One Crime, Many Silos: Why the AML/Fraud Divide Is Helping Criminals Win
One Crime, Many Silos: Why the AML/Fraud Divide Is Helping Criminals Win
One Crime, Many Silos: Why the AML/Fraud Divide Is Helping Criminals Win
Look at the agenda for any financial crime summit and you will find the same structural choice: a main stage dedicated to AML and compliance - and a separate room for fraud. The sessions do not overlap. The delegates do not always mix. The problems, as implied, are distinct.
Transform Finance's Amsterdam summit made an explicit point of questioning that assumption - and the answers it produced were provoking.
"Fraud is a predicate offence to money laundering," one panellist stated flatly. "You cannot say they are two separate things." The money stolen in an investment scam, a romance fraud, or an authorised push payment does not disappear; it moves through mule accounts, shell structures and cryptocurrency exchanges into the same laundering ecosystem that processes the proceeds of drug trafficking and sanctions evasion.
The criminal who defrauds a victim and the criminal who launders the proceeds may be different individuals operating in different jurisdictions, but the money connecting them tells a single story. By financial institutions dividing their investigative functions, this inately ensures that story is never fully read.
The view from inside the silo
The consequences of this division play out at every level of a financial institution's operations.
At the systems level, AML and fraud functions typically run on separate platforms, calibrated to separate typologies, generating separate alerts. A transaction that registers as mildly anomalous on one system and mildly anomalous on another may not trigger investigation on either - because neither system can see the other's signal. Combined, the two data points might constitute clear evidence of a coordinated attack. Separated, they are just noise.
At the analyst level, training divides along the same lines. An AML analyst develops deep expertise in layering and integration patterns. A fraud analyst knows the behavioural signatures of account takeover and social engineering. Neither routinely develops the other's knowledge. Yet, the typologies increasingly overlap: money mule networks, for instance, involve the same accounts, the same transaction patterns and the same individuals whether they are classified as a fraud problem or a money laundering problem - and the appropriate response may differ depending on which lens is applied.
At the customer level, the consequences are most visible. A customer whose account is simultaneously under review by the fraud team, the AML team and the periodic CDD function may receive multiple, uncoordinated outreach calls in the same week. Each team could be unaware of the others, asking overlapping questions, each representing the institution as if it were a different entity. The experience is confusing at best and alarming at worst. It is also, as one speaker noted with some care, precisely the kind of institutional incoherence that social engineers exploit. A call that appears to come from "the bank" is far more credible to a victim already receiving multiple legitimate contacts.
The money mule problem
Nowhere is the cost of siloed thinking more acute than in the management of money mule accounts - and it was on this point that summit's discussion became particularly searching.
Between two and three per cent of newly opened accounts at some institutions are estimated to be opened for fraudulent or money mule purposes. But the more striking finding is that 70% of mule accounts in active use have been held at the institution for years - often opening with normal-looking activity, going dormant, and then being activated when the criminal network is ready to use them. The KYC check at onboarding, however thorough, provides no protection against an account that was opened legitimately and corrupted later.
This creates a surveillance problem that neither fraud nor AML functions are well positioned to solve in isolation. The fraud team sees the velocity of incoming and outgoing transactions at the moment of mule activity. The AML team may hold historical account behaviour data that reveals the pattern leading up to it. Without a shared customer risk profile that both teams can read, the precursor - signals multiple login attempts from different IP addresses, a period of dormancy, a sudden uplift in transaction frequency - may never be assembled into a coherent picture.
The problem deepens when the mule account holder is themselves a victim. A growing pattern identified at the summit involves existing customers being recruited or coerced into allowing their accounts to be used. Identifying and responding to such cases requires a degree of nuance that rule-based systems are poorly placed to provide. These individuals are neither straightforwardly criminal nor entirely innocent. Simply closing their accounts - the traditional institutional response - removes the bank's visibility and pushes the problem elsewhere.
"You are not even allowed to just close an account," one compliance officer observed. "You need to do a lot of investigation before you can say it is acceptable not to do business. The strength, the capacity to find, detect and be reasonable - more and more of that is being placed on the shoulders of the gatekeepers."
What convergence looks like
The summit explored, with some care, what a genuinely unified financial crime function might look like in practice and what the obstacles to getting there are.
On the technology side, the model gaining traction is a unified alert and case management layer sitting above the specialist detection systems, drawing signals from AML, fraud, sanctions and KYC functions into a single customer risk view. There is no need for the abolition of specialist teams or the replacement of exciting systems. This requires coherent data flow - and for there to be a single point of accountability for the whole picture rather than fragmented pieces of it.
On the human side, the challenge is more delicate. Specialism has genuine value. An analyst who knows AML deeply is more useful than one who knows it shallowly alongside three other disciplines. The goal is not to produce generalists, but to ensure that specialists have enough cross-domain awareness to identify when a case needs a different pair of eyes - and the communication lines to make that escalation promptly.
On the governance side, the requirement is executive sponsorship. A convergence initiative cannot be driven from within a transaction monitoring team. It requires a shared vision articulated at the top of the organisation, cross-departmental ownership, and budget that does not belong to any single function.
The cross-border dimension
The siloing problem extends well beyond the walls of individual institutions. Criminals operate across borders as a matter of course. Financial institutions cooperate across borders only with considerable legal and procedural friction.
Within single jurisdictions, progress is being made. The Netherlands was cited at the summit as a model of domestic public-private intelligence sharing, with collaborative frameworks between banks and the Financial Intelligence Unit operating in a manner that would be difficult to replicate in many other European markets. But the majority of significant fraud and laundering activity crosses borders and the frameworks for cross-border institutional cooperation remain underdeveloped.
The incoming AMLA regulation, specifically Article 75, which creates a legal basis for cross-border public-private information sharing partnerships was discussed with genuine optimism. But optimism tempered by experience. "We need strong guidelines and strong governmental drive," one speaker said. "Otherwise the impact will be good but not efficient." The reference point was Singapore, where government-mandated reporting standards and clear compliance obligations have produced measurable reductions in fraud losses. The contrast with European fragmentation - where reporting formats, legal thresholds and investigative obligations differ materially from one member state to the next, was not flattering.
The broadest formulation came from a panellist who had grown impatient with the framing of the problem as either an AML question or a fraud question. "This is crime," they said. "Crime is inherent to humanity. We cannot stop it and we cannot isolate it. We need to bring all the sides together - because what you cannot see, you cannot work against."
It is difficult to argue with that. The question is whether the industry can reorganise itself fast enough to act on it.
This article is part of Transform Finance's coverage of the 4th Annual FinCrime Leaders Summit Europe, Amsterdam 2026.
