By Stuart Clarke, CEO of Blackdot Solutions
Financial crime investigations traditionally open after something has gone wrong. Fraud has been uncovered, suspicious activity has been flagged, or a compliance issue has emerged. Investigators then develop intelligence from what they can reach: internal records, and external data from publicly available and licensable sources (open source intelligence or OSINT), such as corporate ownership networks, adverse media and sanctions exposure. The aim is to establish what happened, who was involved, how the warning signs were missed and what should change so it doesn’t happen again, whether that means updating a typology or re-tuning the rules that generate an alert.
That’s the valuable thing that an investigation produces, and it often arrives too late to act on. By the time a team has mapped a network behind fraud, the customer may have been onboarded months earlier, the money has usually moved on, and the lesson gets applied to the next case rather than this one.
Speed has been the focus for years, and the gains are real. The harder question is when that capability gets used. A faster investigation that starts after a loss still ends in a loss, whereas the same capability applied at onboarding changes the outcome. The people relying on investigators are waiting to make a call: the relationship manager deciding whether to take on a client, the analyst deciding whether an alert deserves escalation, the FIU officer choosing which reports to develop out of thousands. Each of them needs sound intelligence in front of them at the point they decide. Shifting the outcomes of investigations to the left means moving that intelligence to the point of decision, rather than producing it once the decision has already been made. It is a question of when that intelligence arrives, which matters as much as how fast it is produced.
What shifting left looks like in practice
Onboarding is the obvious place to start. Automation tools built for external data let organisations draw on a far broader range of sources than risk and compliance databases alone. A new customer can trigger a risk assessment automatically, with ownership structures, adverse news and sanctions exposure brought into screening without an analyst having to go and dig for them. Put enough of those data points together and you can triage customers at the door, then carry out due diligence to a depth that matches the assessed risk at each tier. Low risk cases move quickly; analyst time goes where it is needed.
Alerts and suspicious activity reports come next. Many financial institutions have to manage vast volumes of transactions and alerts, while national financial intelligence units (FIUs) receive SARs in similar volumes. The UKFIU alone received 866,616 SARs in 2024-25, making it challenging to investigate every case of suspicious activity effectively. A single alert, however, thoroughly it has been worked, tends to show one slice of the activity. Set alongside related alerts and SARs, and checked against external data, that same alert can reveal connections that would otherwise stay hidden. This is often how larger, more dangerous criminal networks operate. Fraud, sanctions evasion, corruption and environmental crime frequently rely on the same enablers and facilitators underneath, and the same formation agents and nominee directors turn up repeatedly.
What often gets missed is intelligence work done before any alert exists. Entities and typologies can be extracted from regulatory output, think tank research and investigative journalism, then washed against customer and transaction data, so risk surfaces without waiting for a monitoring rule to catch up. Reactive investigations belong in this loop too. A closed case should make the next one easier to spot, feeding new typologies back into screening and tuning the systems that raise alerts in the first place. This is not a novel expectation. When FATF assesses a country’s use of financial intelligence under Immediate Outcome 6, assessors look for feedback, operational experience and typologies being routinely worked back into reporting guidance and analytical practice, on the basis that a system which learns from its own cases is a more effective one. The standard is set at national level, though the logic holds just as well inside a single institution. Today, that learning often stays in the case file.
Why AI makes this more urgent
AI is having a profound impact on financial crime, on both sides of the risk equation. For criminals, deepfake tools produce convincing synthetic identities, a capability that was out of reach for most bad actors not too long ago. This enables them to run fraud at a speed and scale that manual checks were not designed for.
The same technology is helping organisations, though. Automation can now collect and sort publicly available data from many sources at once, and the better tools surface the relevant insights rather than adding to the volume an analyst has to work through. Entity resolution, for example, is a core investigation task, and AI can link a range of online profiles and records to the same real-world identity. By performing these groundwork tasks that traditionally take up a large chunk of an investigator’s workflow, humans can instead use their time to apply their judgement, expertise and contextual awareness to cases.
For any of this to stand up to scrutiny, the AI involved must be explainable, with sourcing an analyst can read and check. The principle is to automate what can safely be automated and keep judgement with the investigator.
From ticking boxes to catching criminals
Under pressure to onboard clients or clear alerts, compliance teams can push through checks quickly, as long as the boxes have been ticked. It’s a similar situation at FIUs, with the number of SARs they receive and their ability to investigate them.
On paper the process is compliant. That doesn’t mean criminals are being caught. They deliberately use different identities, accounts, entities, transactions, channels and jurisdictions to mask the trail of their money. A single transaction or SAR might not raise any concerns, but several, smaller discrepancies or similarities over time might. This is the wider picture that often gets missed.
Regulators have moved the same way, asking for effectiveness rather than activity that can be counted: better quality SARs, attention prioritised towards higher risk customers and proactive, intelligence-led work. FATF has assessed effectiveness alongside technical compliance since 2013, and the measure that matters is whether financial intelligence is being put to use. The risk sits in the gap between what current tooling identifies and what a fully resourced review would find.
The move beyond box ticking means combining internal and external data across the first and second lines of defence, whether the job is onboarding a client or unpicking a complex network. Reactive investigations aren’t going away, and they shouldn’t. But their value lies in the way they teach, and that value is wasted if it only ever reaches the next review of something that has already gone wrong. Turning investigations into a preventative capability is what will help tackle financial crime at its source.
From detection to prevention: Rethinking the fight against financial crime
By Stuart Clarke, CEO of Blackdot Solutions
Financial crime investigations traditionally open after something has gone wrong. Fraud has been uncovered, suspicious activity has been flagged, or a compliance issue has emerged. Investigators then develop intelligence from what they can reach: internal records, and external data from publicly available and licensable sources (open source intelligence or OSINT), such as corporate ownership networks, adverse media and sanctions exposure. The aim is to establish what happened, who was involved, how the warning signs were missed and what should change so it doesn’t happen again, whether that means updating a typology or re-tuning the rules that generate an alert.
That’s the valuable thing that an investigation produces, and it often arrives too late to act on. By the time a team has mapped a network behind fraud, the customer may have been onboarded months earlier, the money has usually moved on, and the lesson gets applied to the next case rather than this one.
Speed has been the focus for years, and the gains are real. The harder question is when that capability gets used. A faster investigation that starts after a loss still ends in a loss, whereas the same capability applied at onboarding changes the outcome. The people relying on investigators are waiting to make a call: the relationship manager deciding whether to take on a client, the analyst deciding whether an alert deserves escalation, the FIU officer choosing which reports to develop out of thousands. Each of them needs sound intelligence in front of them at the point they decide. Shifting the outcomes of investigations to the left means moving that intelligence to the point of decision, rather than producing it once the decision has already been made. It is a question of when that intelligence arrives, which matters as much as how fast it is produced.
What shifting left looks like in practice
Onboarding is the obvious place to start. Automation tools built for external data let organisations draw on a far broader range of sources than risk and compliance databases alone. A new customer can trigger a risk assessment automatically, with ownership structures, adverse news and sanctions exposure brought into screening without an analyst having to go and dig for them. Put enough of those data points together and you can triage customers at the door, then carry out due diligence to a depth that matches the assessed risk at each tier. Low risk cases move quickly; analyst time goes where it is needed.
Alerts and suspicious activity reports come next. Many financial institutions have to manage vast volumes of transactions and alerts, while national financial intelligence units (FIUs) receive SARs in similar volumes. The UKFIU alone received 866,616 SARs in 2024-25, making it challenging to investigate every case of suspicious activity effectively. A single alert, however, thoroughly it has been worked, tends to show one slice of the activity. Set alongside related alerts and SARs, and checked against external data, that same alert can reveal connections that would otherwise stay hidden. This is often how larger, more dangerous criminal networks operate. Fraud, sanctions evasion, corruption and environmental crime frequently rely on the same enablers and facilitators underneath, and the same formation agents and nominee directors turn up repeatedly.
What often gets missed is intelligence work done before any alert exists. Entities and typologies can be extracted from regulatory output, think tank research and investigative journalism, then washed against customer and transaction data, so risk surfaces without waiting for a monitoring rule to catch up. Reactive investigations belong in this loop too. A closed case should make the next one easier to spot, feeding new typologies back into screening and tuning the systems that raise alerts in the first place. This is not a novel expectation. When FATF assesses a country’s use of financial intelligence under Immediate Outcome 6, assessors look for feedback, operational experience and typologies being routinely worked back into reporting guidance and analytical practice, on the basis that a system which learns from its own cases is a more effective one. The standard is set at national level, though the logic holds just as well inside a single institution. Today, that learning often stays in the case file.
Why AI makes this more urgent
AI is having a profound impact on financial crime, on both sides of the risk equation. For criminals, deepfake tools produce convincing synthetic identities, a capability that was out of reach for most bad actors not too long ago. This enables them to run fraud at a speed and scale that manual checks were not designed for.
The same technology is helping organisations, though. Automation can now collect and sort publicly available data from many sources at once, and the better tools surface the relevant insights rather than adding to the volume an analyst has to work through. Entity resolution, for example, is a core investigation task, and AI can link a range of online profiles and records to the same real-world identity. By performing these groundwork tasks that traditionally take up a large chunk of an investigator’s workflow, humans can instead use their time to apply their judgement, expertise and contextual awareness to cases.
For any of this to stand up to scrutiny, the AI involved must be explainable, with sourcing an analyst can read and check. The principle is to automate what can safely be automated and keep judgement with the investigator.
From ticking boxes to catching criminals
Under pressure to onboard clients or clear alerts, compliance teams can push through checks quickly, as long as the boxes have been ticked. It’s a similar situation at FIUs, with the number of SARs they receive and their ability to investigate them.
On paper the process is compliant. That doesn’t mean criminals are being caught. They deliberately use different identities, accounts, entities, transactions, channels and jurisdictions to mask the trail of their money. A single transaction or SAR might not raise any concerns, but several, smaller discrepancies or similarities over time might. This is the wider picture that often gets missed.
Regulators have moved the same way, asking for effectiveness rather than activity that can be counted: better quality SARs, attention prioritised towards higher risk customers and proactive, intelligence-led work. FATF has assessed effectiveness alongside technical compliance since 2013, and the measure that matters is whether financial intelligence is being put to use. The risk sits in the gap between what current tooling identifies and what a fully resourced review would find.
The move beyond box ticking means combining internal and external data across the first and second lines of defence, whether the job is onboarding a client or unpicking a complex network. Reactive investigations aren’t going away, and they shouldn’t. But their value lies in the way they teach, and that value is wasted if it only ever reaches the next review of something that has already gone wrong. Turning investigations into a preventative capability is what will help tackle financial crime at its source.