Our monthly round up of news items which help businesses understand the risks around AML and more
Criminals lose, compliance wins, the smarter way to safeguard your business.
Cyber Security
Click, click, nobody’s there: AI bots take aim at ad budgets
Writing in Cyber Security Intelligence, Miguel Lopes says generative AI has given fraudsters an “industrial-scale toolkit” for ad fraud. Bots can now copy human behaviour closely enough to get past standard filters.
They hesitate over buttons, partly watch videos, move the cursor in curves and fill in forms with believable details. Click farms, which are networks of mobile devices run from a central dashboard, produce fake clicks, installs and engagement in huge volumes. Imperva’s 2026 Bad Bot Report, cited in the article, found that bots already make up 53% of all internet traffic. The bots also learn as they go. They test what a brand’s defences treat as “normal” and then keep their activity within that range.
The damage goes beyond wasted pay-per-click spend. Fake clicks and conversions feed false signals into the Google and Meta bidding algorithms, which then aim future spend at the wrong audiences, so the losses grow over time. Lopes says the warning signs include fake leads and forms filled with invalid details, sudden surges in traffic at unusual hours, and high engagement that never turns into real business. His recommendations are regular traffic audits, stronger identity checks at the point of sign-up and real-time anti-fraud tools. The author is Chief Product Officer at TrafficGuard, an ad-fraud protection vendor, so some of the advice naturally favours his own type of product.
For compliance professionals, the story matters for two reasons. First, ad fraud is a large and low-risk source of income for organised crime, and the money it generates still has to be laundered through shell companies, payment processors and mule accounts.
Second, the same AI techniques that create convincing fake leads can also produce synthetic identities that are good enough to get through basic onboarding forms. If bots can fool a marketing funnel, they can test a weak KYC process too.
Firms should make sure their customer verification relies on independent evidence rather than on information the applicant has simply typed in.
Organised Crime
Big Four, big money, high risk?
The research was shared with The Observer ahead of a full report due next month. It looks at around 12,000 major offshore holding companies with significant assets in 19 large economies, which together account for about three-quarters of global GDP.
The project was led by Dan Haberly of the University of Sussex’s Centre for the Study of Corruption, in partnership with the Tax Justice Network. It found that companies audited by Deloitte, EY, KPMG or PwC account for roughly two in every five dollars of high-risk offshore money traced to the 19 “low rule of law” countries, which include Russia, Iran, Lebanon, Venezuela and Belarus. Around 80% of the high-risk money came from Russia, and about half of that ended up back there, a practice known as “round-tripping”.
The researchers stress that this is not in itself proof of wrongdoing. The report comes as police in Cyprus investigate claims that Deloitte helped falsify documents for Roman Abramovich. Abramovich denies concealing his wealth, and Deloitte Cyprus says it “acts in compliance with applicable laws”.
The findings put the spotlight firmly on the UK. The research found that the UK is the leading destination for investment from countries with weak rule of law, and that British firms are the main providers of accounting and other professional services to these investors.
Much of this activity runs through Jersey, Guernsey and the British Virgin Islands. Haberly argues that the same firms that lead on offshore tax planning are “central to the crafting and operation of the offshore structures used by Russian oligarchs and kleptocrats”. The Big Four operate as networks of national partnerships, so global head offices can distance themselves from problems in overseas member firms. The government’s finance bill proposes bringing accountants under Financial Conduct Authority supervision, which would end what one Labour MP calls “marking their own homework”.
For compliance and due diligence professionals, the lesson is that a well-known auditor or adviser should never be treated as proof of legitimacy. A Big Four audit tells you that the accounts have been reviewed. It does not tell you who ultimately owns or controls a structure, where its money came from, or whether it is linked to sanctioned people.
Where a client’s ownership runs through offshore holding companies with ties to high-risk jurisdictions, investigators should trace the beneficial owners, test the source of wealth independently and look for round-tripping. EDD-Pro helps investigators map these ownership chains and bring together sanctions and adverse media checks, so the risk is judged on evidence rather than reputation.
Regulatory
FCA restricts six lenders over weak AML controls
The Financial Conduct Authority has placed restrictions on six unregulated lenders, known as Annex 1 firms. It raised concerns about their anti-money laundering policies, controls and procedures while assessing their applications. The restrictions were imposed at each firm’s request. They limit the firms’ ability to take on new customers or do new business with existing ones, including extending credit.
The firms named are Kingscrown Finance, MOMSB, Momentus Capital, Grosvenor Funding, Grosvenor Funding (North West) and Abbital. Most must now commission an independent review of their AML framework, and Kingscrown has been told to wind down its existing loan book in an orderly way.
Annex 1 firms work in sectors that carry a higher risk of money laundering. They must register with the FCA for supervision under the Money Laundering Regulations, but they are not authorised or subject to wider FCA regulation. The regulator has already warned these firms to expect closer scrutiny. It is now assessing responses to an information request sent to around 900 registered Annex 1 firms, to find where further action is needed. Steve Smart, the FCA’s executive director for fighting financial crime, said: “Where they cannot satisfy us, we will intervene”.
Comment – For compliance teams, the most important message may be the one aimed at regulated firms. The FCA has reminded them that registration under the Money Laundering Regulations is no substitute for their own due diligence.
When dealing with an Annex 1 firm, they should confirm its registration status directly with the firm, check the information it provides independently, and understand and manage the risks involved. In practice, this means looking past a firm’s name on the register to its ownership, its directors, any adverse media and how its business model really works. EDD-Pro is built to help investigators carry out those checks quickly and keep a defensible record of them.
