TL;DR: Financial institutions are being outpaced by fraudsters who exploit the seams between fraud, cyber and compliance teams, while AI reshapes both attack and defence conversations, according to SumSub’s WTF? Summit discussion with FATF, Singapore FinTech Association and Coinhako. Cross-functional governance is now a control issue, not an organisational preference.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on SumSub's blog post: Fraud, cyber and compliance silos are widening financial crime gaps because criminals exploit the seams between teams, tools and data.
Why it matters: For IAM, fraud and security leaders, the message is that governance breaks down when identity, detection and compliance decisions are made in separate operational lanes.
Context
Financial crime controls fail when the organisation treats fraud, cyber and compliance as separate problems with separate data, separate tools and separate ownership. That operating model leaves gaps that criminals can use to move faster than any one team can see.
The article frames those gaps through a discussion at WTF? Summit in Singapore with FATF, the Singapore FinTech Association and Coinhako. The central issue is not whether each team is effective on its own, but whether the institution can share threat context across departments before it tries to share it across borders.
Key questions
A: They should not treat the data as separate if the same customer, account or payment event can trigger all three functions. The practical task is to build a shared case model with common fields, ownership and escalation rules so that one team’s signal can be acted on by the others before funds move.
Q: Who is accountable when fraud, cyber and compliance teams miss the same threat?
A: Accountability should sit with the operating model owner who defines how evidence, escalation and reporting move across departments. When a case fails because no team owned the handoff, the problem is structural. Financial institutions need a single governance path for suspicious events, even if multiple teams contribute controls.
Q: What are the signs that internal financial crime governance is failing?
A: Common warning signs include repeated duplicate investigations, delayed escalations, inconsistent case fields and decisions that have to be rechecked by another team before action. Those symptoms show that the organisation is optimising each function separately instead of running a shared financial crime control model.
Q: What should teams do when cross-border intelligence sharing is limited by local rules?
A: They should first make internal sharing consistent. A common taxonomy, aligned escalation rules and a single view of the case are prerequisites for useful external collaboration. If the institution cannot coordinate within its own walls, it will not be able to make good use of regional or partner intelligence.
Technical breakdown
Why siloed fraud, cyber and compliance stacks create blind spots
When fraud monitoring, cyber defence and compliance case management sit in different systems, each team sees only part of the same event. That creates a reconciliation problem: one team may detect anomalous account behaviour, another may see suspicious infrastructure, and a third may hold customer or transaction context that would make the pattern actionable. The result is not just duplication, but delayed correlation. In financial crime, timing matters because the attacker moves money, not just data.
Practical implication: build a shared operating picture that ties identity, transaction and security telemetry to the same case workflow.
AI as both weapon and shield in financial crime operations
The article highlights a familiar pattern in financial crime: attackers use automation and AI to scale scams, while defenders try to use the same technologies to detect and prioritise suspicious activity. That creates a tooling race, but the deeper issue is governance. If the compliance function does not have the data access, analytical skill and authority to use AI outputs, the organisation gets neither speed nor confidence. AI does not repair fragmented ownership; it amplifies whatever structure already exists.
Practical implication: define who can use AI outputs in fraud and compliance decisions, and what evidence those decisions must retain.
Cross-border data sharing depends on internal data sharing first
The conversation points to ASEAN’s fragmented data-sharing laws as a real constraint, but that external problem only becomes manageable when internal silos are already reduced. Institutions cannot operationalise external intelligence if they cannot align their own fraud, cyber and compliance records. This is especially important where money movement, account takeover signals and regulatory reporting need to be stitched together. Cross-border coordination starts with a common internal taxonomy and consistent escalation paths.
Practical implication: standardise internal case fields and escalation criteria before attempting broader federation with external partners.
Threat narrative
Attacker objective: The attacker objective is to exploit fragmented governance so criminal activity can scale faster than any single control team can coordinate.
- Entry occurs when fraudsters identify organisational seams between fraud, cyber and compliance functions and target the weakest operational handoff.
- Escalation happens when separate tools and separate data prevent teams from correlating suspicious behaviour quickly enough to interrupt the campaign.
- Impact is realised when the institution cannot coordinate a timely response and the fraud operation continues moving funds or expanding account abuse.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Fraud, cyber and compliance silos are now a governance vulnerability, not just an operating-model inconvenience. The article makes clear that criminals are exploiting the seams between teams that were designed to optimise separately. In identity terms, this is a coordination failure across detection, investigation and decision authority. The practical conclusion is that financial crime governance must be designed around shared cases, not departmental boundaries.
AI does not fix fragmented financial crime operating models. It only makes the existing structure move faster. If compliance teams lack the skills, data access or decision rights to use AI outputs, then the institution gets fragmented automation instead of better control. The implication is that AI adoption in fraud and compliance has to be governed as a workflow and authority problem, not a tooling purchase.
Cross-border collaboration will fail if internal data sharing remains weak. The article’s ASEAN angle is important because external cooperation depends on the quality of internal coordination first. Institutions that cannot align their own fraud, cyber and compliance data will struggle to make use of regional intelligence or regulatory partnerships. Practitioners should treat internal taxonomy and escalation design as prerequisites for any broader information-sharing model.
Shared threat context is the missing control surface. The article points toward a named concept worth using: financial crime seam risk. That is the exposure created when separate teams hold partial truth about the same event and no one owns the full decision path. The practical conclusion is that institutions need a single operational view of fraud, cyber and compliance cases.
From our research library:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
What this signals
Financial crime seam risk: When fraud, cyber and compliance teams run separate processes, the attacker’s real advantage is not technical sophistication but the absence of a unified decision path. The operational fix starts with shared case ownership and common escalation logic.
Before institutions can make external intelligence sharing effective, they need internal data sharing that can survive regulatory, investigative and customer-impact pressures. Fragmented operating models create delay at the exact point where speed determines whether fraud can be contained.
AI will widen the gap between mature and immature financial crime programmes. Teams with shared data and clear decision rights will use it to correlate signals; teams without them will simply automate the same silos faster.
For practitioners
- Build a shared financial crime case model Unify fraud, cyber and compliance events into one investigation path with common status, ownership and escalation fields.
- Align fraud and cyber telemetry Map which signals must be visible to both fraud analysts and security operations so suspicious behaviour can be correlated early.
- Define AI decision authority Specify which teams can consume AI outputs, which decisions those outputs may support and what evidence must be retained.
- Standardise internal data-sharing taxonomy Use one set of case definitions and handoff rules before extending intelligence-sharing to external or cross-border partners.
Key takeaways
- Financial crime risk grows when fraud, cyber and compliance teams cannot see the same event through one operational lens.
- The article points to distributed criminal activity and fragmented laws as evidence that coordination now matters as much as detection.
- Institutions need shared case ownership, common data definitions and clear AI decision rights before they can scale collaboration safely.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | The article is about aligning fraud, cyber and compliance operations across organisational boundaries. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Shared investigations depend on the right people and systems seeing the same case data. | |
| GV.RR-02 — Roles, Responsibilities and Authorities Are Established and Communicated | The core problem is unclear handoffs between teams that each own part of the response. | |
| Recommendation — Define a shared financial crime operating model that aligns ownership, escalation and decision rights across teams. Grant fraud, cyber and compliance teams the access they need to investigate the same case without data duplication. Assign clear escalation and decision authority for financial crime cases so no signal stalls at a team boundary. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Controlled case access matters, but access must still support correlated investigation across functions. |
| Recommendation — Apply least privilege to shared cases while ensuring investigators can see the evidence needed to act quickly. | ||
Key terms
- Financial Crime Seam Risk: The exposure created when related fraud, cyber and compliance signals sit in separate teams or systems and no one owns the full decision path. It turns organisational boundaries into attacker opportunities because partial visibility slows correlation, escalation and containment.
- Shared Case Model: A common investigation structure that lets multiple teams work from the same event record, status and ownership rules. In financial crime operations, it reduces duplicate work, prevents contradictory decisions and makes it easier to correlate identity, transaction and security signals.
- Cross-System Governance: Cross-system governance is the discipline of enforcing access, monitoring, and certification across multiple applications rather than inside one platform. It requires normalising identity and activity data so control owners can evaluate business risk across ERP, ticketing, treasury, and identity systems together.
- Operational Taxonomy: The agreed set of field names, categories and escalation labels used across teams to classify events in the same way. When taxonomy is inconsistent, data sharing becomes translation work, and translation delays are often enough for fraud to continue.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org