Anti-money laundering: how are supervisors tackling the current challenges?

Speech by Anneli Tuominen, Member of the Supervisory Board of the ECB, at the Anti-Money Laundering Regulation readiness conference

Helsinki, 5 November 2026

It is a pleasure to be here and I would like to thank the organisers for inviting me.^[1] Today, I will discuss how supervisors are tackling the current challenges in the fight against money laundering.

Let me start by giving you some context about both the magnitude of the challenge we are facing and why it is that banking supervisors are also interested in such matters. The amount of money laundered worldwide every year is estimated to range between 2% and 5% of global GDP.^[2] To put that into perspective, the lower end (around USD 2.4 trillion) is roughly equal to the value of Canada’s entire annual economic output, while the upper end (around USD 5.9 trillion) exceeds the same figure for Germany. We are talking about huge sums of money – sums which, by definition, move through the global financial system. The authorities appear to be having significant difficulties in stemming the flow of this massive financial tide. For example, in the EU alone, recent estimates suggest that less than 2% of the annual proceeds from organised crime networks are seized by law enforcement.^[3]

All of which is problematic for at least two reasons. The first is what I would call the “human dimension”. Money laundering is underpinned by clandestine activities which are illicit by definition and which often have pernicious effects on society, such as tax fraud, corruption and drug or human trafficking. The fallout from such activities can also entail sizeable costs for fiscal authorities, including public healthcare and welfare-related expenses. From a public good perspective, societies have a strong interest in curbing the activities that generate such illicit funds. Closer scrutiny of the financial entities that can be used to launder some of these illegal proceeds would therefore be one way to combat such activities.

The second reason has to do with financial stability. Risks related to money laundering matter for banking supervision, as they may entail legal, credit and liquidity-related^[4] risks, thereby impinging on a bank’s operational continuity or otherwise affecting its reputation – to the point that the viability of the bank itself may be threatened. Meanwhile, prudential factors also matter for money laundering-related risks, for example if a bank is weakly governed and its underlying controls are lax. Given that financial stability is also seen as a public good, the case for eliciting the help of banking supervisors in the fight against money laundering is easy to make.

While the association between money laundering and prudential risks for banks has long been recognised, the digital age has now turbocharged it. The globalisation of financial services and fast-paced technological innovation in both the bank and non-bank sectors have multiplied the avenues for potential vulnerabilities on the prudential and anti-money laundering (AML) sides, making the task of supervisors more complex. In the remainder of my remarks, I will first outline the institutional and regulatory changes the authorities have undertaken in response to these developments. I will then highlight the ways AML and prudential supervisors can work together and outline the common challenges they face. I will conclude by discussing the implications for policymakers and bankers.

Centralising AML supervision

Let’s start with the institutional and regulatory changes. Given that this conference is devoted to preparations for when the EU’s recent Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR)^[5] becomes fully binding in July 2027, you are no doubt all aware that a centralised Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has now been established at EU level to ensure that the new rules are applied consistently across Member States. But it is still worth taking a brief look at how we got to this point.

In many respects, the developments leading to the centralisation of the AML function in the EU (AMLA formally commenced operations in July 2025) were reminiscent of those that led to the centralisation of the prudential banking supervision function for euro area economies a decade or so earlier (the Single Supervisory Mechanism, or SSM, became operational in November 2014). The decision to confer prudential supervisory tasks on the ECB came in response to the euro area sovereign debt and banking crisis, and the recognition that fragmented national supervision had failed to prevent systemic risk and bank-sovereign feedback loops. The creation of a centralised supervisory mechanism was thus meant to ensure consistent standards and restore trust in the banking system. Similarly, AMLA was established following a series of high-profile money laundering cases^[6] in several European countries which exposed weaknesses in both national enforcement and cross-border coordination under a fragmented legal framework. ^[7] These cases brought home the realisation that money laundering risks are inherently transnational in nature and cannot be tackled effectively by national authorities alone.

Therefore, the SSM and AMLA both represent supranational responses to crises that revealed the inadequacy of purely national approaches. The rationale behind these pan-European structures was that cross-border risks could be better addressed through centralised and coordinated approaches. In both cases, the shift towards supranational supervision was also underpinned by a strengthening of the applicable legal framework, notably through the transition from EU directives (which require national transposition and allow for local variations) to regulations (which apply directly and uniformly across all Member States). This is particularly true of AMLA, where a patchwork of nationally transposed directives has largely been replaced by a new Regulation, set to apply from July 2027. This Regulation covers nearly all of the substantive rules for entities, natural and legal persons falling under the scope of the AMLR, while the new (sixth) Directive on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (known as the AML Directive) primarily contains requirements addressed to Member States – including requirements on how their AML authorities should be run. This represents a more harmonised approach than the hybrid model followed by the SSM, where both regulations and directives include substantive requirements for individual supervised entities. Another difference is that AMLA is also the regulatory standard-setter in the AML domain, and not just the supervisor of supervised entities’ compliance, as is the case for the ECB in the prudential domain.

The ECB’s role in the fight against money laundering

So now that we have supranational supervisors in place to guard against both prudential and money laundering risks, let’s take a closer look at how they work together. As you know, AMLA’s tasks include: (i) direct supervision of around 40 high-risk groups or entities in the area of anti-money laundering and countering the financing of terrorism (starting in January 2028), as well as indirect oversight of the rest of the system; (ii) the coordination and support of EU Member States’ financial intelligence units, which receive and analyse suspicious transaction data; and (iii) regulatory tasks related to the development of the single rulebook on anti-money laundering, a task it has taken over from the European Banking Authority. In addition to its regulatory powers, other distinctive features of AMLA include the way it combines supervision and financial intelligence coordination under the same roof,^[8] and the way it covers both supervision of the financial sector and oversight of the non-financial sector.

In its role as prudential supervisor, the ECB does not supervise banks’ compliance with AML requirements. However, the EU framework does allow for the integration of AML-related findings into prudential decision-making, and supervisors can assess the implications such risks may have for banks.^[9] For example, money laundering risks are among the assessment criteria used when the ECB decides whether or not to grant a new banking licence , or when an individual or legal entity seeks to acquire a large financial stake in a bank that would give it significant power over how that bank is run (known as qualifying holdings assessments). Money laundering risks can also play a role when reviewing the suitability of candidates for banks’ management bodies and their key function holders (known as fit and proper assessments). In such cases, drawing on the input of the AML authorities, prudential supervisors can assess the extent to which an applicant bank’s business model, the risk management systems and control it proposes or its existing or prospective shareholders could pose money laundering risks. In a similar vein, a decision by the ECB to withdraw a bank’s licence could be a prudential outcome grounded in AML failures. The ECB may also seek the input of AML supervisors when assessing the suitability of the members of a bank’s management body or its key function holders. The AML-related findings of supervisors may also have a bearing on the ECB’s day-to-day supervision, including its annual check on banks’ health (the Supervisory Review and Evaluation Process, or SREP), if supervisors have reasons to believe that money laundering risks could be connected to a bank’s business model, credit operations or governance and internal risk management practices.

The ECB mainly uses the information shared by AML supervisors to inform its prudential assessments. Meanwhile, the information gathered by prudential supervisors can also be used by the AML authorities to inform their own approach towards the entities they supervise. All of which means that smooth cooperation between the different stakeholders is key to avoiding potential blind spots in the system and preventing disjointed supervisory approaches. This second point is important because both AML and prudential supervisors can apply similar powers and measures to the entities under their remit (including the power to restrict or limit their business, to require changes in their governance or to impose monetary penalties or sanctions). In order to better structure cooperation and information exchange, the ECB and AMLA concluded a Memorandum of Understanding in mid-2025.^[10] This agreement also contains provisions for reciprocal representation, so I personally have the privilege of attending the AMLA General Board meetings as an observer on behalf of ECB Banking Supervision. Within ECB Banking Supervision itself, we have also set up a horizontal coordination function for AML issues to facilitate information exchange, provide expertise on policy issues and ensure a consistent approach on these matters across European banking supervision.

Challenges in a technology-driven financial system

Although the institutional and regulatory framework that guards against money laundering risks has been upgraded significantly in recent years, supervisors’ work has not become any easier. There are two challenges that prudential and AML supervisors share, both linked to the pace of digitalisation and innovation in the financial sector.

The first challenge concerns the nature of the risks that supervised entities face. Rapid advancements in digitalisation have spilled into almost every aspect of economic and social activity. But as banks and other financial entities have increasingly digitalised their operations, their potential channels of vulnerability have multiplied. They now have larger “attack surfaces”^[11] – in other words, more entry pathways and digital touchpoints with customers that malicious actors could exploit. This is also due to their growing reliance on third-party companies to provide a broad range of services, from cloud and critical infrastructure functions to payment solutions. Within an increasingly interconnected and sophisticated financial system, the recent surge in the ability of artificial intelligence (AI) and related technologies to find loopholes in such channels of vulnerability has exacerbated these challenges.

As a result, prudential supervisors are concerned about risks to banks’ operational resilience in the digital age, including cyberattacks, whose intensity and frequency have increased in recent years alongside a rise in geopolitical risks.^[12] In an environment characterised by hybrid threats, risks to operational resilience have risen to the forefront of the ECB’s supervisory priorities.^[13] While money laundering risks have traditionally fallen under the umbrella of financial crime compliance, the digitalisation of onboarding processes for customers and businesses^[14] has expanded these risks into the realm of information and communication technology (ICT) and cybersecurity risk. This is why prudential and money laundering risks have become more closely intertwined. Banks and other financial entities now need to guard against features such as automated scams, synthetic identities and AI-driven deepfakes^[15], which have made long-standing money laundering-related offences such as fraud, identity theft and forgery even more pernicious. And in doing so, they must also stay abreast of financial innovation trends (such as crypto-assets, electronic money and the growth in real-time payments) which increase the speed, anonymity and complexity of such vetting processes. Crypto-assets pose a particular challenge in this regard, which is why a new EU Transfer of Funds Regulation^[16] has recently been enacted to make it easier to trace crypto transactions.^[17]

Overall, insufficient operational resilience in an increasingly digitalised world makes it easier for bad actors to breach automated AML systems. It may also point to broader problems in risk monitoring and control frameworks. This is why both prudential and AML supervisors are keen to tackle such vulnerabilities, within their respective mandates. Moreover, if these risks materialise they may also lead to reputational or disinformation risks that potentially threaten the viability of the bank or financial entity itself, which again would warrant the attention of both supervisors.

The second common challenge revolves around the operational capacities of prudential and AML supervisors themselves in this changed environment where technology has complicated the risk monitoring and assessment landscape. Increased reliance on financial services provided by third parties implies that prudential supervisors need to assess banks’ operational resilience not only to cyberattacks from malicious actors, but also to potential self-inflicted incidents triggered by their attempts to fix or update their own systems (known as IT change risk^[18]). Prudential supervisors have particular concerns about unintended or knock-on effects on the adequacy of banks’ internal controls in a context in which many of these outsourced services are provided by a handful of large technology companies. As you may know, the ECB has focused a lot of supervisory attention on this area in recent years, including by outlining supervisory expectations for banks’ outsourcing arrangements with cloud service providers^[19] and asking banks to draw up action plans to defend against AI-powered cybersecurity threats.^[20] Insofar as AML supervision is concerned, factors such as digital banking, complex cross-border payments and fintech solutions mean that supervisors now need to process very large transaction datasets in order to detect and analyse hidden relationships.^[21] This requires the use of advanced computational techniques so that the results from this analysis can be acted upon quickly.

Prudential and AML supervisors both now face more technologically opaque, complex, data-driven and rapidly evolving risk profiles in the entities they supervise, requiring them to act faster than ever. Their shared challenge will be to keep abreast of these fast-paced developments and adapt their operational capabilities as required, so they can continue to engage in meaningful dialogue with the entities they supervise.

Implications for bankers and policymakers

So far today I have essentially argued that new technology presents challenges to prudential and AML frameworks, with digitalisation acting as a risk multiplier for supranational supervisory bodies operating at the intersection of financial stability and cross-border risks. Let me conclude by outlining the implications of my arguments for banks and other financial entities, as well as for their supervisors.

My main recommendation for banks and other financial entities is straightforward: strengthen your operational resilience frameworks. We have conveyed this message to all ECB-supervised banks in recent years, regardless of their size or business model. Recent events have also shown that this recommendation will continue to serve banks well for the foreseeable future. Once we accept this premise, it has at least two consequences.

The first could best be described as “fighting fire with fire”. Banks and other financial entities need to invest more in AI technologies on a sustained, multi-year basis to counter the growing threats from malicious actors using those same technologies. At the ECB, we have highlighted the need for banks to reinforce existing controls around software development and third-party patches, and recommended greater investment in cybersecurity. Regarding AML-related processes, technological advancements offer opportunities to strengthen both identity-related “know your customer” checks and transaction monitoring.^[22]

The second consequence concerns governance aspects at supervised entities. If banks are to successfully address the risks stemming from the increasing digitalisation of financial services, their management bodies need to have the collective capacity to understand all things digital. So we are paying closer attention to this issue in our fit and proper assessment processes.^[23] This also means that there needs to be a clear accountability framework within banks for AI-driven decisions, including effective oversight and robust challenge mechanisms.^[24]

Prudential and AML supervisors also face the challenge of upgrading the technology powering their day-to-day processes to match the increasingly sophisticated methods of both threat actors (seeking to exploit vulnerabilities) and supervised entities (looking to defend themselves against threats). This means that there is a need not just to invest in technology, but also to use it effectively to better inform supervisory decisions, as traditional supervisory processes may be insufficient in an AI-enabled financial environment built on large datasets. The ECB is increasing its use of digital oversight tools, including through a comprehensive IT project to further digitalise end-to-end supervisory processes.^[25] There is also a staffing dimension here, because as banks and other financial entities make increasing use of AI technology, their supervisors must also remain “tech savvy” to understand the risks these entities actually face.

But perhaps the greatest challenge of all is cultural, as opposed to technological or operational. Prudential and AML supervision takes place with a time lag. Before the digital age, this time lag was substantial, with prudential and compliance checks overwhelmingly relying on manual processes. This meant that supervisory policies could afford to be more reactive than proactive. However, increased digitalisation and technological change in banking and financial markets in recent years means that supervisors need to act much faster by prioritising effectively and taking a more risk-based supervisory approach. I am hopeful that, by working closely together^[26] and with the help of the new institutional and regulatory tools which we have given ourselves, both prudential and AML supervisors will overcome these common challenges to make the financial system more resilient.