AI in Financial Crime Prevention: From Rules-Based Monitoring to Evidence-Based Intelligence

Executive Summary

1Financial Crime Prevention Is an Intelligence Problem

Financial crime prevention is often discussed as a compliance obligation. That is true, but incomplete.

At its best, financial crime prevention is an intelligence discipline.

It connects customer behaviour, transaction flows, counterparties, geographies, products, beneficial ownership, devices, documents, external information, sanctions lists, adverse media, typologies, law-enforcement signals and internal case history. The objective is not merely to process alerts. The objective is to identify suspicious activity, protect the financial system, support lawful reporting and reduce the ability of criminal networks to exploit financial infrastructure.

That is why AI is relevant.

AI can help identify relationships that are difficult to see through static rules alone. It can support entity resolution, anomaly detection, name matching, document classification, behavioural analytics, network analysis, case prioritisation and investigator support. It can also help institutions move from volume-based monitoring to more evidence-based detection.

The core principle remains the risk-based approach. FATF's work on new technologies for AML/CFT emphasises responsible, risk-based implementation and identifies technology as a way to improve the speed, quality and efficiency of measures against money laundering and terrorist financing.

That creates a simple design rule:

AI in financial crime prevention should begin with the typology, not with the model.

The question is not: "Which AI tool should we deploy?"

The question is: "Which financial-crime pattern are we trying to detect more effectively, and what evidence would show that detection has improved?"

2Where AI Can Create Value

AI can create value across the financial crime prevention lifecycle.

The most obvious area is transaction monitoring. Machine learning can support anomaly detection, behavioural segmentation, alert prioritisation and dynamic scenario tuning. It can help distinguish routine variation from genuinely unusual behaviour, especially where patterns evolve over time.

A second area is customer risk assessment. AI can support customer risk profiling by combining structured and unstructured information, updating risk indicators more dynamically and identifying relationships between customers, entities and transactional behaviour.

A third area is sanctions and name screening. Name matching is a classical detection problem. AI and machine learning can help manage transliteration, spelling variation, aliases, fuzzy matching and contextual disambiguation. The objective is not simply to reduce alerts. The objective is to prioritise the alerts that matter while preserving control over true matches.

A fourth area is KYC and onboarding. AI can support document classification, identity-verification workflows, extraction of relevant information, adverse-media review and quality checks.

A fifth area is fraud and scam detection. Fraud patterns can move quickly, especially in digital channels. AI can support behavioural analytics, device intelligence, transaction-pattern analysis, mule-account detection and real-time prioritisation.

A sixth area is investigation support. Generative AI and natural-language processing can support case summarisation, evidence organisation, narrative drafting, knowledge retrieval and typology matching. This is not a replacement for investigators. It is a way to reduce low-value manual effort and improve the quality and consistency of case preparation.

A seventh area is network intelligence. Graph analytics and graph neural networks are particularly relevant because financial crime often involves relationships: accounts, entities, counterparties, shared addresses, beneficial owners, payment chains, devices and transaction corridors. BIS Project Aurora specifically explored how data, technology and collaboration can help combat money laundering across institutions and borders, including through artificial intelligence, machine learning, privacy-enhancing technologies and network analysis.

These use cases should not be treated as isolated technology experiments. They are part of a wider operating model for financial crime prevention.

3From Alerts to Outcomes

The most important shift is not from rules to AI.

The most important shift is from alerts to outcomes.

An alert is activity. An outcome is effectiveness.

A financial-crime function may generate alerts, review cases, close false positives, file suspicious activity reports, refine scenarios and update rules. These are necessary activities. But the value of AI should be measured by whether it improves the quality, speed, consistency or usefulness of prevention and detection outcomes.

A useful outcome lens includes:

• better detection of relevant suspicious behaviour;

• earlier identification of network patterns;

• improved prioritisation of investigative effort;

• fewer low-value alerts;

• stronger case narratives;

• better evidence quality;

• faster time to decision;

• improved feedback from investigations into monitoring logic;

• better adaptation to emerging typologies;

• more effective use of scarce expert capacity.

This is exactly where AI value measurement and financial crime prevention meet.

AI should not be measured only by model accuracy or alert reduction. A model can reduce alerts and still miss important behaviour. A model can increase alerts and still improve detection if it surfaces higher-quality intelligence. A model can perform well in testing and still be weak in production if investigator workflow, data quality or feedback loops are not designed properly.

The measurement question is:

Does AI improve the financial-crime outcome the institution cares about?

That requires a baseline, a value hypothesis, a measurement design and a decision rule.

4The Effectiveness Principle

The Wolfsberg Group's work on innovation in financial crime compliance is important because it helps frame AI and machine learning through responsible use, governance and effectiveness. Its AI and machine-learning principles provide a responsible-use frame for financial crime compliance, while its broader effectiveness work supports the idea that financial-crime programmes should be judged by useful risk outcomes, not only by mechanical control execution.

That matters for AI.

AI should be evaluated through an effectiveness lens:

• What does it help detect?
• What does it help prioritise?
• What does it help explain?
• What does it help prevent?
• What does it help investigators decide?
• What does it help the institution learn?

This avoids two extremes.

The first extreme is technology enthusiasm: assuming that AI is valuable because it is advanced.

The second extreme is control conservatism: assuming that more familiar methods are always safer.

The better approach is evidence-based effectiveness.

If an AI-enabled transaction-monitoring model improves detection quality, reduces low-value review effort, supports explainable case prioritisation and can be validated, monitored and challenged, then it has a serious value case. If it cannot be explained, monitored, governed or linked to better outcomes, then the model should not scale.

That is not a technology judgement.

It is a governance judgement.

ai-financial-crime-2.jpg1600 × 900 · /insights/img/

5Why Graph Analytics Matters

Financial crime is relational.

A single transaction may look ordinary. A sequence may look unusual. A network may reveal the pattern.

That is why graph analytics is central to the future of AI-enabled financial crime prevention.

Traditional monitoring often evaluates customers or transactions through predefined scenarios. That remains useful. But laundering patterns can involve multiple accounts, multiple entities, cross-border flows, circular movement, layering, shared identifiers, common counterparties and indirect relationships. Graph methods are designed to represent these relationships.

A graph can connect accounts, customers, beneficial owners, devices, addresses, phone numbers, merchants, payment references, counterparties and transaction flows. Graph analytics can then support community detection, centrality analysis, link prediction, path analysis and network-risk scoring.

This does not make rules obsolete.

It makes detection more contextual.

Project Aurora is important because it demonstrates the supervisory and public-policy interest in collaborative, network-based detection. BIS states that Phase 1 of Project Aurora explored new ways of combating money laundering through artificial intelligence, machine learning, privacy-enhancing technologies and network analysis, using simulated collaborative analytics across institutions and borders while protecting sensitive information.

The practical lesson for banks is clear:

If the typology is network-based, the detection logic should be capable of seeing networks.

This is particularly relevant for mule networks, trade-based financial crime, sanctions evasion, scam proceeds, crypto-to-fiat flows, complex beneficial ownership and coordinated account activity.

6The Data Challenge

AI in financial crime prevention is only as strong as the data foundation behind it.

That foundation includes customer data, account data, transaction data, product data, KYC data, beneficial ownership data, device data, external data, sanctions data, adverse-media data, case history, investigation outcomes and typology intelligence.

The challenge is not only data volume. It is data meaning.

Financial-crime data is often incomplete, delayed, fragmented or difficult to label. Ground truth is especially hard because not all suspicious activity is detected, not all reported activity is confirmed as criminal, and typologies evolve over time.

Academic AML research repeatedly points to data limitations. Jensen and Iosifidis analyse the use of statistics and machine learning for money-laundering detection and discuss the data and terminology challenges in suspicious behaviour flagging. Synthetic-data research, including IBM's work on realistic synthetic financial transactions for AML models, responds to the same problem: real financial transaction data is highly sensitive and difficult to use for open benchmarking.

This creates a practical design rule:

Before building advanced AI, define the data evidence chain.

A financial-crime AI model should have a clear answer to the following questions:

• Which data sources are used?
• Who owns them?
• What is the data lineage?
• Which fields are critical?
• What is the quality threshold?
• What labels are used?
• How are investigation outcomes fed back?
• How is concept drift monitored?
• Which data may not be used?
• How are privacy and confidentiality protected?

This is not an administrative detail. It is the foundation of trustworthy AI-enabled financial crime prevention.

7Collaborative Analytics and Privacy-Enhancing Technologies

Financial crime often crosses institutional boundaries.

That creates a structural challenge. Each institution may see only part of the pattern. Criminal networks can exploit that fragmentation by spreading activity across institutions, products, geographies and channels.

FATF's stocktake on data pooling, collaborative analytics and data protection addresses this issue directly. It examines technologies that can facilitate advanced AML/CFT analytics within regulated entities and enable collaborative analytics between financial institutions while respecting data privacy and protection frameworks.

This is where privacy-enhancing technologies become strategically relevant.

Approaches such as federated learning, secure multi-party computation, differential privacy and synthetic data can help institutions collaborate analytically without simply pooling raw sensitive data. These methods are not simple, and they do not remove legal, governance or data-quality obligations. But they expand the design space.

MAS's COSMIC platform is a practical example of regulated information sharing. MAS describes COSMIC as a platform that allows financial institutions to securely share information on customers who exhibit multiple red flags that may indicate potential financial crime.

The lesson is not that every jurisdiction will use the same model.

The lesson is that financial crime prevention is becoming more collaborative, more data-driven and more dependent on controlled information sharing.

AI will be most effective when it is designed for that reality.

8Explainability Is Not Optional

Financial crime prevention requires explainability.

Investigators need to understand why a case is prioritised. Compliance leaders need to understand why a model is trusted. Risk functions need to challenge assumptions. Internal audit needs evidence. Supervisors need confidence that the institution understands the model and its limitations.

Explainability does not mean that every complex model must be reduced to a simple rule. It means that the explanation must be appropriate for the decision, the user and the risk.

For a sanctions-screening model, the explanation may need to show matching logic, name variation, transliteration factors and contextual features.

For a transaction-monitoring model, the explanation may need to show behavioural deviation, peer-group comparison, relevant risk indicators and transaction paths.

For a graph model, the explanation may need to show network relationships, shared attributes, central nodes, paths and the features that triggered prioritisation.

For a generative-AI investigator assistant, the explanation may need to show source references, evidence provenance, confidence boundaries and a clear separation between extracted facts and generated narrative.

Methods such as SHAP and LIME are important because they provide structured approaches to interpreting model predictions. But tools alone are not enough. Explainability must be embedded into the workflow.

A useful standard is this:

The model must be explainable enough for the person who must act on it.

An investigator needs actionable reasoning.

A model validator needs technical evidence.

A board needs outcome and control evidence.

A supervisor needs assurance that the institution can evidence control.

These are different explanation levels. A mature AI governance framework should distinguish them.

9Human Oversight and Investigator-Centred Design

AI should support investigators, not bypass them.

Financial-crime decisions often require context, judgement and legal sensitivity. A model can prioritise, suggest, summarise or detect. But the human operating model must remain clear.

Human oversight should not mean a human rubber-stamps an AI output. It should mean that investigators can understand, challenge, accept, override or escalate model outputs.

That requires investigator-centred design.

An AI-enabled financial-crime workflow should define:

• what the model produces;

• what the investigator sees;

• what explanation is provided;

• when the investigator must review;

• when escalation is required;

• how overrides are captured;

• how feedback improves the model;

• how quality assurance samples decisions;

• how errors are analysed;

• how model drift is detected.

This is where AI value becomes operational.

If investigators do not trust the output, the model will not create value. If investigators trust it too much, the model may create automation bias. If feedback is not captured, the system will not learn. If overrides are not analysed, management will not understand whether the model is improving or degrading.

Human oversight is therefore not a checkbox.

It is part of the detection system.

10Measuring AI Value in Financial Crime Prevention

AI value in financial crime prevention should be measured carefully.

The goal is not to prove that AI is impressive. The goal is to prove that AI improves outcomes.

A practical value framework should include five categories.

Detection Value

Does the model detect relevant suspicious behaviour more effectively?

Possible metrics include precision, recall, true-positive rate, false-negative analysis, typology coverage, network discovery and detection of previously unknown patterns.

Investigation Value

Does the model improve investigator productivity and decision quality?

Possible metrics include case preparation time, time to decision, number of cases reviewed per analyst, quality-assurance scores, narrative quality, evidence completeness and escalation relevance.

Risk Value

Does the model improve the institution's ability to manage financial-crime risk?

Possible metrics include improved customer risk segmentation, faster identification of high-risk networks, better typology intelligence, improved control effectiveness and stronger feedback from investigations into monitoring logic.

Control Value

Does the model remain governed, explainable, monitored and auditable?

Possible metrics include validation status, model-drift indicators, override rates, exception trends, data-quality metrics, audit findings, monitoring breaches and control evidence completeness.

Strategic Value

Does the model improve the institution's long-term capability?

Possible metrics include reusable data assets, reusable feature libraries, investigator knowledge bases, scalable model infrastructure, improved typology management and better collaboration across business, technology and control functions.

This value model is the financial-crime-specific version of the wider AI business value framework.

False-positive reduction can be a value metric. But it should not be the only one. A lower false-positive rate is useful only if detection quality is preserved or improved. The better measure is risk-adjusted effectiveness: fewer low-value alerts, stronger detection quality, better prioritisation and better evidence.

11The Governance Model

AI in financial crime prevention needs a clear governance model.

That model should connect financial-crime expertise, technology, data governance, model risk management, legal, privacy, cybersecurity, operations, internal audit and senior management.

A practical governance model has seven components.

1. Use-Case Definition

The institution should define the financial-crime objective before selecting the model.

The use case should specify the typology, process, user, data, decision role, expected value and control requirements.

2. Data Governance

The institution should define data sources, data lineage, quality thresholds, permissible use, retention logic, access controls and feedback loops.

3. Model Development and Validation

The model should be developed, tested and validated against the defined use case. Validation should include performance, stability, robustness, bias considerations, explainability, data quality and operational fit.

4. Human Oversight

The workflow should define how investigators use the model, when they can override it, how feedback is captured and how quality assurance is performed.

5. Monitoring and Drift Management

The institution should monitor model performance, data drift, typology drift, alert quality, override behaviour and investigation outcomes.

6. Evidence and Auditability

The model should produce evidence that can be reviewed. Case files should show why a case was prioritised, which data was used, what the model indicated, what the investigator decided and what happened next.

7. Decision Rights

A governance forum should decide whether to scale, adjust, retrain, restrict or retire the model.

This is how AI becomes controlled execution.

The roadmap in the next section operationalises this governance model.

12The EU and Frankfurt Dimension

The European context makes this topic particularly relevant.

The EU AML package creates a more harmonised AML/CFT framework, including the AML Regulation, AMLD6 and the AMLA Regulation. The AML Regulation applies from 10 July 2027, with specific exceptions for football clubs and agents from 10 July 2029. AMLA is established by Regulation (EU) 2024/1620, has its seat in Frankfurt am Main and will directly supervise 40 high-risk financial institutions from 2028.

This matters for AI in financial crime prevention.

A more harmonised EU AML/CFT framework creates a stronger basis for common supervisory expectations, common methodologies and more consistent use of data. AMLA's Single Programming Document 2026–2028 states that in 2026 AMLA will prepare to roll out the AML/CFT Central Database and finalise the related draft RTS, while the database should be fully operational in 2027.

That is a constructive technology signal.

For institutions in the EU — and particularly in Frankfurt, where AMLA is being built — the practical consequence is readiness: a more data-driven financial-crime prevention environment is coming, and institutions that prepare their evidence base early will meet it from a position of strength.

That means preparing not only models, but also evidence.

Evidence that the model is aligned to risk.

Evidence that the data is fit for purpose.

Evidence that investigators understand the output.

Evidence that outcomes are measured.

Evidence that governance can challenge the model.

13The AI Act and the Fraud-Detection Distinction

The EU AI Act adds another important nuance.

Annex III classifies AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, but it includes an exception for AI systems used for the purpose of detecting financial fraud.

That distinction is important.

It shows that purpose matters.

An AI system used to assess creditworthiness is not the same as an AI system used to detect financial fraud, even if both may analyse financial behaviour. The regulatory classification depends on the intended purpose and the decision context.

For financial crime prevention, this reinforces a broader governance principle:

Classify the system by use case, not by technology label.

A graph model, anomaly model or generative-AI assistant can have different governance implications depending on whether it supports fraud detection, AML monitoring, sanctions screening, customer onboarding, credit decisioning, investigation support or reporting.

That is why AI inventories should capture purpose, decision role, data, users, impact, regulatory classification and oversight design.

ai-financial-crime-3.jpg1600 × 900 · /insights/img/

14Implementation Roadmap

A practical roadmap for AI in financial crime prevention should follow seven steps.

Step One: Start with the Typology

Define the financial-crime pattern the institution wants to detect or prevent.

Examples include mule activity, sanctions evasion, trade-based financial crime, scam proceeds, unusual correspondent flows, rapid movement of funds, beneficial-ownership complexity or high-risk customer behaviour.

Step Two: Define the Value Hypothesis

State what should improve.

Examples: better detection, faster triage, fewer low-value alerts, improved case quality, better typology coverage, stronger network intelligence or faster investigator decision-making.

Step Three: Build the Data Evidence Chain

Define data sources, lineage, quality, labels, access rights, retention, privacy controls and feedback loops.

Step Four: Select the Model Type

Choose the model based on the problem.

Rules may still be appropriate for clear thresholds. Machine learning may support anomaly detection. Graph analytics may support network typologies. NLP may support adverse media or case summarisation. Generative AI may support investigator assistance. The model should follow the use case.

Step Five: Design the Human Workflow

Define how investigators receive, interpret, challenge and document AI outputs.

Step Six: Measure Outcomes

Measure detection quality, investigation quality, control quality and strategic capability.

Step Seven: Govern the Lifecycle

Monitor performance, drift, overrides, errors, typology changes, model updates and business outcomes. Decide when to scale, retrain, redesign or retire.

This roadmap keeps the focus where it belongs: prevention outcomes, not technology theatre.

15What Boards Should Ask

Boards do not need to discuss model architecture in detail.

They need to ask the right governance and value questions.

• Which financial-crime risks are we trying to detect more effectively with AI?
• Which use cases are in production, pilot or assessment?
• What business outcome is each use case expected to improve?
• Do we have a baseline before deployment?
• How do we measure detection value, investigation value, risk value and control value?
• Which data sources are used, and are they fit for purpose?
• How are privacy, confidentiality and data-access controls managed?
• Can investigators understand and challenge model outputs?
• How are overrides captured and analysed?
• How do we monitor drift and typology change?
• What evidence shows that the model improves outcomes?
• Who can decide to scale, restrict, retrain or retire the model?

These are not technical questions.

They are accountability questions.

16Conclusion: AI Should Make Financial Crime Prevention More Effective, Not Merely More Automated

AI in financial crime prevention is not about replacing financial-crime expertise.

It is about making that expertise more effective.

The strongest use cases will not be those that simply automate existing alert flows. They will be those that improve risk understanding, detect hidden networks, prioritise investigation, support better evidence and strengthen the feedback loop between typologies, data, models and human judgement.

The direction of travel is clear.

FATF supports responsible use of new technologies where they improve AML/CFT effectiveness. Wolfsberg has framed responsible AI and machine learning principles for financial crime compliance. BIS Project Aurora has shown the value of data, technology and collaboration in AML innovation. MAS COSMIC shows how regulated information sharing can support financial crime prevention. AMLA gives Europe a Frankfurt-based institutional anchor for a more harmonised and data-driven AML/CFT environment.

The next stage is not AI adoption.

It is AI effectiveness.

That means measurable outcomes, investigator-centred design, explainable models, controlled data, strong governance and clear decision rights.

Financial crime prevention will remain a human, legal and institutional responsibility.

AI can make it sharper.

But only if it is designed, measured and governed as part of the operating model.