AML/KYC 2026: Why are suspicious transaction reports exploding in Belgium?
While sanctioned-vessel profiles more than double and digital-asset regulation becomes increasingly mainstream, Belgium’s CTIF received 102,312 communications in 2025 and financial-crime compliance frameworks are evolving towards greater integration, data sharing and speed. The 2026 issue is therefore not only technology: it is the collision between geopolitics, the speed of financial flows and the transformation of financial models — an environment to which purely documentary and static compliance frameworks are increasingly poorly suited.
AML/KYC compliance in 2026 is caught between two dynamics. The first is fragmentation: the rapid evolution of sanctions, the multiplication of risks linked to shadow fleets and the development of alternative payment systems. According to LexisNexis Risk Solutions, sanctioned-vessel profiles more than doubled between 2023 and 2025, while alternative payment systems are becoming increasingly important.
The second is integration. Fraud and money laundering increasingly share certain signals — compromised identities, accounts used to move funds rapidly and unusual transaction behaviour — while cross-border payments are becoming faster and digital assets are progressively entering structured regulatory frameworks. The Financial Stability Board highlights, in particular, the importance of data sharing, fraud prevention and effective sanctions screening in cross-border payments.
Belgium provides a particularly interesting case. The CTIF received 102,312 communications in 2025, compared with 91,487 in 2024, and referred 1,334 new cases to the judicial authorities, representing a total amount of €2.13 billion. The CTIF itself highlights the continued increase in the number of communications and the growing role of professional money-laundering mechanisms.
This increase does not, however, automatically mean that the money-laundering risk has increased to the same extent. A significant share of communications now comes from payment institutions, whose role in European cross-border flows has become substantial. Analyses of the CTIF's 2025 report notably highlight the role of platforms in the volume of communications received by the Belgian FIU.
At the same time, AMLA is building the new European supervisory model. In 2026, the authority is working on the methodology for selecting entities that will fall under its direct supervision, with direct supervision of up to 40 of the most significant financial institutions or groups scheduled to begin in 2028.
For a Belgian CCO, the challenge is therefore no longer simply to demonstrate that procedures exist. It is to demonstrate that the framework identifies relevant risks, produces measurable results, adapts to new channels and allows decisions to be justified.
Context & Background
What has changed between 2024 and 2026
The European AML landscape has been fundamentally restructured over the past few years. AMLA began its operations in 2025 and is continuing in 2026 to build the Single Rulebook, promote supervisory convergence and prepare for direct supervision. In 2026, the authority is working in particular on the methodology for selecting entities that will be directly supervised; this supervision is scheduled to begin in 2028.
The FATF, for its part, has not abandoned technical compliance in favour of effectiveness: its fifth round of mutual evaluations, based on the 2022 methodology, examines both compliance with the Recommendations and the effectiveness of measures in practice. Assessments adopted in 2026 therefore continue to assess the results achieved by countries in combating money laundering, terrorist financing and proliferation financing.
On digital assets, the regulatory gap is also narrowing. In the European Union, most MiCA provisions have applied since December 2024, while provisions relating to asset-referenced tokens and e-money tokens have applied since June 2024. In the United Kingdom, the FCA published its final rules in June 2026, but the new UK cryptoasset regime is expected to enter into force on 25 October 2027, rather than in July 2026. In the United States, the GENIUS Act has established a federal framework for payment stablecoins.
The change is therefore less about global regulatory convergence than about the progressive normalisation of digital assets within several distinct national regulatory frameworks.
Geopolitics enters the screening file
The threat landscape is also evolving. Sanctions evasion increasingly relies on commercial structures, intermediaries, complex trade routes and, in some cases, shadow fleets or alternative payment systems. LexisNexis Risk Solutions reports that sanctioned-vessel profiles more than doubled between 2023 and 2025 and argues that increasing fragmentation of payment systems requires institutions to look beyond transaction monitoring alone.
For sanctions teams, the issue is therefore not the disappearance of name screening, but its limitations when used in isolation. A counterparty may not be directly sanctioned while still presenting significant exposure to a high-risk jurisdiction, trade chain, vessel or ownership structure.
Sanctions screening should therefore be complemented by a more dynamic analysis of relationships, jurisdictions, beneficial owners, trade routes and transaction behaviour.
The Belgian paradox: communications are increasing, but not everywhere
The CTIF's 2025 annual report shows a sharp increase in the number of communications received. This development must nevertheless be interpreted cautiously. The number of communications received by an FIU is not, by itself, a direct measure of the level of money laundering in the economy. It also reflects the reporting behaviour of obliged entities, the business models of the sectors concerned and the way European financial flows are structured.
Payment institutions now play a particularly important role in this dynamic. Analyses of the report indicate that they accounted for approximately 52,000 communications in 2025, representing more than half of the information received.
The conclusion should not, however, be that traditional banks have necessarily become less effective. A decline or stability in the number of communications from a particular sector cannot, by itself, measure the effectiveness of its AML framework.
The real question is rather whether detection frameworks remain aligned with new payment models.
In-depth analysis
Concrete cases & examples
Wise and the surge in Belgian communications
The Wise case illustrates how new payment rails can change the geography of suspicious-transaction reporting. The lesson is not that Wise alone is responsible for the increase in Belgium's AML risk. The phenomenon is more structural: payment institutions play an increasingly important role in European financial flows, particularly through digital and cross-border payments.
This creates a new issue of information concentration: a central actor can generate very large volumes of communications, putting pressure on the analytical capacity of both the FIU and financial institutions.
For AML teams, this raises an operational question: how can they distinguish a high volume of genuinely informative signals from a high volume of communications simply correlated with the size or business model of a payment provider?
The FSMA and the end of the MiCA transitional period
30 June 2026 marked the end, at the latest, of the Belgian transitional period for certain providers already operating under the national regime. The FSMA states that the providers concerned must hold the necessary MiCA authorisation to continue their activities.
A few days later, the FSMA issued a warning concerning six unauthorised providers: Aurum Foundation, Bank Bit, Bithf Pro, Dxago, Global Dynamic Trade and ZeriaFunding.
For a bank or financial institution, the practical consequence is straightforward: when considering a relationship with a CASP, its regulatory status should form part of the counterparty assessment.
This verification does not replace KYC, understanding the business model or transaction analysis. It adds an essential piece of information: is the counterparty authorised to carry out the activity it is offering?
Belgium facing AMLA: a new supervisory logic
The rise of AMLA adds another dimension to this transformation.
In 2026, AMLA is preparing its methodology for selecting entities that will be directly supervised. From 2028, the authority is expected to directly supervise up to 40 of the most significant and complex high-risk financial institutions or groups in the European Union.
For the groups concerned, the challenge will not simply be to present well-written AML policies.
They will need to demonstrate:
how risks have been identified;
why certain scenarios were selected;
how alerts are handled;
how resources are allocated;
what results the framework produces;
how weaknesses are identified and addressed.
Documentation therefore remains essential. But it must demonstrate the effectiveness and rationale of the framework, rather than constitute an end in itself.
Practical implications
Key takeaways
Geopolitics has become an operational variable in financial risk: the growth of shadow fleets, sanctions and alternative payment systems requires institutions to move beyond simple name matching.
Belgium is experiencing a historic increase in CTIF communications: 102,312 communications in 2025 and 1,334 cases referred to the judicial authorities, representing €2.13 billion.
An increase in communications does not directly measure an increase in money laundering: it also reflects market structures, reporting behaviour and the growing role of payment institutions.
Real time should be targeted, not universal: the question is not whether every alert should be processed within seconds, but which risks require immediate intervention.
FRAML is primarily a shared financial-intelligence project: fraud and AML can retain distinct responsibilities while sharing more data, signals and analytical capabilities.
Crypto is entering the normal perimeter of financial compliance: MiCA, the new UK regime and the US stablecoin framework demonstrate the progressive regulatory normalisation of digital assets, although according to different timelines and rules.
AMLA is progressively shifting attention towards more harmonised, risk-based European supervision: the selection of entities for direct supervision is being prepared in 2026 and direct supervision is scheduled to begin in 2028.
Roadmap / Upcoming deadlines
Deadline | Event | Status | Recommended action |
|---|---|---|---|
2026 | AMLA is finalizing, among other things, its methodological work to prepare the selection of entities subject to direct supervision | In progress | Identify the indicators that demonstrate AML effectiveness and improve the quality and availability of relevant data (AMLA) |
30 June 2026 | End, at the latest, of the Belgian transitional period for certain crypto providers already operating under the national regime | Deadline passed | Verify CASP regulatory status and update due diligence on crypto-related counterparties |
25 October 2027 | Expected entry into force of the new UK cryptoasset regime | Upcoming | Anticipate the implications for groups operating in the UK or exposed to UK providers |
10 July 2027 | Application of the European AMLR and continuation of the harmonisation of the Single Rulebook | Upcoming | Review policies, procedures, controls and reporting processes to ensure consistency with the new European framework |
2027 | Selection of entities subject to AMLA's direct supervision | Upcoming | Identify gaps in the AML framework and strengthen the ability to demonstrate its effectiveness |
2028 | Start of AMLA's direct supervision of selected institutions or groups | Upcoming | Be able to demonstrate effectiveness, governance, data quality and the rationale behind AML resource allocation |
Ongoing | Evolution of sanctions, shadow fleets and alternative payment systems | Permanent | Regularly review high-risk corridors, counterparties and sanctions scenarios |
Conclusion
The 2026–2028 window is not simply about technological modernisation of AML. It marks a deeper transformation of the compliance model. Risks are becoming faster, more cross-border and more interconnected. Digital assets are moving closer to the traditional financial system. Fraud and money laundering increasingly share common signals. Sanctions are evolving in line with geopolitical tensions. And European authorities are progressively building a more harmonised supervisory framework, increasingly focused on risk and outcomes.
For Belgian financial institutions, the answer is therefore not to replace every existing tool with a new platform.
It is to build a framework capable of connecting information, prioritising risks and acting at the right speed.
Tomorrow's compliance function will not be the one with the most procedures. It will be the one capable of demonstrating, with data, that it understands its exposure, detects relevant risks and knows why it acts.
