Credible threats and managed services

Credible threats: Tapping a new model for financial crime compliance

There’s a lot of talk about threat actors. From hackers to attackers, these are individuals or groups who threaten systems with ransomware, data breaches, social engineering, and other tactics.

The term also applies to financial criminals. Some threat actors exploit digital payments and other FinTech to commit fraud, money laundering, or identity theft. Others are nation-state actors who compromise blockchains and virtual assets to fund weapons proliferation.

As tactics become more sophisticated and systems more interconnected, regulators in 2024 are upping their scrutiny of financial crime compliance programs, such as transaction monitoring, know your customer (KYC), and other aspects of anti-money laundering (AML). KPMG has identified financial-crime threat actors as one of the top 10 regulatory challenges of 2024. 

Pressure on risk and compliance

Regulators expect companies to allocate sufficient resources to financial crime compliance processes—not only knowledgeable staff but also automation, data analysis, and a robust process for managing regulatory change.

They also expect organizations to monitor for emerging threat actors—such as those involved in virtual currencies, sanctions evasion, or organized crime—by using advanced techniques for detection and response.

It’s no wonder that chief risk officers in the U.S. say their No. 1 challenge in the next two to five years will be regulatory changes and compliance issues¹. Worldwide, 84 percent of chief compliance officers expect increased regulatory scrutiny, and more than half plan to borrow skillsets from other business functions to help fill their resourcing needs².

Perpetual, not periodic

It will be hard to meet these expectations with sporadic compliance reviews, manual efforts, and hard-to-find talent. Instead, financial crime compliance should be an ongoing process, with real-time monitoring that’s powered by automation and backed by experts in risk, regulations, and forensics.

That’s why progressive risk and compliance functions are using managed services. In this model, providers take responsibility for processes such as transaction monitoring, KYC, and customer due diligence (CDD)—packaged in a multi-year subscription with outcome-based pricing.

The best managed services combine deep domain knowledge, data management, and advanced tech to help companies:

• Continually monitor transactions and detect anomalies in real-time
• Automate manual activities to improve speed and accuracy
• Collect data from multiple sources to enrich customer profiles
• Improve the customer and employee experience 
• Anticipate and prevent conditions that raise government scrutiny
• Reduce the cost of compliance while increasing regulator trust

Operationalizing the growth ambition

When managed well, compliance programs can enable the growth strategy by earning regulators’ permission for bold enterprise transformation—whether it’s launching technologies, interacting with customers and suppliers in different ways, or expanding to new markets.

But when there are failures in financial crime compliance, this trajectory can be reversed. As regulators apply more scrutiny to compliance weaknesses, they’re issuing stronger penalties, including limitations on growth and, in some cases, required divestitures.

Facing both sophisticated threat actors and scrutinous regulators, companies need a new operating model for financial crime compliance. And many are finding it in managed services. 

Learn more about KPMG Managed Services for financial crime compliance.

For an archive of past blogs, please visit Going Beyond: Managed Services.

Footnotes

¹ Source: 2023 KPMG Chief Risk Officer Survey

² Source: KPMG Global Chief Ethics and Compliance Officer survey, 2024