Financial crime compliance is the set of controls a business runs to detect and prevent money laundering, terrorist financing, sanctions violations, and other regulated categories of illicit finance. Historically, it has been a distinct function: separate team, budget, vendors, and reporting line. That distinction is now dissolving, and the shift is a bigger deal for buyers than it sounds.
I founded Bureau, where we answer two questions across the entire digital customer journey: who are you, and can I trust you? We build for anyone responsible for running a digital risk journey, from onboarding through transactions. When Filip Verley put five rapid-fire questions to me on Liminal’s Friday Five, four of my five answers turned out to be versions of the same answer. Here it is with the connective tissue attached.
Why financial crime compliance gets bought before fraud
When we started, we focused only on fraud. We assumed that was the right approach and that a point solution would be enough. What forced us to confront that was ordering.
Compliance is a much larger market than fraud, and more importantly, it is the need people want solved first. I did not expect that. If you come at this from a fraud background, you assume fraud leads, because fraud has an obvious dollar figure attached. It turns out the sequence runs the other way in most buying conversations.
The two show up as if they were different categories of decision: compliance as a regulatory obligation with a named owner and a deadline, and fraud as a loss the business can choose to keep absorbing. One gets scheduled, while the other gets discussed. That framing is exactly what has to break. The real takeaway is that solving risk requires looking across the entire identity lifecycle, including fraud, compliance, and security, through a common network intelligence view, rather than treating them as disconnected problems.
The trade-off nobody prices in: security
Our industry has been neatly organized so far into compliance, credit, and fraud. Security has usually been kept outside that arrangement, treated as a separate department with its own budget and a different conversation. That separation is ending. Security and fraud are starting to merge, and once that thread is pulled, the rest of the lines go with it: compliance and fraud, fraud and credit, credit and security. All of it comes together because what everyone actually cares about underneath the org chart is just identity and transaction trust.
The industry has a name for part of this. FRAML, the merging of fraud and anti-money laundering functions, is well established, and regulators are actively pushing it, with FinCEN and FATF both issuing guidance encouraging closer coordination between fraud and AML teams.
But FRAML describes a two-way merge. What I am describing is a four-way one, and the fourth corner, security, is the one almost nobody has priced in. A synthetic identity created at onboarding is a compliance problem, a fraud problem, a credit problem, and increasingly a security problem; and it is the same synthetic identity in all four cases.
It is worth being honest that this has been attempted before. Institutions tried to integrate fraud and AML functions in the early 2000s and mostly failed at it. Anyone selling convergence today has to answer why this time is different, and I think the answer is in how you do it rather than whether you do it. FRAML only works when there is a cross-institution signal behind it: something like a Graph Identity Network that gives every institution a shared view of identity across the ecosystem. Without that underlying network, it is just another dashboard.
The next 12 to 18 months: stop asking people to replace their stack
So far, the FRAML market has been all about the SaaS stack. Whether you are a bank or a consumer internet platform, the question has been what your SaaS stack looks like for risk and fraud.
What will matter over the next 12 to 18 months is whether you can add something to that stack without asking the buyer to change it. Seamless to integrate data. Plugins rather than migrations. An AI and AML overlay that can actually make and edit decisions on what is already there. That is a different proposition from walking in and saying there is a problem and I have a better mousetrap. This pitch is not going to matter as much as it may have earlier.
This is also, I think, the answer to why the earlier convergence attempts failed. They tried to converge the stack itself, which meant rip and replace, multi-year programs, and a change-management problem large enough to kill the thesis before it delivered.
Converging the decision layer while leaving the stack alone is a different exercise with a much shorter path to value. The current wave of convergence work is broadly heading this direction, toward a single risk view assembled from systems that stay where they are.
The practical version is this. When a vendor tells you they integrate fraud and compliance, ask what has to be removed for that to be true. If the answer involves replacing something you just finished implementing, you are buying a migration, not a decision layer.
The hill I will die on: AI has not solved for creativity
People think AI has solved for creativity now. I do not think so.
Whether it is music or movies, and setting aside the deepfake conversation, which is a different thing, I am willing to bet it is going to be a very, very long time before an AI-made music or film catches up with anything a human being can make. Creativity is not something AI has solved for yet. It has solved for output, which is not the same thing, and the gap between those two is wider than the current enthusiasm suggests.
Key takeaways
- Financial crime compliance is losing its edge. Compliance, fraud, credit, and security have traditionally been organized as separate functions with dedicated budgets. However, they are now converging toward a single question about identity and transaction trust.
- Compliance gets bought before fraud. A compliance gap is a regulatory obligation with a named owner and a deadline. A fraud gap is a loss that a business can choose to keep absorbing. Vendors who assume fraud leads have the sequence backward.
- FRAML is only half the story. The established two-way merge of fraud and AML leaves out security, which is the corner that most buyers have not priced in, and the one where the same synthetic identity shows up as a fourth distinct problem.
- Convergence works as an overlay, not a replacement. Earlier attempts to merge fraud and AML largely failed because they tried to converge the stack. Converging the decision layer on top of an unchanged stack is the version with a real path to value. Ask any vendor claiming convergence what has to be removed for their claim to hold.
