Financial Crime and Fraud Risk
The Global Risks Alliance (GRA)
Financial institutions must know their customers, monitor transactions and report suspicion to financial intelligence units. These controls are costly and produce many reports, while the share that lead to law enforcement action is hard to observe. This page sets out how customer due diligence, monitoring and reporting work and where they are ineffective, how effectiveness is measured, and who decides.
GRA · In development · service level R0
Suspicious activity reporting is the duty of regulated firms to report suspected criminal proceeds or terrorist financing to their financial intelligence unit, supported by customer due diligence and transaction monitoring. Its effectiveness is hard to observe. Reporting officers, FIUs, supervisors and legislators hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
Investigation responsibility and safeguards. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Rule-based transaction monitoring flags many alerts that turn out to be legitimate. Analysts spend time clearing false positives, and real cases can be missed in volume.
Fear of penalties encourages filing reports of low value, which strains FIUs. Feedback from FIUs to reporters is often limited.
Launderers spread activity across institutions. One bank sees only part of the pattern, which is why information sharing partnerships exist.
Supervisors increasingly ask whether controls produce useful intelligence, not only whether processes exist. Measuring that requires outcome data from law enforcement.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Suspicious activity report | A report by a regulated firm to its FIU about activity it suspects involves crime. |
| False positive | An alert that, on review, does not indicate suspicious activity. |
| Tipping off | Disclosing to a person that a report or investigation concerns them, which is generally prohibited. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Suspicious activity reports filed | count by sector | annual | FIU annual reports | OFFICIAL |
| Transaction monitoring false positive rate | share of alerts closed without report | periodic | Firm data | DECLARED |
| Reports used in investigations | count or share | annual | FIU and law enforcement reports | REPORTED |
| Feedback provided by FIU to reporters | count of feedback instances | annual | FIU reports | OFFICIAL |
| Public-private partnership cases | count | annual | Partnership reports | REPORTED |
| AML enforcement penalties | count and currency | annual | Regulator enforcement records | OFFICIAL |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FinCEN SAR statistics | United States suspicious activity report volumes | Public domain |
| UK Financial Intelligence Unit SARs annual report | UK reporting and use of SARs | Open Government Licence |
| Europol Financial Intelligence Public Private Partnership publications | Partnership practice in Europe | Free, Europol terms |
| FATF guidance on partnerships and information sharing | Practice on private sector information sharing | Free, FATF terms |
| Regulator enforcement notices | AML control failures and penalties | Public records, terms per regulator |
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Money laundering reporting officers | Which alerts become reports and how monitoring is tuned | Alert data, typologies and FIU feedback |
| FIUs | How reports are analysed, disseminated and fed back | Report volumes and outcomes |
| AML supervisors | Whether controls are effective as well as present | Supervisory testing and outcome evidence |
| Legislators | What information sharing between institutions is permitted | Partnership evidence and privacy safeguards |
Researchers on suspicious activity controls ask how reporting turns into useful intelligence.
Institutions monitor transactions and customer behaviour, investigate alerts and report suspicion to the financial intelligence unit. Fear of penalties can lead to defensive reporting: large volumes of low-value reports that strain authorities' capacity. Feedback from authorities to reporters is often limited, so institutions cannot easily learn which reports are useful.
Institutions are not investigators or prosecutors. They report suspicion; authorities decide whether to investigate. Customers subject to suspicion may have accounts restricted or closed without explanation because of confidentiality rules, which raises questions of fairness and redress. Partnerships between public and private sectors aim to improve intelligence while respecting these boundaries.
Studying monitoring and reporting processes with machine learning and data engineering expertise. Report contents are confidential.
Examining information-sharing arrangements. Evaluations are limited.
Comparing reporting, confidentiality and redress rules. Practice varies.
Learning from analysts and investigators. Requires safeguards for sensitive information.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.