The role of technology in scaling AML compliance successfully

A rise in customers is always welcome. It’s a shame that it can cause more problems than success for some financial institutions (FIs). 

With greater power comes greater responsibility. In this case, meeting customer demand with more complex and costly compliance requirements is necessary to protect the identities of legitimate clients and spot wrongdoing consistently in global payment systems. Scaling anti-money laundering (AML) compliance successfully relies on the quality of the process never being compromised as it grows to accommodate more data. 

That’s easier said than done. It relies wholly on embracing sophisticated technology that can fight against the typologies that criminals embrace, curbing biometrics and authentications to hack, steal and blackmail customers with data. The hands-on investigations that once existed waste too much time and resources. With false positive rates reaching 95%, the long-term effect of missing vital alerts can devastate reputations. 

The good news is how readily FIs, from startups to brick-and-mortar banks, are increasingly seeking AML technology vendors to reduce errors, smooth the reporting of suspicious actions to regulators and speed up onboarding checks for the end customers. Alert detection and the effectiveness of systems are a huge plus-point for AI; the technology that can become more actionable as a tool for scaling AML operations. It’s very much needed in this regulatory landscape where only those with safety and integrity will flourish.

The regulatory troubles of static compliance systems

Know Your Customer (KYC) checks are a legal requirement around the world within AML frameworks, nuanced as per its jurisdiction: the global Financial Action Task Force (FATF) Recommendations, the EU’s Sixth Anti-Money Laundering Directives (6AMLD), or KYC Guidelines and Financial Conduct Authority (FCA) Regulations in the UK. In the latter, fines for poor AML enforcement were up 156% in 2024. In South Africa, firms face escalating audits and sanctions beyond their FATF greylisting, where, granted, significant progress has been made in delisting.

Onboarding more and more valuable clients is a defining growth factor. Still, no onboarding is completely airtight without stringent KYC that acts around the clock against trusted watchlists to catch out blacklisted entities. Static, outdated platforms are inflexible to these consistent watchlist shifts and regulatory matters. Siloed working splits analysts’ time when cross-referencing pertinent customer data, and physical paper trails are still used to collect forms of identification (passports or ID cards).

Utilising different systems for each integral stage of AML – not designed to fit together seamlessly – exposes compliance gaps and invites criminal exploitation to obfuscate money by opening their anonymous accounts within dormant profiles, among other methods.

This has further knock-on effects for customers wanting to open accounts. KYC operating costs from manual labour contribute to a slow, off-putting experience, while high fees charged to adhere to ID verification price out some customers trying to access more inexpensive credit services or lending. This also stems from managing multiple vendors, where larger banks simultaneously aim to orchestrate many best-of-breed AML products. 

In a report by Gartner, regulatory pressure has resulted in two drivers for banks to replace their AML systems:

• Increasing productivity when investigating AML cases and reducing the total cost of ownership (TCO). 
• Increasing the accuracy of detection and risk scoring.

This extends to smaller FIs that may lack budgets or resources due to increasing money laundering methodologies. A lack of advanced technology will prevent them from meeting AML standards and render them inoperable financially.

Addressing synthetic IDs, deepfakes, and identity fraud through layered verification

Customer data stolen from faulty KYC plays well into the hands of financial criminals, where new technologies help them bypass sophisticated detection and scale their operations. Biometrics may feel like a catch-all for verifying legitimate people behind the accounts, but deepfakes skew the lines between reality and fiction. Generative AI can fabricate online personas from breached identity data to get past ID checks at the KYC stage. More technical ‘injection attacks’ can insert deepfake images or videos into software APIs to curb the need for device cameras. 

Sophisticated criminal networks are spread worldwide, orchestrated across online channels (surface level or on the dark web), data providers, and unregulated ledgers. This makes them exceptionally tricky to find, but letting even one breach slip can be devastating. To prevent this, a collaborative approach from the entire financial system is needed to instil effective eKYC compliance from institution to institution and improve the capabilities of multi-factor authentication, biometrics, and liveness checks, leaving fewer gaps for this infiltration to proliferate.

While AI is powerful for criminals, the technology is highly effective for identity verification (IDV). One-to-one matching algorithms can distinguish real profiles from mocked-up images in real time. Names and facial recognition (through selfies) must be tracked against government documents, adverse media lists, and watchlists. The operative matters are speed and accuracy; this cannot be achieved without KYC, adept at dealing with criminal means and able to scale up AI-driven technology according to customer influx. 

How AI revolutionises and scales AML processes

It’s reported that small to medium-sized enterprises are expected to grow at a CAGR of 11% to 13%, slightly smaller than large businesses, due to stifled innovation under AML compliance. So, not only do AI-based solutions need to be affordable, but they also need to integrate with pre-existing KYC workflows and introduce flexibility to make them fit for the future.In light of this, regulatory technology (RegTech) partners are becoming the go-to solution.

Even for market entrants needing to hit the ground running with well-implemented KYC, Regtechs offer a dynamism that traditional processes miss: integrated systems for compiling and sharing customer data, real-time detection against watchlists and government bodies, and machine learning to ensure the entire AML system is consistently effective with growing user bases. 

There are multiple ways that AI-based RegTech allow businesses to stay in-tune with the complex GenAI and deepfaking techniques that would override ‘unprepared’ traditional solutions:

• No matter how nuanced, legitimate documents can contextualise and check comprehensive customer information.
• Risk profiles can be built more specifically through signals including geolocation or device fingerprinting, active liveness detection for moving images or actions, and passive liveness detection to analyse ‘unreal’ cues from skin texture to lighting reflections.
• Synthetic data can be set up to simulate real-life attacks, for AI models to be trained to spot significant anomalous behaviours indicative of sophisticated criminal techniques (without compromising accurate customer data).

Of course, the quality of the AI at work lies in the hands of expertise; RegTech providers’ support and training allow any FI to take advantage of advanced capabilities that spot fraudulent behaviour at the very first crucial stage, and further still, perpetual KYC (pKYC) to update risk profiles immediately according to changing circumstances. 

Going the extra step with RegTech

pKYC enables AML control around the clock and can deal with high volumes of potential risk alerts at the onboarding stage. In a short time, it will become the requirement for future-proofed compliance that can keep pace with evolving criminal threats and grant legitimate customers phenomenal experiences. 

RegTech is the gateway allowing FIs of any size to share data with trusted sources for IDV, speeding up the route from customers opening an account to starting to use payment services, remittance, and more. In areas where immediate checks for instant payments are key (in the EU, particularly), this is mandatory and in line with customer data protections in the light of cryptocurrencies and other digital assets and wallets. 

AI-backed RegTech also assists institutions in compiling vast amounts of risk information to pre-populate or generate suspicious activity reports (SARs) ready for audit. Once a laborious box-check task to appeal to regulators can be made seamless and to industry standard, using the UN-backed goAML feature. It reduces the faff of raising criminal activity, but more importantly, brings together watchdogs, FIs and law enforcement all accountable to stop it. 

A trend to try to engineer multiple systems may not work for smaller businesses that need global pKYC coverage, anti-deepfake technology, and accurate transaction monitoring at all times. Instead, united systems driven by shared data and workflows are efficient on budgets and grants holistic and consistently-updated customer risk profiles for better compliance decisions. People’s activities change, as do regulations; an entire end-to-end system from onboarding onward that proactively maintains quality AML offers it all, in one stop.

Appealing to new customer demographics and bringing new products to market is integral to the future of positive competition within financial services. While opportunistic thieves can capitalise on the complexity of compliance or its loopholes and grey areas, putting a process in place now can help disruptive FIs continue to flourish without the AML compliance spectre. AI-driven KYC is better for customers and the vendors that use it, which, with more widespread appeal, can lock down risk assessment vulnerabilities and help every key player scale and accommodate accessible finance for all.

Missed our previous article? Find out more about Fintech’s lessons on operational efficiency at scale

Disclaimer
This article is intended for educational purposes and reflects information correct at the time of publishing, which is subject to change and can not guarantee accurate, timely or reliable information for use in future cases.