Criminal networks operationalise new technologies and exploit vulnerabilities faster than compliance programmes can respond. What structural, technological and cultural changes are needed to close the gap?