Why do fraud and AML teams need to work from the same identity signals?

Why This Matters for Security Teams

Fraud and AML teams are often looking at the same attacker journey from different angles. Fraud sees account takeover, synthetic identities, or device manipulation. AML sees placement, layering, and unusual fund movement. If those teams do not share the same identity signals, each function gets only part of the story and the alert arrives after the adversary has already moved money or laundered it across channels.

The operational gap is not theoretical. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which is a useful reminder that identity blind spots are common even before fraud and AML teams begin correlating casework. Identity-led detection also aligns with the NIST Cybersecurity Framework 2.0, where shared visibility and response are core operational expectations.

In practice, many security teams discover the linkage only after payments, mule activity, or account compromise has already spread across multiple systems, rather than through intentional cross-functional detection design.

How It Works in Practice

The most effective model is to treat identity as the common investigative thread across onboarding, authentication, device trust, session behaviour, account changes, and transaction events. Fraud teams usually catch the front end of abuse, while AML teams see the downstream monetisation. When both teams ingest the same identity signals, they can connect an impersonation attempt to the later fund movement and preserve a cleaner chain of evidence.

That shared signal set should include customer identity attributes, device and session fingerprints, IP reputation, velocity anomalies, beneficiary changes, credential resets, login provenance, and account linkage patterns. For non-human workflows, the same idea applies to service accounts and API keys: the credential, the workload, and the downstream action need to be tied together. NHI Management Group’s 52 NHI Breaches Analysis shows how quickly identity failures propagate when access is opaque.

• Use one case model so fraud and AML share the same entity graph instead of separate queues.
• Normalize identity signals into a common schema before scoring, alerting, or case enrichment.
• Link first-party and third-party signals so mule accounts, synthetic identities, and compromised credentials can be traced through the same path.
• Apply policy and thresholds consistently, but let each team retain its own typology and escalation rules.

Current guidance suggests the strongest results come from runtime correlation, not nightly batch handoffs, because laundering chains and fraud pivots can unfold within minutes. This approach is reinforced by identity-centric risk thinking in the NIST framework and by incident patterns documented in NHIMG research. These controls tend to break down when data is fragmented across separate case systems, because the same actor appears as different entities in fraud, AML, and payments tooling.

Common Variations and Edge Cases

Tighter cross-functional correlation often increases false-positive volume and analyst workload, so organisations must balance broader visibility against case fatigue and privacy constraints. There is no universal standard for this yet, but current guidance suggests starting with the highest-value identity links rather than forcing every signal into one score.

In retail banking, the shared signal set may focus on onboarding fraud, device reputation, and beneficiary changes. In fintech or cross-border payments, the priority is often account linking, velocity, and mule detection. In enterprise environments, the equivalent challenge is not consumer fraud but abuse of privileged service identities and automated workflows, where credential misuse can look like legitimate system activity. NHIMG’s Top 10 NHI Issues highlights why access visibility and rotation discipline matter when identity paths are reused.

The main edge case is when one function relies on highly sensitive data that cannot be shared broadly. In those environments, best practice is evolving toward tokenized or privacy-preserving identity joins, with limited enrichment exposed to downstream teams and full records retained in a controlled investigation layer. The practical test is simple: if a team cannot see enough identity context to connect behaviour across channels, it is operating with an incomplete risk picture rather than a different one.

Related resources from NHI Mgmt Group

• How can fraud, payments, and IAM teams work from the same control model?
• How should financial services teams connect KYC, KYB, AML, and fraud controls?
• How should security teams connect fraud monitoring with identity governance?
• Who is accountable when fraud, cyber and compliance teams miss the same threat?