Identifying Emerging Risks in Financial Services

The HMT Supervision Report 2023-24 offers a comprehensive analysis of the UK’s AML/CTF supervisory activities, highlighting risk assessments, enforcement actions, regulatory changes, and future priorities. The report is a critical resource for financial crime officers, outlining emerging threats, supervisory challenges, and strategic priorities under the UK’s Economic Crime Plan 2023-26. 🔍 Takeaways 1️⃣ Strengthening AML/CTF Supervision in the UK • 25 supervisory bodies oversee 90,000+ businesses, ensuring compliance with AML/CTF regulations. • Increased focus on risk-based approaches, targeting high-risk firms in finance, real estate, gambling, and professional services. • Expansion of regulatory oversight, including additional data collection on supervisory effectiveness. 2️⃣ Anti-Circumvention and Sanctions Compliance • The UK Sanctions and Anti-Money Laundering Act (SAMLA) mandates enhanced screening of financial transactions. • Supervisors now assess firms’ controls to prevent sanctions breaches, focusing on Russia-related financial flows. • Increased cross-agency coordination to detect trade-based money laundering (TBML) and sanctions evasion. 3️⃣ Heightened Focus on Financial Crime Risks in Crypto & Fintech • #Cryptoassets, e-money, and BNPL platforms are high-risk sectors due to AML vulnerabilities. • 86% of crypto firms’ applications for AML supervision were rejected or withdrawn due to non-compliance. • Supervisors identified deficiencies in CDD, transaction monitoring, and fraud risk controls across fintech firms. 4️⃣ Risk-Based Approach: Sector-Specific Insights • Financial Services: Retail banking, e-money, wealth management, and wholesale banking remain high-risk. • Real Estate: Growing use of shell companies and offshore structures to facilitate money laundering. • Gambling: Remote (online) casinos and betting remain high-risk, with weak controls over high-value transactions. • Professional Services: Trust & company service providers (TCSPs) remain major enablers of illicit finance. 5️⃣ Enforcement Trends and Increased Supervisory Scrutiny • Rise in AML fines and enforcement actions, targeting non-compliance in financial services, crypto, and real estate. • Supervisors identified an increasing number of unregistered firms conducting AML-regulated activity. • Random risk-based assessments found that 9% of firms required reclassification to higher risk levels. 📌 Recommendations ✔ Enhance KYC and sanctions screening to detect complex money laundering networks. ✔ Implement AI-driven transaction monitoring to mitigate crypto and BNPL risks. ✔ Strengthen risk-based approaches in high-risk sectors like real estate, gambling, and professional services. ✔ Prepare for increased regulatory scrutiny and align AML frameworks with UK’s Economic Crime Plan 2023-26. ✔ Engage with regulatory bodies proactively to stay ahead of AML/CTF #compliance expectations. #AML #FinancialCrime #Sanctions

"Third-party service providers, including fintech firms, can offer consumers the potential for access to new or better services, but such arrangements also provide greater opportunity for malicious actors to gain access to private data. Specifically, such emerging technologies are often vulnerable to exploitation by tech-savvy hackers looking to profit from technical and financial vulnerabilities in these technologies.   Of particular potential risk is the rapid adoption by financial institutions of application programming interfaces, which provide accessible gateways into firms’ information (often relied on by fintech platforms for information sharing) and may increase the risk of data breaches, especially of customers’ personal or sensitive information, if not effectively secured and permissioned.   The adoption and evolution of machine learning tools will also introduce potential new risks. Machine learning capabilities could drive improvements in the automation of information security controls, such as intrusion detection and data loss prevention. Threat actors, however, could also use machine learning capabilities to automate cyber reconnaissance and attacks, further increasing the likelihood and impact of cyber incidents.   The recent deployment of machine learning tools, including generative artificial intelligence technologies, may also provide threat actors with improved methods for performing social engineering, email phishing, and text messaging smishing attacks compromising access into firms’ systems, emails, databases, and technology services."   — From: Board of Governors of the Federal Reserve System, Cybersecurity and Financial System Resilience Report, August 2023 https://lnkd.in/e8ggDqsX

𝐅𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬: 𝐀𝐈 𝐀𝐝𝐨𝐩𝐭𝐢𝐨𝐧 𝐈𝐬 𝐒𝐮𝐫𝐠𝐢𝐧𝐠, 𝐁𝐮𝐭 𝐕𝐚𝐥𝐮𝐞 𝐈𝐬𝐧’𝐭 𝐊𝐞𝐞𝐩𝐢𝐧𝐠 𝐔𝐩 Banks are racing to deploy AI, yet most aren’t getting the results they expected. As of Q3 2025, 43% of global banks report internal AI deployments. But a major 2025 study found over 70% of companies struggle to convert AI investment into real business value. The gap between deployment and outcome reflects a deeper issue: complexity, risk, and limited visibility across the AI ecosystem. 𝐊𝐞𝐲 𝐀𝐈 𝐓𝐫𝐞𝐧𝐝𝐬 𝐑𝐞𝐬𝐡𝐚𝐩𝐢𝐧𝐠 𝐭𝐡𝐞 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 • Real-time fraud and crime detection: Nearly 90% of FIs now use AI for AML, identity risk, and transaction monitoring, improving detection, but increasing monitoring and compliance requirements. • Automated underwriting and decisioning: The global AI in Lending market is growing at 26.6% CAGR, with some banks reporting 50–75% faster decision times. But more automation also means more decision nodes, data pathways, and model dependencies. • GenAI across compliance and operations: 75% of banks are exploring or deploying GenAI for KYC, document processing, and customer operations. More models = more efficiency and exponentially more governance demands. 𝐏𝐚𝐢𝐧 𝐏𝐨𝐢𝐧𝐭𝐬 & 𝐑𝐢𝐬𝐤𝐬 •Shadow AI and Model Sprawl: Teams deploy models independently across fraud, credit, and compliance, creating inconsistent decisions and governance gaps. • Data governance and regulatory exposure: Financial data moving across multiple systems without lineage increases AML, GDPR, and consumer-protection risk. • Model drift and silent accuracy decay: Fraud patterns evolve quickly. A model performing well last quarter may miss new attack vectors today. • Trust and explainability gaps: AI-driven denials and flags require transparency. Without it, regulatory and customer trust erode. 𝐖𝐡𝐚𝐭 𝐁𝐅𝐒𝐈 𝐋𝐞𝐚𝐝𝐞𝐫𝐬 𝐒𝐡𝐨𝐮𝐥𝐝 𝐃𝐨 𝐍𝐨𝐰 👉 Establish a unified, enterprise-wide AI governance layer that inventories every model, agent, data flow, and third-party tool. This layer should provide: • Model lineage • Runtime observability • Version control • Data access logs • Risk scoring Visibility is the foundation of safe, compliant, and scalable AI. Are you facing model sprawl, governance/compliance risk, or fragmented AI security fabric protects the enterprise AI layer and can help you manage and scale AI with trust and transparency. #BFSI #FinancialServices #AISecurity #AIGovernance #RiskManagement

Beyond Technology - Addressing Emerging Threats with Security by Design In the rapidly evolving digital landscape, relying solely on technical security measures is no longer enough. Recent incidents, like a finance employee being tricked into transferring $25 million through deepfake technology, highlight the urgent need for a comprehensive approach to cybersecurity. My latest article dives deep into why Security by Design must be applied to processes and not just systems. I’ll explore the inherent insecurities in widely used technologies like email and video meetings, and how emerging AI technologies are amplifying these risks. 🔑 Key Takeaways: - Shared Responsibility: Security is not just the responsibility of IT; every manager plays a crucial role. - Avoiding False Confidence: Quick technical fixes can create a false sense of security. Real security requires addressing underlying vulnerabilities. - Practical Steps: Implementing non-technical measures such as verification protocols and regular training can significantly mitigate risks. #SecurityByDesign #CyberSecurity #DeepFakes #SocialEngineering #ProcessSecurity #Leadership #DigitalTransformation

The conversation around AI in financial services just shifted—quietly, but meaningfully. This week, Canadian bank executives, regulators, and policymakers came together to discuss the implications of a new generation of AI models. Not productivity gains. Not customer experience. Risk. What’s emerging is a step-change in capability. AI that can identify vulnerabilities faster than traditional methods. AI that lowers the barrier for sophisticated cyber activity. AI that doesn’t just improve systems—but tests their limits. For financial institutions, this reframes the conversation: • Cyber risk is no longer just an IT issue—it’s an enterprise and board-level priority • The greatest vulnerabilities may sit across third-party ecosystems, not within our own walls • AI is now both a defensive tool and a potential threat vector • And perhaps most importantly, resilience is becoming a shared responsibility across the sector We’ve spent the past few years focused on how AI can help us grow. Now we need to spend equal time on how it could challenge us—and how we respond, together. The institutions that will lead in this next phase won’t just adopt AI faster. They’ll govern it better. #AI #FinancialServices #CyberSecurity #RiskManagement #Leadership #DigitalTransformation

A warning worth taking seriously. Digital dependence is becoming a systemic risk for the financial and insurance sector. The AFM and De Nederlandsche Bank (DNB) have just published a joint report arguing that the financial and insurance sector’s growing reliance on a small number of (largely non-European) IT service providers can turn operational incidents into system-wide disruptions. What’s driving the risk? Financial institutions increasingly outsource critical functions (including cloud services, software solutions, and AI models) and often rely on the same underlying infrastructure. Short term: what supervisors want to see. The report urges firms to prepare for disruptive scenarios through practical measures such as developing threat scenarios, sharing incident intelligence, and running “chain tests” across the ecosystem (not just within one firm). Long term: Europe’s strategic fork in the road The report outlines four possible “future states”, from Europe becoming a digital colony to achieving digital autonomy, and argues this is bigger than any one institution. It requires coordinated European action and a stronger European tech ecosystem. Regulation angle (and why this matters now). The report explicitly points to DORA, including the register of information (to map third-party dependencies) and the emerging oversight of critical ICT suppliers, while noting that vulnerabilities can still persist. This topic is close to my heart from my previous work, particularly the growing fragmentation of the value chain and the implications of Big Tech dependencies for financial sector. So it’s encouraging to see more supervisory thinking in this direction. By the way, EIOPA’s recent financial stability report also touches on related themes, including from an AI angle. And as a strong believer in scenario-based approaches, I’m glad to see forecasting and future-state thinking reflected in both the report and its recommendations. Question: how much are you thinking about these dependencies in your own organisation today?

Kicking off the year with the release of our new Departmental Paper on corporate sector vulnerabilities and high levels of interest rates! I had the pleasure of leading this project over the past two years, collaborating with a great team: Nassira A., José Garrido, Deepali Gautam, Benjamin Mosk, PhD, CFA, Thomas Piontek, CFA, Anjum Rosha, Thierry Tressel, and Aki Yokoyama. Our paper provides a detailed analysis of the vulnerabilities that have surfaced in the corporate sector post-pandemic, emphasizing the financial stability risks in a world of persistently high interest rates. While some central banks have begun cutting policy rates, the expectation is that rates will remain elevated compared to pre-pandemic levels. This underscores the urgency of designing and implementing policies to prevent and mitigate risks from the corporate sector. The paper highlights several key findings: ➡️ Firms with substantial refinancing needs—the so-called "maturity wall"—face heightened challenges in rolling over debt as interest rates remain elevated, potentially straining their financial performance. ➡️ Should interest rates remain higher than current projections, corporate defaults could surge significantly, posing critical financial stability risks, particularly in emerging markets and countries with less developed banking systems. ➡️ The growing role of nonbanks in corporate credit intermediation, especially in advanced economies, heightens financial stability risks. The shift of credit to unregulated sectors raises concerns about how risks from a potential corporate default cycle could propagate throughout the financial system. ➡️ Despite progress in insolvency and restructuring frameworks since the pandemic, significant gaps remain. These shortcomings could hinder countries’ ability to swiftly resolve firms in scenarios of intensified corporate distress. Full paper: https://lnkd.in/eUynEVMz

Payments are under increasing scrutiny as regulatory frameworks tighten and fraud risks evolve, particularly in the wake of advancements in Generative AI and deepfakes. 👉 Interchange fees and surcharging regulations shift payment industry dynamics, with regions like the EU and Australia capping fees to protect merchants while the U.S. remains focused on debit interchange through the Durbin Amendment. Meanwhile, surcharging remains a contentious issue, with some countries allowing merchants to pass costs on to consumers, with strict transparency rules. As regulatory bodies seek to make transactions more equitable (with a mix of intended and unintended consequences) payment providers must continuously adapt. 👉 Open banking regulation is also reshaping payments, particularly in the UK, EU, and Australia. By mandating that banks share customer data securely via APIs with third-party providers, these regulations aim to foster innovation and competition. Open banking opens doors for fintechs to build new services, but it also comes with higher expectations for data security, customer consent, and fraud prevention. 👉 Governments are devising digital ID frameworks to streamline identity verification (e.g. the EU’s eIDAS, India’s Aadhaar, NIST draft guidelines in the U.S.). These frameworks ensure secure access to financial services, yet they must now confront the rise of GenAI and deepfakes. Fraudsters can manipulate facial recognition, voice biometrics, and even digital ID systems using AI-generated identities, which means banks and fintechs must evolve their fraud detection techniques. ✔️ Opportunity: Payment providers have a long history of adaptive pricing in response to regulatory shifts. Banks and fintechs that invest in advanced verification technologies, such as multi-factor authentication, behavioral biometrics, and AI-powered fraud detection will not only protect themselves and their customers, but be able to use risk mitigation as source of differentiation. Fraud and risk providers that offer advanced biometric and behavioral verification methods, leveraging voice characteristics, environment detection, and liveness checks will gain share in this new risk environment. ❌ Threat: Traditional payment processors, legacy banks, credit card issuers, and e-commerce platforms must recalibrate pricing strategies and their data access posture in response to evolving regulation interchange fee caps, surcharging restrictions, and open banking mandates. Less sophisticated fintechs and banks that rely on outdated fraud protection systems will find themselves targeted by fraudsters, and risk losing the trust of merchants and consumer customers. My colleagues Michael Cashman, Roger Zhu and I recently updated our perspective on global payment trends… this is 5️⃣ of 6️⃣ in a series of posts. Are you attending #money2020usa? Reach out to the Bain & Company team if you want to discuss implications for your business. 

One of the biggest challenges in financial crime compliance isn’t detecting yesterday’s risks it’s identifying the ones that haven’t fully emerged yet or have reached the scale that’s too obvious to ignore. For a cross-border payments company like Payoneer, this challenge is amplified. Criminal typologies evolve quickly across jurisdictions, exploit regulatory differences, and adapt as payment flows shift. By the time an emerging typology becomes widely recognized, it may already have impacted multiple markets. That’s why detecting emerging risk can’t rely on static rules or periodic model tuning. It requires a disciplined model management framework that continuously evaluates performance, identifies drift, incorporates new intelligence, and ensures models evolve as quickly as the threats they are designed to detect. At Payoneer we’ve made significant investments in building that capability. We’ve established a dedicated Model Management function focused on governance, validation, ongoing performance monitoring, and continuous optimization across our financial crime models. This isn’t just about meeting regulatory expectations—it’s about ensuring our detection capabilities improve as our business grows and the threat landscape changes. Model governance has become a strategic capability. It allows us to rapidly incorporate new typologies, measure effectiveness with confidence, reduce unnecessary customer friction, and make informed, data-driven decisions about where to invest next. As AI, machine learning, and advanced analytics continue to mature, I believe the organizations that succeed won’t simply have the most sophisticated models. They’ll have the strongest model management disciplines behind them—ensuring those models remain explainable, effective, and responsive to an ever-changing risk environment. In financial crime compliance, detecting emerging typologies is no longer just an analytics problem. It’s a governance problem, an operational problem, and ultimately a competitive advantage.