AML supervision has become one of the most intensely scrutinised areas in banking and financial services compliance. Regulators across the EU, UK, and US have dramatically increased enforcement actions against firms with inadequate anti-money laundering controls — and the pace of regulatory change in 2026 shows no sign of slowing. For compliance teams and risk officers, understanding where the principal failure points lie is essential to building programmes that withstand supervisory scrutiny.
Why AML Supervision Risk Is Escalating
The global AML and financial crime landscape has shifted fundamentally over the past three years. The FATF Recommendations continue to drive national-level legislative reform, while the EU’s Anti-Money Laundering Authority (AMLA) is now operational and imposing direct supervisory mandates on high-risk obligated entities. In the US, FinCEN’s beneficial ownership registry under the Corporate Transparency Act (CTA) has added new layers of compliance obligation, particularly for correspondent banking and cross-border transactional business.
Against this backdrop, firms that have not modernised their AML compliance infrastructure face compounding risk: not just regulatory penalty, but reputational harm and the operational disruption of remediation programmes imposed under supervisory direction.
Key Risk Areas in AML Supervision
1. Transaction Monitoring Gaps
Transaction monitoring remains the most commonly cited deficiency in AML supervisory findings. Regulators consistently identify tuning failures — systems that generate too many false positives without catching genuine risk, or that have not been recalibrated to reflect changes in product mix, customer base, or typology guidance. FATF’s updated guidance on risk-based transaction monitoring places the onus firmly on firms to document and evidence their calibration methodology, including threshold decisions and scenario logic.
Key risk indicators in this area include: failure to monitor cash transactions below reporting thresholds, insufficient coverage of digital asset and crypto-adjacent activity, and alert backlogs that result in investigations being completed outside of required timeframes.
2. Customer Risk Stratification and KYC Inadequacies
Customer risk rating models that were designed years ago may no longer reflect the risk profile of the current customer base. Regulators pay particular attention to whether firms have applied enhanced due diligence (EDD) consistently to high-risk customers, including Politically Exposed Persons (PEPs), high-net-worth individuals, and customers operating in high-risk jurisdictions as identified by FATF’s grey and black lists.
A common supervisory concern is the failure to refresh customer due diligence on a risk-rated cycle — firms that onboard clients correctly but fail to update KYC records when material changes occur are routinely cited in enforcement actions. Baretzky & Partners’ KYC framework advisory specifically addresses this gap through ongoing monitoring design and trigger-based refresh protocols.
3. Sanctions Screening Infrastructure
Sanctions compliance sits at the intersection of AML and financial crime risk, and screening failures have resulted in some of the largest financial penalties in recent enforcement history. The convergence of EU, UN, US OFAC, and UK OFSI sanctions regimes — particularly following escalation of Russia-related designations — has significantly increased the complexity of maintaining effective screening infrastructure.
Key risks include: screening system lag time (screens that are updated too infrequently), failure to screen against all relevant lists, inadequate fuzzy matching logic for name variants and transliterated names, and insufficient documentation of screening decisions. Firms operating in multiple jurisdictions must also manage conflicting obligations between regimes.
4. Governance and Accountability Frameworks
Supervisors are increasingly focused on governance — specifically, whether the MLRO has adequate authority and resource, whether the Board and Senior Management are receiving meaningful AML MI, and whether there is a documented three-lines-of-defence model with clear accountability. The Senior Managers and Certification Regime (SMCR) in the UK, and equivalent accountability frameworks in the EU and US, have made personal liability for AML failures a real and pressing concern for individual executives.
Regulators expect to see documented Board-level risk appetite statements for financial crime, supported by regular management information reports that track programme performance against defined metrics — not simply activity metrics, but outcome measures.
5. Regulatory Response and Remediation Readiness
When supervisors initiate an AML review — whether via a themed examination, Dear CEO letter, or enforcement action — the firm’s response capability is itself a supervisory risk. Firms that lack documented policies, cannot produce evidence of control operation, or whose compliance teams are unable to articulate the design rationale for key controls, consistently receive more adverse findings.
Remediation programmes imposed by regulators under supervisory direction are enormously disruptive and costly. Proactive investment in programme quality assurance — including independent testing, look-back reviews, and model validation — significantly reduces the risk of mandated remediation.
How Baretzky & Partners Supports AML Supervision Risk Management
Baretzky & Partners operates an AML and financial crime advisory practice that covers the full compliance lifecycle. Our FATF-aligned methodology and deep knowledge of EU, UK, US, and international sanctions regimes means we are well-positioned to support firms across all the key risk areas identified above.
Our AML supervision support services include: AML programme gap analysis and maturity assessment; transaction monitoring model validation and recalibration; KYC framework design and EDD protocol development; sanctions screening infrastructure review; governance and MLRO effectiveness assessment; and regulatory response and remediation programme management.
Whether your organisation is preparing for a regulatory examination, responding to supervisory findings, or proactively strengthening its financial crime framework ahead of AMLA’s expanded supervisory scope, our specialists can deliver findings and recommendations within defined timeframes.
AML Supervision in 2026: The Strategic Imperative
The direction of travel in AML supervision is unambiguous: regulators are more resourced, more coordinated, and more willing to use enforcement tools than at any previous point. The establishment of AMLA, combined with FinCEN’s continued rulemaking activity and the FCA’s publication of its three-year strategy placing financial crime at the top of its supervisory agenda, means that the window for addressing programme gaps is narrowing.
For banks, payment institutions, and other obligated entities, the strategic imperative is clear: invest now in programme quality assurance, governance infrastructure, and the specialist advisory capability needed to navigate an increasingly demanding supervisory environment.
For enquiries about AML supervision risk management, programme assessment, or regulatory response support, contact Baretzky & Partners via our enquiry form or reach our specialists directly at info@baretzky.com.