AI and money laundering: red flags and how firms can respond

AI presents both a challenge and an opportunity for compliance professionals.

On the one hand, AI money laundering is now a real operational risk: criminals use AI to fake identities, fabricate documents and structure transactions to evade traditional controls. On the other hand, firms can use AI themselves to try to keep pace, backed by good data, strong governance and human accountability.

As Shakespeare put it, firms must ‘be fire with fire’, or to ‘threaten the threat’ner’, to counter the growing threat of AI-enabled financial crime.

In this article, Bruce Viney, Director of Financial Crime Compliance Training, explores both sides: how and where criminals are using AI to circumvent controls, and to what extent financial services firms can use AI to fight back.

How is AI changing financial crime?

Criminals are now using AI to create fake identities and documents, build credible shell companies and structure transactions to avoid detection. Whilst these money laundering techniques aren’t new, generative AI gives criminals capabilities that previously needed considerable technical expertise, resources or organisation.

Criminality has also moved away from one-dimensional activity. Money laundering is now part of wider criminal networks, linked to fraud and sanctions evasion, often enabled by corruption. For example, the Financial Action Task Force (FATF) has identified a growing link between fraud and terrorist financing.

The changes impact every part of a firm’s controls:

• Identity and impersonation fraud undermines our confidence that clients are who they say they are.
• Industrial-scale document fraud weakens our trust in official papers.
• Crime-as-a-service has grown into a whole supply chain, supporting existing and would-be criminals.

How are regulators and firms responding

The FCA and the UAE Central Bank now use AI in their own supervision and have issued guidance to firms on its use. This was examined in detail in our previous article, ‘AI in financial crime compliance: adoption, governance and accountability’.

Financial services firms are increasingly using AI to strengthen their controls. However, while ambition is high, putting AI-based controls into operation is lagging behind. In most cases, implementation is partial, working alongside legacy systems and inconsistent data. Wider adoption is also slowed by challenges around governance, accountability, effectiveness and ensuring people know how to work alongside it.

What does AI-enabled money laundering mean for MLROs?

For MLROs, AI means that core onboarding checks, such as ID verification, document review, video calls and source of funds explanations, can all be defeated by convincing fakes.

Example: Imagine a new application lands on your onboarding team’s desk. The ID is convincing; the company has a professional website, and all the documents are in order. A short video call confirms the director is who he says he is, and the source of funds comes with a plausible explanation.

A few years ago, building a fake client profile that contains all of these elements would have taken time, expertise and resources. Today, AI has made it far easier for criminals to create one. 

How does AI help criminals launder money at the placement stage?

At the placement stage, criminals use AI in four main ways to evade onboarding controls:

• Synthetic identities: these combine real and fabricated information, supported by very convincing AI-generated images. They challenge our ability to gather, assess and verify identities.
• Deepfakes and forged documents: AI-generated video and audio deepfakes are increasingly difficult to detect, while counterfeit and forged documents are now produced on an industrial scale. Together, they undermine the reasonable measures that underpin onboarding due diligence.
• Fake businesses and shell companies: AI can generate fake business profiles, realistic websites and convincing operational documentation, putting a credible façade on a shell company.
• Money mules: mule activity has been growing rapidly. BioCatch reported a 168% rise in money mule cases among US financial institutions in the first half of 2025, and the FCA has identified similar growth. Mules-as-a-service now supply multiple mule assets and supporting services, and AI-supported mule activity makes effective onboarding controls even harder to apply.

It’s a sobering picture - when every part of an application can be fabricated, onboarding teams need to know which warning signs to look for and how to verify them.

What are the red flags of AI-enabled money laundering at the placement stage?

AI-generated files are convincing, but rarely flawless. Identifying red flags is how firms fight back.

As a result, it is important to train staff to help them spot and respond to signs of AI-driven obfuscation. Indicators of criminal-use of AI include:

• Inconsistencies between identity documents, biometric information and independently verifiable records.
• A purported business with little credible external footprint beyond recently created digital content.
• Similar language, documents or explanations appearing across supposedly unrelated customers.
• Newly opened accounts receiving funds from many unrelated third parties, followed by rapid withdrawals or transfers.
• Customers who seem unusually uncertain about their business or the origin of their funds, despite providing sophisticated documentation.

AI changes the credibility of impersonation. A recognisable face or voice is no longer reliable evidence of identity, and even the director on the video call may not be who he appears to be. Onboarding teams need to weigh multiple factors that together support identification.

How does AI help criminals launder money at the layering stage?

At the layering stage, criminals can use AI to help them move and disguise the illicit funds.

Returning to the example highlighted earlier, once the account is opened and funded, the criminals can use AI in five main ways:

• Automated transaction structuring: using software and AI-assisted analysis to spread funds across multiple accounts, entities, transactions or jurisdictions.
• Adaptive transaction behaviour: using AI to analyse transaction patterns and work out how transfers might avoid attracting attention.
• Fabricated commercial explanations: generating invoices, contracts, shipping documents and correspondence to give transfers apparent legitimacy.
• Complex corporate structures: creating convincing business narratives and documentation for networks of companies.
• Crypto asset laundering: managing wallets, transfers and cross-chain activity with AI, potentially adding complexity to tracing funds.

Criminals also use social engineering to pressure staff into shortcuts or errors, or to let AI-generated material pass through unchallenged. However sophisticated the technology, it often still depends on a person letting it through.

All this puts transaction monitoring under pressure. It is the area criminals most commonly target, yet also the most supported by AI tools in firms.

What challenges do firms face when using AI in transaction monitoring?

The main challenges firms face when using AI in transaction monitoring (TM) are data quality, hallucinations and false positives. Although AI is widely used in TM, as with most of the financial crime control framework, fewer than 18% of firms report broad implementation or fully embedded AI. TM therefore illustrates several of the issues that compliance professionals face when integrating AI:

1. Data quality

AI can only work with the data that it receives. Omissions or errors in transaction or customer data are likely to lead to errors in AI extractions.  This is particularly dangerous if too much credence is placed on AI. AI is sometimes treated as unchallengeable, whereas for all its hype, it is a tool and not a magic wand.

2. Hallucinations

AI is known to ‘hallucinate’, inventing scenarios or drawing conclusions that don’t follow the evidence. While AI is very good at identifying patterns, it has been deceived by carefully structured changes to transaction volumes that an experienced human eye would have detected.

3. False positives

False positives are often seen as the most problematic part of TM operations. They can tie up time and resources, and resolving them can be costly and sometimes inaccurate. However, they are rarely the fault of AI. They are more likely to be caused by inaccurate or incomplete data, which brings us back to data quality.

AI in TM is growing and is increasingly important, but MLROs and Heads of Compliance need a clear understanding of its limitations. Those limitations are exactly the gaps that the criminal client is counting on.

How should MLROs manage AI transaction monitoring risk?

MLROs manage AI transaction monitoring risk in three ways: human accountability, high-quality investigations, and red flag identification.

1. Human accountability

We are not at the stage where AI can replace skilled compliance officers.  AI produces information, but it is the compliance officer who makes the decisions and, importantly, the compliance officer that is accountable. Senior management must understand how important it is that accountability remains with people.

2. High-quality investigations

Investigations (e.g. in relation to alerts) must remain high quality and investigators should understand AI’s role in the process. Above all, they should not just assume AI is right.

3. Red flags in ongoing monitoring

 It is important to identify red flags that may suggest criminal AI involvement.  Some examples include:

• Source-of-wealth narratives that are polished but difficult to corroborate independently.
• Inconsistencies between declared business success and financial records, tax information or historical activity.
• Unusually complex loan, investment or consulting arrangements without convincing commercial justification.
• Supporting documentation containing inconsistencies in dates, counterparties, amounts or underlying transactions.

How can firms use AI to fight AI-enabled money laundering?

Perhaps the most important change for firms is that we can no longer rely on one or two indicators at onboarding or during monitoring. Factors must be weighed together, especially when a combination of innocent-looking activities points to illicit activity.

Returning to the example highlighted earlier, the file seemingly passed every individual check: the ID, the documents, the video call and the source of funds. Traditional customer due diligence and enhanced due diligence have always relied on exactly these. AI does not make them redundant, but it does mean none of them can be taken at face value.  

AI can help compliance and financial crime teams to connect these checks. It can cross-check documents, behaviour, transactions and links between customers to spot the inconsistencies that no single check would catch.

Five ways AI supports AML compliance

• Behavioural analytics: spotting deviations from expected customer behaviour, rather than relying only on static rules and thresholds (although an important caveat is that criminals have also used AI to imitate and bypass biometric controls).
• Network analysis: detecting previously unidentified links between customers, accounts, devices and counterparties.
• Document examination: identifying inconsistencies or possible manipulation in know your customer documents, invoices and other supporting evidence.
• Transaction monitoring: prioritising alerts, identifying emerging patterns and potentially reducing false positives.
• Investigation support: helping investigators summarise complex activity, identify gaps and organise evidence.

However, AI’s limits still apply. Explainability, validation, governance and human oversight remain essential, and an AI-generated assessment never replaces the firm’s responsibility to investigate suspicion and make the right reporting decisions.

Be fire with fire

So, to end where we started: what happens to the client in our earlier example? In a firm that combines AI-driven controls with well-trained staff, healthy scepticism and clear human accountability, the cracks start to show. No single check catches the client, but together, the gaps become hard to ignore.

A key message for all financial crime compliance staff is this: AI can help criminals manufacture the appearance of legitimacy, but it cannot create genuine economic substance.

Webinar: AI and Financial Crime - What are the threats and opportunities for firms?

Bruce has been working in financial services for nearly 40 years, 25 of these as a learning professional focusing on compliance for a wide range of financial services companies, mainly through the analysis, design, creation and implementation of global training programmes for Tier 1 Banks and FTSE 100 companies. He has been Global Head of Compliance Learning for such firms three times and has provided compliance learning consultancy to similar companies many times. 

Bruce has also provided compliance training and consultancy in other fields such as real estate, industrial supply chains, charities, payment services providers, gambling and casinos and many others.  He works as a compliance and training consultant for the pharmaceutical industry.

A former Director of Training for CISI, Bruce has extensive experience of compliance and financial services related qualifications and qualified as a Chartered Accountant with Price Waterhouse (as it was then known).

Bruce has wide experience of successfully delivering compliance-related training in Europe, The Middle East, the Far East, India, North America and Africa. Bruce’s training is highly effective with a clear focus on how adults learn most effectively, using innovative design and delivery, which combines a stimulating, culture-sensitive, learning environment with the highest standards of professionalism and a focus on the required knowledge, skills and behaviours of banking professionals.

Bruce provides excellent training events on compliance, with a specific focus on financial crime, including all aspects of anti-money laundering, anti-bribery and corruption, fraud and sanctions.

.