Integration for better risk management
The rise in business email compromise, ransomware, cryptocurrency laundering, and data breaches underscores the need to unify AML and cybersecurity efforts. When AML and cybersecurity teams collaborate, they can correlate cyber indicators with financial activity. This strengthens detection and enhances the quality of cases filed with law enforcement or regulators.
The FBI’s Internet Crime Complaint Center (IC3) reported that U.S. institutions lost over $16 billion in fraud in 2024. These losses have persisted into 2025 with no signs of slowing. Institutions that treat these events as separate issues will fall behind. Funds obtained through cybercrime must still be laundered, underscoring the importance of connecting AML and cyber programs to manage risk effectively.
The following scenario illustrates the difference a combined program can make when it comes to investigating suspicious activity:
A financial institution may notice a surge in business email compromise attempts, including phishing emails targeting finance staff. Their cybersecurity team flags suspicious login activity tied to foreign IP addresses and unauthorized attempts to access business accounts. At the same time, AML staff may observe a pattern of new accounts conducting high-velocity transactions shortly after initial funding.
If the institution had integrated its AML and cybersecurity tools, investigators would be able to use “accept without post” functionality to delay outgoing payments and investigate further. Behavioral analytics can detect mule activity, allowing the case team to quickly file a Suspicious Activity Report (SAR) that includes critical cyber indicators, such as IP addresses and virtual wallet information. Law enforcement can then use this information to connect related cases and trace the flow of illicit funds.
Support for integrating AML and cybersecurity tools
FinCEN’s advisory on cyber-enabled crime encourages institutions to incorporate cyber elements such as IP addresses and virtual wallet IDs into suspicious activity reports. These details help law enforcement connect financial and cyber evidence, improving investigations and outcomes. Although this guidance is not new, it reflects the growing expectations of regulators. Including data-driven AI insights from threat feeds and forensic tools enhances both detection and reporting.
As institutions plan for 2026 risk management, staffing evaluations will play a critical role. Effective convergence of AML and cybersecurity requires specialized knowledge in both disciplines, especially as artificial intelligence and machine learning become increasingly common in surveillance tools.
AML staffing assessments can help institutions:
- Identify gaps in skill sets or coverage areas
- Allocate resources strategically across overlapping functions
- Prepare for increased fraud activity tied to digital channels and emerging threats
- Support continuity planning for key roles, such as the AML officer or fraud investigator
Staffing assessments also demonstrate regulatory readiness and help ensure that compliance functions remain effective, even in the face of turnover or increased workload.
The role of predictive analytics and AI in financial crime detection
As the financial crime landscape evolves, so must your institution’s approach to detection and reporting. Data-driven AI tools help institutions identify anomalies and emerging trends more quickly, but their effectiveness depends on continuous validation and refinement.
Incorporating model governance practices is now an expectation. Financial institutions should document how input variables are selected, justify threshold settings, and perform routine validations to ensure AI model outputs remain reliable. These practices not only enhance accuracy but also enable institutions to meet regulatory expectations for explainability in AI models and informed risk-based decision-making.
By applying above-the-line and below-the-line testing techniques, institutions can improve the effectiveness of their AML and fraud detection systems. These approaches allow teams to identify which alerts were missed (below the line) and which alerts were triggered but ultimately deemed irrelevant (above the line). Incorporating this type of backtesting helps fine-tune thresholds, reduce false positives, and ensure that high-risk activity is not overlooked. This ongoing validation process demonstrates a risk-based approach to monitoring that regulators increasingly expect. Predictive intelligence is a forward-looking capability that gives institutions a proactive edge in identifying and responding to new threats.
2026 readiness checklist for AML and cybersecurity
The following are key actions your institution can take now to bridge security gaps:
- Conduct a joint staffing assessment across AML and cybersecurity teams
- Integrate cyber threat intelligence into AML monitoring systems
- Perform above-the-line and below-the-line testing
- Enhance SAR narratives with cyber-related data fields
- Invest in data-driven AI tools and backtesting capabilities to strengthen detection
The bottom line
AML and cybersecurity functions are converging out of necessity. Institutions that take steps now to integrate data, systems, and teams will be better equipped to address the risks ahead. Whether it is preventing instant payment fraud, aligning with FinCEN guidance, or navigating new regulatory scrutiny, your institution’s readiness will depend on people, processes, and technology working in harmony. With the correct data and the right tools, financial institutions will not only respond to threats but also anticipate and mitigate them.
