In depth

Ten steps towards good governance

Published in November 2023, revised in October 2026.

01Innovating, with caution

New technologies can make anti-money laundering faster, more precise and cheaper, but they must be assessed and introduced with judgement, often alongside the usual methods. The right tool is the one that works and that the supervisory authority expects to find, even when it is not the most sophisticated.

02Looking at effectiveness, but also at costs and timing

A solution that works on paper and slows the work down does not hold. What counts is the result, what it costs to get it and how long it takes.

03Deciding on data

Those who manage risk well decide on the basis of data, and look after it as a resource. You need information that is correct, up to date and gathered at the right frequency.

04Thinking like a risk manager

The anti-money laundering function was born close to compliance and today increasingly uses the methods of risk management: measuring the effects of risk on the accounts, setting risk appetite thresholds, writing action plans. And governing model risk: algorithms are checked periodically, with written rules.

05Sharing data

For machine learning to be of any use, data must be shared securely and with international coverage, in compliance with the GDPR.

06Segmenting more rigorously

Dividing customers between private individuals and companies, or by volume of transactions, is no longer enough. Groups must be built on the relationships among the variables that describe risk.

07Using artificial intelligence where it is needed

Fixed-rule models age. An unsupervised model can examine large volumes of data and find patterns that traditional methods do not see, even mapping the networks of relationships among subjects.

08Automating processes

Less manual work, shorter times, documents archived in digital format. And real monitoring: knowing at every moment where each case stands, measuring the efficiency of the process, documenting decisions.

09Integrating controls

Instead of many programs that do not talk to each other, one open, integrated platform covering the whole analysis cycle, from raw data to decision.

10Focusing on what matters

Operators' time should be spent on the alerts that deserve it. A risk score calculated on several variables helps decide which alerts to take forward at once and which to put on hold.