Financial Crime
Financial crime is the umbrella term for offenses committed to obtain money or property dishonestly, or to conceal where money came from. It covers money laundering, fraud, bribery, sanctions evasion, market abuse and terrorist financing — categories that sit in one function inside most institutions and behave quite differently from each other.
| Principal categories | Money laundering, fraud, bribery and corruption, sanctions evasion, market abuse, terrorist financing |
| Two directions of money | Fraud takes money out; laundering moves criminal money in |
| Terrorist financing | Often small sums of legitimately-obtained money moving to an illegitimate purpose |
| Institutional structure | Commonly one function, with separate teams and separate systems |
| Regulatory driver | Anti-money-laundering law, sanctions regimes, anti-bribery legislation |
| Fraud’s position | Largely unregulated as a control — institutions manage it as a loss, not an obligation |
| Common dependency | The identity of the customer, established at onboarding |
| Standing problem | The categories share customers and rarely share data |
The categories behave differently
| Category | Direction of money | Who loses | Primary driver |
|---|---|---|---|
| Fraud | Out of the institution or the customer | The institution or the victim | Loss avoidance |
| Money laundering | Through the institution | Society, not the bank directly | Regulatory obligation |
| Sanctions evasion | Through, to a prohibited party | Strict liability exposure | Legal prohibition |
| Bribery and corruption | Out, as improper inducement | Competitors and the public | Legal prohibition |
| Terrorist financing | Through, often in small clean sums | Society | Regulatory obligation |
Two differences in that table explain most of how institutions are organized. Fraud is a loss, and the rest are obligations. That difference in driver puts fraud teams under commercial pressure to approve and compliance teams under regulatory pressure to scrutinize, which is why the two functions argue.
And terrorist financing inverts the laundering problem. Laundering takes dirty money and makes it look clean; terrorist financing frequently takes clean money — a salary, a donation — and moves it to an illegitimate purpose, in amounts too small to trip a threshold. Controls built to find large suspicious flows are looking for the wrong shape.
Why the split between fraud and AML persists
In most institutions these are separate teams, separate systems, and separate data. The reasons are historical — AML grew from regulation and fraud from loss management — and the consequences are current.
The same customer can be flagged by a fraud model and a monitoring scenario in the same week without either team knowing. A money mule is both a fraud problem and a laundering problem, and sits awkwardly in whichever function claims it. The convergence argument — that these should share a view of the customer — has been made for years and implemented unevenly, because merging them means merging systems, budgets and reporting lines.
Why this matters for identity verification
Every category in the table depends on the same thing, and it is the thing furthest upstream: knowing who the customer is.
Sanctions screening matches a name that was captured at onboarding. Transaction monitoring compares activity against a profile built at onboarding. Regulatory reporting identifies a subject using onboarding data. Fraud models score behavior against a baseline formed after onboarding. All four inherit the same input.
Where that input is wrong, each control operates correctly and produces a wrong answer. A synthetic identity is screened under a name belonging to nobody, monitored against a baseline it authored, and reported to authorities as a person who does not exist. None of those systems is broken; they are all faithfully processing an identity that was never established.
That is the argument for treating identity document verification as financial crime infrastructure rather than as an onboarding step — it is the single input every downstream control shares, and KYC and AML programs are only as good as the identity they start from.
What financial crime controls can’t do
They cannot eliminate it. Regulators expect risk-based programs, not the absence of incidents, and a program with no findings is usually over-controlled rather than excellent.
They do not share a view of the customer. Where fraud and AML operate separately, neither sees the whole picture and the gap between them is exploitable.
Threshold-based controls miss small-sum activity. Terrorist financing in particular moves amounts designed to stay beneath them.
They cannot repair upstream identity. No downstream sophistication fixes a customer who was never properly identified.
Frequently asked questions
What counts as financial crime?
Money laundering, fraud, bribery and corruption, sanctions evasion, market abuse and terrorist financing. The categories sit in one function in most institutions but differ substantially — in which direction money moves, who bears the loss, and whether the control exists to avoid loss or to meet an obligation.
What is the difference between fraud and money laundering?
Direction and driver. Fraud takes money out of an institution or a customer, and institutions control it to avoid loss. Money laundering moves criminal proceeds through an institution, and controls exist because regulation requires them. That difference is why fraud teams face commercial pressure and compliance teams face regulatory pressure.
Why are fraud and AML usually separate functions?
Historically, because AML grew out of regulation and fraud out of loss management, with different systems and reporting lines. The consequence is that the same customer can be flagged by both without either team knowing, and cases that are both — money mules especially — sit awkwardly between them.
How does identity verification underpin financial crime controls?
Every control depends on it. Sanctions screening matches a name captured at onboarding, monitoring compares activity against a profile built there, and reporting identifies subjects using that data. Where the identity was never established, each control operates correctly and returns a wrong answer.
Related reading
- Money laundering — the category most of the regulatory framework was built around
- Compliance — the function that operates these obligations and evidences them
- Transaction monitoring — the detective control, and the profile it depends on
- Identity fraud — the category that cuts across fraud and laundering alike
