Anti-money laundering compliance for payment institutions is changing on several fronts at once. The EU's new AML authority is building up. Continuous, event-driven KYC is replacing fixed review cycles. AI-generated identities are beating onboarding controls designed for older threats. And supervisors are moving from asking whether controls exist to asking whether they work.
AMLA and the EU single rulebook
The EU Anti-Money Laundering Authority (AMLA) began operating in Frankfurt in July 2025. The EU AML Regulation, a single rulebook replacing national versions of the AML directives, applies from 10 July 2027, and AMLA will start directly supervising a selection of high-risk financial institutions from 2028. For payment institutions active in several EU countries, frameworks built for the strictest national regime will largely carry over, but differences in monitoring calibration and PEP screening that were tolerated under the directives will have to be resolved.
In the GCC, the CBUAE has continued to issue AML/CFT guidance for licensed institutions, with attention to proliferation financing, correspondent banking and trade-based money laundering. SAMA has tightened expectations on cross-border remittance corridors and virtual asset activity. QCB's requirements follow the FATF Recommendations, with particular focus on cross-border payments given Qatar's large expatriate remittance flows.
From periodic review to perpetual KYC
Traditional KYC runs on a timetable: low-risk customers reviewed every three to five years, high-risk customers every year. A customer whose risk changes, through a new PEP role, a sanctions listing or adverse media, may not be picked up until the next scheduled review. Perpetual KYC replaces the timetable with event-driven monitoring: when a trigger occurs, a review starts straight away.
The case for it rests on lower regulatory risk and lower cost, because manual periodic review at scale is expensive and error-prone. It depends on connecting customer data, sanctions and PEP lists, adverse media monitoring and case management, which many payment firms still hold on separate platforms. Firms that have already built a single compliance data platform are best placed to adopt it.
PEP identification and sanctions screening
Identifying politically exposed persons is getting harder. The definition covers not only people in public office but their close family members and known close associates, and PEP databases have grown considerably. Screening has to be continuous, not a single check at onboarding.
Sanctions exposure is also more complex, with shadow fleets, crypto-assets and layered corporate structures used to hide sanctioned parties. Screening that covers account holders but not digital asset counterparties leaves a gap that supervisors are increasingly finding. Enforcement remains heavy: Fenergo counted about $4.6 billion in AML, sanctions and KYC penalties on financial institutions in 2024, and in 2025 OKX agreed to pay more than $500 million and BitMEX $100 million to US authorities over compliance failures.
AI in AML: false positives and new threats
Rules-based monitoring produces more alerts than teams can properly review, and the great majority turn out to be false positives. Models that use customer risk profiles, transaction context and network analysis can cut false positives substantially while finding more genuine suspicious activity.
Supervisors increasingly expect these models to be explainable: firms must be able to show how a risk score was reached. A score with no traceable reasoning is harder and harder to defend in an inspection. Criminals, meanwhile, use AI to probe monitoring thresholds and to create deepfakes that defeat liveness checks at onboarding. Compliance controls should be tested as systems under active attack.
What payment institutions should do now
The key structural question for compliance leaders is whether onboarding, screening, transaction monitoring and case management work as one connected environment or as separate systems. Fragmented set-ups leave coverage gaps, make investigations slow and expensive, and cannot produce the audit trail supervisors expect. Firms operating in the EU should assess their set-up against the single rulebook before it applies in July 2027.