Europe’s AML overhaul demands AI for effective compliance
A new study on anti-money laundering (AML) in Europe warns that the region's financial institutions face mounting challenges in meeting regulatory requirements, as current detection systems struggle to keep pace with increasingly complex financial crime.
Performance issues
The report presents data on the continued underperformance of AML frameworks across Europe. The Financial Action Task Force has assessed 120 countries and found that 97% demonstrate only low to moderate effectiveness in preventing money laundering and terrorist financing. In the Netherlands, less than 3.5% of the 3.48 million suspicious transaction reports submitted in 2024 were identified as suspicious. France's Tracfin reported that approximately 5% of suspicious activity reports (SARs) were regarded as actionable. In Germany, only 15% of SARs were investigated by law enforcement, and 95% of forwarded cases did not result in prosecution.
Legacy systems
The authors note that legacy rule-based systems are at the centre of the problem. These systems are said to produce high false-positive rates and generate large quantities of low-quality alerts. One operational risk study found that such systems resulted in reporting in just 2% of cases. According to the report, these limitations stem from siloed data architectures and a lack of cross-border visibility, leaving financial institutions ill-equipped to detect modern, networked forms of financial crime.
Regulatory changes
Europe is entering a new era of AML regulation, driven by the EU's extensive AML reform package and the recently approved Artificial Intelligence Act. The AML package is designed to harmonise compliance requirements, strengthen due diligence obligations, and create a dedicated Anti-Money Laundering Authority (AMLA) at the EU level. The Artificial Intelligence Act classifies transaction monitoring and sanctions screening as high-risk applications of AI, which will require strict standards for transparency, human oversight, data management, and lifecycle controls.
"The data is clear: Europe's AML system is no longer keeping pace with financial complexity," said Yaron Hazan, Vice President of Regulatory Affairs at ThetaRay. "For years, institutions have been trapped in a cycle of rule tuning, manual investigations, and defensive reporting, without materially improving outcomes. Under the new regulatory regime, failing to adopt AI will become a compliance vulnerability in itself."
Operational risks
The report identifies specific areas of heightened risk, including correspondent banking and crypto-asset flows. These areas are highlighted as particularly problematic for traditional AML tools, as conventional rule engines are not designed to detect the complex network behaviour that can emerge across international transaction chains. The study also raises concerns about potential regulatory friction between the AML Regulation and GDPR data processing laws. Without further guidance, institutions could face overlapping legal and compliance risks when handling sensitive personal data alongside AML requirements.
AI integration
The combination of the AML Package and the Artificial Intelligence Act sets new expectations for how technology must be integrated into compliance programmes. The report suggests that a shift is underway towards intelligence-led detection, which relies on hybrid oversight by humans and AI, comprehensive data governance, and transparent, explainable models. The authors propose that this approach will be necessary as financial institutions move towards more automated and scalable compliance operations.
"Europe's new AML framework fundamentally raises the standard for what effective compliance means," said Andrea Minto, Professor of Law and Regulation of Financial Markets at Ca' Foscari University of Venice and the University of Stavanger. "The AML Package and the AI Act make clear that the integration of AI into customer due diligence and AML monitoring is inevitable. Financial institutions must now prepare for a world in which technological capability and legal obligation are inseparable."
