Every fintech I have worked with, including the one I ran operations for, hits the same wall. The product works, the funding round closes, the headcount doubles, and somewhere in that growth the actual "how we do things" stops living on paper and starts living in three or four people's heads.
Nobody decides to skip documentation. It just loses every time against a feature deadline or a client onboarding deal. The problem is that regulators, auditors, and your own new hires do not care why it is missing. They just see the gap.
What undocumented actually looks like
It is rarely as dramatic as "we have no AML policy." It is messier than that. The policy exists, but the version everyone actually follows is the one the compliance lead keeps adjusting in her head based on exceptions nobody wrote down. The onboarding checklist exists, but half the team uses a shortcut that skips a step because "it's fine for repeat clients." The incident response plan exists on a wiki page nobody has opened since it was written.
None of that shows up as a problem until something goes wrong, or until a regulator asks to see it.
The Starling lesson
Starling Bank is the clearest recent example of what this costs in practice. The FCA fined Starling close to £29 million in October 2024 for financial crime control failures. The bank's customer base grew from about 47,000 in 2017 to 3.6 million by 2023, and its sanctions screening and onboarding controls did not scale with it. A screening misconfiguration that existed since 2017 went unnoticed, and the bank opened more than 54,000 accounts for 49,000 high risk customers in breach of a requirement it had agreed with its own regulator. None of that happened because anyone set out to break the rules. It happened because the process that worked at 47,000 customers was never rebuilt, documented, and tested for 3.6 million.
Starling is not alone. Monzo was fined £21.1 million in July 2025 for AML control gaps between 2018 and 2022. Across 2025, FCA fines on financial firms topped £124 million, and most of them trace back to the same root cause: systems and controls that existed on paper but were not actually being followed, tested, or kept current as the business changed.
Why regulators keep asking for the same thing
Under DORA, which took effect across the EU in January 2025, financial entities now have to maintain structured, regularly reviewed documentation covering ICT risk strategy, incident response, and business continuity. Not because Brussels enjoys paperwork, but because an undocumented process is unauditable and unrecoverable. If your head of engineering is the only person who knows how a failover actually works, you do not have a resilience plan, you have a single point of failure with a nice name.
The EBA's outsourcing guidelines make the same point from a different angle. They require a written outsourcing policy covering the full lifecycle of any arrangement, plus a maintained register available to supervisors on request. The requirement is not about ticking a box. It exists because when a critical vendor fails or a key employee leaves, the institution still needs to know what it agreed to and how to respond.
The compounding cost
The fines are the visible part. The real cost shows up earlier and quieter. The new ops hire who takes six weeks to become useful because nothing is written down. The audit that drags three months because evidence has to be reconstructed from memory and Slack threads. The key person who leaves and takes the only working knowledge of how reconciliation actually happens. The automation project that stalls because nobody can agree on what the current process even is, so there is nothing to automate.
Undocumented processes do not just create regulatory risk. They cap how fast you can grow, because every new person, every new market, and every new system has to be trained by word of mouth instead of by a process someone can actually follow.
What to do instead
You do not need a 200 page manual. You need every critical process, onboarding, AML checks, incident response, vendor management, written down clearly enough that someone new could run it without calling the person who built it. Then you need it reviewed and kept current, which is the part most teams skip.
This is exactly the gap we close at Novafin. We map how your operations actually run, not how the org chart says they run, document what needs to be documented for your regulator and your team, and then build the automation on top of a process that is finally written down. Clean operations first. Then the AI handles the repetitive part. If you want a straight look at where your documentation gaps are before a regulator finds them, talk to us.