The Evolution of Financial Crime and the Transformation of AML Functions

For decades, anti-money laundering (AML) systems have been built on a relatively stable logic — customer identification, risk assessment, and transaction monitoring based on predefined scenarios. This model assumes that customer behavior is relatively predictable, that deviations can be described through rules, and that criminal schemes follow recurring patterns that can be identified.

With the emergence of artificial intelligence, these assumptions are starting to lose their validity. The reason is not simply automation or increased data volumes, but the fact that AI enables the simulation of “normal” behavior at scale. This means that illicit activity no longer aims to evade controls through deviation, but rather by blending into expected patterns. As a result, AML systems face a new type of challenge — identifying not obvious anomalies, but well-constructed normality.

Controls as a Source of Risk

The 2019 case, reported by The Wall Street Journal, in which a UK-based company executed a €220,000 transfer following a phone call from its “CEO,” illustrates not only technological advancement but also a shift in risk dynamics. There was no system compromise or traditional email fraud — only a highly convincing voice.

This changes how internal controls should be perceived. Mechanisms traditionally seen as additional safeguards — such as verbal confirmations or phone verifications — can become entry points for fraud. In this context, trust ceases to be a protective mechanism and becomes a vulnerability when it can be convincingly simulated.

Artificially Constructed Customer Profiles as a Long-Term Risk

Data from Federal Bureau of Investigation and Federal Trade Commission is often cited in relation to artificially constructed customer profiles — combinations of real and fabricated data used to create seemingly legitimate identities. However, the key issue is not their scale, but how they are used.

These profiles are not created for one-off fraud. In most cases, they are used over time, initially building trust through entirely normal behavior. A transaction history is established, relationships with various counterparties are developed, and gradually the profile begins to resemble that of a typical customer.

Crucially, the risk does not materialize at the beginning of the relationship, but at a later stage, when sufficient history has been built and suspicion is lower. This challenges approaches that treat onboarding as the primary control mechanism.

In this sense, such profiles should be understood as a means of accessing the financial system with reduced detection risk, rather than as isolated fraudulent activity.

When AML Systems Become a Predictable Factor

Analysis of activities linked to Lazarus Group shows behavior characterized by a high degree of adaptation and structure. Transactions do not appear random, but rather as part of a deliberate process aimed at optimizing behavior within the control environment.

This leads to an important conclusion — AML systems no longer function solely as control mechanisms, but also as factors that influence how participants behave.

When system responses are predictable, they can be used as a source of information. Each block, delay, or alert provides insight into how controls operate. This enables the gradual shaping of behavior that remains below detection thresholds.

As a result, a dynamic environment emerges where controls not only limit risk but also indirectly shape how it manifests. In turn, behavior adapts to meet system expectations without directly violating them.

Limitations of Identification in a Digital Environment

Reports by Europol show that the ability to create convincing digital identities challenges traditional approaches to customer identification. In the past, identification was viewed as establishing an objective fact — whether a person exists and whether the provided data is authentic.

In a digital environment, this logic is no longer fully applicable. Increasingly, identification becomes an assessment of how convincing the provided information and behavior are.

This means that identification does not provide absolute certainty, but rather a level of confidence based on available data and technologies. As a result, the importance of ongoing monitoring increases significantly.

When identity can be convincingly simulated, customer behavior becomes the primary indicator through which risk can be assessed over time.

Limitations of Transaction-Based Analysis: Lessons from Danske Bank

The Danske Bank case demonstrates that analyzing individual transactions is insufficient for understanding complex schemes. Many operations did not appear unusual when viewed in isolation, yet collectively formed a pattern that went undetected.

This highlights the limitation of approaches that assess each transaction independently, without considering the broader context. In practice, risk rarely manifests through a single action, but rather through a sequence of actions that appear normal on their own.

In this sense, the significance of a transaction cannot be assessed without understanding behavior over time and its connections to other activities.

Limitations of Transaction-Based Analysis: Lessons from Danske Bank

The Danske Bank case demonstrates that analyzing individual transactions is insufficient for understanding complex schemes. Many operations did not appear unusual when viewed in isolation, yet collectively formed a pattern that went undetected.

This highlights the limitation of approaches that assess each transaction independently, without considering the broader context. In practice, risk rarely manifests through a single action, but rather through a sequence of actions that appear normal on their own.

In this sense, the significance of a transaction cannot be assessed without understanding behavior over time and its connections to other activities.

The Role of Artificial Intelligence in Modern AML Processes

In response to this environment, the use of artificial intelligence in AML is not merely about automating existing processes, but about redefining how risk is identified and assessed.

Defining Normal Behavior in Context

One of the most significant effects of AI is the ability to define normal behavior not as a predefined framework, but as something derived from real data and observed patterns.

In practice, this means systems build expectations based on historical behavior, similar customer profiles, and the specific context of transactions.

Within this model, the meaning of an action is not determined solely by its parameters, but by how well it aligns with expected behavior. The same transaction may be entirely normal in one case and high-risk in another, depending on context.

Analyzing Relationships Between Customers and Transactions

Analyzing relationships between customers and transactions represents a fundamentally different approach from traditional models that assess entities in isolation. Instead of focusing on individual deviations, this approach examines dependencies and patterns of interaction.

Institutions such as HSBC and ING use such models to identify hidden connections and coordinated activity.

This allows the detection of groups of customers who appear normal individually, but collectively exhibit behavior characteristic of organized schemes.

Prioritization of Alerts and Analytical Efficiency

In practice, one of the main advantages of AI is not necessarily identifying more cases, but structuring and prioritizing information more effectively. AML teams deal with large volumes of alerts, where the challenge is not lack of data, but information overload.

By prioritizing, grouping, and contextualizing alerts, AI enables analysts to focus on the highest-risk cases. This improves resource allocation and reduces time spent on irrelevant alerts.

As a result, the role of analysts shifts from reviewing large volumes of individual cases to interpreting more complex patterns and relationships.

Dynamic Risk Assessment Over Time

AI enables risk to be viewed not as a static characteristic defined at onboarding, but as something that evolves based on customer behavior.

In practice, even small behavioral changes can become significant when analyzed over time and in context. This requires continuous monitoring and reassessment, where the time dimension plays a critical role.

Risk is therefore not identified at a single point, but tracked as a developing pattern that may gradually indicate deviation.

The Role of Expert Judgment in AML Processes

Despite technological advancements, the role of human judgment does not diminish — it evolves. AI can support the identification of potential risks and generate hypotheses, but their evaluation and interpretation remain the responsibility of analysts.

This is particularly important in the context of regulatory requirements, where decisions must be justified and traceable. Automated detection alone is insufficient if it cannot be explained and defended.

Effective AML functions are therefore not defined by the level of automation, but by the ability to balance technological tools with expert judgment.

What Distinguishes an Effective AML Approach

In today’s environment, both criminal networks and financial institutions have access to similar technological capabilities. The difference lies not in the tools themselves, but in how they are used.

Criminal models use AI to blend into normal activity.
AML functions use it to define what normal behavior actually is and when it deviates.

This is the fundamental distinction.

In a world where behavior can be convincingly simulated, sustainable advantage will not come from system complexity, but from the ability to understand context and identify patterns that appear normal at first glance.

How Compliance Navi Can Support This Process

In this dynamic environment, building an effective AML framework requires not only implementing technologies, but also structuring and integrating them within the overall control model.

Compliance Navi supports obligated entities in adapting their AML processes to emerging risks associated with artificial intelligence.

In practice, this includes assessing existing control mechanisms, identifying potential vulnerabilities related to behavioral patterns and new technologies, and designing monitoring frameworks that capture the dynamic nature of risk.

Training is a key component in this context. Understanding how AI can be used both to bypass controls and to strengthen them requires targeted preparation of AML teams. Compliance Navi develops practical, case-based training programs that enable specialists to recognize emerging patterns and apply more effective analytical approaches.

The focus is not only on implementing tools, but on building a sustainable model that combines technological solutions with expert judgment and aligns with regulatory requirements.

Where needed, Compliance Navi is available to review existing AML frameworks or discuss specific cases related to emerging technological risks.