December 2006. The FSA found Nationwide had weak information‑security risk assessment, inadequate procedures, training and controls, and a poor incident response after a laptop containing customer information was stolen, exposing customers to the risk of financial crime. Nationwide qualified for a 30% early‑settlement discount (the FSA said the undiscounted penalty would have been £1.4m) and had taken mitigating steps including disabling remote access, writing to customers, offering to reimburse customers who proved financial loss, increasing anti‑fraud monitoring and commissioning an independent review of its information security.