The Bank of England has fined UK payments operator Vocalink £11.9 million for failing to meet a February 2022 deadline to address weaknesses in its risk management and governance framework.

Despite being directed by the central bank to strengthen its systems and controls, Vocalink—owned by Mastercard—fell short due to ineffective risk oversight and inadequate internal governance and escalation processes. This marks the first time the Bank has issued a fine against a systemically important financial market infrastructure firm.

Vocalink plays a critical role in the UK’s financial ecosystem, operating real-time payments, direct debit services, and managing ATM networks that handle the vast majority of salaries, household bill payments, and government benefits. The company said it has since made substantial improvements and invested in remediating the issues flagged by the Bank. Thanks to its cooperation and willingness to resolve the matter, Vocalink received a 45% reduction from the original fine, which would have otherwise totaled £20 million. A spokesperson emphasized that the historical issues had no impact on the delivery of services to UK consumers and businesses.