Opinion
Financial crime has industrialized. Investigation hasn't.
Criminal networks now operate at global scale with specialized teams, AI and digital infrastructure, while many financial institutions still investigate suspicious activity through fragmented, manual processes.
Financial crime no longer looks like crime. It looks like a business. Networks that once relied on isolated actors now operate through specialized roles: recruiters, money mules, technical operators and coordinators who may never interact directly. Europol and INTERPOL have described this shift as the industrialization of fraud. Fraud is one visible expression of a wider system of adversarial risk, in which illicit revenue, concealed beneficial ownership and fund transfers increasingly function as connected business operations.
By common estimates, the world spends roughly half a trillion dollars a year fighting financial crime, while around one and a half trillion dollars is lost to it anyway. Those figures illustrate the scale of the challenge, but the operational gap is not only one of detection. A widening mismatch has opened between the speed and structure of the adversary and the way many institutions still investigate.
Artificial intelligence lowers the cost of operating at scale for both sides. Criminals got there first. AI can support the creation of convincing identities, generate realistic synthetic documents, analyze large volumes of exposed information to identify targets and coordinate work that once required a larger human team. Criminal networks also have an important advantage: they do not have to preserve and defend a comparable record of their decisions. They can create new identities, reroute payments, move to another platform and abandon compromised infrastructure by exploiting the seams between identity, payment and compliance systems. By the time an institution understands why a transaction looked wrong, the structure behind it may already have changed.
Most financial institutions have invested heavily in transaction monitoring, customer due diligence, sanctions screening and fraud detection. These systems can surface more suspicious activity than ever before. But an alert only identifies a reason to look. An alert does not establish who controls an entity, how counterparties are connected, whether a transaction belongs to a larger pattern or which explanation best fits the evidence.
The bottleneck begins after the alert. Investigators must combine internal records with transaction histories, corporate registries, sanctions data, public information and other sources, often across jurisdictions and languages. They must reconcile evidence that may be incomplete or contradictory, test alternative explanations and document their reasoning well enough to withstand examination. More alerts and more data do not automatically create more protection; they can simply leave institutions with a larger inventory of cases competing for the same specialist attention.
A stronger response therefore requires treating investigation as an operating capability in its own right. The objective is to synthesize the information institutions already hold, reach a well-supported conclusion and preserve the path behind it. That capability has several layers: bringing together siloed data, applying reasoning that reflects how experienced investigators think and producing documentation thorough enough for a regulator, court or internal audit.
No regulation mandates a specific technology. But governance requirements such as auditability, explainability, human authority over consequential decisions and periodic effectiveness testing make governed AI the operating model these rules effectively require. It is technology that can help gather evidence, trace relationships, compare competing explanations and preserve the reasoning behind each finding while remaining inside approved sources, permissions, domain logic and review requirements. In financial-crime investigations, automation without clear boundaries creates a new form of risk. The analysis must be bounded, auditable and explainable, and a human specialist must retain authority over decisions that can lead to blocked transactions, account closures, suspicious activity reports or referrals to law enforcement.
Effective investigation infrastructure cannot simply be a faster version of today's process. It needs to be a different one, reducing the manual work of collecting, transferring and organizing information so that investigators can spend more time on judgment: weighing ambiguous evidence, examining missing information, testing alternative interpretations and deciding what the facts actually support.
Performance measurement should change as well. Alert volumes and cases opened reveal activity, but they do not show whether an institution is keeping pace with the threat. More useful measures include the time required to reach a decision, the consistency of evidence gathering, the ability of another reviewer to reproduce the investigative path and the proportion of specialist time devoted to judgment rather than assembly. That is the accountability regulators and institutions ultimately rely on.
Financial crime has industrialized through scale, specialization and rapid adaptation. Institutions will not close the gap by adding another detection layer to the same fragmented investigative process. Their defenses will ultimately be judged by how many meaningful cases they can resolve in time, how clearly they can explain those decisions and how reliably the investigative path holds up under review. In enforcement-grade environments, trust is the only currency that scales.
Eyal Azoulay is the Founder and CEO of Tangos.
