NatWest (National Westminster Bank plc) is part of NatWest Group alongside Royal Bank of Scotland and Ulster Bank. NatWest is a frequent CIFAS filer, particularly for Misuse of Facility markers related to money muling activity. Their fraud operations are highly centralised, with decisions made by a specialist team in Edinburgh. NatWest has faced repeated criticism from the Financial Ombudsman for filing markers without adequate evidence of the account holder's knowledge or intent. If NatWest has closed your account, a NatWest CIFAS marker may be the reason other banks are declining you.
This guide is specific to NatWest Bank PLC. The filing patterns, internal processes, response behaviours, and escalation dynamics described here are based on outcomes from real NatWest Bank PLC cases, not generic advice that applies to any bank.
For a complete overview of how CIFAS markers work, see our guide to CIFAS markers.
What is a NatWest Bank PLC CIFAS marker?
A CIFAS marker is an entry on the CIFAS National Fraud Database : a shared register used by over 775 banks, lenders, insurers, telecoms providers, and employers across the UK. When NatWest Bank PLC files a marker against you, it flags your name, date of birth, and address as being associated with fraud. Every organisation that checks CIFAS before approving an application will see this flag.
A CIFAS marker is not a criminal record. It is not a court judgment. It is a unilateral decision by NatWest Bank PLC, made without a hearing, without notifying you, and without any requirement to prove their case to an independent body before filing. This is why markers can be challenged and removed: the burden of proof lies with the institution that filed it.
Fraud markers like this one usually do not appear on your credit file (Experian, Equifax, or TransUnion), so a clean credit report does not mean there is no marker. Only protective entries, such as Protective Registration or Victim of Impersonation, usually show there. The only reliable way to confirm whether a marker exists is to submit a Subject Access Request directly to CIFAS .
Can NatWest Bank PLC file a CIFAS marker without telling you?
Yes. NatWest Bank PLC is under no legal obligation to inform you that a CIFAS marker has been filed. Most people discover the marker only when they are declined for a product elsewhere: a bank account, mortgage, phone contract, or job.
You should submit a SAR to both CIFAS and NatWest Bank PLC directly. CIFAS will confirm the marker type, filing date, and institution. NatWest Bank PLC will provide the internal records, investigation notes, and communications about the decision to file. These records are critical ammunition for your challenge; they often reveal that NatWest Bank PLC had insufficient evidence at the time of filing.
CIFAS marker types filed by NatWest Bank PLC
CIFAS Fraudscape 2026 recorded more than 444,000 filings to the National Fraud Database in 2025, a 6% year-on-year increase. NatWest Bank PLC files across several CIFAS categories. Understanding which marker type has been filed against you determines the challenge strategy. Our CIFAS marker statistics show which institutions and marker types come up most in the cases challenged through ADVICIFAS Pro.
- Misuse of Facility: account used to facilitate fraud (money muling, payment fraud, evasion of payment). Remains on CIFAS for 6 years. If you were used as a money mule, this is the marker you have.
- Facility Takeover: unauthorised access to an account (SIM swaps, credential theft, social engineering). Remains on CIFAS for 6 years.
- Identity Fraud: application made using a stolen or fabricated identity. Remains on CIFAS for 6 years.
- False Application: false or misleading information on an application (undisclosed addresses, income discrepancies). Remains on CIFAS for 6 years.
- False Insurance Claim: insurance claim deemed fraudulent or exaggerated. Remains on CIFAS for 6 years.
- Asset Conversion: financed asset disposed of without authorisation. Remains on CIFAS for 6 years.
- Protective Registration: applied for by someone at risk of identity fraud, to protect them. Remains on CIFAS for 2 years. This is the only marker that helps you.
All fraud markers remain on the CIFAS National Fraud Database for 6 years unless successfully challenged. A successful challenge removes the marker immediately; there is no minimum waiting period. Every month it stays active is another month of declined applications, refused credit, and failed employment checks.
What does a NatWest Bank PLC CIFAS marker affect?
A CIFAS marker filed by NatWest Bank PLC is visible to every organisation that checks the CIFAS National Fraud Database . The consequences extend far beyond banking.
Mortgages
Mortgage lenders run CIFAS checks as part of their application process. A fraud marker will result in an automatic decline from most mainstream lenders. Even specialist lenders who accept adverse credit will typically refuse applicants with an active CIFAS marker. If you are mid-application when the marker is discovered, the application will be withdrawn, and you may lose survey fees, solicitor costs, and your deposit. See our full guide to getting a mortgage with a CIFAS marker.
Car insurance
Motor insurers increasingly check CIFAS before issuing policies. A marker can result in refused cover, cancelled policies, or significantly inflated premiums. If a policy is cancelled due to a CIFAS marker, you must declare the cancellation on all future insurance applications, compounding the problem even after the marker is removed.
Employment background checks
Employers in financial services, government, law enforcement, and security-cleared roles run CIFAS checks as part of pre-employment screening. A fraud marker will typically result in a failed background check and a withdrawn job offer. You may never be told the real reason; the employer will simply say you "didn't pass vetting". See our full guide to CIFAS markers and employment.
Phone contracts
Mobile networks check CIFAS before approving contract applications. A marker will result in declined contracts, forcing you onto pay-as-you-go or SIM-only deals. This is particularly impactful for people who need a handset on contract.
Student finance
Student Loans Company does not routinely check CIFAS for tuition fee loans, but a marker can affect your ability to open a student bank account, obtain a student overdraft, or secure private student accommodation that requires a credit/fraud check.
Rental applications
Letting agents and landlords who use referencing services may run CIFAS checks. A fraud marker can result in a failed reference, a refused tenancy, or a requirement for a guarantor or additional deposit. Tenant referencing fraud checks rose 263% year-on-year according to Fraudscape 2026 .
Business banking
If you are a director or sole trader, a personal CIFAS marker can prevent you from opening a business bank account, obtaining business credit, or passing due diligence checks from clients and suppliers. This can effectively prevent you from running a business.
What banks will accept you with a CIFAS marker?
While most high street banks will decline applications from CIFAS-marked individuals, some options exist. For a detailed breakdown, see our guide to bank accounts that accept CIFAS-marked customers.
- Basic bank accounts: UK banks are required to offer basic bank accounts under the Payment Accounts Regulations 2015. However, even basic accounts can be refused if a CIFAS marker is present. In practice, some banks apply the check and some don't.
- E-money accounts: providers such as Wise are electronic money institutions (EMIs), not banks. Their CIFAS checking policies vary. Some accept CIFAS-marked customers with limited functionality; others decline outright.
- Credit unions: some credit unions do not check CIFAS and may accept applications based on their own criteria.
- Post Office: the Post Office Money current account is provided by Bank of Ireland UK and may accept applications that high street banks refuse.
The difference between a "declined application" and a "CIFAS block" matters. A declined application is the bank's own risk decision. A CIFAS block is a flag from the National Fraud Database that most institutions treat as an automatic decline. Challenging the marker removes the flag entirely. It doesn't just improve your chances; it eliminates the barrier.
ADVICIFAS Pro Kit
Bank, Even With
a CIFAS Marker.
Stop getting rejected. We've found the ones that actually say yes. Hundreds of verified financial options that accept CIFAS-marked customers. £3.99/mo, cancel anytime.
NatWest Bank PLC's typical response patterns
Understanding how NatWest Bank PLC responds to challenges is critical to building an effective strategy. Based on outcomes from real cases, NatWest Bank PLC exhibits several consistent patterns.
Initial complaint response
NatWest Bank PLC typically responds to a formal complaint within 4-8 weeks, frequently using the full 8-week window under FCA rules. Their initial response almost always upholds the marker. The response will usually:
- Reference "financial crime prevention obligations" as justification
- Provide a summary of suspicious transactions but no evidence of account holder knowledge
- Issue a final response letter quickly to start the Ombudsman clock
- Decline to engage with specific legal arguments in the initial response
A rejection from NatWest Bank PLC is not the end of the process; it is a predictable step in it. The initial rejection often contains weaknesses that strengthen the escalated challenge. NatWest Bank PLC's refusal to disclose specific evidence is itself a point that can be raised in subsequent correspondence.
Common weaknesses in NatWest Bank PLC's position
Across multiple cases, NatWest Bank PLC consistently exhibits these vulnerabilities when challenged.
- High Ombudsman overturn rate: NatWest markers are overturned at the Financial Ombudsman at a notable rate, suggesting systematic over-filing
- Reliance on "receipt of funds" as sole evidence: NatWest frequently cites receiving funds from fraud victims as evidence of money muling, without demonstrating the account holder knew the source was criminal
- Failure to evidence intent: NatWest's investigation files often focus on transaction patterns and fail to address the critical question of whether the account holder acted dishonestly
- Template-driven responses: NatWest complaint responses are heavily templated, often failing to address the specific points raised in the challenge
- Inconsistent treatment across the group: the same activity pattern may result in a marker from NatWest but not from RBS, undermining the claim that the evidence meets the CIFAS threshold
The legal basis for challenging NatWest Bank PLC
A challenge to a NatWest Bank PLC CIFAS marker draws on multiple legal frameworks simultaneously:
- CIFAS Principle 4: NatWest Bank PLC must have reasonable grounds to believe fraud was committed, backed by clear, relevant and rigorous evidence held at the time of filing, and your conduct must meet the criteria of the marker's case type. If they cannot produce this evidence when challenged, the marker does not meet the filing threshold.
- UK GDPR Article 5(1)(d): the marker is personal data that must be accurate. A marker implying fraud where NatWest Bank PLC cannot prove fraud is inaccurate data.
- UK GDPR Article 16: you have the right to rectification of inaccurate personal data.
- UK GDPR Article 17: you have the right to erasure where processing is no longer lawful.
- Data Protection Act 2018, Section 165: you can require NatWest Bank PLC to confirm the lawful basis for processing the marker data and demonstrate that the processing is necessary and proportionate.
- FCA Consumer Duty (July 2023): NatWest Bank PLC has enhanced obligations to avoid foreseeable harm, particularly where the customer is vulnerable. Filing a marker against someone who was a victim of fraud, was in financial hardship, or has mental health conditions may breach the Consumer Duty.
- FCA Principle 6: NatWest Bank PLC must pay due regard to your interests and treat you fairly.
Step-by-step challenge process
Step 1: Confirm the marker details
Before challenging, confirm exactly what has been filed. Submit a Subject Access Request to CIFAS to obtain the marker type, filing date, and filing institution. Also submit a SAR to NatWest Bank PLC directly; this will provide the internal records, notes, and communications NatWest Bank PLC holds about the decision to file. See SAR forensic analysis for how the platform uses this data.
Step 2: Formal complaint to NatWest Bank PLC
Send a formal written complaint to NatWest Bank PLC's complaints department . The complaint must be specific: cite the marker type, the filing date, the CIFAS Principle 4 evidential threshold, and the specific grounds on which the marker does not meet that threshold. Generic complaints receive generic rejections. For a full breakdown of the complaint process, see our full CIFAS marker removal guide. The complaint should:
- Identify the marker type and date
- State that you dispute the marker and request its removal
- Cite the specific legal and evidential grounds for removal
- Request that NatWest Bank PLC disclose the evidence relied upon at the time of filing
- Set out your account of events and explain why the filing threshold is not met
- Reference any vulnerability, coercion, or victimisation that applies
Writing this letter yourself is possible but difficult. You need to cite the correct CIFAS principles, reference the right GDPR articles, and tailor the arguments to NatWest Bank PLC's specific patterns; a generic letter gets a generic rejection. ADVICIFAS Pro builds this letter automatically from your case details, targeting every applicable legal framework and known NatWest Bank PLC weakness.
Step 3: Analyse NatWest Bank PLC's response
NatWest Bank PLC must respond within 8 weeks. Their response will typically uphold the marker, but the way they uphold it matters. When you upload the response, the platform analyses it automatically. Look for:
- Whether they cite specific evidence or rely on general statements about "suspicious activity"
- Whether they address your specific grounds for challenge or use a template response
- Whether they acknowledge vulnerability or Consumer Duty obligations
- Whether they provide the evidence you requested
Step 4: Counter-response
If NatWest Bank PLC rejects the initial complaint, which is the most common outcome, send a counter-response that directly addresses the weaknesses in their reply. This letter should dismantle their justification point by point, highlight what they failed to evidence, and make clear that escalation will follow if the marker is not removed.
Step 5: CIFAS direct challenge
If NatWest Bank PLC maintains the marker after the counter-response, you can challenge the marker directly with CIFAS. CIFAS will contact NatWest Bank PLC and ask them to demonstrate that the filing meets Principle 4. This is an independent review, and if NatWest Bank PLC cannot satisfy CIFAS that the evidential threshold is met, CIFAS can require the marker to be removed.
Step 6: Financial Ombudsman Service
Once NatWest Bank PLC has issued their final response (or 8 weeks have passed without a response), you can escalate to the Financial Ombudsman Service (FOS). The Ombudsman's decision is binding on NatWest Bank PLC. If the Ombudsman finds that the marker was filed without adequate evidence, NatWest Bank PLC must remove a CIFAS marker, and may be ordered to pay compensation for the harm caused.
Step 7: ICO complaint
A complaint to the Information Commissioner's Office (ICO) can be filed in parallel with or after the Ombudsman process. The ICO has enforcement powers under the UK GDPR and can compel NatWest Bank PLC to delete inaccurate data. ICO involvement also creates a regulatory compliance risk for NatWest Bank PLC that adds significant pressure to resolve the complaint.
Common mistakes when challenging NatWest Bank PLC
Most failed CIFAS challenges fail not because the marker was justified, but because the challenge was poorly executed. Avoid these mistakes.
- Using a generic template: NatWest Bank PLC receives hundreds of CIFAS complaints. A template letter that doesn't cite specific legislation, doesn't reference NatWest Bank PLC's own response, and doesn't address the particular marker type will receive a template rejection. The complaint must be specific to your case.
- Not requesting a SAR first: challenging without knowing what evidence NatWest Bank PLC holds is fighting blind. The SAR reveals what NatWest Bank PLC relied on when filing. Without it, you can't dismantle their position because you don't know what it is.
- Accepting the first rejection as final: NatWest Bank PLC almost always rejects the initial complaint. This is expected and does not mean the marker is justified. The rejection itself often contains weaknesses (vague reasoning, failure to cite evidence, template language) that strengthen the escalated challenge.
- Missing the 6-month FOS deadline: once NatWest Bank PLC issues their final response, you have 6 months to refer the complaint to the Financial Ombudsman . If NatWest Bank PLC hasn't responded within 8 weeks, you can refer immediately without waiting for a final response. Missing this window limits your options.
- Contacting the branch: CIFAS markers are filed and managed by NatWest Bank PLC's centralised fraud and complaints teams, not branch staff. Calling or visiting your branch will not resolve a CIFAS marker. Your complaint must go to the complaints department in writing.
- Admitting fault on the phone: NatWest Bank PLC may call you to discuss the account closure. Anything you say can be noted and used to support the marker. Do not discuss the specifics of the activity or accept responsibility without understanding what you are being asked about. Put everything in writing.
Typical timelines
- Initial complaint to NatWest Bank PLC: response within 4-8 weeks
- Counter-response: NatWest Bank PLC typically responds within 2-4 weeks to a follow-up letter
- CIFAS direct challenge: CIFAS aims to resolve within 8 weeks
- Financial Ombudsman: initial assessment within 4-8 weeks; full investigation can take 3-6 months depending on case complexity and Ombudsman workload
- Some NatWest Bank PLC markers are removed at the initial complaint stage: particularly where the evidence of victimisation or administrative error is strong
The challenge process is cumulative. Each stage builds on the last: NatWest Bank PLC's response (or lack of response) at each stage becomes evidence in the next. The roadmap tracks every deadline and prepares the next step automatically. This is why early stages matter even when they result in rejection.
NatWest Bank PLC-specific considerations
- Also files under: CIFAS markers from NatWest may appear under the following names on your report: national westminster bank, national westminster bank ltd t/a natwest boxed, national westminster bank plc, natwest, natwest boxed. All are challenged through the same process.
- NatWest Group cross-checks: If you also held accounts with Royal Bank of Scotland or Ulster Bank, check whether markers were filed by those entities too. They are separate CIFAS members within the same group.
- NatWest's Ombudsman track record: NatWest has a documented pattern of markers being overturned at the Ombudsman stage. This is relevant context for the challenge; it demonstrates that NatWest's filing threshold is applied inconsistently.
- Young account holders: NatWest files a disproportionate number of markers against younger account holders (18-25). If you are in this age group, vulnerability arguments, including susceptibility to money mule recruitment, are particularly strong.
Compensation
If a NatWest Bank PLC CIFAS marker is removed, you may be entitled to compensation for the harm it caused while it was active. This can include:
- Financial loss: declined applications, higher insurance premiums, lost employment income, costs of alternative financial arrangements
- Distress and inconvenience: the Financial Ombudsman regularly awards compensation for the mental health impact and practical disruption caused by wrongly filed markers
- Consequential losses: if the marker caused a property purchase to fall through, for example, the associated costs (solicitor fees, survey fees, lost deposit) may be recoverable
Compensation claims are typically included in the Ombudsman complaint. The Financial Ombudsman Service has the power to order NatWest Bank PLC to pay up to £430,000 in compensation per complaint (as of the current FOS limit).
What to do if NatWest Bank PLC won't remove the marker
If NatWest Bank PLC refuses to remove the marker after your formal complaint and counter-response, you are not out of options. The challenge process is designed to escalate.
Financial Ombudsman Service (FOS)
The Financial Ombudsman is free to use and their decision is binding on NatWest Bank PLC. You can refer your complaint once NatWest Bank PLC has issued a final response, or after 8 weeks if they haven't responded. The Ombudsman reviews whether NatWest Bank PLC held sufficient evidence of deliberate dishonesty at the time of filing and whether they followed proper procedures. If they find the marker was unjustified, NatWest Bank PLC must remove it and may be ordered to pay compensation.
ICO complaint
A complaint to the Information Commissioner's Office can be filed at any time, in parallel with or after the FOS process. The ICO enforces the Data Protection Act 2018 and UK GDPR. If the marker constitutes inaccurate personal data, the ICO can compel NatWest Bank PLC to rectify or erase it. ICO involvement also creates regulatory compliance risk for NatWest Bank PLC: an enforcement notice from the ICO is something their legal team wants to avoid.
Continuing the challenge vs waiting
Some people consider waiting out the 6-year marker duration instead of challenging. This is almost always the wrong choice. Every month the marker remains active, the financial damage compounds: declined applications, higher costs, missed opportunities. The challenge process costs a fraction of what the marker costs you in lost income, refused credit, and higher premiums over 6 years.
