Why Does Financial Crime AI Need Its Own Place in Bank-Wide AI Governance?

Financial crime is one of the largest AI use cases in banking, yet it usually sits outside the day-to-day remit of the bank’s AI leadership, needing its own teams, suppliers, and regulators as a result of its complexity and associated risk.

However, that separation is starting to close. Regulators are beginning to bring AML and fraud AI into bank-wide AI governance, which means a bank’s AI leader will increasingly be asked to stand behind financial crime compliance (FCC) AI not directly chosen by their department.

FCC AI is among the hardest use cases to govern, because both missed risk and false positives carry regulatory consequences. Get it right, though, and it can become a bank’s strongest proof that its AI governance strategy works at scale.

Here are four things that set FCC AI governance apart, and what AI leadership should ask of it.

1. Why Is FCC AI Coming Into Scope Now?

Global regulatory shifts are pulling FCC AI governance into sharper focus:

1. Singapore: the Monetary Authority of Singapore names AML and fraud as areas where AI can have material impact, and expects cross-functional oversight.

2. United States: the Federal Reserve’s SR 26-2 places AML models under the general model risk framework, replacing the separate 2021 statement on AML model risk.

3. Hong Kong: the Hong Kong Monetary Authority has asked banks to assess AI for suspicious activity monitoring, with feasibility studies and implementation plans signed off at board level.

4. United Arab Emirates: the Central Bank of the UAE’s 2026 guidance on responsible AI requires banks to keep an inventory of all AI models, with boards and senior management directly accountable for AI systems and outcomes, including in fraud detection.

The result is that FCC AI, which once sat only with financial crime and model risk teams, is increasingly expected to sit in the bank’s AI inventory, and it comes with unique requirements not found in other AI use cases.

2. What Makes FCC AI Different From Other AI in the Inventory?

Decisions and errors are regulated. Screening and monitoring decisions lead to sanctions blocks and suspicious activity reports, and supervisors expect a clear trail showing who was accountable for each outcome.

That raises the stakes on errors. In most AI use cases, a false negative is a missed opportunity. In FCC, it can mean a sanctions breach or laundering that goes undetected, followed by enforcement action, heavy fines, remediation programmes, and lasting damage to the bank’s reputation. False positives matter too, through cost, delay and customer impact.

Missed risk tends to be a structural exposure rather than the failure of an individual analyst. Manual review at volume limits how deeply each alert can be investigated. The FATF notes that machine learning can reduce false positives, but that explainability, data quality, and regulation remain the main barriers.

Supervisors test effectiveness. The Wolfsberg Group expects financial crime AI to be explainable, validated, and accountable, whether built or bought, and to serve a legitimate purpose in proportion to the risk. Its 2025 statement on monitoring goes further, asking firms to balance model risk with financial crime risk when they validate and move to new systems. Supervisors will ask whether the AI finds more of what matters, not only whether it runs as designed.

The FCC team usually buys and owns its AI. As it stands, AML and sanctions suppliers are typically chosen by the financial crime team, not the bank’s AI leadership. This is because financial crime leaders answer personally to regulators for their controls, the systems depend on specialist knowledge, and screening and monitoring platforms long predate most enterprises’ central AI functions. Central governance therefore has to work with FCC procurement rather than replace it.

3. Where Can Central AI Governance Add Most to FCC?

Data quality and access. Poor or fragmented data is one of the main barriers to AI in AML. Customer, transaction, and screening data often sit in separate systems, so models see only part of the picture. AI leaders often control the bank’s data platforms, so they can give FCC teams cleaner, more connected data than they could assemble alone, which improves both detection and the explanations behind each decision.

Bought AI. Banks increasingly buy rather than build, with UK third-party AI use cases doubling from 17% to 33% between 2022 and 2024. Regulators expect firms to stay accountable for that AI and to see real evidence from suppliers, not just assurances. Purpose-built FCC systems that come with validation evidence, decision-level explanations, and a full audit trail meet that bar, and give the bank more to stand behind than tools it would have to explain alone.

Consistency across fraud and AML. Fraud AI is generally more mature and often closer to enterprise AI functions. Applying one standard across fraud, AML, and sanctions avoids gaps between them.

Enterprise AI governance adds most by setting the evidence standard and maintaining the inventory, while the FCC team keeps ownership of outcomes. In practice, the FCC team chooses and runs the system, and the bank’s AI leadership decides what evidence it must produce both before and after going live.

4. What Should Central Governance Ask of FCC AI?

Four questions set a workable standard:

• Explanations: can each decision be explained to an auditor or supervisor, beyond model documentation?

• Validation: does independent validation test missed risk as well as false positives, including for supplier models the bank cannot fully see inside?

• Monitoring: is performance tracked over time, with a record of every change? Typologies and customer behaviour shift, so a model that performs well at launch can degrade without anyone noticing, which is why model drift needs active management.

• Oversight: are there clear points where people review or override decisions, and a named senior manager accountable for the use case?

Is Your FCC AI Ready for Central Governance?

FCC AI is among the hardest use cases to govern centrally, and the best proof that governed AI works. A short checklist shows how ready it is:

• Is every FCC AI system in the bank’s AI inventory?

• Does validation test missed risk as well as false positives?

• Can each decision be explained to a supervisor?

• Is the accountable senior manager named?

• Are generative or agentic tools in FCC covered by the bank’s AI policy?

• Is there supplier evidence beyond self-attestation?

Purpose-built, decision-grade AI for financial crime can already meet this standard. Decisions are made within policy boundaries the compliance team sets, each with a decision-level rationale and full audit trail. Governance and performance then improve together, not as a trade-off.

Key Takeaways

• Regulators are starting to bring AML and fraud AI into bank-wide AI governance.

• FCC AI carries regulatory consequences for both missed risk and false positives.

• The FCC team keeps ownership of outcomes; central governance sets the evidence standard.

• Data quality is one of the main barriers to AI in AML, and one where AI leadership can help FCC most.

Financial crime is where bank-wide AI governance faces one of its hardest tests, and where getting it right says the most about the rest of the bank’s AI.