The financial services industry stands at a crossroads. Despite investing over $180 billion annually in financial crime compliance globally, financial institutions are failing spectacularly at their primary mission: preventing financial crime. Money launderers successfully process between $2-5 trillion annually representing up to 5% of global GDP, while authorities intercept less than 1-2% of these illicit flows. Meanwhile, traditional compliance systems generate false positive rates exceeding 90%, overwhelming investigators with irrelevant alerts while real threats slip through undetected.

This paradox reveals a fundamental crisis in how the industry approaches AI governance. Rather than enabling better crime detection, current compliance-heavy frameworks are creating bureaucratic bottlenecks that simultaneously stifle innovation and undermine security. The result is a vicious cycle where institutions spend more on compliance while becoming less effective at preventing actual crimes.

The Compliance Industrial Complex in APAC

Financial institutions across Asia-Pacific have built what amounts to a compliance industrial complex; one that checks every regulatory box, but often misses the mark on actual financial crime deterrence.

Spending is rising sharply. AML compliance costs in APAC have grown by 9–10% over the past two years, particularly in markets like Singapore, Malaysia, Indonesia, and the Philippines. Midsize to large firms in the region now spend between US $12–14 million annually, while smaller institutions are still allocating US $1–2 million each year, a substantial burden relative to their size.

Yet these escalating costs haven’t translated into better outcomes. Detection rates remain low. Analyst burnout is on the rise, but hiring lags behind, especially as firms struggle to find compliance professionals with both regulatory expertise and technical fluency. The result? A growing volume of alerts, an overstretched workforce, and mounting operational risk.

This misalignment between cost and capability has created a vicious loop: more money, more tools, more alerts - but no meaningful reduction in actual financial crime.

The Alert Avalanche in APAC

Nowhere is the dysfunction more evident than in APAC’s transaction monitoring systems. Alert volumes have surged by 800% in recent years, yet over 90% of these alerts are false positives, according to the AML Tech Barometer. This means investigators spend the bulk of their time chasing noise instead of identifying true threats.

The consequences are more than operational, they’re systemic. According to the Nasdaq Global Financial Crime Report 2024, APAC recorded the highest global fraud losses, totalling US $221.4 billion, with US $190 billion attributed to payments fraud alone.

These figures reflect a deeper issue: compliance teams are drowning in alerts that fail to distinguish genuine threats from benign anomalies. While real criminal behaviour evolves, traditional detection systems lag — overwhelmed by volume, underpowered in intelligence, and increasingly ineffective at stopping sophisticated financial crime.

Innovation Paralysis Through Regulatory Complexity

The compliance-first approach has created a regulatory environment that actively discourages innovation. Traditional vendors promote complex 12-point compliance frameworks that promise "audit readiness" through extensive documentation and multi-layered governance structures. While these frameworks appear comprehensive, they suffer from critical weaknesses that paradoxically increase both compliance risk and innovation costs.

Bureaucratic Bottlenecks

Heavy regulatory frameworks create bureaucratic bottlenecks that slow innovation. Financial institutions now spend 40% of their compliance budget on documentation and audit preparation rather than actual crime detection capabilities. This misallocation of resources means that institutions are investing heavily in appearing compliant rather than being effective.

The regulatory landscape has become a maze of conflicting requirements. Over 40 countries have initiated or enacted national AI policies, with more than a dozen introducing sector-specific financial services guidance. However, instead of harmonisation, regulatory divergence is accelerating, creating what experts call "regulatory fragmentation" that leaves multinational banks caught in crossfire between inconsistent standards.

{{cta-first}}

The Innovation-Compliance False Dichotomy

Current approaches perpetuate a false dichotomy between innovation and compliance, suggesting these goals are fundamentally incompatible. This thinking has led to what researchers call the "innovative trilemma"e perceived impossibility of simultaneously maintaining market integrity, providing clear guidance, and fostering innovation.

The European Union's AI Act exemplifies this challenge. While intended to create harmonized standards, financial services firms report that the heavy burden of documentation, mandatory transparency, and strict compliance checks can slow innovation considerably. Banks and insurers have requested reductions in real-time monitoring requirements, arguing that these can be "disproportionate and discourage innovation."

Real-World Consequences in APAC

Security Failures at Scale

• APAC lost US $221.4 billion to fraud in 2024, the highest globally even as AML compliance spending soared. ‍
• Traditional, reactive detection systems continue to let sophisticated scams slip through.

Operational Inefficiencies

• Siloed systems and poor data quality create compliance gaps.
• Analysts spend excessive time on false positives, detracting from detecting real threats.

A Growing Talent Crisis

• Many APAC compliance teams are understaffed, despite high workloads and pressure to adopt advanced tech.
• Talent now needs both regulatory know-how and technological fluency, a rare costly combination.

The Path Forward: From Compliance to Governance

The evidence is overwhelming: compliance-first AI approaches are failing on their own terms while simultaneously stifling the innovation needed to address evolving threats. Financial institutions cannot continue down this path of escalating complexity and decreasing effectiveness.

The solution lies not in abandoning compliance but in reframing the entire approach around governance rather than checkbox mentality. Governance-first AI focuses on building systems that are inherently trustworthy, transparent, and effective - qualities that naturally satisfy regulatory requirements while enabling innovation.

This represents a fundamental shift from reactive compliance to proactive governance, from fragmented systems to integrated platforms, and from bureaucratic overhead to operational effectiveness. The institutions that embrace this transition will not only achieve superior compliance outcomes but will also gain competitive advantages through more effective crime detection and lower operational costs.

Conclusion

The AI governance crisis in financial services is not a technical problem, it is a strategic challenge that requires fundamental rethinking of how institutions balance innovation with risk management. The current compliance-first paradigm has demonstrated its limitations through massive costs, operational inefficiencies, and security failures.

The time has come to move beyond the false dichotomy of innovation versus compliance toward a governance-first approach that treats trustworthy AI as a competitive advantage rather than a regulatory burden. The institutions that make this transition first will not only achieve better compliance outcomes but will also position themselves to lead the next generation of financial crime prevention.

What’s Next in This Blog Series

In our next blog, we'll explore how initiatives like Singapore's AI-Verify program are pioneering the governance-first approach and setting new standards for responsible AI deployment in financial services.

Stay tuned.

AUSTRAC’s latest draft rules signal a defining moment for AML compliance in Australia.

With growing pressure to address regulatory gaps and align with global standards, AUSTRAC has released a second exposure draft of AML/CTF rules that could reshape how financial institutions approach compliance. These proposed updates are more than routine tweaks, they are part of a strategic pivot aimed at strengthening Australia’s financial crime defences following international scrutiny and domestic lapses.

Background: Why AUSTRAC Is Updating the Rules

AUSTRAC’s policy overhaul comes at a critical time for the Australian financial sector. After years of industry feedback, regulatory incidents, and repeated warnings from the Financial Action Task Force (FATF), Australia has faced growing pressure to modernise its AML/CTF framework. This pressure intensified after the Royal Commission findings and the high-profile Crown Resorts case, which exposed systemic failures in detecting and reporting suspicious transactions.

The second exposure draft released in July 2025 reflects AUSTRAC’s intent to close key compliance loopholes and bring the current system in line with global best practices. It expands on the earlier draft by incorporating industry consultation and focuses on more granular obligations for customer due diligence, ongoing monitoring, and sanctions screening. These changes aim to strengthen Australia’s position in the face of a rapidly evolving threat landscape driven by digital finance, cross-border transactions, and sophisticated laundering techniques.

What’s Changing: Key Highlights from the Exposure Draft Rules

The second exposure draft introduces several new requirements that directly impact how reporting entities manage risk and monitor customers:

1. Clarified PEP Obligations

The draft now defines a broader set of politically exposed persons (PEPs), including foreign and domestic roles, and mandates enhanced due diligence regardless of source of funds.

2. Expanded Ongoing Monitoring

Entities must now monitor customers continuously, not just at onboarding, using both transaction and behavioural data. This shift pushes compliance teams to move from static checks to dynamic, risk-based reviews.

3. Third-Party Reliance Rules

The draft clarifies when and how financial institutions can rely on third parties for KYC processes. This includes more specific provisions for responsibility and liability in case of failure.

4. Sanctions Screening Expectations

AUSTRAC has proposed more stringent guidelines for sanctions screening, especially around name-matching and periodic list updates. There is also an increased focus on ultimate beneficial ownership.

5. Obligations for Fintechs and Digital Wallet Providers

The draft recognises the role of digital services and imposes tighter onboarding and monitoring standards for high-risk products and cross-border offerings.

Comparing ED2 with Tranche 2 Reforms

While Tranche 2 reforms remain on the horizon with a broader mandate to include lawyers, accountants, and real estate agents under the AML/CTF regime, the second exposure draft zeroes in on tightening the compliance expectations for existing reporting entities.

Unlike Tranche 2, which aims to expand the scope of regulated professions, the exposure draft rules focus on strengthening operational practices such as ongoing monitoring, customer segmentation, and enhanced due diligence for existing covered sectors. The rules also go deeper into technological expectations, such as maintaining audit trails and validating third-party service providers.

In short, ED2 is more about modernising the how of AML compliance, whereas Tranche 2 will eventually reshape the who of the regulated ecosystem.

Why It Matters for Financial Institutions

For compliance officers and risk managers, these proposed changes translate to increased scrutiny, more granular documentation, and an urgent need to improve monitoring practices. Institutions will be expected to maintain stronger evidence trails, adopt real-time monitoring tools, and improve their ability to detect behavioural anomalies across customer life cycles.

Moreover, the clear emphasis on risk-based ongoing due diligence means firms can no longer rely on periodic checks alone. Dynamic updates to risk profiles, responsive escalation triggers, and cross-channel data analysis will become critical components of future-ready compliance programs.
‍
{{cta-first}}

Tookitaki’s Perspective and Solution Fit

At Tookitaki, we believe AUSTRAC’s second exposure draft offers an opportunity for Australian institutions to build more resilient, intelligence-driven compliance programs.

Our flagship platform, FinCense, is built to adapt to evolving AML obligations through its scenario-driven detection engine, AI-led transaction monitoring, and federated learning capabilities. Financial institutions can seamlessly adopt continuous risk monitoring, generate audit-ready investigation trails, and integrate sanctions screening workflows, all while maintaining high levels of precision.

Importantly, Tookitaki’s federated intelligence model draws from a community of AML experts to anticipate emerging threats and codify new typologies. This ensures institutions stay ahead of bad actors who are constantly evolving their methods.

What’s Next: Preparing for the New Rules

AUSTRAC is expected to finalise the rules following this round of industry consultation, with phased implementation timelines to be announced. Financial institutions should begin by assessing gaps in their existing AML controls, especially around ongoing monitoring, PEP screening, and documentation processes.

This is also a good time to evaluate technology infrastructure. Solutions that enable scalable monitoring, natural language audit logs, and flexible rule design will give institutions a distinct advantage in meeting the new compliance bar.

Conclusion

AUSTRAC’s second exposure draft marks a pivotal shift from checkbox compliance to intelligent, risk-driven AML practices. For financial institutions, the future of compliance lies in adopting flexible, technology-powered solutions that can evolve with the regulatory landscape.

The message is clear, compliance is no longer a static requirement. It is a dynamic, strategic pillar that demands agility, insight, and collaboration.

Thailand’s financial system is entering a defining era for anti-money laundering and counter-terrorism financing.

As the country deepens its regional trade and digital finance ambitions, it also faces mounting pressure to confront evolving financial crime threats, ranging from cross-border laundering to high-velocity scams and informal value transfers. With the FATF eyeing gaps in oversight and regulators tightening expectations, AML/CFT compliance is no longer just a back-office responsibility. It's a front-line defence for trust and competitiveness.

In this blog, we break down the current AML/CFT regulatory framework in Thailand, highlight key risks and real-world threats, explore upcoming reform pressures, and share how banks and fintechs can strengthen their compliance strategy through both innovation and collaboration.

The Regulatory Landscape in Thailand

Thailand’s AML/CFT framework is governed by the Anti-Money Laundering Office (AMLO), established in 1999. AMLO functions as both the financial intelligence unit (FIU) and the key enforcement agency overseeing compliance and investigations related to illicit finance.

The two core laws forming the backbone of the regulatory regime are:

• The Anti-Money Laundering Act (AMLA), B.E. 2542 (1999)
• The Counter-Terrorism and Proliferation of Weapons of Mass Destruction Financing Act, B.E. 2559 (2016)
  ‍

Entities subject to AML/CTF obligations include:

• Commercial banks and financial institutions
• Money service businesses (MSBs), e-wallets, and fintech platforms
• Securities companies and insurance providers
• Real estate developers and dealers in precious stones/metals
• Legal professionals and notaries (in limited contexts)

Reporting entities must:

• Conduct customer due diligence (CDD) and enhanced due diligence (EDD)
• File suspicious transaction reports (STRs) and cash transaction reports (CTRs) with AMLO
• Retain records for a minimum of 5 years
• Establish internal AML programs, risk assessments, and staff training
  ‍

FATF and Grey List Pressures

Thailand has had a complicated relationship with the Financial Action Task Force (FATF). After being grey-listed in 2011 due to strategic deficiencies in its AML regime, it made significant reforms and was removed in 2015.

However, FATF’s most recent mutual evaluation pointed to new challenges:

• Limited oversight of certain non-financial sectors
• Gaps in beneficial ownership transparency
• Uneven application of risk-based approaches
• Under-reporting of suspicious transactions by fintech and digital players

Why it matters: FATF grey-listing carries serious consequences. It can deter foreign investment, slow correspondent banking relationships, and increase the cost of doing business internationally. For Thai banks and fintechs, staying aligned with FATF expectations is not just about compliance—it’s about global competitiveness.

Real-World Threats: What’s Fueling Financial Crime in Thailand

Thailand’s economy, geographic location, and strong informal networks make it vulnerable to a wide range of predicate offences. Some of the most prominent financial crime threats include:

🔹 Drug Trafficking and Organised Crime

Transnational criminal groups exploit Thailand’s location in the Mekong subregion to launder drug proceeds through shell companies, property purchases, and trade channels.

🔹 Public Sector Corruption and Tax Crimes

Illicit enrichment and VAT fraud are common predicate offences, with funds often laundered via nominee accounts and luxury assets.

🔹 Cross-Border Laundering

Money mules, informal remittance systems, and trade-based money laundering (TBML) remain significant threats. Syndicates frequently layer funds through multiple jurisdictions.

🔹 Investment and Romance Scams

Thailand is increasingly being used as both a staging ground and a destination for proceeds from international fraud, including pig butchering scams and tech support frauds targeting foreign victims.

AMLO has flagged the rising use of e-wallets, digital platforms, and cash-intensive businesses as high-risk vehicles for laundering.

Challenges for Banks and Fintechs

Despite progress, many institutions face real hurdles when it comes to AML/CFT execution.

• Legacy Systems and Manual Workflows
  Traditional rule-based systems often generate high false positives and miss nuanced patterns, especially in real-time transactions.
• Fragmented Intelligence
  Limited cross-institutional data sharing weakens the detection of syndicated risks, such as mule networks operating across multiple banks.
• High Compliance Costs
  Smaller fintechs and non-bank financial institutions struggle to meet regulatory requirements without draining operational resources.
• Speed vs Safety in Payments
  Instant payment rails (e.g., PromptPay) have made fund movement frictionless, but also difficult to trace once fraud or laundering occurs.

Thailand’s Push Toward RegTech and AI

Recognising these challenges, regulators and industry players are increasingly turning to RegTech to strengthen compliance without stifling innovation.

Notable trends:

• AI-driven transaction monitoring is gaining traction for detecting suspicious behaviour across vast datasets in real time.
• Automated screening tools are being used to process watchlists, sanctions, and politically exposed person (PEP) data more efficiently.
• Digital KYC and eKYB (Know Your Business) solutions are helping fintechs onboard customers with less friction and more accuracy.

AMLO itself has been vocal about the importance of technology in enhancing reporting accuracy and enabling real-time intelligence. Collaboration between regulators and the private sector on typology sharing and case-based learning is also gaining momentum.

How Tookitaki Supports Smarter Compliance in Thailand

Tookitaki’s FinCense platform is well-positioned to help Thai banks and fintechs overcome both regulatory and operational AML/CFT challenges.

Here’s how:

🔹 Scenario-Based Detection
FinCense leverages typologies contributed by global experts through the AFC Ecosystem. These include real-world cases such as QR-code laundering, mule account recruitment, and shell invoicing many of which mirror red flags identified by AMLO.

🔹 Smart Screening
Advanced screening tools that support multi-lingual names, alias logic, and national ID handling—critical in jurisdictions like Thailand.

🔹 AI-Powered Risk Scoring
Dynamic customer risk scoring and automated threshold tuning reduce false positives and allow institutions to focus on the most relevant alerts.

🔹 FinMate: AI Copilot for Compliance Teams
FinMate assists investigators by summarising alerts, surfacing behavioural insights, and recommending next steps, reducing the average case investigation time.

Whether you're dealing with fraud from romance scams or laundering via e-wallet networks, FinCense offers a flexible, modular approach that’s ready for Thailand’s fast-evolving risk environment.

Key Takeaways for Compliance Teams

✅ Thailand’s AML/CFT ecosystem is evolving, but financial crime threats are getting more sophisticated.
✅ FATF scrutiny and regulatory reform will intensify over the next 12–18 months.
✅ Manual systems are no longer sustainable—technology is a must-have.
✅ Cross-border risk requires cross-sector intelligence—collaboration is key.
✅ Institutions that prioritise adaptive compliance now will gain a strategic edge in the future.
‍

Conclusion: Thailand’s Next Chapter in AML/CFT Compliance

Thailand has made significant progress in building its AML/CFT regime, but the fight is far from over. As financial crime networks grow more organised and tech-savvy, regulators and institutions must respond in kind—with smarter systems, stronger collaboration, and a proactive mindset.

The future of compliance in Thailand isn’t just about ticking regulatory boxes. It’s about building trust, resilience, and readiness—not just for the next audit, but for the next threat.