Since assuming the presidency of FATF, Giles Thomson has been direct about the nature of the threat. Financial crime, he argues, is becoming industrialised: increasingly professionalised networks of enablers now offer laundering as a commercialised service, operating across borders and sectors at a pace traditional, siloed responses were never built to match. As Thomson put it, “we need to match their pace with a united front across sectors and borders.”
The scale behind that warning is considerable and enforcement has not kept pace. INTERPOL estimates that under 1% of criminal assets are seized and frozen worldwide, with the share recovered and returned smaller still. The UK’s National Crime Agency estimates that more than £100 billion is laundered in or through the country and its corporate structures each year, against around £350 million recovered in a good one, a conversion rate of well under half of one per cent.
Pressure on the system’s key players is increasing in response, with bodies representing the interests of banks and national Financial Intelligence Units (FIUs) pushing the same way, wanting closer collaboration, a sharper focus on effectiveness and a change in where each part of the system spends its effort.
Effectiveness has always been the stated goal, what’s different now is that the tools have caught up. Capability that used to be scarce and expensive is becoming available at scale, just as regulators at every tier are demanding the results it makes possible. Against an industrialised threat, the capability that matters most is seeing the whole network being a single flagged account.
Giles Thomson’s vision builds on a realisation that has been growing for several years, that illicit finance is no longer simply a compliance matter, but a national and international security concern requiring a correspondingly serious response.
Each part of the system is being asked to work differently. Banks are being pushed away from screening everything toward higher risk activity, with specialist investigation and intelligence units running proactive, intelligence-led work rather than simply clearing alerts.
FIUs are being assessed and measured the same way. FATF’s own effectiveness methodology increasingly judges financial intelligence not by volume processed but by whether it facilitates real action against criminals and their assets. COSMIC is itself an example of this shift in practice, not just principle.
Law enforcement has been pulled in the same direction, toward sharing intelligence more readily and pursuing asset recovery more aggressively, rather than treating the financial trail as secondary to the underlying predicate crime. The UK’s Data Fusion initiative, through which major banks share higher-risk transaction data directly with the National Crime Agency, is a direct product of this shift.
Yet teams, structures and strategies are only as effective as the tools available to them, and for most of the last two decades, those tools lagged a long way behind the ambition.
The core tools have barely changed, like list-based querying of individual entities for links to politically-exposed persons and sanctions, plus relatively basic adverse-media and rules-based transaction monitoring. Both have proven ill-equipped for a world of industrialised, technology-enabled, networked financial crime.
In banks, the practical consequence was that real depth of investigation depended on a small, expensive pool of expertise usually drawn from government, military or law enforcement backgrounds. HSBC’s 2012 fine for failing to prevent Mexican and Colombian cartel laundering led to hiring the former Director of the US Financial Crimes Enforcement Network to build its Financial Crime Threat Mitigation function from scratch. Standard Chartered, Citibank, Deutsche Bank and NatWest built similar units, and in each case the unit exists because a failure forced the institution to import capability it did not have, at a cost only the largest banks could absorb.
FIUs faced a version of the same constraint, with an added structural disadvantage: funding. Investment in financial intelligence capability has historically arrived reactively, triggered by a poor FATF Mutual Evaluation result or the threat of appearing on the grey list, rather than as a standing institutional priority. The Royal United Services Institute has gone as far as describing the UK’s own FIU as “one of the most materially significant structural weaknesses in the country’s economic crime system.”
Across banks, FIUs and law enforcement, the result was not bad faith but a structural mismatch between the scale of the problem and the resources available to address it. Activity was substituting for effectiveness, because effectiveness was expensive and activity was what could be afforded.
Regulatory direction is reinforcing this at every tier simultaneously, not sequentially. The Wolfsberg Group’s own language captures the shift bluntly, “a focus on everything is a focus on nothing.” Banking regulators across the US have proposed rules in 2026 directing institutions to spend less effort on low-risk activity and more on genuinely high-risk relationships.
Automation now absorbs much of the repeatable work that previously consumed scarce analyst time. It pulls together corporate records, maps ownership and control structures and assembles the first pass of a case. That shift doesn’t remove judgement from the process; it moves to interpreting what has been found, rather than spending hours finding it.
This is the shift that matters most: financial crime is a network problem, not an entity problem. FATF’s own 2026 research on underground banking describes an industrialised landscape where the same infrastructure, from shared professional enablers to settlement chains and same shell structures, services multiple, often unrelated criminal clients simultaneously. It is the industrlisation Thomson warned about, seen from the inside. Understanding one flagged name in isolation was never going to be enough; understanding the network behind it increasingly is the actual task.
Capability once confined to government intelligence agencies is, as a direct consequence, becoming broadly accessible rather than exceptional. FATF’s own good-practice guidance now explicitly recommends open-source intelligence and social-media monitoring as standard detection tools, citing Oman’s central bank as a working example of combining OSINT with supervisory data and law enforcement feedback to identify high-risk cases before they escalate. A function that used to require hiring directly from a national intelligence agency is increasingly something a well-resourced compliance or intelligence team can build and run itself.
Government’s own posture toward the private sector is shifting too, from information-sharing partnership toward active, if carefully governed, disruption. The UK’s Data Fusion initiative, through which major banks share higher-risk transaction data directly with the National Crime Agency, already reflects this; a US Presidential Memorandum signed in August 2026, authorising vetted private firms to conduct government-supervised operations against foreign cyber-enabled criminal networks, extends the same logic considerably further.
The technology making all of this practicable now spans a genuine ecosystem. There are tools for tracing and recovering illicit assets as they move through increasingly complex and digital financial infrastructure; verified, secure channels that let law enforcement and the private sector exchange sensitive information at a speed and scale the fax-and-email era never allowed; and open-source intelligence platforms capable of building, almost instantly, the kind of network picture that used to require days of manual research by a small, specialist team.
Artificial intelligence is, understandably, the most discussed part of that ecosystem, and the most overstated. Used well, within a properly governed intelligence cycle, it can meaningfully compress the collection and processing stages that have always consumed the most analyst time, freeing scarce human judgement for the analysis and decision-making that require it. Used carelessly, it introduces a different problem: outputs that are hard to explain, audit, or defend to a regulator, a court, or a victim. The honest position, and increasingly the regulatory one, is that AI belongs in the loop, not in place of the analyst.
For anyone running a financial crime, FIU or investigations team, the implication is practical. This capability no longer has to be bought in after a scandal or when a poor Mutual Evaluation forces the issue. It can be built deliberately, starting with the network rather than the alert, with automation handling collection so analysts can spend their time on judgement. The institutions that make that move before they’re made to will be the ones regulators point to as the model. The rest will be explaining, again, why activity was all they could afford.
Whether that closes the gap between £100 billion and £350 million remains to be seen. But for the first time in a long time, the tools to try now exist.