Artificial intelligence, or AI, refers to a set of algorithms that give a machine cognitive functions traditionally associated with humans, such as the ability to analyse, solve problems and make decisions. Today, it is a double-edged tool: it has become indispensable in the financial sector thanks to its ability to process massive amounts of data, automate complex processes and detect fraud, while at the same time providing criminals with unprecedented means of action that, until recently, belonged to the realm of science fiction. From sophisticated fraud to large-scale money laundering, AI is therefore profoundly reshaping the face of financial crime.
In Belgium alone, Febelfin's July 2026 action plan against online fraud recorded EUR 93 million diverted through phishing in 2025, up from around EUR 49 million in 2024, when banks detected, blocked or recovered 75 percent of phishing-related transfers. Net losses remain about 0.004 percent of total transaction volume, yet the absolute amounts keep rising and authorities are struggling to keep pace. This raises a central question: how is artificial intelligence reinventing criminal methods, what responses are authorities and financial institutions attempting to develop, and what challenges remain to be addressed in order to regain the upper hand in this technological battle, with its considerable implications?
How does AI facilitate financial crime?
The rapid expansion of generative AI tools, the democratisation of open-source models and large-scale automation have provided cybercriminals with a ready-made arsenal that is accessible and remarkably effective. AI is fundamentally transforming the nature, speed and complexity of risks.
Automation of fraud
AI-powered tools now automate phishing campaigns, generate convincing scam messages and adapt malware to evade detection. Criminals can therefore target an increasing number of victims simultaneously, with a higher success rate than in the past.
This automation goes even further: some criminals use AI to create bots capable of operating autonomously 24/7 to carry out complex financial crimes, such as market manipulation and large-scale fraud, with minimal human intervention.
Increasingly sophisticated methods
Generative AI makes it possible to create highly realistic fake images, voices and videos, making scams such as business email compromise and identity fraud increasingly difficult to detect.
The most striking case remains the 2024 Hong Kong deepfake video conference, where an employee transferred HK$200 million, nearly US$25 million, to people who did not exist on screen. We described the mechanics of that case, and of synthetic identity fraud, in a separate article. What matters here is the shift it marks: financial crime now relies on AI-assisted psychological manipulation as much as on technical intrusion.
This sophistication is also evident in synthetic identity fraud: AI helps criminals combine stolen or fabricated data to create credible identities, enabling them to open fraudulent accounts and launder money on a large scale. The FATF's Horizon Scan on AI and deepfakes (22 December 2025) highlights that AI and deepfake technologies can undermine identity-verification procedures and facilitate the remote opening and management of multiple accounts. Criminals also exploit AI to identify weaknesses in financial systems, detect regulatory loopholes and evade detection by closely imitating legitimate transaction patterns.
Acceleration and large-scale amplification
Beyond sophistication, it is the very scale of the threat that is changing. Attacks can now target thousands of victims simultaneously and adapt in real time to the responses of security systems. This acceleration is reinforced by lower barriers to entry: AI tools, often open source and publicly accessible, require increasingly fewer technical skills to be misused for criminal purposes.
The European Banking Authority has similarly identified AI as a growing driver of fraud and financial crime, noting its use to automate laundering schemes, forge documents, generate deepfakes and evade detection.
Personalisation and enhanced social engineering
Finally, AI enables an unprecedented level of attack personalisation. By analysing publicly available data, including social media and various databases, criminals can create highly targeted messages, with a level of precision that significantly increases fraud success rates. AI is also increasingly being integrated into compliance processes to improve fraud detection, transaction monitoring and the analysis of complex financial patterns.
Recent Belgian warnings illustrate how these techniques are being combined in practice. In August 2026, the FSMA warned about fraudulent WhatsApp groups impersonating an authorised financial institution and promoting an investment scheme supposedly powered by AI.
How are the financial sector and institutions responding to this threat through AI?
The financial sector is mobilising
In response to this threat, AI-based detection tools are increasingly being used to combat fraud, strengthen cybersecurity and compliance, and monitor user journeys. This trend is already visible across European banking. In its Supervision Newsletter of 20 November 2025, ECB Banking Supervision reported a significant increase in AI use cases among European banks between 2023 and 2024, including applications for fraud detection. By leveraging machine learning, these tools establish behavioural baselines and identify deviations, detecting unusual behaviour, events or content from vast amounts of data at a speed and level of detail that would be difficult to achieve manually.
In practice, AI models provide four major advances:
First, transaction anomaly detection identifies unusual amounts, rapid sequences of payments, transfers to unknown accounts or purchases in atypical geographical locations.
Second, advanced behavioural analysis has become a key pillar of this approach. It compares activity during a banking session with a customer's usual behaviour in order to identify deviations and assign a risk score, based on transaction habits, natural language processing applied to communications, and even behavioural biometrics, such as typing patterns and mouse movements.
Real-time transaction monitoring represents a third major development: transactions can now be analysed within a few hundred milliseconds, making it possible to preventively block them before they are even completed.
Finally, network analysis, through Graph Neural Networks (GNNs), models the relationships between financial entities as a whole in order to uncover patterns that remain invisible at the individual level, such as smurfing, layering or hidden beneficial owners.
The European Parliament has also highlighted fraud detection, AML checks, sanctions screening and transaction monitoring among the potential applications of AI in financial services, while stressing the importance of data governance, testing, documentation, explainability and human oversight.
An institutional response
This technological response is accompanied by an institutional one, driven by several recent developments that demonstrate growing awareness of the issue. AMLA, operational since 2025, will progressively expand its capabilities until it reaches full direct supervisory capacity, planned for 2028. Its objective is to centralise, at European level, the supervision of the financial entities posing the highest risks, supported by enhanced analytical capabilities. The obligations that will feed that supervision sit in the AML Regulation (Regulation (EU) 2024/1624), which applies from 10 July 2027. For Belgium, the FATF's mutual evaluation of 16 December 2025 placed the country in enhanced follow-up, with Recommendation 15 on virtual assets rated non-compliant.
At the same time, the EU AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk. Two financial uses are explicitly listed as high-risk in Annex III: the assessment of creditworthiness and the credit scoring of natural persons (point 5(b)), and risk assessment and pricing in life and health insurance (point 5(c)). The high-risk obligations for these stand-alone systems were originally due to apply on 2 August 2026; the Digital Omnibus on AI (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026, deferred them to 2 December 2027. One set of obligations is already live: the Article 50 transparency duties, applicable since 2 August 2026, require disclosure when a person interacts with an AI system and the labelling of AI-generated or manipulated content, deepfakes included. Providers of systems already on the market before that date have until 2 December 2026 to comply with the machine-readable marking obligation under Article 50(2). At international level, the FATF Recommendations now explicitly cover virtual assets (Recommendation 15) and digital identification (Recommendation 10). On AI specifically, the FATF's Horizon Scan of December 2025 sets out the risks synthetic content creates for identity verification, and the opportunities the same technologies offer for detection.
Central banks, including the Federal Reserve, the European Central Bank and the Bank of England, are also investing in innovation labs dedicated to SupTech, testing approaches such as network analysis to map suspicious flows at a systemic level. This is complemented by strengthened cooperation with Financial Intelligence Units.
What structural limitations are holding back this response?
Despite these new tools, regulators face deep-rooted constraints that limit their ability to compete with highly agile criminal actors. The first of these concerns the slowness of the legal framework compared with technological innovation: adopting new regulations can take years, whereas criminal groups can adapt their methods within weeks. The law therefore struggles structurally to anticipate technologies evolving at an exponential pace.
This slowness is compounded by resource constraints: public authorities have significantly smaller budgets and smaller pools of technological talent than the private sector or the best-funded criminal organisations, at a time when competition for AI specialists is particularly intense. Institutional silos represent a third major limitation: even within individual states, information does not circulate effectively between tax, judicial, customs and financial authorities, creating blind spots that criminals know how to exploit. Finally, these internal difficulties are aggravated by insufficient international cooperation, which struggles to keep pace with the transnational nature of these new forms of crime.
In response to these constraints, several avenues could help narrow the gap with criminal actors. The development of regulatory sandboxes could make it possible to test AI-based compliance solutions in a controlled environment without waiting for legislation to become fully established. Strengthening public-private partnerships would facilitate the pooling of resources and technical expertise, which are currently largely concentrated in the private sector. The creation of real-time information-sharing platforms between tax, judicial and financial authorities would reduce institutional silos. Finally, greater harmonisation of international standards, beyond the FATF Recommendations, would help close the loopholes exploited by increasingly transnational forms of financial crime.
For compliance functions, the priority is no longer detection alone:
verify identity against synthetic media: liveness and injection-attack detection, plus a call-back on a channel already known to the customer for any high-value payment instruction;
re-test monitoring scenarios against AI-generated behaviour rather than historical patterns, and document why a scenario was recalibrated;
inventory AI use cases and classify them against Annex III before 2 December 2027, with a named owner per model;
label AI-generated content, as Article 50 has required since 2 August 2026, and keep the audit trail, noting that systems already on the market before that date have until 2 December 2026 for Article 50(2) marking.
This article reflects the state of the framework as at 27 October 2026. AI is fundamentally transforming financial crime by multiplying the speed, scale and realism of attacks. In response to this threat, institutions are mobilising, but their response remains structurally slower than the technology they are seeking to regulate. AI therefore accelerates financial crime through a scissors effect: it initially benefits those who are able to deploy it fastest, before regulation can catch up. In this race, where AI serves both as a weapon and a shield, will the decisive battle ultimately be fought more on the terrain of governance than technology itself?
