It believed the firm did not have a cohesive process for escalating, monitoring and managing anti-money laundering or countering financing of terrorism issues and ensuring compliance of the law.
"Craigs had not maintained sufficient written records in relation to the due diligence process," it said in the statement.
However the regulator also acknowledged since 2014 Craigs had taken steps to improve its compliance with the law and had introduced a range of initiatives which would reduce the chance of a future breach.
As part of the settlement agreement Craigs has agreed to appoint an independent party to identify any further areas that may assist with the continued improvement of its compliance programme and to follow up on those recommendations as soon as possible.