Privacy
AML analysis can involve extensive transaction histories and personal relationships inferred from financial activity. Institutions should limit data use and access to what is necessary for the relevant compliance purpose.
Responsible AI practice IWIB4AI session Needs review
AI in the Combat Against Money Laundering – The Current State of Play
Using AI to detect money laundering while maintaining reliable data, accountable governance and meaningful human review.
Draft – legal and case law references not yet verified
Summary
Financial institutions can use AI to support anti-money laundering work, including identifying suspicious patterns and prioritising alerts for investigation. The use case concerns adoption maturity, deployment priorities and the regulatory challenges of integrating AI into compliance workflows. Adaptive governance and data assurance are central to making these systems trustworthy as financial crime patterns and operational conditions change.
The Problem
AI may help institutions detect financial crime more effectively, but unreliable data, opaque risk indicators and poorly controlled model changes can produce missed threats or unjustified scrutiny of customers. Institutions must improve detection without treating model outputs as conclusive evidence or weakening responsibility for compliance decisions.
Ethical Grounds
Fairness
Risk indicators and historical investigation data may disproportionately flag particular customer groups without sufficient justification. Testing should examine both detection performance and unjustified disparities in alerts and downstream treatment.
Accountability
Institutions remain responsible for AML decisions even when models or data come from external suppliers. Named owners, documented validation and controlled model changes should make errors traceable and remediable.
Human oversight
Investigators need enough context, expertise and authority to challenge AI-generated alerts. Review should be substantive, particularly before adverse customer action, rather than a routine endorsement of model scores.
Legal Compliance
| Framework | Provision | Relevance |
|---|---|---|
| GDPR | Arts. 5–6 | Processing personal data for AI-supported AML requires a valid legal basis and compliance with purpose limitation, data minimisation, accuracy, security and accountability; an AML obligation does not authorise unrestricted data reuse. |
| GDPR | Art. 22 | Where AI leads to solely automated decisions with legal or similarly significant effects on customers, institutions must assess whether Article 22 applies and whether an exception and the required safeguards permit the decision. |
| EU AI Act | Art. 6 and Annex III | AI used for AML is not automatically high-risk merely because it operates in financial services; classification depends on the system’s intended purpose and the applicable statutory criteria. |
| DORA | Arts. 5–6 | For financial entities within scope, AI-supported AML systems must be addressed within management-body accountability and the documented ICT risk-management framework. |
| National law | General | Applicable national AML rules govern customer due diligence, suspicious-transaction reporting, recordkeeping and restrictions on tipping off, which AI-supported workflows must preserve. |
Sources
Court & Regulator Decisions
CK v Dun & Bradstreet Austria (opens in a new tab)
Where AML workflows involve qualifying automated decisions, this ruling informs meaningful explanations of decision procedures rather than reliance on opaque risk scores.
Ligue des droits humains v Conseil des ministres (PNR) (opens in a new tab)
Passenger risk-screening safeguards offer an instructive analogy for AML alerts, particularly non-discrimination, controlled algorithmic adaptation and human review before adverse action.
OQ v Land Hessen (SCHUFA) (opens in a new tab)
The determining-role test helps assess whether an AML score effectively decides customer outcomes despite nominal involvement by compliance staff.
Key Takeaways
- Define each AI deployment’s purpose, decision boundaries and applicable legal requirements before implementation.
- Validate data quality and test false positives, missed risks and unjustified disparities.
- Assign accountable owners and monitor performance, drift and model changes throughout deployment.
- Require meaningful human review before consequential customer action and retain evidence supporting decisions.
Related Use Cases
From the Session
AI in the Combat Against Money Laundering – The Current State of Play