Strategic and Emerging AML/KYC Challenges

Introduction

Anti-money laundering and know-your-customer controls were traditionally designed around identifiable customers, relatively stable payment channels, national borders, and institutions that directly controlled the customer relationship. Digital finance has weakened each of these assumptions. A customer may now be onboarded remotely, transact continuously through an application, move value instantly across several institutions, use a crypto-asset service provider, or interact with a decentralised protocol without a conventional intermediary.

The strategic challenge is not simply to add more alerts or collect more identification documents. It is to redesign financial-crime risk management so that it remains effective when speed, scale, automation, anonymity, interoperability and jurisdictional fragmentation increase simultaneously. Excessive controls can exclude legitimate customers and obstruct innovation; weak controls can expose institutions to regulatory sanctions, fraud losses, correspondent-bank exit and reputational damage.

This chapter critically examines emerging AML/KYC challenges in digital banking, instant payments, fintech partnerships, crypto-assets, decentralised finance, digital identity, privacy-enhancing technologies, mule networks and cross-border data management. It also develops a future-ready strategic approach based on risk intelligence, governance, proportionality, technology assurance and continuous horizon scanning.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain why digital banking and instant payments alter conventional AML/KYC risk assumptions.
2. Evaluate the responsibilities created by fintech partnerships and outsourced customer journeys.
3. Analyse risks associated with crypto-assets and decentralised finance.
4. Assess the opportunities and limitations of digital identity and privacy-enhancing technologies.
5. Identify mule networks and distinguish them from ordinary high-risk customer activity.
6. Critically evaluate cross-border data, privacy and regulatory-cooperation problems.
7. Design a strategic, proportionate and future-ready AML/KYC operating model.

1. From institution-centred control to ecosystem risk

A traditional AML programme often assigned responsibility according to the legal entity holding the account. Digital finance requires an ecosystem perspective. Risk may be distributed across a bank, a banking-as-a-service provider, a payment institution, a cloud provider, a mobile application, an identity provider, an open-banking interface and a crypto-asset exchange. The customer may experience these entities as one service even though their legal responsibilities differ.

A useful analytical distinction is between customer risk, product risk, channel risk, geographic risk and transactional or behavioural risk. These categories should not be treated as independent silos. For example, a low-value payment product may become high risk when it enables immediate international transfers, is accessed through a compromised device and is connected to a network of newly opened accounts.

A risk-based approach does not mean accepting risk without controls. It means applying controls proportionate to the nature, scale and severity of the risk, while documenting the reasoning. A simple conceptual model is:

where R is an assessed risk score, P is the estimated probability of misuse, and I is the potential impact. This is a decision-support model, not an objective measurement of money laundering. Its limitations include uncertain data, correlation between variables, changing threats and the danger that a numerical score creates false precision. Institutions should therefore use risk scores alongside expert judgement, scenario analysis and governance challenge.

The speed–certainty tension

Digital systems reduce the time available for review. A conventional transfer may have been held for manual investigation; an instant payment may settle within seconds and become difficult to recover. The institution must therefore move part of the control process upstream:

• reliable identity evidence before account activation;
• device, network and behavioural intelligence at login;
• sanctions and watch-list screening at relevant points;
• transaction monitoring designed for real-time or near-real-time decisions;
• rapid post-transaction detection, freezing and recovery procedures;
• clear customer communication when a payment is delayed or declined.

The objective is not to stop every suspicious transaction. That would be commercially and operationally impossible. The objective is to reduce the probability and impact of criminal misuse while preserving legitimate access.

2. Digital banking and instant payments

2.1 Digital onboarding

Remote onboarding increases reach and reduces cost, but it introduces risks involving synthetic identities, stolen identity documents, deepfakes, account farming, device emulation and social engineering. A document may be genuine while the person presenting it is not the rightful holder. Conversely, a legitimate customer may fail an automated check because of poor image quality, disability, language differences or limited connectivity.

Effective digital KYC should combine several forms of evidence:

1. Identity evidence: government-issued documents or reliable official records.
2. Identity verification: comparison of the person with the evidence, using suitable liveness and biometric controls where lawful and proportionate.
3. Attribute verification: address, date of birth, tax status, occupation and other relevant attributes.
4. Device and session intelligence: device reputation, SIM changes, emulator indicators, IP and network anomalies.
5. Relationship and purpose information: expected account use, source of funds and anticipated transaction profile.
6. Ongoing review: updating information when behaviour, ownership or risk changes.

Biometric matching is probabilistic. A false match may allow impersonation; a false non-match may exclude a legitimate customer. Performance can also vary across demographic groups. Governance should therefore include threshold testing, independent validation, appeal procedures, alternative verification routes and controls over biometric data retention.

2.2 Instant payments

Instant payments generate three linked difficulties: limited time for intervention, rapid movement through multiple accounts, and irrevocable or difficult-to-recall settlement. Criminals may exploit these characteristics for fraud, laundering, extortion, sanctions evasion or the rapid dispersal of stolen funds.

Monitoring should consider not only individual transactions but also sequences and networks. Relevant indicators include:

• a newly opened account receiving funds from many unrelated persons;
• immediate onward transfers to several beneficiaries;
• repeated payments just below internal review thresholds;
• rapid changes in device, location or beneficiary profile;
• circular flows returning to an associated account;
• accounts whose inflows and outflows are inconsistent with stated occupation;
• coordinated activity across accounts sharing devices, addresses, telephone numbers or IP infrastructure.

A key design principle is prevention where feasible and disruption where necessary. High-risk beneficiaries can be subject to confirmation, cooling-off periods or additional authentication. Lower-risk payments may pass automatically, while real-time risk engines, post-event analytics and recipient-bank cooperation address residual risk.

2.3 The limitations of transaction thresholds

Threshold-based monitoring is easy to explain but easy to evade. Criminals can fragment payments, use multiple accounts or vary timing. A threshold should therefore be one feature among many. Behavioural and network indicators are generally more resilient than a single amount rule.

Institutions should measure not merely the number of alerts but the effectiveness of controls. Useful indicators include the proportion of suspicious activity detected before dissipation, recovery rates, time to disposition, alert quality, customer-impact rates, false-positive patterns and the percentage of high-risk relationships with current beneficial-ownership information.

3. Fintech partnerships and accountability

Fintech partnerships can involve white-label banking, embedded finance, payment initiation, digital wallets, customer-support providers, cloud analytics and outsourced KYC utilities. They can improve inclusion and innovation, but they may also create fragmented accountability.

The core principle is that outsourcing a process does not outsource the regulated institution’s responsibility. Before entering a partnership, management should establish:

• who owns the customer relationship;
• who performs customer due diligence and who approves exceptions;
• who identifies beneficial owners and controls changes in ownership;
• who monitors transactions across the full relationship;
• who files suspicious transaction reports where required;
• who retains records and for how long;
• how information is shared during investigations;
• how the arrangement is exited without losing critical data or service continuity.

A service-level agreement is not a substitute for control assurance. The institution should obtain access to relevant data, audit rights, model documentation, incident reports and performance metrics. It should test the partner’s controls rather than rely on contractual representations.

A three-lines governance perspective

The first line—business and operations—owns customer and product risk. The second line—compliance and financial-crime risk—sets standards, challenges decisions and interprets regulation. The third line—internal audit—independently evaluates design and effectiveness. In complex ecosystems, this model should be supplemented by board-level oversight, procurement risk review, information-security assurance and legal analysis of data-sharing constraints.

A recurring failure is responsibility diffusion: each participant assumes that another party is screening, monitoring or escalating the risk. The remedy is a control map that assigns every material obligation to a named accountable owner and identifies data dependencies.

4. Crypto-assets and virtual-asset services

Crypto-assets create AML/KYC challenges because value can move quickly, globally and pseudonymously. Public blockchains may provide transparent transaction histories, but addresses do not automatically identify natural persons or legal entities. The risk depends heavily on the asset, protocol, service provider, jurisdiction, use case and ability to link on-chain activity to off-chain identity.

Relevant risks include:

• transfers through unregulated or weakly regulated exchanges;
• use of mixers or tumblers to obscure transaction provenance;
• privacy-enhancing coins and privacy layers;
• ransomware payments and extortion;
• sanctions evasion and illicit cross-border transfers;
• theft from wallets and subsequent layering;
• rapid movement between fiat, stablecoins and other assets;
• false claims about beneficial ownership of institutional wallets.

The FATF’s travel-rule concept requires relevant information about the originator and beneficiary to accompany qualifying virtual-asset transfers, subject to applicable law. Implementation is technically and legally difficult where service providers use different messaging standards, where counterparties are unknown, or where transfers occur directly between unhosted wallets.

A sound crypto-asset programme should combine customer due diligence with blockchain analytics, exposure screening, wallet-risk assessment, source-of-funds analysis and enhanced review of high-risk services. Blockchain analytics are not infallible. Clustering is inferential, labels can be stale, attribution can be wrong, and a high-risk address may reflect exposure rather than culpability. Decisions should therefore record the evidence, confidence level, time period and opportunities for customer explanation.

Stablecoins and systemic scale

Stablecoins may combine the speed and programmability of crypto-assets with a perceived connection to fiat currency. Their use in payments can increase volume and liquidity, while reserve structures, intermediaries and redemption arrangements create additional governance questions. AML controls must examine not only individual holders but also issuers, reserve managers, exchanges, wallet providers and smart-contract permissions.

5. Decentralised finance

Decentralised finance (DeFi) uses smart contracts and distributed infrastructure to provide services such as exchange, lending and liquidity provision. “Decentralised” is not a complete risk classification. A protocol may have identifiable developers, administrators, governance-token holders, front-end operators, liquidity managers or entities controlling upgrade keys. Conversely, a genuinely autonomous protocol may lack a conventional customer onboarding point.

AML analysis should ask:

1. Who designs, controls, upgrades or economically benefits from the arrangement?
2. Who operates the user interface or front end?
3. Can users be identified, screened or restricted?
4. Are smart-contract permissions capable of freezing, routing or disguising value?
5. What records exist and who can provide them to investigators?
6. Which jurisdiction’s rules may apply to the relevant activity?

The absence of a traditional intermediary does not eliminate illicit-finance risk. It may shift risk to interface providers, developers, validators, governance structures or on-ramp and off-ramp institutions. At the same time, imposing conventional bank controls mechanically may be ineffective or technically impossible. Regulation and supervision must distinguish between software, a service, a legal person and a controlled financial activity.

6. Digital identity and privacy-enhancing technologies

6.1 Digital identity

Digital identity can improve KYC by allowing trusted attributes to be verified repeatedly rather than copied across institutions. A digital identity ecosystem may include an issuer, identity wallet, relying party, credential verifier and revocation service. The principal benefits are reduced document fraud, faster onboarding, improved auditability and potentially greater financial inclusion.

However, digital identity is not automatically trustworthy. Risks include identity theft, centralised surveillance, exclusion caused by inaccessible credentials, compromise of private keys, weak enrollment and overreliance on a single identity provider. Institutions should assess assurance levels, issuer reliability, credential integrity, revocation mechanisms and the match between identity assurance and product risk.

6.2 Privacy-enhancing technologies

Privacy-enhancing technologies (PETs) seek to reduce unnecessary disclosure while preserving useful verification. Examples include tokenisation, selective disclosure credentials, secure multiparty computation, differential privacy and zero-knowledge proofs. A zero-knowledge proof can, in principle, allow a party to demonstrate that a statement is true—such as being over a required age or not appearing on a specified list—without revealing all underlying data. The technical capability does not by itself establish that the statement is current, complete or based on a reliable source.

PETs create a productive but difficult tension. AML regimes require institutions to know customers, identify beneficial owners, maintain records and provide information to competent authorities. Privacy law requires purpose limitation, data minimisation, security and lawful processing. The correct response is not unlimited data collection or absolute anonymity. It is controlled disclosure: collect what is necessary, retain it for a justified period, protect it, and make it available through lawful processes.

Institutions should conduct privacy and financial-crime impact assessments before deployment. They should define who can reverse a token, who can respond to lawful requests, how errors are corrected and what happens when credentials are revoked.

7. Mule networks and organised account abuse

A money mule is a person or entity used to receive, move or withdraw illicit proceeds, sometimes knowingly and sometimes through deception. Mule networks may involve recruited individuals, compromised accounts, synthetic identities, shell companies and professional coordinators. They are central to modern fraud and laundering because they convert a criminal’s digital activity into apparently ordinary customer transactions.

Mule detection is difficult because legitimate customers can also receive third-party payments, operate small businesses or transfer funds internationally. An effective model combines:

• graph analysis of senders, recipients, devices and identifiers;
• account age and behavioural change;
• velocity and pass-through ratios;
• shared contact details or devices;
• recruitment signals in employment or social-media channels, where lawful;
• complaints, scam reports and payment-recall data;
• links to known compromised accounts or criminal infrastructure.

A useful operational measure is the pass-through ratio:

where PTR is the pass-through ratio, O is outgoing value over a defined observation period, and I is incoming value over the same period. The ratio is dimensionless. It can highlight accounts with rapid onward movement, but it is not proof of mule activity. A logistics business or payment intermediary may legitimately have a high ratio. The measure must therefore be combined with timing, counterparties, customer profile and network evidence.

Institutions should distinguish a victim from a willing participant. A person deceived into opening an account may require protection, education and recovery support rather than punitive closure. Poorly designed controls can drive vulnerable customers away from regulated channels and reduce intelligence quality.

8. Cross-border data and regulatory fragmentation

Money laundering is transnational, but data protection, secrecy, localisation and reporting rules remain substantially national. A bank may identify suspicious activity only by combining data held in several countries, while legal restrictions may limit transfers to a group compliance function or foreign investigator.

Key conflicts include:

• differing definitions of personal data and sensitive data;
• restrictions on exporting customer information;
• bank secrecy and professional confidentiality;
• inconsistent suspicious-transaction-reporting rules;
• different retention periods;
• divergent beneficial-ownership registers;
• restrictions on automated decision-making and profiling;
• inconsistent recognition of electronic identity and signatures.

Cross-border governance should begin with data mapping. Institutions should document what data is collected, where it is stored, who can access it, the legal basis for processing, the retention period and the circumstances in which it may be disclosed. Standardised data taxonomies and secure information-sharing channels reduce unnecessary duplication.

A group-wide risk framework should permit local implementation where law requires it, but local variation should be explicit rather than accidental. Escalation protocols should identify when local legal advice, supervisory engagement or a formal information-sharing mechanism is necessary.

9. Enforcement lessons and institutional accountability

Enforcement actions across the banking and payments sector repeatedly show that sophisticated technology cannot compensate for weak governance. Common findings include inadequate customer-risk assessment, delayed transaction monitoring, poor escalation of alerts, incomplete beneficial-ownership information, weak correspondent due diligence, untested automated systems and failure to remediate known deficiencies.

The lessons are broader than the facts of any one case:

1. Growth does not suspend control obligations. Rapid customer or transaction growth should trigger capacity and model review.
2. A formal policy is not evidence of effectiveness. Regulators examine implementation, records, staffing, testing and outcomes.
3. Alerts are not the control objective. The objective is timely, well-reasoned risk disposition and reporting.
4. Senior management must understand material deficiencies. Delegation of tasks does not remove accountability.
5. Data quality is a compliance issue. Missing or inconsistent data can make a technically advanced model unreliable.
6. Remediation must address root causes. Increasing alert reviewers may not solve defective customer segmentation or incomplete transaction feeds.

The Danske Bank Estonia scandal demonstrated the consequences of non-resident business, weak customer understanding, inadequate controls and ineffective governance. The FinCEN Files illustrated how suspicious-activity reporting can coexist with continued movement of funds when institutions and authorities lack sufficient capacity to act on intelligence. Cryptocurrency enforcement actions have likewise shown that registration, licensing and sanctions obligations cannot be treated as optional merely because the service is delivered digitally.

These examples should not be reduced to a checklist. Their strategic significance lies in the relationship between business model, risk appetite, control design and management information.

10. A future-ready AML/KYC strategy

A future-ready strategy should combine six capabilities.

10.1 Threat-informed risk assessment

Risk assessments should incorporate typologies, law-enforcement intelligence, internal incidents, customer complaints, product changes and geopolitical developments. They should be refreshed when a new payment rail, partner, asset or jurisdiction is introduced—not only on an annual calendar.

10.2 Unified customer and network intelligence

Customer due diligence, transaction monitoring, fraud, sanctions screening and cyber intelligence should not operate as isolated systems. Subject to legal constraints, a unified view can identify relationships among accounts, devices, wallets, beneficiaries and businesses. Network analytics should support investigators rather than replace them.

10.3 Real-time and retrospective controls

Real-time controls address immediate loss and dissipation. Retrospective analytics identify typologies that were not visible at the time of payment and support model tuning. Both are necessary. A real-time model may be deliberately conservative, while a retrospective model can conduct deeper analysis with more complete data.

10.4 Model risk management and responsible AI

Machine-learning systems may improve prioritisation, but they can reproduce biased data, drift as criminal behaviour changes, and become difficult to explain. Institutions should maintain model inventories, define intended use, test performance across relevant populations, monitor drift, document features, control access and provide human review for consequential decisions.

Performance should be assessed using measures appropriate to the operational objective. Precision is:

where TP is true positives and FP is false positives. Recall is:

where FN is false negatives. These measures are meaningful only when labels are reliable and the sampling process is understood. In AML, a “true positive” may mean a case escalated or reported, not necessarily a criminal conviction. Institutions should therefore avoid treating model metrics as direct measures of social benefit.

10.5 Control proportionality and customer fairness

Controls should be calibrated to risk. Broad de-risking of entire sectors or communities may reduce short-term exposure but can undermine inclusion and drive activity into less transparent channels. Customers need clear reasons, review pathways and timely correction of inaccurate information, subject to tipping-off restrictions and legal requirements.

10.6 Resilience and learning

A resilient programme assumes that systems will fail, data will be incomplete and threats will evolve. It therefore maintains fallback procedures, incident playbooks, skilled investigators, independent testing and feedback loops from cases to policies and models.

11. Applied case: an instant-payments fintech partnership

Background

This illustrative case concerns Meridian Bank, which partners with SwiftPocket, a fintech offering an instant-payment wallet to customers in three jurisdictions. SwiftPocket performs digital onboarding and sends transaction data to Meridian for settlement and monitoring. The partnership grows rapidly through social-media marketing.

Problem

Within six months, Meridian observes many newly opened wallets receiving payments from unrelated persons and transferring funds to crypto-asset exchanges. Several accounts share devices and telephone numbers. SwiftPocket’s contract states that it performs KYC, but Meridian receives only a pass/fail result and cannot routinely inspect the underlying evidence. Payments settle within seconds, and customer complaints indicate romance scams and fake employment schemes.

Analysis

The risk is not established by any single indicator. The relevant pattern combines rapid growth, remote onboarding, shared devices, high pass-through activity, unrelated counterparties, crypto-asset exposure and information asymmetry between the partners. Meridian’s principal control failure is governance: it has accepted a customer journey without ensuring access to the evidence needed to discharge its own obligations.

A network view is more informative than an account-by-account review. Suppose an account receives 40 payments totalling 8,000 monetary units and sends 7,600 onward within two hours. Its pass-through ratio is:

The ratio indicates rapid movement but does not prove laundering. Investigators must examine the source accounts, customer explanation, occupation, device links, beneficiary risk and whether the account holder is a victim.

Approach and solution

Meridian should:

1. pause expansion of the partnership until control gaps are addressed;
2. obtain auditable KYC evidence and beneficial-ownership information;
3. implement shared-risk indicators and secure, lawful data exchange;
4. introduce pre-payment or step-up controls for high-risk beneficiaries;
5. create a joint fraud-and-AML investigation team;
6. conduct retrospective review of existing wallets;
7. report suspicious activity where legal thresholds are met;
8. provide victim-support and account-recovery pathways;
9. validate SwiftPocket’s identity and transaction-monitoring models;
10. establish termination and data-transition procedures.

Outcome

In this illustrative scenario, the review identifies a smaller group of organised mule accounts, a larger group of deceived customers and several false positives caused by legitimate gig-economy payments. The bank improves detection by combining device, payment and beneficiary data rather than applying a single transaction threshold. It also renegotiates the partnership so that accountability, audit access and incident notification are explicit.

Learning points

The case demonstrates that partnership risk is ecosystem risk; rapid payments require layered controls; numerical indicators support but do not replace investigation; and customer protection is part of effective AML strategy rather than an unrelated service concern.

12. Horizon scanning

Horizon scanning is a structured process for identifying developments that may alter financial-crime risk or control effectiveness. It should not be a speculative technology list. A practical scan asks four questions:

1. What is changing in technology, criminal behaviour, regulation or society?
2. Which customers, products, data or controls could be affected?
3. What evidence would indicate that the risk is becoming material?
4. What low-regret action can be taken before certainty is complete?

Institutions should monitor generative AI-enabled impersonation, deepfake onboarding, autonomous scam operations, tokenised deposits, central-bank digital currencies, cross-chain bridges, quantum threats to cryptography, privacy-preserving payments, open banking, biometric fraud and changes in sanctions or beneficial-ownership transparency. Each item should have an owner, an evidence threshold, a review date and a decision route.

A useful governance device is a horizon register containing the development, time horizon, affected processes, risk hypothesis, indicators, control experiments and accountable executive. This turns awareness into action while avoiding premature investment in fashionable but immature tools.

Challenges and limitations

Emerging AML/KYC strategy faces unavoidable limitations. Criminals adapt to controls, data can be incomplete, international cooperation is uneven, and technology may create new exclusion or surveillance risks. Advanced analytics can generate false confidence when labels are weak. Privacy restrictions may limit ideal data integration, while excessive collection can itself create security and legal exposure. Regulators may issue principles that require interpretation, producing uncertainty for novel business models.

These limitations favour disciplined experimentation: define the problem, test the control on representative data, measure customer and financial-crime outcomes, obtain independent challenge, and scale only when governance is adequate.

Chapter Summary

Digital finance changes AML/KYC risk by increasing speed, interconnectedness, remote access and jurisdictional complexity. Digital onboarding requires layered identity evidence, device intelligence and fair exception processes. Instant payments require real-time prevention combined with post-event network analysis. Fintech partnerships do not transfer regulatory accountability; institutions must control data access, monitoring, audit and exit arrangements.

Crypto-assets and DeFi require analysis of service providers, wallets, protocols, interfaces and control points rather than simplistic assumptions about anonymity or decentralisation. Digital identity and privacy-enhancing technologies can improve assurance and minimise unnecessary disclosure, but only when reliability, revocation, lawful access and inclusion are addressed. Mule networks require graph-based analysis and careful differentiation between victims and willing participants. Cross-border data problems demand mapping, lawful sharing, standardised taxonomies and explicit local variation.

A future-ready programme is threat-informed, network-aware, technologically assured, proportionate, privacy-conscious and resilient. Its success depends less on the volume of alerts than on governance, data quality, timely intervention, sound investigation and continuous learning.

Key Terms

Anti-money laundering (AML): Laws, policies and controls designed to prevent, detect and report the laundering of illicit proceeds.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

Blockchain analytics: Analysis of distributed-ledger transactions and address relationships to identify patterns and exposure.

Crypto-asset: A digital representation of value or rights that can be transferred or stored electronically.

Decentralised finance (DeFi): Financial activity delivered through distributed or smart-contract-based arrangements.

Digital identity: Electronic representation of identity attributes used for identification or authentication.

False positive: An alert or decision indicating risk where the suspected concern is not substantiated.

Fintech partnership: A business arrangement in which a technology-oriented firm provides or supports financial services.

Horizon scanning: Structured identification and assessment of future developments that may affect risk or controls.

Instant payment: A payment that is processed and made available to the recipient within a very short period, often seconds.

Know your customer (KYC): Processes for identifying, verifying and understanding customers and their expected activities.

Mule account: An account used to receive, transfer or withdraw illicit funds, knowingly or unknowingly.

Network analysis: Examination of relationships among accounts, persons, devices, transactions and entities.

Privacy-enhancing technology (PET): Technology that reduces unnecessary exposure of personal data while enabling useful computation or verification.

Risk-based approach: Allocation of controls according to the nature and severity of assessed risk.

Sanctions evasion: Avoidance of restrictions imposed on designated persons, countries, goods or activities.

Synthetic identity: A constructed identity combining real and fabricated personal information.

Travel rule: Requirement for specified originator and beneficiary information to accompany qualifying virtual-asset transfers.

Zero-knowledge proof: A cryptographic method of proving a statement without revealing the underlying information beyond what is necessary.

Review Questions

Short Answer Questions

1. Why do instant payments require both preventive and retrospective AML controls?
2. Identify four risks associated with remote digital onboarding.
3. Why does outsourcing KYC to a fintech not remove a bank’s accountability?
4. What is a money mule, and why must victims be distinguished from willing participants?
5. State two benefits and two limitations of digital identity systems.

Long Answer Questions

1. Critically evaluate how digital banking changes the assumptions underlying traditional AML/KYC frameworks.
2. Explain the principal AML/KYC challenges created by crypto-assets and decentralised finance.
3. Discuss how privacy-enhancing technologies can be reconciled with beneficial-ownership and suspicious-transaction obligations.
4. Design a governance framework for a bank that uses a fintech partner for instant-payment services.
5. Evaluate the role of responsible artificial intelligence and model-risk management in future AML programmes.

Analytical / Application Questions

1. A new wallet receives 120 unrelated payments and transfers 92% of the value to three crypto-asset exchanges within one hour. Analyse the indicators, alternative explanations, investigative steps and possible controls. Do not conclude that the activity is criminal solely from the facts given.
2. A multinational bank cannot transfer customer-identification data from one subsidiary to its central compliance unit because of local privacy restrictions. Develop a lawful and operationally effective information-sharing strategy.
3. Prepare a horizon-scanning plan for a bank concerned about deepfake onboarding, cross-chain transfers and AI-enabled mule recruitment. Specify risk hypotheses, indicators, owners and low-regret actions.

Multiple Choice Questions with Answers

Question 1

Which feature most directly increases the AML risk of instant payments?

A. They always involve cash withdrawals

B. They provide limited time to intervene before funds are dispersed

C. They eliminate the need for customer identification

D. They can only be used domestically

Correct Answer: B. They provide limited time to intervene before funds are dispersed

Question 2

What is the principal accountability rule for a bank outsourcing KYC to a fintech?

A. The fintech automatically assumes all regulatory responsibility

B. The bank has no responsibility after signing a service agreement

C. Outsourcing a process does not remove the bank’s regulatory responsibility

D. Responsibility belongs only to the cloud provider

Correct Answer: C. Outsourcing a process does not remove the bank’s regulatory responsibility

Question 3

Why is a blockchain address not necessarily equivalent to an identified customer?

A. Blockchain transactions cannot be recorded

B. Addresses may be pseudonymous and require off-chain attribution

C. All blockchain addresses are legally anonymous

D. Blockchain systems do not permit transfers

Correct Answer: B. Addresses may be pseudonymous and require off-chain attribution

Question 4

Which statement best describes decentralised finance for AML analysis?

A. Decentralisation automatically eliminates financial-crime risk

B. Only traditional banks can be relevant control points

C. Analysts should examine developers, interfaces, governance and control functions

D. DeFi transactions are always private

Correct Answer: C. Analysts should examine developers, interfaces, governance and control functions

Question 5

A customer receives 8,000 monetary units and sends 7,600 onward during the observation period. What is the pass-through ratio?

A. 0.05

B. 0.76

C. 0.95

D. 1.05

Correct Answer: C. 0.95

Question 6

Which is a limitation of biometric digital identity?

A. It cannot be used for remote onboarding

B. A false non-match may exclude a legitimate customer

C. It makes data protection irrelevant

D. It guarantees that the presenter is the rightful owner

Correct Answer: B. A false non-match may exclude a legitimate customer

Question 7

What is the primary purpose of a privacy-enhancing technology in AML/KYC?

A. To guarantee complete anonymity in all transactions

B. To eliminate beneficial-ownership obligations

C. To reduce unnecessary data disclosure while enabling required verification

D. To prevent lawful access by competent authorities

Correct Answer: C. To reduce unnecessary data disclosure while enabling required verification

Question 8

Which pattern is most relevant to possible mule activity?

A. A stable salary credited monthly by a known employer

B. A new account receiving many unrelated payments and rapidly transferring funds onward

C. A mortgage payment to a regulated lender

D. A recurring utility bill from the customer’s registered address

Correct Answer: B. A new account receiving many unrelated payments and rapidly transferring funds onward

Question 9

Why should a high pass-through ratio not be treated as conclusive evidence of money laundering?

A. The ratio has no mathematical meaning

B. Legitimate intermediaries may also have rapid inflows and outflows

C. Outgoing payments are never relevant to AML

D. The ratio can only be calculated for cash

Correct Answer: B. Legitimate intermediaries may also have rapid inflows and outflows

Question 10

Which practice best supports cross-border AML data governance?

A. Copying all data into every group entity without restriction

B. Avoiding all data sharing between subsidiaries

C. Mapping data, access, legal bases, retention and lawful disclosure routes

D. Allowing business staff to decide informally what may be shared

Correct Answer: C. Mapping data, access, legal bases, retention and lawful disclosure routes