They should assign shared ownership for decision logic, case context and escalation rather than treating each domain as a separate tool or team. A unified operating model keeps identity signals, fraud signals and AML signals aligned to the same customer journey and reduces the handoff delays that create blind spots.
Why banks need one operating model for fraud, identity and AML
Banks do best when fraud, identity and AML are governed as one decision system, not three parallel workstreams. The practical unit of control is the customer journey, because onboarding, authentication, transaction review and escalation all depend on the same evidence, the same case context and the same ownership rules.
A shared operating model lets the bank use one view of customer risk across onboarding, account access and transaction behaviour. That reduces duplicated review, inconsistent decisions and the common failure mode where one team sees a warning sign but another team owns the next step.
This is also where governance matters more than tooling. If the bank separates fraud, identity and AML into different queues without common decision logic, the organisation can preserve local efficiency while losing end-to-end control. The result is slower escalation, weaker context and more opportunities for a risky case to move through the cracks.
What should be shared across the three functions?
The first shared layer is decision logic. Fraud, identity and AML should use aligned triggers, thresholds and disposition rules wherever the same behaviour is being judged, even if each team still applies its own specialist analysis. That creates consistency in who can act, when a case must escalate and what evidence is enough to hold, step up or block activity.
The second shared layer is case context. The person or business should not be re-investigated from zero each time a signal moves between teams. Shared context should include identity proofing results, device and behavioural signals, account history, transaction patterns, prior alerts and any prior escalation decisions that affect current risk.
The third shared layer is ownership. Shared ownership does not mean one giant team with no specialist skills. It means one accountable operating model with clear handoffs, common prioritisation and a single view of when a case has moved from suspicion to action. Banks that get this right usually standardise the operating rhythm first, then decide where specialist analysts add depth.
Where the model also needs stronger linkage between fraud and cyber functions, Fraud and Cyber Convergence Guide is useful because it shows how shared signals and joint case management reduce blind spots. For the identity layer, Identity Fraud Prevention Guide is relevant where identity signals feed fraud detection across the customer lifecycle.
Where operating-model failures usually show up
The biggest failure is signal fragmentation. A bank may have strong identity proofing, strong transaction monitoring and strong AML controls, yet still miss the pattern if each function treats its own alert as a separate problem. The customer can pass one control while the next function never receives the full story.
Another common failure is queue-driven ownership. If the case moves from team to team without a single escalation rule, the institution creates avoidable delay. That delay matters because fraud can accelerate money movement, identity abuse can deepen account compromise and AML review can lose the timing needed to detect suspicious flows while they are still actionable.
There is also a governance risk in metric misalignment. A team measured only on alert closure may optimise for speed, while another team measured only on SAR quality or fraud loss may optimise for caution. Banks need a shared operating model so that local KPIs do not undermine the enterprise decision path.
A broader convergence model is laid out in Fraud and Cyber Convergence Guide, and the same logic applies here: the bank should measure whether the organisation is reducing duplicate work, improving escalation speed and preserving context across cases. For AML-specific expectations, the bank should align the model to FATF Recommendations, AML and KYC Framework so customer due diligence and suspicious activity handling remain consistent with the control environment.
How banks should implement a unified fraud, identity and AML model
Start by defining one case taxonomy and one escalation path. The taxonomy should tell analysts whether a signal is identity-related, fraud-related, AML-related or a mixture, but the escalation path should not force the customer into three disconnected processes. The point is not to erase specialist work, it is to make specialist work visible in one journey.
Next, align the minimum data set. Banks should decide which identity, account, device, behavioural and transactional attributes must be visible to every team handling the case. If a team cannot see the context that explains the risk, it will recreate the work or miss the risk entirely.
Then assign a single accountable owner for the operating model. That owner does not need to approve every case, but should own the decision logic, the handoff rules, the quality of case context and the performance measures that show whether the model is working. Without that accountability, convergence becomes a coordination exercise rather than a control model.
For AML governance and banking obligations, FinCEN is the right authority for US-centric reporting and suspicious activity expectations, while EBA AML/CFT Guidance helps with EU banking expectations. Those references matter because the operating model should support regulatory decision-making, not sit beside it.
Risk and Threat Considerations
Fragmented fraud, identity and AML models create blind spots that adversaries and mule networks can exploit. If one team sees only identity proofing, another only payment behaviour and another only suspicious movement, the institution may miss the combined pattern until losses or reporting obligations are already in motion.
Failure mechanism: Separate queues, separate thresholds and separate ownership break the chain of evidence, so escalation is delayed or never happens even when the same customer journey contains multiple indicators of abuse.
Impact: The bank can under-detect account takeover, synthetic identity abuse, mule activity and laundering patterns, while also creating inconsistent customer treatment and avoidable regulatory exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | A unified operating model depends on defined mission, stakeholders and control ownership. |
| GV.RM-01 — Risk Management Strategy | The model requires one strategy for prioritizing and escalating customer risk across functions. | |
| Recommendation — Define shared fraud, identity and AML ownership in organizational context. Set one enterprise risk strategy for fraud, identity and AML decisions. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Shared case context and escalation depend on reviewing and correlating evidence across functions. |
| AC-6 — Least Privilege | Analysts should only access the case context needed for their function within the shared model. | |
| Recommendation — Correlate alerts and case evidence across fraud, identity and AML workflows. Limit case access by role while preserving cross-functional visibility. | ||
Practitioner Guidance
What to verify: Confirm that one named owner governs the decision logic, not just the tooling, and that every material case can carry identity, fraud and AML context forward without rework. If analysts still need to ask a different team for the same evidence, the operating model is not yet unified.
Decision rule: If a signal changes the customer risk decision but cannot be shared with the next control point in time to affect action, treat that as an operating-model defect, not a workflow nuisance. The bank should fix the handoff before it tries to optimise alert volumes.
Practitioner takeaway: The best convergence model is the one that preserves specialist judgement while removing ownership gaps, because the customer journey, not the org chart, is where fraud, identity and AML risk actually meets.
Related resources from NHI Mgmt Group
- How should IT teams govern identity access when AI becomes part of the operating model?
- How should security teams govern physical and digital access through one identity model?
- How should security teams govern identity and access in a decentralized operating model?
- How should security teams govern identity controls when an identity security platform merger changes the operating model?