How should fraud, AML and payments teams share responsibility for laundering detection?

How to split ownership without splitting the laundering trail

Fraud, AML and payments teams need a shared operating model, not three separate verdicts on the same customer or transaction. The practical unit of work is the money trail: account opening, payee setup, transfer initiation, settlement, and post-transfer review. That is where laundering often hides between a fraud event and a later AML alert.

Shared responsibility works best when each team owns a distinct slice of the same case. Fraud teams usually see the earliest behaviour and scam mechanics, payments teams see the transfer path and controls in motion, and AML teams see aggregation, typologies and reporting thresholds. If those views are not joined, each team may correctly answer a different question while missing the laundering pattern.

Joint governance should define who triages, who investigates, who escalates and who files the regulatory report. The operating model should also make clear which signals are shared automatically, which require analyst review, and which cases stay open until the full chain is explained rather than only the latest transaction.

Where the seam usually breaks

The common failure is organisational, not analytical. Fraud teams may stop once the customer is protected from immediate loss, while AML teams may only act when a pattern is already visible in monitoring or case queues. That gap creates a timing problem: the same mule network, scam corridor or layering sequence can move from fraud into AML before anyone owns the full storyline.

Another seam appears when payments operations treats suspicious activity as an exception process instead of a detection source. That is why fraud, AML obligations and SAR guidance from FinCEN should be reflected in the same escalation criteria used by operations, so a blocked transfer, recalled transfer or beneficiary change can become a case input, not just a payment outcome. In the EU context, the same coordination logic supports the expectations set out in EBA AML/CFT Guidance.

Shared responsibility also reduces blind spots around scam-enabled laundering. Fraud teams often see impersonation, account takeover, social engineering or mule recruitment earlier than AML teams do, while AML teams may be better placed to connect those events to structuring, rapid movement of funds or repeated beneficiary reuse. The seam closes only when both teams treat the same data as mutually relevant.

What good operating model design looks like

A durable model starts with shared case ownership rules. One team should not “close” an event if another team still needs it for laundering analysis. Instead, ownership should move by stage, with a common case identifier, a shared evidence set and a single escalation threshold for when a matter becomes a financial crime investigation rather than a fraud-only or AML-only review.

It also helps to define shared signals at the control points that matter most: onboarding, device and account risk, payee and beneficiary changes, payment authorisation, velocity patterns, return attempts, and post-transfer beneficiary reuse. Where these signals are unified, investigators can see whether a customer, account, device or beneficiary is part of a wider laundering path instead of an isolated fraud incident.

For teams building the model from scratch, Fraud and Cyber Convergence Guide is a useful operating reference for shared signals, joint case management and governance, and Financial Services Identity Security Guide is useful where KYC, access and third-party controls affect the fraud-to-AML handoff.

The strongest models do not rely on a single team to infer intent. They require fraud, AML and payments to agree on evidence standards, escalation timing and what constitutes a complete investigation. That is especially important where the laundering route uses a scam first, then a transfer, then layering through multiple accounts or rails.

Practitioner Guidance

What to verify: Check whether a single case can follow a customer from onboarding through transfer execution and post-event monitoring without losing context at each handoff. If not, the organisation is probably managing fraud and AML as adjacent functions rather than a single laundering-detection workflow.

Decision rule: If the same activity could indicate scam victimisation, mule activity or laundering, keep the case open until the teams agree on the dominant explanation and the residual risk. Do not let the first team to see the event define the end state for all others.

What practitioners underestimate: The most dangerous gap is not missing a signal, it is misaligned closure criteria. When teams use different thresholds for “done”, laundering can pass through the gap even when every team individually performs well.

Practitioner takeaway: Shared responsibility should be built around shared evidence, shared escalation and shared case ownership, because laundering is usually visible only when the fraud view, the payment view and the AML view are combined.

Related resources from NHI Mgmt Group

• How should fraud teams and IAM teams share responsibility for step-up decisions?
• What breaks when fraud, AML, and onboarding teams do not share the same data and workflows?
• Who should own Golden SAML detection when identity and cloud teams share responsibility?
• How should payments and risk teams improve fraud detection when transaction volumes are rising and fraud tactics keep changing?