The Bank of England has fined Vocalink Limited GBP 11.9 million for a compliance failure under section 196 of the Banking Act 2009, marking the first time the Bank has fined a financial market infrastructure firm. The action relates to Vocalink’s failure to comply in full, by 28 February 2022, with a Bank direction requiring remediation of identified systems and controls issues. Vocalink, regulated by the Bank since April 2018 as a specified service provider supporting UK payments systems, implemented a remediation programme but did not meet all requirements by the deadline due to an ineffective risk management framework and weaknesses in controls, governance and escalation processes. The investigation identified a lack of an integrated risk management framework for the remediation programme, limiting the ability to understand, monitor and share risks across the three lines of defence and external assurance providers, alongside failures to escalate key risks and information to senior committees. Vocalink’s early admission and cooperation reduced the penalty by 15%, and agreement to resolve the matter delivered a further 30% reduction, implying a GBP 20 million penalty absent those reductions.