Part one: demonstrating effectiveness 2.0
Since assuming the presidency of FATF, Giles Thomson has been direct about the state of the threat and the response it demands. Financial crime, he argues, has industrialised. Criminal groups are diversifying and cooperating across fraud, money laundering and other predicate offences, using shared infrastructure, professional enablers, virtual assets and specialist laundering services. His response has been equally direct, “we need to match their pace with a united front across sectors and borders.”
The scale of the challenge underpinning Thomson’s comments is considerable. Global money laundering is estimated at between $800 billion and $2 trillion a year, and which amounts 2 to 5% of global GDP. Fraud is a major and growing driver of it, with global losses estimated at $442 billion in 2025 alone - a sum rivalling the proceeds of the worldwide drugs trade - with Americans alone reporting $15.9 billion in losses that year.
But Thomson’s remarks can be read as a sharper restatement of the ‘effectiveness’ framework FATF has pushed for over a decade. It first introduced the requirement to assess effectiveness, not just technical compliance, in 2013, shifting the test from whether a country had the right laws on the books to whether its system was actually delivering results: investigations, prosecutions, asset recovery, intelligence that gets used. So, what’s new?
Illicit finance is no longer treated only as a compliance failure; the mechanism that moves money to fund wars, evade sanctions, launder the proceeds of corruption, and enables fraudsters and other organised criminals to enjoy the proceeds of crime is increasingly being called out as a strategic threat.
As a result of this growing realisation, pressure is being applied with real specificity. Banks are being told, not just encouraged, to stop screening everything and filing defensive SAR/STRs, and instead to concentrate on activity that is genuinely high-risk. The Wolfsberg Group has rather bluntly summed up the expectation, stating “a focus on everything is a focus on nothing.” National Financial Intelligence Units (FIUs) face their own version of this scrutiny under FATF's fifth round of mutual evaluations, which judges them not on how many reports they process but on the breadth of sources they draw on, the quality of the operational and strategic intelligence they produce, and whether any of it actually reaches law enforcement in a form they can use. Law enforcement has not escaped the same demand with agencies expected to show that the financial intelligence they receive translates into prosecutions, disruption, and assets recovered.
And underneath both of those sits an additional, and complementary force, a growing insistence that tackling financial crime cannot exist in siloed isolation. Collaboration, intelligence sharing and interoperability across private to private, public to public and private to private sectors are being explored vigorously. The Netherlands' TMNL and Singapore's COSMIC show what structured, cross-bank information-sharing looks like in practice; Australia's AUSTRAC leads the Fintel Alliance, and separately chairs regional FIU cooperation across the Asia-Pacific and Pacific; the UK's JMLIT and Data Fusion initiatives runs on the same logic domestically. What is comparatively new is how much of this is now being pushed across borders, not just within them.
While the effectiveness framework has been debated widely by the global AML community for some time, and its elevation to a national strategic threat has started gaining real traction in recent years, what is providing genuine promise is the role technology can now play in facilitating better detection and investigation of financial crime, in the more robust production of financial intelligence, and in enabling secure cooperation between the system's major players.
Part two: what technology now makes possible
What makes this moment different is that the capability to act now actually exists. The starting point is scale: systems that can process volumes of data no analyst ever could, surfacing patterns a human reviewing cases one at a time would never see. That shift carries with it a genuine realisation, consistent across banks, FIUs and enforcement alike, that financial crime is a network problem, not an entity problem. FATF's own 2026 research on underground banking describes an industrialised landscape where the same infrastructure - shared professional enablers, the same settlement chains, the same shell structures - services multiple, often unrelated criminal clients at once. Automation absorbs much of the repeatable work that used to consume an analyst's whole day, pulling together internal information and fusing it with additional external data points to work a case. It doesn't remove judgement from the process but rather moves it to where it actually matters: interpreting what has been found rather than spending hours finding it.
What has changed just as much is the diverse range of material that can feed into that process. Open source intelligence (OSINT) technologies once reserved for government security services can now draw on a far broader set of sources than compliance teams have traditionally had access to. Anti-financial crime professionals are moving well beyond PEP lists, sanctions data and adverse media, to incorporate corporate records, social media, vessel, aviation and trade data, all adding context that a name-check alone could never supply.
To make use of OSINT tools, techniques and workflows, financial institutions have been building out specialist financial crime investigations, intelligence and threat mitigation teams – staffed with professionals drawn from government security agencies, law enforcement and military units – to take a more proactive and “intelligence-led” approach to detecting illicit finance. These units are harnessing technology to take a more programmatic and rigorous approach to monitoring the typologies and threats surfacing from the output from investigative journalists, think tanks, and international bodies alongside information flowing through emerging information sharing partnerships. While the strategic intelligence produced is providing insights that help to fine tune detection setting and raise awareness among relevant stakeholders, major gains are being demonstrated by firms that are able to utilise tools that pull specific names and networks out of that analysis and cross-reference them, proactively, against customer, transaction and SAR data, opening a case before an alert would otherwise have existed.
Of course, we could not discuss the role of technology without referencing artificial intelligence (AI). Used inside a properly governed intelligence cycle, it can compress exactly the collection and processing work described above, freeing human judgement for the analysis and reporting that needs it. Used carelessly, it creates a different problem entirely: outputs no one can explain, audit, or defend to a regulator, a court, or a victim. The honest position is not that AI replaces the analyst, but that it belongs firmly in the workflow, with humans in (and on) the loop in a manner commensurate with the associated risks.
The adoption of advanced technologies to produce better strategic and operational intelligence is being explored across the AML/AFC spectrum, albeit in some jurisdictions, banks and FIs are pursuing this adoption with greater vigour than their FIUs and law enforcement counterparts.
But none of this works without a way to share the intelligence that’s produced, with each organisation only seeing a small piece of the puzzle through their own limited perspective. Perhaps the most important area of focus, from a technical and legal perspective, is supporting the sharing of highly sensitive data across borders and between organisations in a timely and secure manner, precisely the kind of cooperation being demanded of the system.
Historically, demonstrating effectiveness has been expensive, because the work itself was data-intensive and, at the more specialist end, highly manual and time consuming. The technologies above are finally making that model affordable at scale, just as regulators across every tier of the system are demanding the results it can produce. Whether that is enough to tackle the industrial scale of the problem is yet to be seen. But for the first time in a long time, the tools to try now exist.
