They've read your data first

1 · What the three supervisors say they run

Each has said, in its own words and its own documents, that it uses analytics on firms’ reporting and that a person still makes the decision.

• AU · AUSTRAC: AI and large language models on SMRs (CEO speech, June 2026); “AI-enabled analytics to help detect indicators of financial crime” (AI transparency statement, Dec 2025); a Targeting and Prioritisation Model and near real-time analytics tooling (Annual Report 2024–25); Reports, typologies, supervision targeting, non-compliance; No AI in decisions “without human intervention” (transparency statement)

• SG · MAS: Network analysis of STRs since at least 2019; machine learning to “sift out high-risk networks and transaction patterns” (parliamentary reply, Oct 2023); full visibility of COSMIC sharing (2023 Bill speech); Networks across institutions, then the firms they touch; MAS then engages firms “to assess the robustness of their controls”

• UK · FCA: Data “to spot outliers” (Sep 2024); an in-house synthetic data tool to test firms’ sanctions screening (AI Update); generative AI to review documents received from firms (work programme, Mar 2026); Firm selection, control testing, document review; AI “won’t replace human judgment” (Sep 2026)

The vocabulary differs. The direction does not. In all three, analytics decides where the supervisor looks, and a person decides what it finds.

2 · Your reports are the first exam paper

The data the supervisor analyses first is the data you sent it.

Australia. AUSTRAC received 452,951 suspicious matter reports in 2024–25, up 19 per cent, and holds around two billion transaction report records. Its 2026–27 priorities commit to exploring advanced SMR analytics and to engaging entities “whose SMRs are consistently poor quality”. A reform paper from AUSTRAC proposes text analytics to assess the readability and intelligence value of SMRs, with a stated aim of reducing defensive reporting. Late reporting is caught the same way: timely reports, in AUSTRAC’s words, “allow us to analyse current activity”.

United Kingdom. The FCA’s annual financial crime return, REP-CRIM, asks firms for counts of politically exposed customers, high-risk customers, sanctions alerts and suspicious activity reports. The FCA has said it follows up firms that file poor-quality returns, and that poor data may itself indicate weak systems and controls. Its examples are the kind a model catches instantly: more external SARs than internal ones, or more financial crime staff than customers.

Singapore. MAS applies network analysis to suspicious transaction reports, enriched with police intelligence and other data, and feeds what it finds back to firms through supervisory engagement and typology alerts.

A report used to be read when someone pulled it. It is now read in bulk, against everyone else’s. Quality, timeliness and consistency are visible across the whole of a firm’s reporting, not just the sample an examiner happens to open.

3 · The supervisor can see across the market. You can’t.

The second shift is that supervisors increasingly hold a view no single firm has.

Singapore made it law. COSMIC went live on 1 April 2024 under the Financial Services and Markets (Amendment) Act 2023, with six major banks sharing indicators of suspicion on the misuse of legal persons, trade finance and proliferation financing. MAS “will have access to all information shared on the platform”, and firms must ensure what they share is accurate and complete. In August 2026 MAS said it is widening COSMIC beyond the three risk areas and onboarding other major banks within two years.

Australia does it through partnership. AUSTRAC says Fintel Alliance has built shared data sets that reveal risks no single institution can see, including all cash deposit data under $10,000 from the four major banks, and is exploring how to extend Fintel Alliance to newly regulated Tranche 2 entities.

The UK is moving the same way through intelligence-led supervision, with the FCA supporting the National Crime Agency’s data fusion programme and taking part in an NCA-led analysis of account data shared by seven banks.

What this changes is the order of events. A customer network that touches several institutions can be visible to the supervisor before it is visible to any one of them. The question in an examination is then less “what did you find?” and more “why didn’t you find what we can already see?”

4 · Selection is now a data exercise

Which firm gets examined, and on what, is increasingly decided by a model before anyone picks up the phone.

• AUSTRAC’s Corporate Plan says supervision targets the entities exposed to the highest inherent risk, “as identified by AUSTRAC’s Targeting and Prioritisation Model”. Its agency brief to the Minister talks of near real-time monitoring to identify and respond to non-compliance. With reporting entities heading towards 100,000 once Tranche 2 is in, no supervisor can work that population by hand.

• The FCA describes an approach that “uses data to spot outliers and issues”, with risk indicators such as high turnover of MLROs, and proactive AML assessments of firms it deems higher risk.

• MAS uses its analytics to identify networks first, then engages the firms involved on their controls.

None of the three has published how its model weights anything, and none should be expected to. What can be said is that the inputs are largely what firms report and how they compare with similar firms. Being an outlier, in either direction, is the thing a model is built to notice.

5 · Your own AI will be examined as governed AI

Supervisors that run models themselves are well placed to ask hard questions about yours.

Singapore has written it down. MAS issued its AI Risk Management Guidelines on 7 October 2026, after a consultation in late 2025. They expect board oversight, an inventory of AI uses, a materiality assessment for each, and proportionate controls over data, testing, human oversight and monitoring. They apply from 7 October 2027, with some sections to be met by October 2028. On third-party tools MAS is explicit: firms “remain accountable for AI used in the services they deliver”. As early as 2021 MAS said it wanted firms using analytics in AML to show sufficient validation of increased effectiveness over existing practices.

The UK is testing, not yet prescribing. The FCA has built its own synthetic data tool to test firms’ name screening, and in April 2026 published a synthetic AML dataset with the Alan Turing Institute for testing transaction monitoring approaches, while noting that synthetic data should complement, not replace, live data. A supervisor with its own test data does not need to take a firm’s word for how its screening performs.

Australia’s AI transparency regime covers AUSTRAC’s own use. For firms, the AML/CTF obligations are technology-neutral: a programme is judged on whether it works, whatever runs it.

6 · Much of your data was compiled by someone else, and it is still yours

There is a layer underneath all of this that rarely gets examined until something goes wrong: the reference data. Screening lists, adverse media, politically exposed persons and corporate ownership mostly come from a small number of commercial providers, and the same datasets sit behind a large share of the market.

How those datasets are built is not a secret, it is in the providers’ own material. The largest screening datasets are researched by people: one major provider describes hundreds of research analysts working across 65 to 70 languages, gathering public-domain information profile by profile. Ownership databases are mostly aggregations, one describing data collected from more than 170 upstream providers and then standardised. The better providers do cite a source for each entry. A cited source, though, is a pointer to where something was read. It is not an auditable chain showing who decided what, on what evidence, when it was last checked, and what changed. Published profiles have been wrong before, and at least one provider has apologised in open court for a terrorism label it should never have applied.

The supervisors have been consistent that none of this moves the responsibility:

• UK. The FCA’s guidance on politically exposed persons says a firm using a commercial database “would need to understand how such databases are populated”. Its 2023 sanctions review found some firms “too reliant on third party providers with ineffective oversight over them”, and its thematic guidance lists treating a commercial screening system as a panacea as poor practice.

• Singapore. MAS’s AI Risk Management Guidelines expect firms to document data sourcing, processing and lineage for their AI, and state that a firm “retains primary accountability for its use of third-party AI”.

• Standard setters. The Wolfsberg Group’s screening guidance notes that lists are often maintained through external vendors, flags the lag between a regulator’s update and the vendor’s, and calls for independent testing. The Basel Committee’s 2023 progress report on risk data found several large banks still lacked complete data lineage, with only two of 31 global systemically important banks fully compliant. That is about risk data generally, but it shows how far lineage still has to go even at the top of the market.

This is where the supervisors’ own analytics and the firm’s reference data meet. A supervisor looking across the market sees a customer once, from several institutions’ reports. A firm sees that customer through a dataset it licensed and cannot fully reconstruct. When the two views disagree, the examiner will ask the firm to explain its own, and “the provider said so” has never been an answer any of the three regulators accepts.

7 · A person still decides, which is why the file still matters

It would be easy to read all this as automated enforcement. It isn’t, and each supervisor has gone out of its way to say so. AUSTRAC’s transparency statement rules out AI making decisions without human intervention. The FCA’s executive director for enforcement said in September 2026 that AI won’t replace human judgment. MAS uses its analytics to decide which firms to engage, then engages them.

So the examination itself still looks familiar: a team, a request list, a walk-through. What has changed is the agenda. The examiner arrives with questions shaped by data, and the answers have to come from the firm’s own customer file. A report that was defensive, a customer whose ownership was never resolved, a network the firm didn’t see: each is now easier for the supervisor to find and harder for the firm to explain after the event.

What to be sceptical of

Five claims circulate that don’t survive checking:

1. “The regulators are using AI to catch firms.” On their own account, all three use analytics to triage and target, and a person decides. That is a change in where the examiner looks, not automated enforcement. Overstating it sells fear, not preparation.

2. “A quarter of regulators now use AI for AML.” A version of this circulates, often as 27 per cent. In the Cambridge SupTech Lab’s 2024 survey, 27 per cent is the share of authorities prioritising AI pilot projects across supervision generally, not AML. The survey’s AML finding is that AML/CFT is a priority area for 62 per cent of authorities with a suptech solution. Check the denominator before repeating a number.

3. “Network analytics finds three times more money laundering.” The figure comes from the BIS Innovation Hub’s Project Aurora, which reported up to three times more detection and up to 80 per cent fewer false positives in a simulation, on synthetic data. It is a strong argument for collaborative analytics, not a measured result in live operations.

4. “Our screening data is independently verified.” Usually it means each record cites a public source. That is useful, and it is not the same as evidence of who checked it, when, and against what. Ask what sits behind the citation before relying on the word “verified”.

5. “Regulator-grade” or “regulator-approved” AI. No regulator in any of the three markets approves vendors or methods, and MAS states plainly that firms remain accountable for third-party AI. A claim of endorsement is the quickest way to lose a compliance reader who checks.

What to do about it now

Five things, none of which require buying anything:

1. Read your reporting the way the supervisor’s model will. Pull a year of SMRs, STRs or SARs and read them in bulk rather than one at a time. Are they specific, timely and consistent, or templated and defensive? If you file REP-CRIM, check the return for internal contradictions before the FCA’s analytics does.

2. Know where you sit against your peers. Suspicious reports per thousand customers, the share of high-risk and politically exposed customers, alert volumes, staff numbers. You don’t need the supervisor’s data to know whether you look unusual, and if you do, have the explanation written down before anyone asks.

3. Fix the customer data your reports stand on. Every report, and every red flag shared on a platform like COSMIC, is only as good as the customer record behind it. Unresolved ownership, stale due diligence and profiles that don’t match activity are what make a report thin and a network invisible.

4. Ask your data providers how a record is built. For a sample of your own customers, ask what sources sit behind each screening hit and ownership link, when they were last checked, and what the provider changed. The FCA expects you to understand how the database is populated; if the answer can’t be produced, that is a finding you would rather make yourself.

5. Inventory your own models and automation now. List every place a model, rule set or tool makes or shapes a compliance decision, who owns it, how it was validated against what it replaced, and who reviews its output. In Singapore that is a requirement from October 2027. In Australia and the UK it is the first thing an examiner who runs models will ask for.

There is no authoritative guide to how supervisors’ own analytics will change examination in practice; this is a reading of what the three supervisors have said about their tools, from the public record, so a reader can draw their own line.

Sources

• AUSTRAC: Our AI transparency statement (last updated December 2025)

• AUSTRAC: CEO speech, AFIA Risk Summit (June 2026)

• AUSTRAC: Our regulatory priorities 2026–27

• AUSTRAC: Annual Report 2024–25; Corporate Plan 2025–29

• AUSTRAC: Agency brief to the Minister (May 2025, released under FOI); regulatory reform opportunities, Attachment A (2025)

• AUSTRAC: Fintel Alliance expansion release; CEO speaking notes, ACAMS Assembly Australasia 2025

• MAS: Loo Siew Yee, “Combatting financial crime through new technologies built on strong fundamentals”, 16 Oct 2019; Wealth Management Institute industry forum, 5 Aug 2021

• MAS: Written reply to parliamentary question on use of AI in supervision of FIs, 3 Oct 2023

• MAS: Second Reading speech, Financial Services and Markets (Amendment) Bill, 9 May 2023; COSMIC launch release, April 2024; oral reply on COSMIC, 5 Aug 2026

• MAS: Information paper on AI model risk management, 5 Dec 2024; AI Risk Management Guidelines, 7 Oct 2026

• FATF: Mutual evaluation report, Singapore, May 2026

• FCA: AI Update (2024); Sarah Pritchard, “A targeted and outcomes-based approach to tackling financial crime”, 5 Sep 2024

• FCA: Financial crime analysis of firms 2017–2020 (REP-CRIM), 7 Oct 2021; Annual Work Programme 2026/27, 26 Mar 2026

• FCA: Research note, Synthetic data and anti-money laundering, 15 Apr 2026; Steve Smart, Law Society Economic Crime Conference, 17 Sep 2026

• FCA: FG17/6, The treatment of politically exposed persons for anti-money laundering purposes, July 2017, para 2.11; Sanctions systems and controls: firms’ response to increased sanctions, 6 Sep 2023; Financial Crime Thematic Reviews, FCTR 8.3

• MAS: Guidelines on Artificial Intelligence Risk Management, 7 Oct 2026, paras 5.4 and 5.11

• Wolfsberg Group: Guidance on Sanctions Screening, 2019

• Basel Committee on Banking Supervision: Progress in adopting the Principles for effective risk data aggregation and risk reporting, 28 Nov 2023

• Commercial data providers’ own published product and methodology material (providers not named, in line with the series’ practice); statement in open court, High Court of England and Wales, 1 Feb 2017

• Cambridge SupTech Lab: State of SupTech Report 2024 (executive summary)

• BIS Innovation Hub: Project Aurora, final report, May 2023

Every statement about a supervisor’s tools is drawn from that supervisor’s own publications, speeches or parliamentary record. None of the three has published how its targeting models work, and nothing here claims to describe them. Statements about how commercial datasets are compiled are drawn from the providers’ own published material.

Published by Dligence as part of the “What Good Looks Like” series. Dligence is a compliance-data company; this paper is analysis of the public regulatory record, is not legal advice, and no part of it implies regulatory endorsement of any provider or method.