The identified failures were that the bank, from 1 April 2015 and 30 November 2017, "allowed money to pass through the bank and be used within the UK without carrying out appropriate checks."

Specifically, the bank "failed to adequately check its customers’ Source of Wealth and Source of Funds when it was required to make sure the money was not connected to financial crime.  "

This type of failing is the basis of one order after another, in multiple jurisdictions.

Why? It's because it's very easy for regulators to see failure: it's not qualitative, it's quantitative.

So, identifying the customer correctly is a clerical function and regulators can police that.