Economic crime risk is shaped by a combination of regulatory expectations, evolving threats, technological change and operational realities. Together, these pressures make it increasingly difficult for firms to prevent economic crime and demonstrate that their controls are effective.

We explore the key pressures facing regulated financial services firms, how they manifest across the customer lifecycle, and how we help firms respond.

What economic crime is costing UK firms and their customers

£124m: in FCA fines in 2025, before remediation costs and business disruption.
£1.28bn: lost to UK payment fraud in 2025, up 4% year-on-year

These numbers aren’t isolated incidents. They’re the visible edge of a much wider shift.

Regulators, enforcement bodies and industry standard-setters are intensifying their focus on economic crime, and, increasingly, on firms’ ability to demonstrate that their response is effective in practice.

Across these developments, the direction of travel is consistent.

The question is moving beyond whether firms have the right policies and controls, towards whether they can demonstrate that those controls are operating effectively against the risks they face.

FCA and National Crime Agency

UK, 2024 to 2026

Recurring findings across sectors point to a familiar gap: policies may exist, but evidenced practice often falls short, particularly around risk assessment, due diligence and third-party oversight.

Wolfsberg Group

industry, June 2026

Updated risk-based approach guidance reinforces the need for firms to focus resources where risk is greatest.

FATF

global, June 2026

Under the incoming UK presidency, fraud and stronger risk-based supervision are explicit international priorities.

AMLA

Direct supervision of selected high-risk obliged entities begins in 2028, alongside efforts to harmonise customer due diligence standards.

A complex industry. A converging set of pressures.

For firms responding to that expectation, the challenge is anything but uniform.

The nature of the risk varies by firm type, business model, customer profile, regulatory environment and organisational maturity. The operational challenge also looks different depending on where you sit – from senior management and compliance through to operations, technology, data and those with direct accountability for individual controls and decisions.

The environment is also changing at pace: threats are evolving, regulatory expectations are rising, and AI and technology are changing both the risks firms need to manage and the capabilities they are expected to deploy.

Regulatory expectations Evolving threats AI and technology Operational challenge Firm type Business model Customer profile Organisational maturity

Through our work across regulated financial institutions and engaging with senior stakeholders, we see the same pressures repeatedly emerge.

Those pressures converge into eight core themes.

Regulatory and accountability

Regulatory scrutiny is intensifying

Demonstrate that controls are effective and work in practice while meeting new obligations.

Senior leaders face greater accountability

Clear ownership, effective oversight and defensible evidence matter.

Controls struggle to keep pace

Evolving threats and expectations outpace traditional frameworks.

AI adoption outpaces assurance

Governance gaps and unclear accountability slow safe deployment.

Operational and economic

Fragmented operations drive unnecessary cost

Duplicated and inefficient processes consume capacity without improving risk outcomes.

Detection creates volume, not intelligence

False positives and weak scenarios drive costly investigations.

KYC friction raises cost and loses customers

Manual onboarding and reviews delay revenue and frustrate customers.

Weak data undermines transformation

Poor data weakens controls and limits automation and risk decisions.

The themes are recurring pressure points across the industry, not a single issue that every firm experiences in the same way or within one function. Their intensity and consequences change depending on where they surface in the customer relationship.

That is where the customer lifecycle becomes an important lens.

The same pressures play out across the customer lifecycle, but not in the same way at every stage. A pressure around data, for example, can have one implication at onboarding, another during monitoring, and another when a firm needs to evidence a decision at exit.

The same is true of controls, risk assessment, operating model, technology and accountability.

Onboarding

Where the foundations are established

Customer risk assessment, due diligence, data quality, customer experience and operational efficiency all come together at the point a relationship begins.

The challenge is not simply completing the process, but reducing friction and establishing a risk and evidence foundation that stays useful as the relationship develops.

Ongoing monitoring

Where the response has to keep pace

Monitoring does not stop at onboarding. Behaviour changes, threats evolve and regulatory expectations sharpen, so the response has to move with the relationship: keeping the customer’s risk assessment current, separating signal from noise, and keeping the operating model, data and technology behind the monitoring fit for purpose.

This is where the pressures compound. Fragmented processes, duplicated work, unreliable data and legacy technology stop being separate problems and reinforce each other, and every one shows up in the alerts your team cannot clear.

Exit & de-risking

Where decisions have to stand up to scrutiny

At exit, the firm needs to stand behind the decisions made throughout the relationship.

The quality of the data, risk assessment, monitoring, decision-making and evidence therefore becomes critical, particularly where a decision may later need to be explained or defended.

Across the diversity of firms, stakeholders, risk environments and operating models we see, the same eight pressures keep appearing, and the customer lifecycle shows how they manifest in practice.

That connects two perspectives:

What is changing across the industry

regulatory expectations, evolving threats, technology and AI, operating complexity

How that change is experienced by firms

across the eight recurring pressure themes and three stages of the customer lifecycle

Together, they provide a more complete view of where the economic crime response is under pressure, and why.

How we help

We work across the full customer lifecycle and supporting control framework with banks, insurers, wealth and asset managers, and FinTechs and challenger banks across the UK, EU and UAE, with global reach through our RegTech products and prior delivery.

We bring specialist expertise together with capability across advisory, transformation, data, technology and AI, including our RegSight and Compass RegTech products and technology-enabled delivery that accelerates work and reduces engagement costs, so we can both build the response and defend it.

That allows us to look at the problem from both directions:

Across the customer lifecycle and control framework:

understanding the recurring pressures and how they interact across the customer lifecycle.

Into the detail:

understanding the specific operational, data, technology, regulatory and accountability issues that make those pressures difficult to resolve.

We start with the economic crime problem, not the technology.

Where AI, data or technology can improve the response, we use them to address the underlying issue, whether that means improving decision quality, reducing avoidable workload, strengthening evidence or making controls more effective and defensible.

Our combination of cross-industry perspective, specialist expertise and 14 years of focus on economic crime is what allows us to see both the recurring theme and the nuance of where it appears.

That brings us back to the question regulators are increasingly asking. Not simply: do you have the control?