If 2026 has revolved around the pace of infrastructure, 2027 is the year the rulebooks switch on. 

Around the world, regulators are moving from asking whether controls exist to testing whether they work. While payments get faster and sanctions lists longer, criminals are using the same AI tools compliance teams are buying.

The institutions that come out ahead in 2027 won't be the ones with the thickest policy manuals. They'll be the ones that can prove, decision by decision, that their controls hold up in every market they serve, as sanctions lists swell overnight, stablecoins become payment rails, scams run at industrial scale, and AI Agents take on decisions once reserved for analysts. 

Europe's Single Rulebook Goes Live

On July 10, 2027, the European Union's (EU) Anti-Money Laundering Regulation replaces 27 national interpretations of customer due diligence with one rulebook.

The thresholds tighten too. Due diligence on occasional transactions now starts at €10,000 rather than €15,000, beneficial ownership is set at 25% or more, and an EU-wide €10,000 cap applies to cash payments.

Additionally, regulated crypto providers can no longer offer anonymous accounts or support privacy coins, and luxury goods traders and crowdfunding platforms join the regime. [1]

Supervision changes just as much. From July 2027, the new AML Authority (AMLA) will begin selecting up to 40 high-risk financial institutions or groups operating in at least six member states, completing the process by the end of the year ahead of direct supervision in 2028. Other institutions will remain under national supervision, but within an increasingly harmonised EU framework. [2]

If a supervisor picked one of your decisions at random, could you explain it? Put your programme to the test with our AMLR stress test.

Automated Decisions Must Be Explainable to Customers

From July 10, 2027, Article 76(5) allows firms to make customer due diligence decisions using automated processes, including AI, but only on three conditions:

• The system uses only data collected through due diligence

• Key decisions are subject to "meaningful human intervention"

• The customer can obtain an explanation and challenge the outcome

Those key decisions cover onboarding or refusing a customer, maintaining or ending a relationship, carrying out or refusing an occasional transaction, and raising or lowering due diligence levels. Suspicious transaction reports are the one exception, which means explanation records and reporting records must be kept apart to avoid tipping off.

The AMLR doesn't define what a good explanation contains, but its practical meaning is clear. 

An explanation is only as good as the record made when the decision was taken: the inputs, the model version, the outcome, and what the human reviewer saw and changed. Institutions using AI for in-scope decisions will need to assess whether their systems can meet these requirements before the regulation applies.

This pressure continues later in the year, as on December 2, the EU AI Act's obligations for high-risk systems, including credit scoring, come into force [3].

APAC Goes After Mule Networks

Across the Asia-Pacific region, scams have become an organised, cross-border industry. 

Around 55% of adults in ASEAN+3 economies faced at least one scam attempt in 2024–25, and in selected ASEAN markets only around one in five victims recovered any money [4]. Hong Kong alone reported HK$8.1B in deception losses in 2025, with Singapore reporting S$913m.

In response, regulators have targeted the accounts moving the money. Thailand had suspended 3.4 million mule accounts by December 2025, shares high-risk account data across banks through a Central Fraud Registry, and caps daily transfers from suspected mule accounts at THB 50,000. 

Singapore's Scams (Countermeasures) and Other Matters Act, passed in September 2026, introduces offences relating to the misuse of online accounts and provides legal powers for sharing scam-related information between police and service providers [5].

The common thread is liability. Thailand now holds banks, telcos, and platforms liable for losses when they fall short of regulatory standards, and Hong Kong is consulting on a similar approach. 

In 2027, institutions across the region will be judged on how quickly they spot mule activity, often on fast payment rails linked across borders.

AI Agents Outpace the Rulebook

AI in financial crime compliance has moved from pilot to production, and regulators are no longer questioning its place in the industry. Across Europe, the Americas, and Asia-Pacific, they are converging on the same expectations: explainability, auditability, and human oversight [6].

The detailed rules are lagging behind. In April 2026, US banking agencies replaced SR 11-7, the model risk guidance that shaped AML model validation for 15 years, with new guidance that excludes generative and agentic AI from its scope. The agencies also signalled plans to seek further industry input on AI model risk management [7].

That gap won't stop examiners asking the obvious questions. When an agent closes an alert, what did it consult? Who owns the outcome? Is human review a real control, or a rubber stamp?

Institutions seeking to scale AI responsibly in 2027 will need to answer those questions: drawing clear lines between what Agents recommend and what humans decide, logging reasoning at every step, and testing AI dispositions against blind human review. 

Supervisors are building the same capability, with the FCA developing AI tools to oversee approximately 60,000 firms expected to enter its AML supervisory remit through a phased transition beginning in late 2028 [8].

If an examiner asked how your AI reached its last decision, could you show them? Our 7 principles of AI explainability in FCC set out what regulators are expecting.

US Stablecoin Rules Take Effect

The GENIUS Act is set to introduce a new regulatory framework for payment stablecoins in 2027, bringing issuer oversight and financial crime obligations into sharper focus [9]. 

Under the new framework, only permitted payment stablecoin issuers will be authorised to issue payment stablecoins in the US. Issuers are treated as financial institutions under the Bank Secrecy Act (BSA), with full AML programmes, suspicious activity reporting, customer identification and sanctions screening, and the technical ability to freeze or block tokens on lawful order.

The reach is global. Foreign issuers can only sell into the US if they are supervised under a comparable regime and register with the Office of the Comptroller of the Currency (OCC), and issuers from comprehensively sanctioned jurisdictions are barred outright.

Earlier this year, FinCEN found that roughly half of known stablecoin issuers had never registered as money services businesses [10]. With exchanges and custodians required to offer only compliant stablecoins from July 2028, 2027 is the year banks, exchanges, and payment firms will need to decide which issuers they can stand behind.

For compliance teams, issuer approval is only the starting point. Institutions will also need to understand how suspicious activity is monitored, how sanctions restrictions are enforced, and who is accountable when a transaction must be blocked or investigated.

The UK Brings Crypto Fully Inside the Perimeter

The UK's crypto timeline runs through the whole of 2027. 

From February 1, 2027, firms must apply enhanced due diligence to crypto asset correspondent relationships under the amended Money Laundering Regulations [11]. On February 28, the Financial Conduct Authority's (FCA) application window for the new crypto regime closes.

Then, on October 25, 2027, the regime will go live, replacing simple anti-money laundering registration with full authorisation [12]. It also applies to overseas firms serving UK consumers. Firms that miss the window must run off their UK crypto business.

For banks and payment providers, that means reassessing crypto counterparties throughout 2027. A firm considered acceptable at the beginning of the year may have a different regulatory status by October. Will existing due diligence processes detect that change?

Instant Payments Reach the Rest of the EU

The EU's Instant Payments Regulation now extends beyond the eurozone. Payment providers in member states such as Poland, Sweden and Hungary must be able to receive instant euro transfers by January 9, 2027, and send them – along with offering verification of payee on every credit transfer – by July 9, 2027 [13].

For compliance teams, the change is about time. A transfer that settles in seconds can't wait in a screening queue. For targeted EU financial sanctions, the regulation requires payment service providers to screen their customers at least daily, rather than conducting those checks during the execution of each instant euro transfer. 

Other applicable sanctions and AML monitoring obligations remain in place. That moves greater pressure upstream, to customer screening that must be accurate, responsive, and complete.

Providers that still rely on manual review of payment alerts face a hard choice in 2027: hold payments and break the instant promise, or cancel transfers by default when a decision can't be reached in time.

Sanctions Deadlines Diverge on Both Sides of the Atlantic

2027 opens with sanctions moving in opposite directions. From January 1, 2027, the EU's ban on Russian liquefied natural gas extends to long-term supply contracts [14]. Meanwhile, a US general licence authorising Russian diesel imports runs until April 7, 2027 [15].

The same cargo, counterparty, or payment can now be licensed in Washington and prohibited in Brussels. 

Each general licence carries an expiry date that has to be renewed, lapsed, or enforced in screening logic on the day it changes. Multi-jurisdiction institutions can no longer rely on one blended list with one risk appetite. 

When a general licence is signed, extended, or allowed to lapse overnight, would your screening reflect it by the next payment? Find out in Signed, Licensed, Waived: Can Your Sanctions Controls Keep Up With Washington?

The US Redefines What ‘Effective’ Means

In April 2026, FinCEN and the federal banking agencies proposed the most significant overhaul of US AML/CFT programme rules in decades [16].

The proposal splits effectiveness into two tests: whether a programme is properly designed, and whether it is implemented in all material respects. A well-designed programme would face enforcement only for significant or systemic failures, not minor gaps, and the national AML/CFT priorities would become an explicit programme requirement. Independent testing would also shift its focus from technical completeness to whether the programme actually works.

Depending on when the final rule is published, institutions could face significant implementation work during 2027.

Less process doesn't mean less scrutiny. It means scrutiny moves to outcomes: alerts escalated on time, priority risks reflected in monitoring, and watchlists updated when they change. For US institutions, the question for 2027 is whether they can show the programme works, not just that it exists.

Are You Ready for 2027?

Some deadlines are already set, while other regulatory changes are still taking shape. Before 2027 begins, it's worth asking:

• Could you evidence your controls, not just your policies, when the AMLR applies on July 10?

• Do you know which of your automated due diligence decisions a customer could ask you to explain?

• Is your customer screening fast and accurate enough to keep instant payments instant?

• Have you decided which stablecoin issuers and crypto firms you can stand behind?

• Are your mule detection controls watching inbound payments, not just outbound ones?

• Would a lapsed or extended sanctions licence reach live screening the same day?

Start 2027 Ahead of the Deadlines

Across regions, the direction is increasingly clear. Regulators want institutions to demonstrate that their financial crime controls work, adapt to changing requirements and produce decisions that can be explained.

The institutions best prepared for 2027 won't simply be those with more analysts or more extensive policies. They'll be those that can apply controls consistently, investigate risks efficiently, and demonstrate how decisions were reached.

Silent Eight's Iris 7 AI Agents help financial institutions automate high-volume customer and payment screening decisions within defined policy boundaries, while maintaining explainable, auditable outcomes.

As regulatory deadlines approach, the question is whether your existing screening and investigation processes can keep pace.

To explore how AI can support your 2027 financial crime compliance priorities, speak to our team.