Fragmented operations drive unnecessary cost

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoring

Exit & de-risking

The risk is connected. The operating model isn’t.

The FCA’s June 2026 review of insurance firms’ economic crime controls found unclear accountability across group structures, inconsistent application of policy between business units and limited evidence of structured, risk-based monitoring. Its April 2026 review of customer due diligence found that, at some firms, the same people carried out onboarding and the compliance review intended to challenge it.

The EU is codifying the same expectation. The AMLR requires group-wide compliance policies, a Compliance Manager at management-body level and a Compliance Officer with clear group-wide duties, collapsing any assumption that fragmented, entity-by-entity operating models can survive supervisory review.

The controls are there. The problem is how they connect. Risk moves across customers, products, teams and jurisdictions, while accountability, data and processes remain organised around individual controls. That creates gaps that are difficult to see from within any one function.

We see the same pattern in firms that have already been through remediation. The governance framework is rebuilt, the review closes and the model works, for a while. Then people move on, products and geographies expand, typologies change and the business evolves. Over time, budgets tighten, resources are reallocated and the additional capacity put in place for remediation is quietly stripped back. The risk assessment and risk appetite can be refreshed, but the operating model underneath them does not always move at the same pace. The pressure is not simply to build better controls. It is to keep the model aligned as the business and the risk change.

Nobody designs what happens between them

A control gets built by one team. Another is added later. Each makes sense on its own, but nobody designs what happens between them. When a case, customer or piece of intelligence crosses the boundary, the receiving team rebuilds the context, repeats checks and makes its own judgement.

The same pattern appears across different risk types. Fraud can move in minutes while AML builds its picture over months. Both teams can be looking at the same customer, but the firm may still treat them as separate processes. A fraud team can flag a payment as a scam while the AML team decides there is not yet enough evidence to escalate it. Both decisions can be reasonable. The intelligence between them is what gets lost.

Because each team can still demonstrate that its own control works, the problem rarely appears in individual metrics. It emerges at the interfaces: screening and case management, first and second line, fraud and financial crime, or the firm and an outsourced provider. Over time, those gaps consume capacity as well as creating risk: work is duplicated, investigations slow down, decisions become inconsistent and more effort is required to achieve the same outcome.

The controls have not necessarily failed. The operating model has made them harder and more expensive to run as one system.

UK institutions surveyed report average annual AML and KYC operating spend of US$78.4m [source to be confirmed].

Work duplicated at the interfaces is spend that adds no risk coverage.

How we support you

We start with how the firm actually operates: its business, risk profile, structure and existing controls, and use that to determine what the operating model needs to look like. We bring an independent view of industry practice and regulatory expectations, then design the ownership, standards and connections between functions so the model works for that firm and continues to hold as the business and risk change.

Typical engagements include:

Mapping where accountability actually breaks down across team and function boundaries, including where a third party now sits inside that boundary

Designing a single governance framework with clear ownership, in place of a patchwork of team-level arrangements

Finding where teams duplicate the same work, most visibly between fraud and AML, and connecting the intelligence instead of doubling the effort

Building a RACI that traces every finding back to a single accountable owner

Making sure the model survives past the review that prompted it, not just satisfies it

Baselining the recurring cost of duplicated work before anything changes, so savings are measured against an agreed baseline and capacity released is reported separately from cash saved

See our full list of services

Our experience

A UK building society

Why we were brought on: following internal and external findings on its financial crime controls, it launched a multi-year Financial Crime Transformation Programme to rebuild its FCC framework around a proper target operating model, reinforce the three lines of defence, and remediate CDD across roughly ten million customers.

What we did: we provided FCC subject matter experts and transformation specialists to lead the Customer Due Diligence workstream and run the programme management office, covering higher-risk customer remediation, governance and reporting through to Board Risk Committee and the FCA.

Outcome: the programme is running at scale, around 27,000 higher-risk customers in active remediation, governance embedded up to Board and regulator level, with CDD/KYB, PEP and data workstreams ongoing.

A leading UK retail and commercial bank

Why we were brought on: the bank was struggling to recover Fraud Operations service delivery amid rising fraud attacks, capability gaps and reliance on inflexible systems, with customer experience increasingly impacted.

What we did: we embedded a fraud specialist team to strengthen quality, process and training, and to embed the bank’s new Fraud Operations target operating model through coaching and operational uplift.

Outcome: Fraud Operations service delivery and resilience improved, frontline capability and consistency strengthened, and the TOM was embedded into day-to-day operations.

A multinational insurer and asset manager

Why we were brought on: the firm needed to understand how effectively its financial crime compliance framework stood up against regulatory expectations, across every major market it operated in.

What we did: we ran a mock regulatory review of the FCC framework, then designed the target operating model and new organisation design for the Group FCC function, completed in under 12 weeks against a committed deadline.

Outcome: the TOM and organisation design were approved and implemented, a Financial Crime Risk Appetite Framework was established with monthly KRI monitoring, and the business-wide risk assessment was completed across all markets.

£21,091,300

FCA fine, July 2025

Over a year

the money laundering reporting officer role was held only on an interim basis

A recent industry example shows the cost of an operating model with no single accountable owner. The FCA’s Final Notice against a UK digital bank, issued in July 2025, found its governance framework “insufficiently robust” to manage its own remediation programme, that it was “unclear at times who within [the bank] was accountable,” and that there was “a lack of awareness by key employees, including those responsible for testing and assurance.” The bank’s money laundering reporting officer role had been held only on an interim basis for over a year. The fine was £21,091,300. This was not a failure of any single control. It was a failure of who owned the picture across all of them.