AML fundamentals: financial crime in payments

The payments industry is the backbone of global commerce. To ensure stability and trust, businesses must understand the financial compliance risks and fincrime threats impacting the market today.

This 2026 explainer by Paco Mainez-Vidal and Danny Gunter explores financial compliance risks and fincrime threats impacting modern payment systems and global commerce.

Introduction

The payments industry is the global ecosystem that enables the transfer of money between individuals, businesses, and financial institutions. It encompasses all the processes, technologies, and players involved in moving funds securely and efficiently.

Essentially, the payments industry is the backbone of commerce and financial systems worldwide. Payments facilitate transactions for goods, services, and financial transfers, enabling funds to move from payer to payee through various channels.

However, like every other area of financial services, the payments industry faces several financial risks that can impact stability, compliance, and trust. Among these, financial crime is one of the most significant and potentially damaging.

Financial crime refers to illegal activities committed for financial gain. It typically involves deception, fraud, or the abuse of trust and can occur in both personal and corporate contexts. The main financial crime risks affecting payments include money laundering, terrorist financing, and fraud. This article provides an overview of their definitions, characteristics, and examples. 

Money laundering

Money laundering is the process of concealing the origins of illegally obtained money so that it appears legitimate. IMF and UNODC estimate that 2%-5% of global GDP is laundered annually, which translates into a staggering 2-5 trillion in USD in 2026*.

Money laundering typically involves three stages:

1. Placement – Introducing illicit funds into the financial system (e.g., depositing cash into banks).
2. Layering – Moving the money through complex transactions to obscure its source (e.g., transfers between accounts, shell companies, offshore jurisdictions).
3. Integration – Bringing the ‘cleaned’ money back into the economy as apparently legal funds (e.g., investments, property purchases).

The aim is to make it difficult for authorities to trace the money back to criminal activity. Today, real-time payment rails and digital wallets allow capital to move in seconds. This speed allows criminals to move money through dozens of accounts in different countries incredibly fast. By the time an investigator flags the first transfer, the money has already been laundered through ten different accounts in numerous jurisdictions.

This is a major concern for financial institutions because it enables crimes such as fraud, corruption, and terrorist financing. Money laundering is typically committed by individuals or organisations seeking to hide the origins of illicit funds. Common perpetrators include organised crime groups, terrorist organisations, fraudsters, and corrupt officials.

When developing controls to detect, investigate, and mitigate money-laundering risk, financial institutions (FIs) and payment service providers (PSPs) also implement measures to identify whether individuals or legal entities are attempting to use their products and services to evade sanctions.

Economic sanctions are restrictions imposed by governments or international bodies (such as the UN, EU, or OFSI in the UK) to influence the behaviour of countries, organisations, or individuals. They are a foreign policy tool designed to achieve political, security, or humanitarian objectives without the use of military force.

Terrorist financing

Terrorist financing (TF) refers to providing funds or financial support to individuals, groups, or organisations that engage in terrorist activities. Unlike money laundering, which hides the origin of illicit funds to inject them back into the financial system for legitimate uses, terrorist financing focuses on funding terrorism regardless of whether the money comes from legal or illegal sources.

TF is difficult to detect because the amounts involved are often small compared with traditional money laundering. Additionally, funds may come from legitimate sources, disguised as charitable donations or business payments, making detection even more challenging.

Fraud

Fraud is an intentional act of deception carried out to gain an unfair or unlawful advantage, usually financial. It involves misrepresentation or concealment of facts to trick another party into giving up money, property, or rights.

Fraud is one of the most serious threats financial institutions face today, with fraud-related scams worldwide surpassing USD 1.03 tn in 2024**, and the trend continuing upward in 2025, driven by AI-powered schemes and social engineering attacks. Consumers in the United States alone reported USD 12.5 bn in losses in 2024***, mainly from investment and imposter scams.

Key typologies and drivers behind these figures include:

• AI-driven fraud (deepfakes, voice cloning, scam farms);
• Authorised Push Payment (APP) scams and account takeover (ATO);
• The complexity of cross-border and real-time payments makes preventing and detecting fraud significantly more difficult for FIs.

The role of regulation

Regulators establish the rules and expectations that financial institutions must follow. In the UK, for example, the regulatory framework is intentionally principle-based: both the Financial Conduct Authority (FCA) and the Money Laundering Regulations (MLRs) adopt a risk-based approach. This provides firms with the flexibility to interpret the regulations in line with their business models and to design policies and processes that address the specific risks they face.

An alternative Regulatory model would be the EU, with a combination of both principles and rules: The EU’s ‘Better Regulation’ agenda helps deliver evidence-based policies and laws that achieve their objectives in the most efficient way, while being tailor-made to the needs of EU member states and financial institutions.

Lastly, the US follows a primarily rules-based model. US regulators typically favour detailed, prescriptive rules, with emphasis on checklists, bright-line tests, and explicit compliance criteria, providing certainty and ease of enforcement.

As watchdogs and governing bodies, regulators are fundamental in ensuring all supervised firms operate to the same baseline standards. This consistency drives fairness, competition, and stability across the UK market while still allowing space for innovation. A well-calibrated regulatory environment encourages FIs to develop safer, more customer-centric, and competitively priced products.

However, regulators still face challenges in securing consistency in supervisory expectations and in holding all firms to the same standards. When addressing money laundering in the UK, for example, progress is constrained not by intent but by structural limitations. Fully disrupting money laundering would require a fundamental shift in how FIs interact with one another.

Today’s payments landscape contains vast amounts of actionable data, far more than ever before. In theory, if every party in the payment chain had access to the right tools and shared intelligence, an FI could ‘follow the money’ end-to-end and across borders: from victim to perpetrator, through placement and layering, and ultimately to the integration of illicit funds into the legitimate economy. The data exists, but it is siloed. Each institution is restricted to the information within its own perimeter, with no visibility once funds leave its environment. As soon as digital money moves beyond the originating FI, that visibility breaks down.

Privacy laws in one country often prevent FIs from sharing data with authorities in another, creating ‘blind spots’ that transnational criminal organisations (TCOs) leverage to hide their tracks. This challenge is compounded by the fragmentation of regulation. Criminals exploit the fact that laws are national, but money is global. If one country tightens its laws, criminal capital often flows to a ‘secrecy haven’ or a jurisdiction with weaker enforcement.

For regulation to truly deliver on its goals, the future must involve a more collaborative, intelligence-led financial ecosystem. This does not mean removing healthy competition or compromising customer privacy; rather, it means creating frameworks where essential risk data can be shared responsibly, securely, and in real time.

The role of regulation, therefore, is not only to set rules but also to create the conditions that enable meaningful cooperation across the global financial system. When regulators drive standardisation, ensure consistent supervisory expectations, and encourage the development of shared data utilities and modernised technology, the entire industry becomes significantly more resilient to criminal exploitation.

How payment firms detect and investigate financial crime

Payment firms use a combination of technology, processes, and human expertise to detect and investigate financial crimes such as fraud, money laundering, and sanctions breaches. In most FIs, the process follows these steps:

1. Detection

• KYC & Customer Due Diligence: Verify identity and assess risk before onboarding, including document forensics and generative AI detection.
• Sanctions Screening: Check customers and transactions against global sanctions lists (OFAC, EU, UN).
• Transaction Monitoring Systems (TMS): Analyse transactions in real time or in batches using rules and scenarios (e.g., unusual patterns, high-risk geographies) that generate alerts when potential suspicious activity is identified.
• Fraud Detection Tools: Use AI and machine-learning models to spot anomalies, including transaction velocity checks and device fingerprinting.
• Behavioural Analytics: Monitor spending patterns and flag deviations.

2. Investigation

• Alert Review: Analysts review alerts generated by monitoring systems.
• Case Management: Tools consolidate data for investigation (customer information, transaction history).
• Enhanced Due Diligence (EDD): Deeper review of high-risk customers or transactions.
• Suspicious Activity Reports (SARs): Filed with regulators when suspicious behaviour is confirmed.

Many financial services companies are also relying on a set of advanced technologies to identify and mitigate risk throughout the customer lifecycle, including:

• AI and machine learning to reduce false positives and improve detection speed and accuracy;
• Graph analytics and network analysis to identify ‘hidden’ links between entities (e.g., to uncover money mule networks and ultimate beneficial owner (UBO));
• Blockchain analytics to track crypto transactions for illicit activity.

Lastly, collaboration is continuing to emerge as the key driver in combating financial crime, with core tenants:

• Working with law enforcement, regulators, and industry bodies;
• Sharing intelligence through platforms such as FIUs (Financial Intelligence Units) and information-sharing partnerships.

Conclusion

Financial crime in the payments industry is a systemic risk that threatens trust, security, and global commerce. As payment systems become faster, more digital, and more interconnected, criminals exploit these innovations through increasingly sophisticated methods. From fraud and money laundering to sanctions evasion and terrorist financing, the threats are diverse and evolving at rapid pace.

From a public-sector perspective, effective regulation protects consumers, strengthens trust in the financial system, and enables firms to innovate safely. As financial crime becomes increasingly sophisticated and digital by default, regulation must evolve in parallel – moving beyond oversight alone towards enabling the collective capabilities required to truly ‘follow the money’ and disrupt illicit finance at scale.

For payment firms, the response must be equally dynamic: leveraging advanced technologies such as AI-driven monitoring, robust KYC processes, and real-time sanctions screening, while fostering collaboration across regulators, financial institutions, and technology providers. Ultimately, combating financial crime is about protecting customers, safeguarding the integrity of the financial system, and ensuring that innovation in payments does not come at the cost of security.

This article is part of The Paypers’ Explainers section. To access other educational materials from this section, click here. If you have suggestions about other topics that could be included in this section, we invite you to write to us at editor@thepaypers.com.

Sources

* Straight Talk: Countries are advancing efforts to stop criminals from laundering their trillions: https://www.imf.org/en/publications/fandd/issues/2018/12/imf-anti-money-laundering-and-economic-stability-straight

** Global Anti-Scam Alliance: “International scammers steal over USD 1tn in 12 months in Global State of Scams Report 2024”

*** U.S. Federal Trade Commission: “New FTC Data Show a Big Jump in Reported Losses to Fraud to USD 12.5bn in 2024”

About the authors

Paco Mainez-Vidal

 

Paco Mainez-Vidal is the Global Head of Financial Crime Strategy for Nium, based in London. Prior to Nium, Paco was Global Head of Data and Analytics for Wealth and Personal Banking Financial Crime Risk at HSBC. His work spans risk intelligence, typology analysis , and analytics-led optimisation to improve detection and prevention of financial crime. Paco has supported FIUs and the Council of Europe, held roles at Standard Chartered, served in military intelligence, and holds MSc/BSc degrees and key certifications. 

 

Danny Gunter

 

Danny Gunter is MRLO, UK for Nium, specialising in financial crime risk management and regulatory compliance. He has extensive experience in anti-money-laundering, due diligence, and fraud prevention from roles including Deputy MLRO and Head of Due Diligence at TerraPay, and Financial Crime Advisory Manager at Worldpay. Danny’s career spans compliance, operational risk, and fraud analytics across payments and financial services, supporting stronger controls and risk-based processes.