Financial Crime, Fraud and Anti Money Laundering Models

Financial crime, fraud, and anti-money laundering (AML) models play a central role in the governance of AI systems within financial services. As AI tools become more prevalent, financial institutions must ensure these systems do not inadvertently facilitate or obscure financial crime. The Financial Conduct Authority (FCA) expects firms to apply existing regulatory frameworks to AI systems, including those used in AML and fraud detection. The EU AI Act, which came into force in February 2025, introduces new obligations that directly affect these models. Firms must now consider not only the technical design of AI systems but also their alignment with existing AML frameworks and regulatory expectations.

AI Models and Financial Crime Risk

AI models used in financial crime detection must be designed to identify suspicious activities such as money laundering or terrorist financing. For example, an AI-based transaction monitoring system must be capable of flagging unusual patterns that deviate from established norms. The FCA expects these models to be tested rigorously, including through scenario-based testing that mimics real-world financial crime activities.

Models must also be reviewed regularly to ensure they remain effective against evolving threats. Where AI systems are used to make decisions that affect customer access or transaction approval, firms must ensure these decisions are explainable and auditable. This is especially important in light of the EU AI Act’s Article 5, which prohibits certain high-risk AI practices, including those that could mislead or manipulate users.

• AI models must be tested against historical data of known financial crime cases
• Regular retraining is required to maintain effectiveness against new fraud techniques
• Explainability is required for decisions affecting customer outcomes

AML Models and Regulatory Compliance

AML models must align with existing UK regulatory frameworks such as the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002. AI systems used for customer due diligence or transaction monitoring must meet these standards. The FCA’s approach to AI governance requires firms to apply existing AML controls to AI-based systems. For example, if an AI tool is used to assess customer risk, it must be reviewed to ensure it does not introduce bias or fail to identify high-risk individuals.

The EU AI Act’s Article 50 transparency obligations, which apply from 2 August 2026, also require firms to provide information about AI systems used in decision-making processes. This includes machine-readable marking of generative AI systems placed on the market before that date, by 2 December 2026.

• AI-based AML systems must undergo regular risk assessments
• Transparency requirements apply to AI systems used in customer risk scoring
• Systems must be reviewed for potential bias or exclusion of protected groups

ISO Standards and AI Governance

The adoption of ISO/IEC 42001:2023 provides a framework for managing AI systems within financial organisations. This standard supports the establishment of an AI management system that aligns with existing compliance frameworks. The standard requires firms to identify AI risks, implement controls, and monitor systems continuously. The first UKAS-accredited certification body, BSI, became operational in January 2026, enabling firms to seek formal certification.

The ISO/IEC 42006:2025 standard governs the certification bodies themselves, ensuring they meet international quality criteria. Firms using AI models for financial crime or fraud detection must ensure these systems meet the requirements of these standards. The Digital Omnibus on AI, which came into force in July 2026, defers certain obligations such as high-risk AI requirements to 2 December 2027, but firms must begin preparing now.

The AI literacy duties under the EU AI Act apply from February 2025, requiring staff to understand AI systems they interact with or oversee.

• ISO/IEC 42001:2023 provides a framework for AI risk management
• UKAS-accredited certification through BSI became available from January 2026
• ISO/IEC 42006:2025 governs certification body standards

As AI systems become embedded in financial crime detection, firms must ensure these tools are not only effective but also compliant with existing frameworks. The EU AI Act introduces new obligations that apply to AI models used in financial services, including transparency, risk management, and data governance. The FCA expects firms to apply these principles to AI systems, including those used for fraud or AML purposes.

The practical steps required include testing models against real-world data, ensuring explainability, and aligning with ISO standards. These efforts must begin now, as regulatory deadlines such as machine-readable marking by 2 December 2026 are approaching. Firms must also prepare for the eventual enforcement of these rules through national supervisory authorities, which begin operations from August 2026.

The goal is to ensure AI systems support rather than complicate compliance efforts, particularly in high-risk areas such as financial crime detection.