About a-team Marketing Services
The knowledge platform for the financial technology industry
The knowledge platform for the financial technology industry

A-Team Insight Blogs

Inside the Uneven Geography of AML Enforcement Outcomes in 2025 – Fenergo Analysis

Subscribe to our newsletter

Fenergo’s latest Global enforcement analysis shows total AML, KYC, sanctions and customer due diligence penalties declining to $3.8 billion in 2025, down from $4.6 billion in 2024 and $6.6 billion in 2023, marking a second consecutive year of decline. Beneath that headline, regional outcomes moved in sharply different directions. North American fines fell by 58%, while EMEA penalties increased by 767% and APAC fines rose by 44%, with Europe accounting for a disproportionate share of global enforcement value and emerging as a clear outlier in the data. At first glance, the results appear noisy. On closer inspection, they reflect the uneven timing of enforcement cycles and the conclusion of long-running investigations rather than a change in supervisory resolve.

Much of the European total is explained by the conclusion of long-running investigations, some rooted in conduct dating back several years, including pandemic-era failures. These cases are now reaching resolution at the same time that the EU’s AML supervisory framework is being reshaped. To examine what this divergence tells us about the current state of AML enforcement, RegTech Insight spoke with Rory Doyle, Head of Financial Crime Policy at Fenergo, to explore how regulators are applying pressure, where controls are falling short, and why enforcement outcomes continue to lag the risks they seek to address.

Lagging Enforcement Outcomes

The concentration of AML penalties in Europe does not reflect a sudden escalation in regulatory intensity. It reflects the length of time required to investigate, prosecute and conclude complex financial crime cases. Enforcement outcomes remain backward-looking, often crystallising years after the underlying failures occurred.

This lag is visible in recent UK cases linked to transaction monitoring weaknesses during the COVID period. As Doyle explains, “The UK continues to show a steady and robust approach to AML enforcement, and the fines we saw in 2025 reflect just how long regulatory investigations can take.” He adds, “Issues that emerged during the COVID period are now working their way through the system and feeding into enforcement outcomes years later.”

The result is a clustering effect. Multiple European authorities are closing cases within a similar timeframe, producing a spike that stands out against other regions where major enforcement actions peaked earlier. This does not imply reduced scrutiny elsewhere. It illustrates how enforcement calendars, not risk exposure, drive annual totals.

Quality, not Volume

While fines remain the most visible signal of enforcement, regulators are increasingly focused on the effectiveness of AML controls rather than their scale. High compliance spend and large alert volumes have not translated into proportionate disruption of financial crime. A speaker at a recent SEC Crypto roundtable noted that whilst the US spent over $5.9 billion on FinCrime mitigation over the previous 12 months, fewer than 1% of incidents were captured.

Doyle points to a growing concern among supervisors about suspicious activity reporting (SAR) practices. “They believe in future that rather than having huge amounts of SARs going through to FinCEN that they would rather people concentrated on the quality of the reports because it’s very hard to find a needle in a haystack full of needles.”

This concern is operational rather than theoretical. Poorly structured reports slow analysis, dilute intelligence value and place pressure on supervisory resources. The issue is not whether institutions are reporting, but whether reporting supports meaningful investigation.

Disproportionate Digital Asset Impacts

The data also shows digital asset firms continuing to feature prominently in high-value AML penalties. This reflects transaction growth and cross-border exposure colliding with uneven compliance maturity. Doyle frames the issue in operational terms: “I would question how large the compliance departments are in virtual currency firms compared to those volumes if you compare it to traditional firms.”

At the same time, sanctions controls are becoming more complex. Alignment between US, UK and EU sanctions lists has historically reduced friction for global firms. That alignment appears to be at risk. “There is a worry that possibly these lists could diverge away from each other with some jurisdictions sanctioning individuals who aren’t going to be sanctioned by others,” Doyle notes, highlighting the strain this places on screening and escalation frameworks.

Across these pressures, institutions face a persistent constraint: skilled financial crime resources have not grown in line with workload. Technology is increasingly used to support that gap, but accountability remains fixed. As Doyle puts it, “We should never take away the human interaction requirement that somebody needs to have a personal responsibility for either the submission or the non-submission.”

The divergence visible in recent AML enforcement outcomes is not evidence of retreat or deregulation. It reflects delayed case resolution, structural change in European supervision, and unresolved questions about control effectiveness. The enforcement landscape remains shaped by legacy failures, operational constraints and the challenge of turning compliance activity into usable intelligence.

A more constructive thread running through the current enforcement landscape is a renewed emphasis on coordination rather than fragmentation, particularly within the EU’s evolving AML framework. Doyle points to the AML Regulation’s explicit focus on cooperation as a signal of where supervisory effort is being directed. “Article 75 of the AMLR tells the appropriate people, whether that be financial institutions, regulators, or financial intelligence units within the EU that there needs to be cooperation,” he says.

Set against the backdrop of large, delayed enforcement outcomes, the shift toward collaboration reflects a recognition that effectiveness depends less on isolated controls and more on shared intelligence, consistent interpretation and coordinated action across jurisdictions.

Subscribe to our newsletter

Related content

WEBINAR

Upcoming Webinar: Sponsored by FundGuard: NAV Resilience Under DORA, A Year of Lessons Learned

Date: 25 February 2026 Time: 10:00am ET / 3:00pm London / 4:00pm CET Duration: 50 minutes The EU’s Digital Operational Resilience Act (DORA) came into force a year ago, and is reshaping how asset managers, asset owners and fund service providers think about operational risk. While DORA’s focus is squarely on ICT resilience and third-party...

BLOG

DORA CTPP List Published, But Who’s Missing?

When the European Supervisory Authorities (ESMA, EBA and EIOPA) published the first list of Critical ICT Third-Party Providers (CTPPs) in November 2025, the step marked a major milestone in the rollout of the Digital Operational Resilience Act (DORA). The regulators described the designations as “crucial” to implementing the Union-level oversight framework. Yet despite the significance...

EVENT

RegTech Summit New York

Now in its 9th year, the RegTech Summit in New York will bring together the RegTech ecosystem to explore how the North American capital markets financial industry can leverage technology to drive innovation, cut costs and support regulatory change.

GUIDE

The DORA Implementation Playbook: A Practitioner’s Guide to Demonstrating Resilience Beyond the Deadline

The Digital Operational Resilience Act (DORA) has fundamentally reshaped the European Union’s financial regulatory landscape, with its full application beginning on January 17, 2025. This regulation goes beyond traditional risk management, explicitly acknowledging that digital incidents can threaten the stability of the entire financial system. As the deadline has passed, the focus is now shifting...