The market and regulatory environment in which financial services institutions operate is evolving, with new risks and threats emerging. The Russia-Ukraine war and conflict in the Middle East have changed the counter-terrorism risk profile and sanctions landscape significantly, creating more stringent and complex obligations for financial services institutions, including heightened requirements for dealing with the circumvention of sanctions. And as geopolitical instability continues in a number of regions of the world, this is likely to be an ongoing concern over the coming 12-24 months at least.

At the same time, the incidence of fraud has risen exponentially, driven by digitisation, the impact of COVID and the cost-of-living crisis. Modern slavery and human trafficking are on the increase, exacerbated by conflict. Corruption continues to undermine living conditions and proper governance in a number of countries. Meanwhile, the climate change crisis is leading to a scarcity of natural resources and changes to migration patterns.

Partly in response to this increasingly complex risk landscape, the regulatory environment is also changing. On 20 July 2021, the European Commission introduced a comprehensive set of laws to enhance the EU's regulations against money laundering and the financing of terrorism ("AML Package"). The suggested revisions mainly focus on enhancing procedures for identifying suspicious transactions and activities, as well as addressing vulnerabilities that criminals use to launder illegal funds or fund terrorist actions through the financial system. The final texts of the EU AML/CFT Package have been published in the EU’s official Journal on 19 June 2024.

The AML Package² is comprised on the following:

• 6th Anti-Money Laundering Directive (AMLD6): Effective date 20 days after publication in the EU's Official Journal, with a transposition deadline for Member States of 10 July 2027
• AML/CFT Regulation (AMLR): Effective date 20 days after publication in the EU's Official Journal, with an application start 3 years after coming into force (from 10 July 2027), and provisions for football agents and professional football clubs effective from 10 July 2029.
• Anti-Money Laundering Authority Regulation (AMLAR): Effective date 7 days after publication in the EU's Official Journal, with an application start of 1 July 2025

The AMLAR establishes the new EU authority "AMLA" (Anti-Money Laundering Authority), which is set to commence operations by mid-2025 from its headquarters in Frankfurt. AMLA's primary objective is to oversee the enforcement of the new anti-money laundering regulations in the EU. Additionally, it will directly supervise financial entities within the EU that pose heightened risks, intervene in cases of supervisory failures, serve as a central hub for supervisors, mediate disputes between them, and supervise the implementation of targeted financial sanctions.

With the transposition and implementation of the EU AML package, Subject Persons would be obliged to revisit their AML/CFT policies, controls, processes and procedures to be compliant with the regulations. 

The financial services industry itself continues to undergo transformation, as markets and products are subject to rapid innovation and disruption. In payment services for example, embedded finance and large tech vendors such as Apple, Alphabet and Amazon are entering the financial services space. New business models have emerged, and open banking is creating a digital-first approach to interacting with customers. Payments are becoming faster - which means that the underlying architecture, including the financial crime approach, needs to be respond faster - and digital assets are introducing new types of risks, whilst attracting greater regulatory scrutiny.

As the industry evolves, so too do the expectations of customers, who demand a client experience that is faster, more seamless, integrated, and personalised than before. Additionally, the workforce has a greater focus on flexibility, purpose, and trust; and as digital natives, customers are much more familiar with technology and expect this to be reflected in how they interact with financial services institutions.

We cannot ignore the continuing impact of technology change. A number of key technology trends are converging that will transform the approach to tackling financial crime. Artificial intelligence, machine learning, and cloud computing create opportunities for innovation and automation of data gathering, data analysis and pattern recognition. The flip side, of course, is that we see criminals taking advantage of these capabilities, to perpetrate more complex frauds.

The external data landscape is also changing. There is an increasing focus on information sharing to improve financial crime detection and prevention – both public-to-private and private-to-private - with notable examples including SAMLIT in Sweden and TMNL in the Netherlands. There is also much more data available, from third parties, open sources, and social media.

In response to this changing data landscape, more work will need to be done to ensure that financial services institutions understand how to receive, analyse, and share information in an accurate and timely manner, whilst respecting data privacy (GDPR) and Consumer Duty rules. While this may take time, the potential value and impact of these changes make it an exciting development.