Managing multi-jurisdictional AML compliance at scale 2025

Given today’s globalisation, it can be easy to forget how disconnected finance once was. You do not have to go far back to remember the difficulties in wiring transfers across borders. Today, for e-commerce, investing or otherwise, international finance is instant for the modern customer. And with that, there are plenty of holes for criminals to exploit.

The more cross-border activity we see, the larger the web that’s created for launderers or terrorist financiers and organised crime groups to remain unseen, and their proceeds from crime. Flushing laundered-cash-turned-clean through the surface level financial system is nothing new, and has been employed cross-jurisdictionally through air and ship travel. Now we have the new digital frontier creating as many challenges as there are solutions for detecting and stopping criminality. 

Financial institutions and market-leading fintechs can benefit greatly from appealing to more customers, anyone, anywhere in the world. In order to develop innovative products and make finance not just global but accessible, deterring cross-border fraudsters and payments is imperative from the start. Know Your Customer (KYC) checks can start off a safer, more transparent onboarding process for demanding clientele, but can only grow in line with expectations if part of an anti-money laundering (AML) process that can adapt.

Three crucial cross-border challenges

Before any sized financial institutions (FI) can dream to scale, it remains a common challenge to adhere to base-level KYC requirements. This is true at regional levels, with the added pressures of onboarding customers speedily, or facilitating the flow of legitimate transactions to another country where AML laws may look very different. At the same time, digital fincrime keeps morphing into new guises.

1. A lack of uniformity

The Financial Action Task Force (FATF) has the unenviable job of holding nations accountable for their AML efforts, and bettering the fight against evolving criminal methods. The uptake to the watchdog’s requirements differs around the world, either due to the personnel, technological or financial resources available to a particular jurisdiction, or specific risks that they face (such as exploitation, tax-related crime, state capture, corruption etc).

The market for compliance data management is set to reach over $13.6 billion by 2030, given the requirement to fit-out AML systems that can deal with the threat of advanced criminal technology and battling regulations. When this means that certain regions lack the AML mechanisms that’s expected of them, cross-border investigations suffer. It’s tricky to be able to identify sources of funds or potentially harmful entities acting in some areas. Transfer restrictions may be imposed, which stalls the experiences of users that expect an FI to facilitate, for example, remittance.

When the KYC practice requires access to customer data, different data privacy laws mean that some FIs may struggle to adapt their own AML systems to account for local requirements when collecting, storing, or sharing sensitive data. Besides legalities, cultural financial manners and language barriers only block the ease with which client information is transferred, even in extremely important cases such as investigating global money laundering.

2. Areas exposed to criminals

High-alert jurisdictions could be notorious hotspots for criminal exploitation which, when part of the global fabric, ensures laundered funds can cross borders into banking systems elsewhere. No matter where payments may end up, the sheer volume of digital processes are making the ‘masking’ of funds that much simpler, even when known laundering techniques such as smurfing, under- or over-valuing goods, and muling are on the agendas of FIs and governmental agencies everywhere. 

Couple that with the fact they’re passing between countries that have varying degrees of AML coverage, and it leaves major gaps throughout the interconnected ecosystem for bad actors to exist in. That can then proliferate, given that crime networks are stationed all over the globe and tough to track down or link together. Now, placement can be achieved digitally by exploiting dormant accounts using pseudonymous identities. Decentralised regulations allow funds to travel without the oversight of central authorities.

3. The speedy development of digital assets

The transferral of virtual assets – such as cryptocurrencies or non-fungible tokens (NFTs) – also currently exist in a vacuum that’s only partly regulated. The anti-fincrime world is only reactive to the spread of digital money which, while seeing some headway through certain jurisdictional efforts by the USA’s SEC and the UK’s Financial Services and Markets Bill, also falls short in certain regions. As such, savvy crypto-first launderers can get ahead using the following methods:

• Funds split between various digital currencies can mask tracking.
• Cryptocurrency ‘mixers’ or ‘tumblers’ pool various digital assets together to make payees and transactions unidentifiable.
• They can also be easily transferred into fiat currency using crypto exchanges or service providers (only recently gaining greater regulatory scrutiny). 
• ‘Privacy coins’ (including Monero and Zcash) enable anonymous transactions by obscuring the origins and end destinations. 
• E-transfers from one bank account to another in a different jurisdiction can obscure beneficial owners.

Global standards, local execution: where tech provides borderless AML

In order for the FATF to make their globalised AML mission possible, the regulator continually identifies localities that display vulnerabilities before blacklisting. In identifying them publicly, FATF attempts to create an impetus to make each part of the worldwide financial system as future-proofed as possible to these threats. Only then can interlinked businesses, regulators, governments, intelligence agencies, and law enforcement conduct KYC that’s valuable in punishing criminals and safeguarding integrity. 

FATF’s assessment of nations’ AML maturity is identified using effectiveness and technical compliance ratings in line with their 11 Immediate Outcomes. Together, the regulator and assessed nations cooperatively develop more tech-driven measures for advanced onboarding, enhanced due diligence, transaction monitoring and reporting. 

This is not just aimed at being more efficient or accurate in spotting timely suspicious activity, but advocating for greater takeup in regulatory technology (RegTech) that’s cost-effective in granting the diverse pool of financial companies access to cutting-edge AML that grows in line with customer data volumes.

Enhanced Due Diligence (EDD)

Technically advanced KYC goes beyond manual document checks to verify people are who they say they are. In an age where criminals can mimic customers to bypass biometrics, conducting due diligence properly entails the use of identity verification (IDV) including liveness checks that can be approved immediately with government-held documentation. 

If individuals are found to be from high-risk areas or on trusted watchlists (according to user-set risk thresholds) they can be automatically elevated to EDD to work out their nature of business or connected entities and company structures – crucial for identifying beneficial ownership.

Watchlist Screening

Global lists exist to expose sanctioned individuals or politically exposed persons (PEPs). Utilising electronic KYC (eKYC), the credentials and authentications of these individuals can be screened and matched against databases to determine if further action needs to be taken. With instantaneous watchlist screening accessible to FIs, a connected barrier is created to exclude risky customers from pervading within the ecosystem. 

Continuous Monitoring

RegTech aims to provide FIs with automated AI-driven monitoring solutions that can detect any suspicious behaviours among historical transactional datasets. Training AI models effectively depends on the quality and volume of data used, but the technology can learn and adapt its ability to find anomalous activity over time, and even detect newfound typologies that may be utilised to hide cross-border financial crime.

AI runs around the clock and processes data at a fraction of human time, ensuring that any customer identity and transaction checks following initial KYC are conducted consistently. AML becomes immediately proactive in stopping the flow of cross-border funds that are outside the norms of legitimacy.

Decentralised Identity (DCI)

While not widespread for risk assessment, DCI provides a new avenue to grant personal data controls to users in light of jurisdictional data privacy. Credentials can be stored within digital identity wallets only sharable with authorised parties, providing unrivalled security to customers and auditable KYC information for FIs.

Data Sharing and Collaboration

For AML across borders to be achieved as practically as the FATF framework attempts, there needs to be a proactive effort to share anti-fincrime intelligence, expertise and knowledge around jurisdictional data challenges and evolving criminal patterns. Within nations, initiatives have to be beyond sectors to identify suspicious behaviours that can be raised in order to prosecute them accordingly. Outside of this, worldwide AML professionals and greater RegTech usage can advocate for the most accurate and cost-effective cross-border KYC and AML. 

A 2024 Gartner KYC vendor survey found that 36% see cross-industry collaborative networks as “indispensable” for real-time risk management and reporting – bringing together accountable public and private companies to close compliance gaps and strengthen their individual and collective investigation methods.

Considerations to scale a multi-region compliance framework

Regulatory frameworks are not uniform, but this does not mean that consistent onboarding and monitoring workflows cannot be attributed to different regions whenever necessary. It takes an AML platform that can be customised according to various risk levels per jurisdiction, made all the more possible with RegTech advancements:

• Create screening rules: users are able to adapt their KYC verification workflows according to regions that may lack AML compliance.
• Customised risk models: compliance teams can adjust risk thresholds on customer risk profiles based on geographies where they operate.
• Reporting with confidence: AML systems that track trails of investigation provide the necessary audits for regulatory assessments in any region. 

Of course it’s not just worldwide and regional rules which change. Individual entities may not always stay the same, so maintaining continuous vigilance relies on perpetual KYC (pKYC). This works to update data amongst customers’ unified risk profiles in real-time, according to transaction histories, adverse media, watchlists and public records. When this is implemented, an FI remains capable of catching fast-changing behaviours immediately. It’s a future-first method that bolsters KYC well beyond one-time verification.

When AML becomes automated, intelligent and fully bespoke to appeal to varying jurisdictions using these advanced risk controls, the same principle can be applied to onboarding new customers. Businesses become safe and trustworthy, scaling their userbases without compromising the quality of their compliance.

While FATF and regional regulators work tirelessly to promote beneficial AML to reduce the risk of faulty compliance, fines and reputational damage, it is through risk-based technology that each invaluable part of the financial world can remain so. Not only can they continue to provide products that positively change the way customers engage financially, but do so in the knowledge that they’re halting today’s and tomorrow’s criminals from jeopardising the financial ecosystem, which should be thriving in this exciting age of digitalisation.

Up next in our blog series: Enhancing customer onboarding at scale

Disclaimer
This article is intended for educational purposes and reflects information correct at the time of publishing, which is subject to change and cannot guarantee accurate, timely or reliable information for use in future cases.