AI in Financial Crime Compliance: Adoption, Governance and Accountability
With AI here to stay, the Mills Review frames the challenge for financial crime professionals: "The question is no longer whether AI should be used, but who AI is going to serve?"
AI is evolving fast, changing not only within itself but both the threats of financial crime and how firms are able to manage them.
Research by Finextra & FICO found that although nearly every firm they surveyed recognised the need for enterprise-wide AI-enabled fraud management, fewer than one third had fully deployed AI-driven fraud detection at scale. Whilst that gap will close, it will do so under pressure. Firms are being pushed to build AI compliance capability at the speed AI-enabled crime is developing, which risks governance being left behind.
In this article, Bruce Viney, Director of Financial Crime Compliance Training, outlines how AI is reshaping financial crime risk, how the FCA and UAE Central Bank are responding, and the practical steps firms should take to keep governance and accountability aligned with adoption
How is AI changing financial crime risk?
AI is making existing financial crime faster, cheaper and harder to detect, rather than creating new typologies.
The Mills Review expects AI to amplify fraud and cyber risks by 2030, while Interpol describes AI as a "force multiplier" for criminal networks - enabling the same offences at greater speed and scale. The practical consequences are that voice cloning, biometric manipulation, deepfakes, synthetic IDs, cyber-attacks are becoming more frequent, more convincing and harder to detect. Already, identifying AI generated images with the human eye is next to impossible.
The scale is significant, the latest Nasdaq Verafin report records a sharp rise in criminal adoption of AI, with 90% of financial professionals surveyed in the report noting an increase. The same report puts global illicit financial activity at $4.4 trillion, having risen by $1.3 trillion across 2024 and 2025, with fraud the fastest-growing category.
However, fraud is not a ring-fenced predicate crime. It is one of many tools used by international crime networks to generate illicit funds, sitting alongside money laundering, cybercrime, human trafficking, sanctions evasion and proliferation financing. As AI erodes the traditional distinctions between these crimes, the ability to see financial crime as a single integrated threat becomes essential. Any framework built to counter the criminal use of AI must reflect that.
How are regulators responding to AI?
Faced with rapidly scaling threats, regulators are integrating AI into their oversight frameworks, while making clear that accountability stays with the firm.
FATF's December 2025 paper set out two parallel narratives:
- AI as a means of improving efficiency in law enforcement, preventive measures and compliance
- Use of AI by money launderers, terrorist financiers and sanctions evaders to circumvent existing frameworks.’
So, whose side is AI on? The truth is, AI doesn’t choose sides, its impact depends entirely on who is using it. Consequently, firms that refuse to adopt AI are choosing to meet an AI-enabled threat without an AI-enabled response.
National regulators are beginning to use AI as part of their supervisory approach. The UK’s Financial Conduct Authority (FCA) is developing its AI Lab and is experimenting with AI within its supervisory activities. The UAE Central Bank partnered with Accenture to enhance its Supervisory Technology (SupTech) and has since issued guidance on consumer protection and the responsible use of AI.
Despite operating in different jurisdictions, both supervisors are focusing on the same regulatory approach – firms may (and arguably should) use AI to automate and enhance a response to criminal use of AI, but accountability remains with the firm.
Why the shift from compliance activity to compliance effectiveness matters
Regulators are increasingly shifting their focus from procedural compliance to control effectiveness (i.e. do the controls actually work?), and AI is accelerating this shift.
Building on FATF's direction, both the FCA and the UAE Central Bank have moved towards assessing compliance effectiveness rather than compliance activity. This becomes more pronounced as firms rely on AI as an active compliance tool, because the workings of an AI system are largely opaque while its outcomes are measurable.
A firm that can evidence the effectiveness of its monitoring is in a stronger position than one that can only evidence that monitoring took place. For firms, this may begin to change what needs to be documented and what needs to be defensible in a regulatory intervention.
What does AI mean for firms in practice?
Regulators treat AI as a means of improving the effectiveness of controls, not replacing professional judgement. FATF sees the opportunity in AI to enhance our ability to dynamically identify risks, patterns and typologies -but only within an integrated framework of risk-based controls, with active human oversight. Decisions relating to SARs, risk assessments, red flags and alerts will remain in the human domain.
Data quality has always sat at the heart of effective financial crime compliance. Now, with the use of AI, it’s even more important. Without data that is accurate, relevant, appropriate and sufficient, an AI system will not produce reliable output - and may produce confident output that is incorrect.
Implementation of AI needs to be accompanied by appropriate, risk-based governance, covering model validation, explainability, ongoing monitoring and documentation. Remember, AI does not remove accountability, so governance arrangements should include clear statements of who is accountable for AI oversight.
Both the FCA and the UAE Central Bank are looking for integrated financial crime and risk-based compliance frameworks. Put simply, whilst distinct risks arising from different activities and typologies still require separate risk assessment; once these granular risk assessments are complete, they must be integrated into a single compliance control framework. Criminals don’t work in silos, so neither should we.
Risk-based financial crime training has been a vital pillar of compliance frameworks for years. However, it needs to move with the times. Staff training must help staff keep pace with threats and typologies that are evolving considerably faster than they were. Staff working alongside AI systems need targeted training in how to use them - including how to challenge an output rather than accept it.
Overall, staff training needs to adapt to the new risks that AI creates – both from the firm’s own use (e.g. data privacy, accuracy and bias) and from misuse by others (e.g. phishing, deepfakes and identity fraud).
Where does this leave firms?
The speed at which AI is transforming criminal activity surpasses anything most compliance professionals have seen, and the response will necessarily involve adopting AI to mitigate the risks it creates.
The real issue is about change, and in particular how supervision, regulation and control frameworks are shifting. At the heart of this are the people within the firm, and how they will be empowered to change and evolve as AI increases its presence.
Over the next few years, the firms that manage this successfully will be those that combined technological innovation, strong governance, high quality data and effective human oversight.
AI will not replace humans in financial crime compliance, but it will change their role - from data gathering to focusing on the decision-making process. Accountability remains human, and that requires new roles, new skills and new understanding.
How we can help
Our AI training courses help Front and Back Office staff, Compliance and Risk teams, and Senior Management and the Board build the governance, accountability and oversight this shift demands.
Get in touch
About the Author
Bruce has been working in financial services for nearly 40 years, 25 of these as a learning professional focusing on compliance for a wide range of financial services companies, mainly through the analysis, design, creation and implementation of global training programmes for Tier 1 Banks and FTSE 100 companies. He has been Global Head of Compliance Learning for such firms three times and has provided compliance learning consultancy to similar companies many times.
Bruce has also provided compliance training and consultancy in other fields such as real estate, industrial supply chains, charities, payment services providers, gambling and casinos and many others. He works as a compliance and training consultant for the pharmaceutical industry.
A former Director of Training for CISI, Bruce has extensive experience of compliance and financial services related qualifications and qualified as a Chartered Accountant with Price Waterhouse (as it was then known).
Bruce has wide experience of successfully delivering compliance-related training in Europe, The Middle East, the Far East, India, North America and Africa. Bruce’s training is highly effective with a clear focus on how adults learn most effectively, using innovative design and delivery, which combines a stimulating, culture-sensitive, learning environment with the highest standards of professionalism and a focus on the required knowledge, skills and behaviours of banking professionals.
Bruce provides excellent training events on compliance, with a specific focus on financial crime, including all aspects of anti-money laundering, anti-bribery and corruption, fraud and sanctions.
.
