2026 is turning into another expensive year for financial institutions when it comes to Anti-Money Laundering (AML) compliance. Despite billions invested in compliance departments, sophisticated monitoring systems, Know Your Customer (KYC) processes and regulatory reporting, banks continue to receive enormous penalties for failing to detect or report suspicious financial activity. And the amounts involved are becoming increasingly difficult to ignore.
In the United States, Bank of America was hit with more than $1.2 billion in penalties over serious AML deficiencies, including failures to report billions of dollars in suspicious transactions. American Express faced a $350 million penalty for weaknesses in its AML framework, with regulators identifying approximately $13 billion in potentially suspicious activity that had not been adequately monitored or reported. Other significant cases in the US include penalties against UBS Financial Services ($125 million) and Canaccord Genuity ($80 million). Europe has also seen its share of enforcement actions, with Denmark’s Saxo Bank receiving a fine exceeding €40 million and Spain’s CaixaBank facing penalties of more than €30 million.
These are not obscure financial institutions operating on the margins of the financial system. They are established, reputable organisations with substantial compliance budgets, experienced teams and sophisticated technology. Many have already invested heavily in strengthening their controls, sometimes following previous regulatory interventions. Yet significant deficiencies continue to emerge. This raises an uncomfortable question: why do banks keep getting AML compliance wrong, despite spending so much money trying to get it right?
The most obvious explanation, and probably the one that dominates public opinion, is that banks simply do not want to look too closely. The reasoning is straightforward: processing transactions and maintaining customer relationships generates revenue, while stopping suspicious activity potentially means losing business. If the financial benefits of maintaining those relationships exceed the expected cost of regulatory penalties, perhaps banks are consciously accepting the risk. In other words, AML fines become just another cost of doing business.
There is undoubtedly some historical evidence supporting this interpretation. Certain enforcement cases have revealed situations where commercial interests were prioritised over compliance concerns, warnings were ignored or management deliberately failed to address known deficiencies. It would be naive to suggest that such behaviour never occurs.
However, applying this explanation to every major AML fine seems equally simplistic. A billion-dollar penalty, combined with reputational damage, remediation costs, increased regulatory scrutiny and potential restrictions on business activities, is hardly an attractive business proposition. Most financial institutions have very strong incentives to avoid such outcomes.
A second explanation is that banks genuinely want to comply but struggle to translate that ambition into effective operational controls. This is particularly relevant for large, internationally operating financial institutions, where decades of mergers, acquisitions, technological evolution and regulatory changes have created extremely complex IT landscapes. Customer information is scattered across different systems, transaction data is fragmented across products and geographies, and compliance processes often rely on a combination of legacy applications, manual interventions and relatively isolated monitoring solutions.
Detecting suspicious activity in such an environment is far from straightforward. A transaction that appears perfectly legitimate in one system may become suspicious when combined with information from another account, another business unit or another country. But connecting those dots requires access to complete, consistent and timely information, something many banks still struggle to achieve. Even when the necessary technology exists, implementing it across a large banking organisation can take years, competing with countless other IT priorities and constrained by limited resources, complex governance structures and lengthy decision-making processes.
And technology is only part of the problem. A bank may have an excellent transaction monitoring engine, but if it generates more alerts than compliance teams can realistically investigate, the result is still an ineffective control. Similarly, sophisticated screening algorithms are of limited value when customer data is incomplete, outdated or inconsistent. Increasing the sensitivity of detection rules may identify more suspicious transactions, but it also creates more false positives, requiring additional investigations and potentially overwhelming already stretched compliance departments.
This brings us to a third explanation, which is perhaps the most uncomfortable one: what if detecting all suspicious financial activity is simply impossible?
Financial crime rarely comes with a convenient label. Criminals deliberately structure their activities to resemble legitimate business, using intermediaries, complex ownership structures, multiple accounts and seemingly ordinary transactions. Even with complete access to customer and transaction information, determining whether a payment is connected to money laundering can be extremely difficult. Banks generally see the movement of money, but they do not necessarily know the underlying economic reality, the intentions of the parties involved or the full context of a transaction.
Moreover, suspicious does not automatically mean illegal. A customer transferring a large amount abroad might be laundering money, but could equally be purchasing property, supporting family members or making a legitimate business investment. A company receiving payments from numerous international counterparties might be involved in criminal activity, or simply operating a successful international business. Distinguishing between these situations often requires information that banks do not possess and cannot easily obtain.
Of course, regulators do not expect banks to detect every criminal transaction. AML frameworks are generally built around a risk-based approach, requiring financial institutions to identify, assess, monitor and report suspicious activity rather than guarantee that no illicit money ever passes through their systems. Nevertheless, when significant criminal activity is discovered retrospectively, it is often much easier to identify warning signs that should supposedly have been detected. With the benefit of hindsight, patterns become clearer, connections become more obvious and previously ambiguous transactions suddenly appear suspicious.
But this is not necessarily the perspective from which the bank originally operated. At the time of processing, the institution may have been evaluating millions of transactions, most of them legitimate, without the additional information later uncovered by investigators or law enforcement. This does not excuse failures to investigate clear warning signs or maintain adequate controls, but it does illustrate the difference between identifying suspicious activity in real time and reconstructing it after a criminal network has already been exposed.
And this is where the discussion becomes particularly interesting, because the second and third explanations eventually lead us back towards the first one, although in a very different way than public opinion might suggest.
Banks could theoretically adopt an extremely conservative approach to AML compliance. They could block or delay far more transactions, request additional documentation for almost every unusual payment, subject customers to frequent reviews and refuse relationships whenever there is even a relatively small degree of uncertainty. Such an approach might reduce certain financial crime risks, although excessive alerts could also overwhelm investigators and make genuinely suspicious activity harder to identify. It would certainly make everyday banking significantly more difficult for millions of perfectly legitimate customers.
Imagine having to explain the purpose of every larger payment, provide supporting documentation for routine international transfers, or wait several days before accessing your own money because a transaction triggered a compliance alert. For businesses, these interruptions can be even more damaging, affecting supplier payments, liquidity management and commercial relationships. And as payments increasingly become instant, customers expect financial transactions to be executed in seconds, not after hours or days of manual investigation.
We already see examples of this tension today. Customers complain about accounts being unexpectedly blocked, transactions being delayed, repeated requests for information and sometimes entire banking relationships being terminated because institutions consider certain customer profiles or activities too risky (see my blog "From Compliance to Controversy: The Global Rise of Debanking" - https://bankloch.blogspot.com/2025/11/from-compliance-to-controversy-global.html). This phenomenon, commonly referred to as de-risking, can even exclude legitimate individuals and businesses from access to essential financial services.
Consequently, banks must continuously balance two objectives that are not always compatible: preventing financial crime and providing reliable, accessible and convenient financial services. Tightening controls can improve detection, but may also increase false positives, operational costs and customer frustration. Relaxing controls can improve the customer experience, but may create additional compliance exposure. There is no perfect threshold that eliminates both risks.
This also changes how we should interpret the commercial considerations behind AML decisions. When a bank decides not to make its controls excessively restrictive, it is not necessarily trying to protect revenue from criminals. It may simply be trying to protect the experience of its legitimate customers. After all, the overwhelming majority of customers are not involved in financial crime, and they reasonably expect to use their banking services without constantly having to prove their innocence.
Interestingly, this dilemma is not unique to banking. Across many industries, society increasingly expects private companies to take responsibility for protecting the public interest, even when doing so conflicts with their commercial objectives. We are gradually asking commercial organisations to assume responsibilities that traditionally belonged, at least partly, to governments, regulators and public authorities.
Consider social media platforms. We expect them to actively detect and remove fake news, hate speech, discriminatory content, online scams and fraudulent investment schemes. We also expect them to intervene when users express suicidal thoughts, promote dangerous extreme dieting or encourage violent extremism. In practice, this means asking private companies to continuously monitor, evaluate and sometimes restrict the activities of their own users. Yet these same companies typically generate revenue through user engagement, advertising and the amount of time people spend on their platforms. Removing controversial content, restricting certain communities or blocking suspicious accounts may therefore directly conflict with the mechanisms driving their business. Moreover, deciding what constitutes harmful content, rather than legitimate expression, raises difficult questions about freedom of speech and the authority we give private companies to make such decisions. This does not mean social media companies should be relieved of their responsibilities, or that they could not do significantly more to prevent harmful and illegal activities on their platforms. However, governments and law enforcement also have an essential role to play, rather than increasingly shifting these responsibilities towards private companies. At the same time, social media platforms have not always demonstrated the strongest willingness to cooperate with local authorities and law enforcement, which is equally problematic and certainly does not help in finding the right balance.
Traditional media companies face similar expectations. They are increasingly expected to verify information, combat misinformation, reject misleading advertisements and refuse commercial partnerships with questionable organisations. But thorough fact-checking costs money, sensational stories often attract more attention, and refusing advertisers means sacrificing revenue. Once again, society expects companies to prioritise broader public interests over immediate financial returns.
The healthcare sector provides another interesting example. Hospitals and doctors are expected to consider not only what is medically possible, but also whether certain treatments are appropriate, effective and proportionate to their expected benefits and costs. In publicly funded healthcare systems, this can involve difficult decisions about allocating limited resources. Yet depending on the reimbursement model, providing additional treatments may generate additional revenue for the healthcare institution. We therefore expect healthcare providers to help control public expenditure, potentially at the expense of their own financial interests. Naturally, such decisions must remain grounded in medical ethics, clinical evidence and fair access to care, rather than purely financial considerations.
Even seemingly less critical industries face comparable contradictions. Gift voucher providers are increasingly expected to reduce the number of unused or expired vouchers, by extending validity periods, actively reminding customers to redeem their balances or allowing to reactivate expired vouchers. However, unredeemed vouchers can represent a meaningful source of profitability for their business.
Similarly, gambling companies are expected to identify problematic gambling behaviour, impose spending limits and intervene when customers show signs of addiction, even though some of those customers may generate substantial revenue.
Digital subscription services are increasingly expected to make cancellations easier and avoid exploiting customers who continue paying for services they barely use, although such inactive subscriptions can contribute positively to recurring revenues.
The common denominator is clear. We increasingly expect private companies to act as guardians of the public interest, while continuing to evaluate their success primarily through commercial performance. Banks are expected to prevent financial crime, social media platforms to protect society from harmful content, healthcare providers to use public resources responsibly, and gambling operators to protect customers from excessive gambling. In each case, doing the right thing may mean deliberately reducing revenues, increasing costs or introducing friction for customers.
This creates a fundamental misalignment of incentives. We cannot continuously demand that companies behave in a socially responsible manner while rewarding their management, employees and shareholders predominantly for financial growth and profitability. Certainly, regulations and penalties can force companies to internalise some of the societal costs of their activities. But relying primarily on punishment creates a rather strange system in which commercial success is rewarded, while insufficient attention to the public interest is penalised afterwards.
A more sustainable solution would require a broader change in how we define and reward corporate success. Shareholders would need to accept that responsible behaviour can sometimes reduce short-term profitability. Management incentives should reflect not only financial performance, but also measurable contributions to the public interest. Employees should be recognised for making responsible decisions, even when those decisions negatively affect commercial targets. And customers should be prepared to support companies that behave responsibly, even when this comes with slightly higher prices, additional controls or a less convenient service.
Naturally, this is much easier said than done. Social responsibility is difficult to measure objectively, different stakeholders have conflicting interests, and customers do not always behave consistently with the values they express. We may criticise a bank for insufficient AML controls, but complain when our own payment is blocked. We may demand stronger moderation from social media platforms, but protest when our own content is restricted. And we may applaud responsible companies, while ultimately choosing their cheaper or more convenient competitors.
None of this means banks should be excused from their responsibilities. Some regulatory findings clearly demonstrate unacceptable behaviour, including knowingly ignoring risks, failing to act on internal warnings, underfunding compliance functions or allowing significant monitoring backlogs to accumulate. Such failures deserve serious consequences. However, there is an important distinction between deliberately ignoring criminal activity, failing to implement reasonable and effective controls, and not detecting activity that was genuinely difficult to identify with the information available at the time.
Unfortunately, these distinctions are often lost in the public debate. A headline announcing that a bank failed to detect billions in suspicious transactions easily creates the impression that the institution knowingly facilitated criminal activity. Yet the underlying reality can be considerably more complex. The amount of suspicious transactions identified by regulators is not necessarily the amount of proven criminal proceeds, and a failure to report suspicious activity does not automatically imply that the bank knew those transactions were illegal.
The industry clearly needs to continue investing in better technology, more complete transaction data, stronger cross-system correlation, improved monitoring and more efficient investigation processes. Artificial intelligence may help reduce false positives, identify complex patterns and automate parts of the investigation process. But even the most advanced technology will not eliminate uncertainty. Financial crime detection will always involve imperfect information, judgement calls and trade-offs between security, cost and customer experience.
Perhaps the discussion should therefore move beyond asking why banks continue to receive enormous AML fines, towards two more fundamental questions: what level of financial crime prevention do we realistically expect from our banking system, and what are we collectively prepared to sacrifice to achieve it?
Comments
Post a Comment