Digital payments push AML deeper into financial infrastructure

Digital finance is changing anti-money laundering from a compliance process into part of the operating architecture behind payments, according to Hytham Ahmad, technology leader for AI, financial crime and data platforms at SAS Middle East. In a Finextra expert opinion, Ahmad said faster transactions, cross-border transfers and the spread of wallets, processors and point-of-sale systems are increasing the need for controls that can work at payment speed.

Ahmad described modern AML as a layered system rather than a single gate. The components he identified include know-your-customer and customer due diligence checks, sanctions screening, transaction monitoring, and case management with regulatory reporting where required.

Those functions are interdependent, he said. Weak identity verification can reduce the value of later transaction monitoring, while poor case handling can leave institutions unable to act effectively on alerts produced by monitoring tools. Ahmad argued that institutions obtain better detection outcomes when these controls are treated as a connected pipeline instead of separate systems.

Technology changes the control model

The shift reflects the scale and speed of digital payments. Ahmad said artificial intelligence and machine learning are increasingly used in fraud detection and credit scoring because static rules can miss patterns across large volumes of activity. He also pointed to blockchain payment trails, near-field communication for contactless transactions, cloud computing for scalable monitoring, and APIs and software development kits that connect banking cores, screening engines and case management systems.

According to Ahmad, AML technology is moving away from fixed rules and toward adaptive detection models that improve as they process more data. That change has operational consequences for banks, payment firms and other financial institutions because monitoring capacity must expand and contract with transaction volumes.

Different payment rails carry different risks

Ahmad said risk varies by channel. Payment gateways use tokenisation, encryption, 3D Secure protocols and AI-based analytics to assess transactions in real time. Payment processors add controls such as PCI DSS compliance, encryption and orchestration platforms that route transactions across networks. Digital wallets are embedding QR codes, biometric authentication and tokenisation into consumer payment flows, while point-of-sale systems are becoming more mobile, cloud-based and connected through internet-of-things technology.

The distinction between domestic and cross-border flows is also material, Ahmad said. Domestic payments often involve local clearing houses, real-time payment systems and country-specific compliance requirements. Cross-border payments can add SWIFT messaging, blockchain-based remittances, foreign-exchange conversion and AML and KYC controls across multiple jurisdictions.

Ahmad said cross-border flows receive close regulatory attention because illicit funds can be mixed with legitimate commerce in global payment channels.

New products widen the perimeter

Several payment trends are reshaping AML demands, according to Ahmad. Contactless payments and buy now, pay later products shorten the interval between initiation and settlement, reducing the scope for manual review. Embedded finance places payment functions inside non-financial apps and platforms, expanding the number of environments institutions may need to monitor.

Ahmad also cited central bank digital currencies as a new payment rail still being assessed by regulators and compliance teams. Biometric authentication, voice-activated payments and wallet-based super-apps are changing identity checks and concentrating multiple payment methods inside single platforms.

The common pressure across these developments is speed, Ahmad said. His view is that financial institutions will need AML, fraud detection, sanctions screening and monitoring to be designed into payment infrastructure rather than added as separate compliance tools after systems are built.

This story draws on original reporting from Finextra Research.