4.1 Introduction
AI has the potential to transform policing by performing certain tasks much faster than humans can, thereby giving the law enforcement agencies (LEAs) a critical advantage against criminals and pave the way for efficient, responsive and effective law enforcement at significant scale. Such tasks can include integration (Sarzaeim et al., Reference Sarzaeim, Ahmadi, Alipour and Borumand2023) and analysis of complex data sets (IBM, Reference Forbes2023) (e.g., illicit money flows, Suspicious Transaction Reports (STRs), electronic communications, images and video, etc.); prioritisation of most pressing threats and risks (Sarzaeim et al., Reference Sarzaeim, Ahmadi, Alipour and Borumand2023); translation of large documents; development of secure communication channels; and training platforms.
For the LEAs, in particular, any AI tool shall be underpinned by relevant legal provisions pertaining to data bias, fairness, and potential threats on privacy, data security, accountability, human rights protection and discrimination, to name a few. When the possibility of criminal conviction thus the depravation of liberty as a consequence increases, so should safeguards and principles if an AI is used in the criminal justice system. While plethora of studies have been conducted on the interrelation between predictive policing (Sarzaeim et al., Reference Sarzaeim, Ahmadi, Alipour and Borumand2023; European Council, 2024), AI and fundamental human rights (Council of Europe, n.d.) as well as the effects of AI on policing organisations (Sarzaeim et al., Reference Sarzaeim, Ahmadi, Alipour and Borumand2023), this chapter focuses on the use of AI in the investigation stage of policing where the crime in question has gone beyond mere suspicion and there is enough evidence to conduct the investigation and start procedures for seizure and confiscation of illicit proceeds of crime.
Accordingly, we focus on key potential areas of AI deployment that are relevant in several use cases, then present our horizon scanning results on AI tools for LEAs (what these tools can be in the future).
4.2 User Requirements
The implementation of AI-supported and other new technological tools for investigation of financial crime is not straightforward. This is partly because LEAs often lack the necessary skills, appropriate basic training or further education (Dewald, 2022). Furthermore, LEAs often lack organisational capacities, such as legal, technical and financial resources to implement such tools easily and effectively (Tombul and Cakar, Reference Tombul and Cakar2015).
In the TRACE project, the assessment of user and organisational needs for the implementation and use of AI-supported and other new technological tools for tracing illicit money flows (IMFs) was carried out via a mixed methods approach, including a quantitative survey, qualitative interviews and focus groups with employees of various law enforcement and judicial agencies. For the quantitative survey, a total of forty-two employees of various law enforcement agencies were contacted via an online questionnaire. Respondents were asked about their experiences in the tracing of IMFs, the usefulness and added value of digital investigation software in this context, and the challenges of cross-border police cooperation and information sharing. Table 4.1 provides an overview of the composition of the sample, which included eleven supervisors and thirty-one investigators with an average seniority of fourteen years.
Table 4.1 Long description
The table presents a list of countries and their respective units involved in financial crime, terrorism financing, and related activities. It includes columns for Country, N (number of units), Unit (type of unit), and another N (unit count per category). Countries listed include Austria, Belgium, Cyprus, Czech Republic, Estonia, France, Germany, Guernsey, Luxembourg, Netherlands, Portugal, United Kingdom, and the United States. Units range from A M L or C F T supervision, anti-terrorism financing, anti-fraud, asset recovery, cybercrime, economic and financial crime, FIU, internal affairs, international tax, and criminal investigation. The United States has multiple units covering money laundering, organised crime, and tax crime. A total of 42 units are recorded.
For the qualitative data collection, a total of eight individual interviews were conducted with LEA personnel from Austria, Italy, Czech Republic, Germany, Estonia, and two members of staff from international organisations, Europol and Eurojust. Interviewees were mid-level LEA/judicial staff who were still involved in investigations/prosecutions as senior officials, and as such were also taking on strategic and management functions. The participants had expertise in investigating organised crime, cybercrime, and economic and financial crime. These interviews were supplemented by one focus group with five employees of different Estonian law enforcement agencies. In a second data collection and evaluation phase, two workshops were conducted. In contrast to the initial interviews and focus group, these meetings primarily served to revisit, evaluate and refine the findings. These workshops involved nine participants (from Italy, the Czech Republic, Austria, and Spain). Table 4.2 provides an overview of the sample.
Table 4.2 Long description
The table provides detailed information about participants involved in a study or project related to financial crime, organised crime, and international cooperation. The table includes six columns: Participant Code, Number of Participants, Date, Country, Work Experience, and Area of Expertise. Each row represents either an individual or a group of professionals from various countries and institutions. Participants come from Germany, Austria, Italy, Estonia, the Czech Republic, and the European Union. Their work experience ranges from over 10 years to over 30 years. Areas of expertise include organised crime, financial and economic crime, cybercrime, tax and customs crimes, mafia-related crime, internal investigations, and European police and judicial cooperation. Examples include: A German participant with over 21 years of experience in organised crime. An Austrian participant with over 10 years of experience in both organised and financial crime. A participant from Italy with over 15 years of experience in mafia-related organised crime. A group of six participants from Estonia with 15 to 30 years of experience in international cooperation, tax or customs crimes, and organised crime. E U participants with over 10 and 25 years of experience in European police and judicial cooperation. A joint entry from Estonia and the Czech Republic focused on internal investigations. Dates of participation range from 2020 to 2023. Participant codes are alphanumeric and often include country abbreviations. The table highlights the diversity of professional backgrounds, geographic representation, and thematic focus areas relevant to transnational crime and enforcement collaboration.
The following section provides the results of these two approaches. The results of the questionnaire are intended to show broad patterns of user needs, which are then fleshed out with more detailed accounts from the interviews. Regarding the quantitative sample size, a brief note is warranted. Although a sample size of forty-two is in principle very small, N 42 is reasonable considering that the sample includes qualified and experienced representatives of LEAs and thus organisational perspectives.
4.2.1 Findings
The challenge in tracing IMFs starts with the fact that most types of (organised) crime encompass illicit transactions. According to the responses, the scope of crimes ranges from money laundering and tax fraud to drugs, arms and human trafficking, to insurance fraud, espionage and kidnapping. Table 4.3 provides the respective overview. An understanding of this relation is important for the collection of user needs and the design of investigative tools, because even though there are, irrespective of the specific crime, some general investigative practices and tactics, different types of crime require different investigative techniques and tools. For example, crimes committed on the internet using crypto currencies demand different skills from investigators and their tools than traditional forms of tax fraud. Likewise, crimes that can be deeply interwoven with and covered up by (supposedly) legal business models make it more difficult to trace and prove the illegality of related money transactions. The situation becomes ever more complicated in cross-national cases as, for example, in the case of tax evasion, national states often differ in their respective legal provisions. This may result in a certain offence being subject to criminal penalties in one jurisdiction, while in another it merely constitutes an administrative offence (European Parliamentary Research Service, 2017).
Table 4.3 Long description
The table presents statistical data on crimes commonly associated with Illicit Financial Movements (I M F), based on 41 cases. The table includes three columns: the type of crime, the number of times each crime was mentioned (N equals 41), and the percentage of cases in which the crime appeared. The most frequently mentioned crime is money laundering, cited in 40 out of 41 cases, representing 96 percent of the total. Tax fraud and drug trafficking are each mentioned in 33 cases, accounting for 79 percent. Corruption and bribery follow closely, appearing in 32 cases (76 percent), while bank fraud is noted in 29 cases (69 percent). Other crimes include human trafficking (26 cases, 62 percent), arms trafficking (25 cases, 61 percent), and credit card fraud (23 cases, 56 percent). Less frequently mentioned crimes are insurance fraud (16 cases, 38 percent), espionage and kidnapping (11 cases each, 26 percent), and trade mispricing (9 cases, 22 percent). A final category, labelled Others, includes crimes such as bankruptcy fraud, benefit fraud, computer-related fraud, and smuggling, which were mentioned in 5 cases (11 per cent). This table highlights the prevalence of financial and transnational crimes in I M F-related investigations, with a strong emphasis on laundering, fraud, trafficking, and corruption. It provides insight into the types of criminal activities most commonly linked to illicit financial flows and supports the need for targeted enforcement and policy measures.
Another significant challenge that the use of improved and AI-supported software could mitigate is the increased use of modern information and communication technology and cryptocurrencies to organise and commit crime. This development poses new obstacles for investigators and has direct impact on their needs and the capabilities of potential tools (World Bank, 2016). To counter this technological-digital upgrade of criminals, LEAs in Europe and beyond are increasingly relying on digital and partly AI -based investigative software (Tombul and Cakar, Reference Tombul and Cakar2015) as a tool to fight organised and financial crime (Gottschalk and Solli-Saether, Reference Gottschalk and Solli-Saether2010). This is also reflected in the responses from our sample. 21 per cent of respondents stated that the use of digital forensic software is ‘very important’ in cases involving IMFs, and a further 43 per cent indicated that it is ‘important’. Consequently, many of the respondents also already use software such as rsCase (rsCase, Reference Gottschalk and Kimn.d.), infoZoom (infoZoom, n.d.), Analyst’s Notebook (i2 Analyst’s Notebook, n.d.) and Cellebrite. (Cellebrite, Reference Cellebriten.d.). In this respect, 59 per cent of our respondents stated that they use digital forensic software ‘very often’ or ‘often’ and a further 26 per cent stated to use it, at least, ‘rarely’. Thus, software-assisted investigation is already part of police practice and considered to be an important instrument.
However, as Table 4.4 also shows, a distinction must be made here between the use of general digital forensic software and AI-supported tools. According to the respondents, the latter are used less frequently. Only 21 per cent say that they use AI-based software very often or often, while 36 per cent say that they never use it. In comparison, only one respondent states that they never use simple digital forensic software. One reason for this, as stated by one of the interviewed German officers (Ip1_Po_DE), is the frequent lack of organisational capacity among LEAs to implement such technology. In particular, there is often a lack of appropriate technical infrastructure and investigators with the relevant expertise. According to some respondents, the latter is due to the high level of competition with the private labour market, where IT specialists often find a significantly better remuneration scheme. This lack of technological and personnel capacity is especially evident, in the context of tracking IMFs involving cryptocurrencies. Almost all of the interviewed officers agreed that this is practically impossible at present and is usually not done, because the necessary technology and personnel expertise to do so is lacking.
Table 4.4 Long description
This table compares the frequency of digital forensic or investigation activities with the frequency of A I-based or A I-supported software use, based on a sample size of 42 responses. It is divided into two main columns: Frequency of Digital Forensic or Investigation and Frequency of A I-Based or Supported Software Use. Each column includes sub-columns for the number of responses (N) and the corresponding percentage. For Digital Forensic or Investigation: Very Often is reported by 8 respondents (19 percent). Often is the most common response, with 17 mentions (40 percent). Rare is selected by 11 respondents (26 percent). Never is reported by 1 respondent (2 percent). n.a. (not applicable or no answer) accounts for 5 responses (12 percent). For A I-Based or Supported Software Use: Very Often is reported by 3 respondents (7 percent). Often is selected by 6 respondents (14 percent). Rare is reported by 8 respondents (19 percent). Never is the most frequent response, with 15 mentions (36 percent). n.a. accounts for 10 responses (24 percent). The total number of responses for each category is 42, representing 100 percent of the sample. The table highlights a higher frequency of digital forensic or investigation activities compared to the use of A I-based tools, suggesting that while digital forensics is commonly practised, A I integration remains limited or emerging in this context.
Having established the context in which digital and an AI-based forensic investigation software are helpful and the frequency with which the software are already used, we will now address the specific user needs. Firstly, we identified the specific tasks for which improved software, potentially supported by AI, is perceived to improve workflows. Here, respondents primarily saw a need for software solutions that would improve automatic data and document extraction (68 per cent), data sorting (62 per cent), efficient term search and the extraction of names, phone numbers, bank details, all of which are functions and features that can already be successfully performed by powerful artificial intelligences. About half of the respondents (51 per cent) stated that improved software for exchanging information with other LEAs (across borders) would benefit their work. However, the results of the qualitative interviews also point to the risks of additional information exchange technology, as some participants reported that LEAs are already ‘flooded’ with information they received through the various EU-wide police information networks (Ip1_Po_DE). Hence, some participants argued that more important than new software would be a centralisation of existing communication channels (Ip4_Po_IT, Ip6_Po_CZ). The least important tasks for new software solutions are the linkage of information and knowledge between different parts of the organisation (44 per cent), linking data between different data bases (i.e., connecting silo-knowledge; 30 per cent) and the automatic authentication of documents (11 per cent).
Overall, the result of our study points out that LEAs particularly welcome special programmes for tasks that are becoming increasingly time-consuming and laborious due to the significant increase in data volumes. As demonstrated in Figure 4.1, fewer respondents (51 per cent) regard analytical tasks, such as establishing links between suspect networks as important. One reason for this could be that analytical skills are considered to be the core competence of investigators. Therefore, outsourcing them to a ‘machine’ may be viewed with reservation (Gottschalk, Reference Fiedler2010). However, in the interviews some participants suggested that (partially) automated pattern and relationship analysis (‘connecting the dots: accounts, people, places’ Ip2_Po_AT) software might be interesting for tracking and processing cash flows/financial flows.
Work tasks requiring improved software solution.
Figure 4.1 Long description
The horizontal bar chart illustrates the perceived usefulness of software solutions across various operational areas, based on responses from 37 participants. Each bar represents a specific area and its corresponding percentage, indicating how many respondents identified that area as one where software tools would be beneficial. The most frequently cited area is automated data or document extraction, selected by 68 percent of respondents, highlighting a strong need for tools that can efficiently process and retrieve information from documents. Data sorting follows closely at 62 percent, suggesting that organising large volumes of data remains a key challenge. Efficient term search is identified by 59 percent, indicating the importance of quick keyword or phrase retrieval. Entity extraction, which involves identifying names, phone numbers, bank details, and similar data, is noted by 57 percent of participants. Two areas - information exchange with foreign police authorities and mapping networks and organisational structures - are each cited by 51 percent, reflecting the need for improved collaboration and visualisation tools in cross-border and complex investigations. Intra-organisational information sharing is selected by 44 percent, while connecting siloed knowledge is mentioned by 30 percent, pointing to internal communication and integration challenges. Less frequently mentioned areas include automated document authentication (22 percent) and others, such as miscellaneous or niche needs, at 8 percent. Overall, the chart emphasises the demand for intelligent, automation-driven software solutions to support investigative and analytical tasks in law enforcement and financial crime contexts.
A further area where improved technology is necessary, and which emerged in the interviews, is the encryption and decryption of communication technology. Here, participants reported an imbalance between the police and organised crime groups, with the latter having increased expertise in the protection (i.e., encryption) of their means of communication. For example, one of the German officers (Ip1_Po_De) mentioned that due to the market-driven competition between providers of encryption and decryption software, progress is extremely rapid. While before implementation LEAs have to go through security checks of such new software and more comprehensive set up and test phases, criminal organisations would adapt more quickly. As a result, LEAs would often lag behind technological developments. Another problem associated with communication technology is that, especially for cross-border cooperation, no communication tools are available that are suitable for everyday investigation work. Thus, according to the interviewees, investigators use applications like WhatsApp to informally and quickly share information relevant to operations and investigations.
To further differentiate the analysis, we compared differences in user needs according to different user groups. Therefore, we distinguished between ‘frequent users’ and ‘non-users’ based on the data on the frequency of use of digital forensic investigation software (Table 4.4, column 1). ‘Frequent users’ are participants who use digital forensic programs ‘very often’ or ‘often’, ‘non-users’ use such software ‘rarely’ or ‘never’. The results primarily show overlaps in user needs between these two groups. Figure 4.2 and Figure 4.3 provide an overview. The most important user need for both groups is general usability (i.e., how smoothly and quickly the programme works and how efficiently tasks can be completed with it). The high priority given to usability is also illustrated by the high ranking of characteristics that we measured to substantiate the concept of usability (e.g., that the programmes should be self-explanatory, should have a simple interface design and should be accessible for IT novices). Less important for the respondents is that programmes have a wide range of functions, that they can be used across platforms, and/or are web-based applications.
User needs of ‘non-users’.
Figure 4.2 Long description
This horizontal bar chart displays the perceived importance of various software features among 12 respondents who are categorised as non-users. Each feature is evaluated across three categories: Very important or important, Less important or not important, and n.a. (not applicable or no answer). The most highly rated features are usability and simultaneous user document access or editing, both considered very important or important by 92 percent of respondents, with only 8 percent rating them as less important. Self-explanatory design, user interface design, and extendibility each received 83 percent support as very important or important, with minor percentages rating them lower. Accessibility for I T novices and broad range of functions were rated very important or important by 75 percent, with 8 percent rating them less important and 17 percent marking them as not applicable. Specialisation in one function and cross-platform applicability were each rated very important or important by 67 percent, with 25 percent and 17 percent respectively rating them less important, and 8 to 17 percent marking them as n.a. Web-based applications were considered very important/important by 58 percent, with 33 percent marked as n.a. and 8 percent as less important. Desktop-based applications received the lowest importance rating, with only 50 percent considering them very important or important, 25 percent less important, and 25 percent n.a. Overall, the chart highlights a strong preference for usability, collaboration features, and intuitive design among non-users, suggesting these are key factors in potential software adoption.
User needs of ‘frequent users’.
Figure 4.3 Long description
This horizontal bar chart illustrates how 25 frequent users rated the importance of various features in software solutions. Each feature is evaluated across three categories: Very important or important, Less important or not important, and n.a. (not applicable or no answer). The most valued feature is usability, rated very important or important by 80 percent of respondents, with only 8 percent rating it less important and 12 percent marking it as n.a. Accessibility for I T-novices follows at 72 percent, with 16 percent less important and 12 percent n.a. Self-explanatory design is rated highly by 68 percent, while design of user interface is considered important by 64 percent. Specialisation in one function and desktop-based applications are each rated very important or important by 60 percent of respondents. Extendibility also scores 60 percent, with 20 percent less important and 20 percent n.a. Broad range of functions and simultaneous user document access or editing are each rated important by 56 percent, with notable percentages rating them less important or n.a. Web-based applications are considered very important or important by 48 percent, with 24 percent less important and 28 percent n.a. The least prioritised feature is cross-platform applicability, rated very important or important by 44 percent, with 32 percent less important and a significant 24 percent n.a. Overall, the chart shows that frequent users prioritise usability, accessibility, and intuitive design, while features like web-based access and cross-platform compatibility are seen as less critical.
Looking at the differences between the two groups, it is important to highlight that our analysis is purely descriptive. Therefore, no correlations or reasons can be given with regard to the differences. Nonetheless, we would like to highlight two points. First, that among ‘frequent users’, accessibility for IT novices is ranked higher than among ‘non-users’. One possible reason for this could be that the former, due to their more frequent use, have had more negative experiences with the usability of programmes and, therefore, attach greater importance to low-threshold programmes. Second, the specialisation of programmes ranks higher among ‘frequent users’ than among ‘non-users’. On the one hand, this preference could be related to the fact that programmes with many functions are more difficult to learn to use. On the other hand, this group could also have higher performance expectations for certain programmes. This is typically easier to achieve with specialised programmes.
Overall, the results of our study show that digital forensic software are seen as an important investigative tool and are also used as such. However, AI-supported solutions are rarely used at the national level of policing. One reason for this is the lack of organisational capacities in LEAs, such as insufficient infrastructure or a lack of technological expertise and corresponding training opportunities. More importantly, however, the qualitative data shows that, in terms of technological advancement, there are more pressing needs, such as the improvement decryption and decoding software or the development of internationally useable secure communication software for LEAs. Furthermore, it should not be overlooked that additional technology not only brings advantages, as the information overload mentioned in connection with communication technology shows. In terms of specific user needs, our data shows that investigators prefer software solutions that support targeted and automated data, search, extraction and sorting. Such software solutions should have a high level of usability, that is, be largely self-explanatory in use, have a simple user interface, and be accessible to people with little or no IT experience.
Having established the user needs and requirements, it is important to establish what types of AI tools and information analysis may be useful in financial crime investigations.
4.3 AI Applications and Tools in Policing
4.3.1 Definition and Core Concepts of AI
AI does not have a universally agreed definition. The EU AI Act provides a general and encompassing concept of AI and defines AI system as a software ‘that is developed with one or more of the techniques and approaches listed in Annex I and can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with’ (European Council, 2024). Furthermore, it lists various categories of AI based on the purpose and risks they may pose when deployed.
Despite this relatively new definition of AI, the term AI was first coined by McCarthy in 1955 (Dick, Reference Ezeh, Widgery and Canada2019), and a number of commentators asserted that AI refers to ‘machines or computers that mimic cognitive functions that humans associate with the human mind, such as learning and problem solving’ (Russell and Norvig, 2018). Thus, it is envisaged that the future of this technology will be cognitive, not ‘artificial’ (Joseph and Turksen, Reference Franssen, Berrendorf, Vermeulen, Peršak and Recchia2022).
AI has been categorised into four types of activity or processes, namely: thinking humanly, acting humanly, thinking rationally, and acting rationally (Russell and Norvig, 2018). It would however not be entirely accurate to define the function of the AI as ‘human thinking’ because unlike the human cognition and decision-making, all AI systems rely on three essential components: computing capability (hardware), developing advanced algorithms (software), and access to relevant and reliable data to exploit. Currently, all these components are provided by people; thus, an AI system is also reliant on human input in general and in police investigations in particular. The second category of ‘the thinking rationally’ defines AI as ‘the study of the computations that make it possible to perceive, reason, and act’ (Charniak and McDermott, Reference Charniak and McDermott1991) while the acting rationally category defines AI as ‘the study of the design of intelligent agents’ (Poole, Mackworth and Goebel, Reference Poole, Mackworth and Goebel1998).
While the term AI has existed for over fifty years, the access to and convergence of vast datasets (a common feature in cross-border financial crime investigations), powerful hardware and advanced algorithms have made application of AI in various contexts and in high-functioning robotics a reality only in the last decade. Accordingly, AI is categorised by first, second, and third generations. The first generation of AI tools are commonly installed in many devices which we use daily deal with finite number of tasks thus referred to as ‘artificial narrow intelligence’ (Poole, Mackworth and Goebel, Reference Poole, Mackworth and Goebel1998). Voice and face recognition, self-driving or autonomous vehicles are some of the examples of the first-generation AI systems. AI is also used to support several businesses needs inter alia, process automation, cognitive insight, and cognitive engagement (Joseph and Turksen, Reference Franssen, Berrendorf, Vermeulen, Peršak and Recchia2022; Davenport and Ronanki, Reference Davenport and Ronanki2018).
In recent years, we have seen the second-generation of AI, also referred to as ‘artificial general intelligence’ or AI agents, which are able to reason, plan, and solve problems autonomously for tasks they were never designed for (Gutowska, 2024).
If the AI technology develops at the same pace as it has been doing in the last decade, it is envisaged that there would be the third generation of AI, coined as ‘artificial super intelligence’, which would consist of self-aware and conscious systems that could, to a certain extent, make human thinking and decision-making redundant. If such technology is materialised, it would have very different characteristics from those attributed to the present AI tools, which inevitably would pose several technological, scientific, legal, ethical and societal challenges and opportunities, with different requirements for governance, policy, and law enforcement (UK Ministry of Defence, Reference Gummadi2018). LEAs, therefore, need not only adopt new technologies to counter financial crime but also be aware of emerging criminal activities enabled by AI. Virtually, all financial crimes involve dishonesty and laundering the proceeds of such crimes (NCA, Reference Gertenbach, Botha and Leenen2025). Accordingly, LEAs need to reveal meaningful details (intelligence) among the multitude layers of legal and illicit activities and analyse complex sets of data in order to see the full picture of organised crimes whereby they can identify suspects (people and entities) as well as their proceeds of crime to seize and recover. Below are some of the examples of contexts (use cases) and methods which LEAs can leverage by utilising AI.
4.3.2 Examples of Use Cases
After consultation with several LEAs and in light of Europol’s SOCA Report 2021 (EUROPOL, 2021), the following use cases containing various criminal activities and often involving IMFs were considered in regard to the deployment of AI in the investigation of such crimes:
Financing of terrorism;
Web forensics for tackling terrorism investigations;
Property market transactions using cryptocurrency;
Cyber extortion;
Money laundering with stolen art and antiquities; and
Online gambling for money laundering.
These non-exhaustive lists of use cases were designed to be representative, though simplified, versions of potential real-life scenarios involving complex and organised crime schemes involving IMFs and typically entail electronic evidence. It was deemed that AI-driven tools could be deployed for investigating them.
4.3.2.1 Financing of Terrorism
Terrorist organisations operate more and more often in global, non-transparent company networks. To face and untangle these networks, it is necessary to deepen the understanding of the business model, structure, and characteristics of such global actors, to understand supply chains in these networks, to increase essentially corresponding data and to develop effective technical possibilities to link them.
In our use case, ‘Financing of terrorism’, LEAs look for businesses and financial footprints of terrorist activities. The supply chain networks of global terrorist organisations are typically part of hidden support networks of ‘seemingly’ legitimate businesses. Typically, four main relevant core services are involved: Financing of political campaigns (political support), financing religious infrastructure (religious support in the form of donations and/or misuse of zakat in the case of Islamic terrorism) (Chugani, Reference Chugani2008; Freeman and Ruehsen, Reference Ferguson2013), banking services (external financial support), and media companies (knowledge sources/knowledge support). Additional services, such as healthcare, travel agencies, or charities and donation are often (at least in a large part) legal networks, whereas essentials – like black markets – are anonymous networks (Council of Europe, n.d.). In particular, terrorist organisations face the challenge of buying illegal goods or selling to finance their racketeering. The ‘www’ (World Wide Web) has always been one of the most important ways of doing this. However, new technologies (such as blockchain) allow players on black markets and special online shops previously undreamed-of possibilities of fund raising. So, in this use case, LEAs should concentrate (as a first step) on supply chain networks of terrorism.
In this context, AI can offer a way to facilitate the compilation and analysis of the vast amounts of data that would be collected in such a scenario and create a knowledge graph to help identify connections between the primary suspect(s) and any other potentially relevant persons, who can then be investigated further to determine whether they serve a role in the larger organisation. See for an example Figure 4.4.
Example knowledge graph of Financing of Terrorism use case.
Figure 4.4 Long description
The diagram visualises connections between individuals, social media accounts, and geographic locations relevant to an investigation. It includes five main elements: a followed Facebook page, a followed Instagram account, a contact, a suspect, and a location. The Facebook page is followed by the suspect and is linked to other members, indicating mutual connections or friendships. The Instagram account is followed by the suspect and is followed back by Member 1, suggesting reciprocal interaction. A contact, labelled Member 2, is associated with a phone number registered in Syria. The suspect, named Aussie, is identified as 25 years old and of Austrian nationality. The location is specified as Syria, with an address field that may contain further details. The diagram uses different line styles to represent types of relationships: Solid black lines indicate direct social media or phone relationships. Dotted blue lines represent evidence of links, such as money transfers or social media posts. Solid orange lines denote basic informational connections. The visual structure highlights how digital and personal connections intersect across platforms and borders, suggesting potential investigative leads or associations between the suspect and other individuals or entities.
4.3.2.2 Web Forensics for Tackling Terrorism Investigation
Digital forensics or web forensics is a process used by security analysts and investigators that often involves identifying, extracting, analysing and documenting digital evidence that can be used in investigations and admissible in court proceedings (Cobwebs, 2020). The nature of the work involved in web forensics includes complex and creative solutions and methods that are designed to identify, collate, and present critical information from digital sources, such as computers, smartphones, servers, and networks. Findings from these sources are then analysed for the value chain in investigations and as potentially substantive evidence for the purpose of crime prosecution. These analytics are seen as a useful tool that can help LEAs solve complex cases and trace digital footprints (CEPOL, 2019; Casey, Reference Casey2011). AI-driven tools can enhance Web Intelligence (WEBINT) and Open-Source Intelligence (OSINT) solutions whereby they can provide Application Programming Interface (API) and/or data scraping from such sources to provide visually and analytically advanced investigation aids.
Many of the activities (financing, recruitment, planning of attacks, etc.) of terrorist organisations take place in the cyber space, thus can have global reach through a variety of online means from social media to dark web forums and sites. They can also receive direct donations and payments from their members or supporters. These new threats thus necessitate new investigative methods designed to collect and analyse the digital data to gather evidence against terrorist organisations and their members (Joseph and Turksen, Reference Franssen, Berrendorf, Vermeulen, Peršak and Recchia2022). Based on previous terrorism investigations, a typical set of data and objects (evidence) can include, inter alia:
Passwords (e.g., BitLocker recovery key) to be found on another device.
Communication channels used (analysis according to the following aspects, keyword-based and manually).
Content hostile to the basic order of freedom and democracy.
Content related to violent extremism and/or terrorism.
(Organised) crime related content (Text in Document or Chat, Photos, Videos): weapon trafficking and/or drug dealing.
Content related to blackmail/extortion.
Content related to any suspicious activities that may be identified as money laundering activities.
Content related to involvement in stores, events, concerts, etc.; relevant actors (i.e., keyword-based search for ‘Thor’s Thunder’ and ‘Germanica’).
Content related to membership fees.
Content related to donations.
Content related to rental, leases or trade with real estate and/or other goods.
Persons (ordered by frequency of contact, incl. their nicknames, hosted websites, blogs, etc.).
Organisations/Actors.
Financial transaction related content (non-official Agreements on financial matters, bank confirmations, IBANs, Money, CryptoC etc. in files, documents or chats) (FATF, 2019).
It is evident that such a scenario would involve vast amounts of data from a variety of sources that AI tools can help consolidate and analyse for connections and then create a visual representation of those established connections.
4.3.2.3 Property Market Transactions and Money Laundering
The property market has been a popular choice for criminals to invest in and/or to ‘clean’ their dirty money (Forbes, 2018). A recent EUROPOL (2020) Report confirms that emergence of an economic recession (caused by COVID-19) in the EU may lead to a reduction of prices for certain objects that are particularly favoured by criminal investors, which includes particularly real estate that lends itself to the investment of criminal profits (EUROPOL, 2020). The property and construction sectors have become attractive for money laundering both in terms of investment and as a justification for the movement of funds.
Furthermore, in recent years, we have seen an increased use of crypto currencies in the property market transactions (PwC, 2022). This poses numerous challenges for national economies, crime prevention and investigation as well as money laundering risks driven by serious crimes. For instance, establishing the source and legitimacy of the cryptocurrency funds can be particularly problematic owing to the anonymity and difficulty in tracing cryptocurrency transactions that may use Bitcoins (Bitcoin.org, n.d.), Dash (Dash.org, n.d.), Monero (GetMonero.org, Reference Fiedler and Ötschn.d.) or other privacy coins stored in crypto-wallets. It is to be noted that Blockchain is the technology that enables the existence of cryptocurrency. Bitcoin is the name of the best-known cryptocurrency, the one for which blockchain technology was invented (PwC, 2022). Such transactions may not involve formal financial institutions (e.g., banks), establishing the identity of persons and conducting due diligence on them would be an onerous task. Without an analytical tool available to LEAs, investigation and gathering of evidence (e.g., mapping of connections of individuals and transactions) can be an onerous task.
The key features of money laundering in real estate can include:
Discrepancy between the usual income and wealth of the owner and the property: in some cases, the most expensive properties in the city are owned by individuals with no income or wealth that would allow them to purchase such a property.
An anonymous owner, as a result of recourse either to a third party or to companies, trusts or similar arrangements.
A property’s underestimated or overvalued price.
The indication by a country that there is a risk of money laundering by its citizens in another country (The Law Society, Reference Grosso, O’Brien, Taylor, Woodworth, Lanier, Bohm and Acker2020).
All of the above typologies require LEA to analyse various data sets and connections between them.
4.3.2.4 Cyber Extortion
The global costs of the WannaCry cyber-attack have been estimated at £6.5 billion (Acronis, 2025). The cost of ransomware attacks, besides the ransom being paid in Bitcoins to the adversary, caused losses due to lost productivity (Fouche and Solsvik, Reference Fouche and Solsvik2019), the cost of business continuity, restoration of service (often, not only within the attacked entity, but also in the respective supply chain), loss of public confidence and reputation damage, and post-crisis disruption to the normal course of business. To investigate the ransom payments extorted by ransomware and identify ransomware-as-a-service (RaaS), a number of frameworks have been proposed but they rely on analysis of a wide range of data sources including ransomware knowledge base, ransomware removal guides, reports from Counter Threat Units, Incident Responses (IR), and Security Operations Centers (SOC), online forums where victims and researchers post Bitcoin addresses associated with the concerned ransomware; and secondary research databases to name just a few. With the proliferation of heterogeneous data sources as described above, a single platform-agnostic AI tool is needed to automate complex analytical tasks and visually present combined results. A knowledge graph tool such as the one developed by TRACE could enable such analysis and help close the gap in cyber extortion prosecution capabilities.
Once a cyber extortion is completed criminals move their illegal proceeds/funds in a variety of ways (Figure 4.5).
Ways of movements of illegal proceeds/funds.
Figure 4.5 Long description
This flowchart illustrates the movement and transformation of victims’ payments within a financial crime scheme. The process begins at the top with victims’ payments, which flow into an aggregation of funds stage. From this central point, the funds are distributed through multiple channels. One pathway leads to money mules and hawala systems, both of which ultimately result in conversion to fiat, indicating the transformation of illicit funds into traditional currency. Another pathway directs funds to coin mixers, which are used to obscure the origin of cryptocurrency transactions. From the coin mixers, the funds proceed to a cryptocurrency exchange, where they are either converted to fiat or spent directly on goods, bypassing conversion. A separate direct link from the aggregation of funds leads to an entity labelled RaaS operator, suggesting involvement in a Ransomware-as-a-Service model or similar criminal infrastructure. The diagram uses directional arrows to show the flow of funds and highlights how different mechanisms - both traditional (hawala, money mules) and digital (coin mixers, exchanges) are used to launder and utilise illicit proceeds. It emphasises the complexity and layered nature of financial crime operations, particularly in schemes involving ransomware or fraud.
Based on well-known cases of cyber extortion, a number of techniques are identified that can help LEAs in investigating ransomware and, in particular, to identify criminals involved in ransomware attacks.
These may include:
Analysis of records kept by the cybersecurity team within the victim organisation.
Profiling criminals by the modus operandi.
Forensic language analysis of the phishing email, the ransomware notice, communications with criminals, etc.
Identification and attribution of the malware code and exploitation techniques.
If there’s exfiltration of data, trace the repositories (e.g., a google drive).
OSINT, which includes:
◦ Scanning the Dark Web for information about illegitimate business or users.
◦ Cross-referencing information to build more complete pictures of the criminal activity.
◦ On-chain analysis of moving funds (Gertenbach et al., Reference Gertenbach, Botha and Leenen2024).
While most of these tasks would be conducted by LEAs, the gathered data can be overwhelming for the human eye. Thus, AI can connect the dots (nods of information) and present a workable framework to hone in on perpetrators.
4.3.2.5 Money Laundering with Stolen Art and Antiquities
It is well established that arts and antiquities are used both for terrorist financing and laundering proceeds of crime (European Commission, 2017). It has been argued that the establishment of central databases of all stolen art would strengthen due diligence (Roodt and Benson, Reference Roodt and Benson2015), prevention of crime and law enforcement in the art trade, allowing all interested stakeholders to search and verify artworks, which would then lead to a ‘fortification’ of cultural and artistic heritage against those with nefarious intentions. This is indeed a sensible suggestion, and in fact one that has been in operation for many years in various jurisdictions around the world; most notably the Scotland Yard database that has been in existence since 20081 as well as at least eighteen international databases that exist for stolen art (Yates, Reference Yates2016).
In addition, there are a multitude of international databases that exist, cataloguing the collections of art held around the world, ostensibly within public collections, a prime example of which is the www.ArtUK.org website. In the absence of a national inventory of museum holdings and databases of stolen art and antiquities, law enforcement in respect of stolen art works becomes ever more complicated. Even if such databases of stolen art existed, what is even more challenging is that there is no technological tool to conduct a combined analysis of such art databases against, inter alia, individuals, their residence/s, business connections, money, and asset movements. An AI knowledge graph and/or a similar analytical tool can be used to fill this gap.
4.3.2.6 Online Gambling for Money Laundering
Money laundering through online gambling (Fiedler, 2014) is similar to the standard process of online gambling itself (De Sanctis, 2019). If anything, it is harder to detect because criminals can launder their whole stash through online gambling as a few bets to give a convincing veneer of legitimacy. They would lose only a few percentage points – a better rate than they would have to pay to traditional money launderers. The online gambling market is worth about US $53.7 billion a year (Grand View Research, 2019) and is expected to grow (European Commission, 2012). The following factors make it prone to financial crime including but not limited to fraud and money laundering: (1) virtuality of products; (2) virtuality of cash flows (EUROPOL, 2023); (3) internationality of cash flows; (4) complexity of payment processes; (5) non-harmonised legal frameworks (or legal uncertainty); (6) high pay-out percentages; and (7) tax-free winnings in many jurisdictions, such as Germany (European Council, 2022). The sources of online gambling and the formal headquarters are accumulated in a few tax-friendly legal orders, such as Malta (Fisher et al., 2025), and are formally headed by few specialists. Without an analytical tool available to LEAs, investigation, gathering of evidence (e.g., mapping of connections of individuals and transactions) of gambling proceeds as well as their assets can be an onerous task. AI-driven data analytics and knowledge graphs, which visualise national and EU-cross-border transactions, can address this challenge.
These use cases make it clear that AI tools can be deployed in several contexts in investigation of financial crime and asset recovery. These variety of contexts that are represented in financial crime investigations are further explained in the rest of this chapter.
4.3.3 The Application of OSINT and AI in Criminal Intelligence and Counterterrorism
Open-Source Intelligence (OSINT) offers investigators a rich trove of publicly accessible data for various financial crime investigations. This includes financial documentation such as annual financial reports (e.g., accounting and audits), social media data revealing personal and professional networks, behavioural patterns, and digital footprints; public registries containing business ownership information, property records, and tax filings; and web-based materials such as online forums, blogs, and news articles pertaining to suspected criminal activity. The aggregation and analysis of these diverse data sources enable investigators to identify anomalies and previously unseen connections indicative of fraudulent activities or misconduct, providing crucial actionable intelligence to support effective investigations (Browne et al., 2024).
The capacity to leverage OSINT significantly enhances investigative capabilities, contributing to more efficient and comprehensive investigations of complex financial crime schemes. The incorporation of AI into OSINT workflows significantly improves the efficacy of financial crime investigations. Key AI technologies facilitating this enhancement include:
Natural Language Processing (NLP), enabling the extraction of meaningful insights from unstructured text data within OSINT sources, identifying key phrases indicative of fraudulent activity, and analysing sentiment to gauge intent and deception;
Machine Learning (ML), facilitating the detection of outliers and anomalies within vast datasets of financial transactions, and employing clustering algorithms to identify potentially collusive relationships between entities (e.g., manipulation of public procurement);
Network Analysis, visualising and analysing complex relationships between individuals and organisations to uncover hidden connections and trace illicit financial flows;
Computer Vision, including Optical Character Recognition (OCR), enabling the analysis of visual data such as scanned documents and images to extract textual information, identify forgeries, inconsistencies, or other anomalies indicative of fraudulent behaviour; and
Image analysis techniques that can glean meaningful data from picture formats, identifying logos, individuals, locations, or objects relevant to the investigation (Browne et al., 2024).
The synergistic application of these AI techniques to OSINT data allows for the rapid identification of patterns and correlations that would be impossible to detect through manual analysis alone, substantially accelerating investigations and improving the probability of successful prosecution.
Furthermore, OSINT can facilitate a number of other tasks:
Suspect and Associate Identification: The analysis of social media, public records (e.g., property and business registrations), and online forums reveals connections between individuals and organisations, enabling the mapping of potentially criminal networks.
Financial Transaction and Asset Discovery: Examination of publicly available financial disclosures (e.g., annual reports, filings to competent authorities) facilitates the identification of suspicious transactions, hidden assets, and offshore accounts, enabling the tracing of illicit funds and supporting asset forfeiture proceedings.
Timeline Reconstruction and Behavioural Pattern Analysis: OSINT data (e.g., social media posts, news articles) allows for the reconstruction of event timelines, revealing patterns of suspicious activity that may elude traditional investigative methods.
Alibi and Statement Verification: OSINT data can corroborate or refute witness and suspect statements; for example, geolocation data from social media can be used to verify alibis.
Investigative Lead Generation: OSINT frequently yields unforeseen insights that significantly advance investigations. This may include the discovery of undisclosed business relationships, conflicts of interest, or previously unknown evidence sources (Browne et al., 2024).
In addition to OSINT, data analytics can encompass NLP (Sarzaeim et al., Reference Sarzaeim, Ahmadi, Alipour and Borumand2023) and Large Language Models (LLMs) (IBM, Reference Forbes2023). NLP can be deployed to enable AI to interpret and generate human language in a meaningful and useful way in various contexts such administrative tasks, record keeping, converting speech to written text, etc. Europol (2024) opines that large volume of text-based data such as interview transcripts, witness statements, online communications and social media posts, etc., can be analysed swiftly and efficiently using NLP. As asserted earlier, a quick analysis of such information is particularly useful in crime-in-progress scenarios and during or in the aftermath of terrorist attacks (Europol, 2024). In particular, NLP can empower the investigators to classify, cluster, summarise, and translate text (Dixon and Birks, Reference Dixon and Birks2021). In the TRACE project, NLP was utilised for entity recognition whereby legal and natural persons and their assets can be identified and analysed in complex financial crime cases.
4.3.4 Cyber and Digital Forensics
Cyber and digital forensics have existed well before AI became a publicly available tool. However, AI has catapulted the speed and efficiency of data detection, recovery, repair, and analysis. Common applications of AI in this realm include video monitoring, image classification, facial recognition, voice recognition, iris scan, gait analysis, fingerprints, and pattern recognition. For example, an artefact search in a vast dataset of stolen or missing items by AI can take seconds rather hours if a human investigator were to conduct such search. In cases of deepfakes (AI-generated voices and images/videos) whereby criminal impersonate persons to phish personal information and commit fraud and/or spread false information, AI can be deployed to identify the integrity of such actions (Press, Reference Press2024). Furthermore, encrypted information, communication and access credentials of criminals can be obtained by advanced predictive capabilities that AI offers (Vurubindi and Narahari, 2024; Hayadi and Haryanto, 2022; Tan et al., Reference Tan, Ramachandran and Jabar2022). While actual and potential deployments of AI in various contexts continue to expand and evolve (Vurubindi and Narahari, 2024; Hayadi and Haryanto, 2022; Tan et al., Reference Tan, Ramachandran and Jabar2022) what has become clear is that for any AI to operate effectively and produce reliable results, it needs to have reliable and relevant data. Equally important is the fact that AI needs to be used according to fundamental legal and ethical safeguards. Without this integrity of policing, the use of AI in policing is dented. In Chapters 2, 5, and 8 of this book, ethical and legal standards that shall inform the use of AI are articulated in detail. Nevertheless, it is worth briefly mentioning these here.
4.4 Safeguards in Policing with AI
Data Privacy and Civil Liberties: One of the primary concerns surrounding AI in law enforcement is the potential for violations of privacy and civil liberties. AI systems rely heavily on data collection, raising questions about how this data is gathered, stored, and used. Without strict safeguards, there is a risk that surveillance technologies could infringe upon individuals’ rights, leading to unwarranted scrutiny or profiling.
Algorithmic Bias and Fairness: AI algorithms are only as unbiased as the data used to train them. If historical data contains biases – whether related to race, gender, or socio-economic status – AI systems can perpetuate and even amplify these biases. This could lead to disproportionate targeting of certain communities, undermining public trust in law enforcement.
Complexity and Lack of Transparency: The complexity of AI systems can make it difficult for users to understand how decisions are reached. This ‘black box’ problem raises concerns about accountability, as officers may rely on AI-driven recommendations without fully understanding the underlying logic. Ensuring transparency in AI algorithms is crucial for maintaining trust and accountability.
Over-Reliance on Technology: While AI can enhance decision-making, over-reliance on technology could diminish critical thinking and investigative skills among officers. It is essential to strike a balance between human judgement and technological assistance, ensuring that AI serves as a tool rather than a replacement for law enforcement expertise.
Cybersecurity Threats: AI systems themselves can become targets for cyberattacks. Hackers could manipulate AI algorithms, corrupt datasets, or disable critical systems, compromising investigations and endangering public safety. Robust cybersecurity measures are essential to protect AI-powered platforms from malicious interference.
Legal and Ethical Uncertainty: The rapid advancement of AI technologies often outpaces the development of legal frameworks and ethical guidelines. Law enforcement agencies must navigate a complex landscape of regulations while ensuring that AI-driven practices align with fundamental rights and the rule of law.
By striking the right balance between innovation and responsibility, law enforcement agencies can harness the full potential of AI while maintaining public trust and accountability. As the TRACE project demonstrated (Sachoulidou et al., 2024) collaborative efforts, continuous evaluation, and adherence to ethical principles are key to ensuring that AI becomes a powerful ally in the pursuit of justice and safety.
4.5 Future Prospects and Emerging Trends
The current possibilities of the use of AI in policing are discussed above. As AI is a fast-evolving technology, it is also important to consider its potential future applications. Our horizon scanning has provided the following roadmap (Figure 4.6), summarising the state of the art and future scenarios including 2026 (near future), 2030–2035 (mid-term), and 2040 and beyond (long term). This roadmap synthesises the insights gathered from various sources, including publication data, internet data, and community detection analyses, to present a holistic view of the future of AI in countering financial crime in general and money laundering in particular. It anticipates the integration of emerging technologies, the refinement of algorithms, and the strengthening of global cooperation, setting the stage for a more effective and intelligent approach to policing and countering financial crime.
The roadmap contains six different knowledge objects:
Weak Signals: These are subtle, early indicators of potential changes or emerging trends that are not yet widely recognised or understood. Weak signals are often overlooked but can be harbingers of significant shifts in social behaviour, economic patterns, or technological advancements. These weak signals could indicate changes in trends, disruptive events, threats or innovation (European Union, 2024).
Trends: Trends are patterns or shifts in behaviour, attitudes, or conditions that develop over time and point to a general direction in which a particular aspect of society, technology, or the market is moving.
Disruptive Events: Disruptive events are occurrences that significantly alter the status quo or even a system change. These can be sudden and unexpected, causing a major impact on societies, economies, or ecosystems, and they often require substantial adaptation or response.
Threats: Threats are factors or circumstances that have the potential to cause harm or adverse effects. In the context of financial crime, these are perceived challenges or dangers that could undermine performance, stability, integrity of the economy and/or particular sectors that are important in a given economy.
Innovation: Innovation refers to the creation or adoption of new ideas, methods, products, or services in the context of countering financial crime. It involves thinking creatively and differently to develop solutions that are novel and effective, often improving efficiency, solving problems, or meeting the needs of individuals or organisation.
Roadmap of future AI developments to counter financial crime.
Figure 4.6 Long description
This infographic presents a timeline from 2024 to 2040, forecasting the evolution of artificial intelligence (A I) technologies and their role in anti-money laundering (A M L). Each year highlights specific developments: 2024: Emergence of AI for emotional face recognition and supervised machine learning for A M L patterns amid geopolitical and economic instability. 2025: Rise of intelligent AI-driven cyber warfare forces. 2030: Geopolitical tensions over innovation, adoption of permissioned distributed ledgers, and neuromorphic computing. 2035: Deployment of intelligent sensors and tracking systems for continuous monitoring. 2040: Artificial Super Intelligence (A S I) influencing political decision-making. The infographic outlines key technological trends, including: Quantum computing; Human brain interfaces in investigations; Transfer of human capabilities to machines; A I pattern recognition; Augmented reality interfaces; Edge computing; Mesh and ad hoc networks; Multimodal narrow AI (K I). It also references emerging infrastructures and platforms: Global blockchain industry; Smart metering systems; Explainable A I; In-game communications; Metaverse and new darknets; Spatial computing. Social and security concerns are noted, such as increasing societal divides due to social media, fake detection challenges, and cyber warfare threats.
Below is the explanation of the roadmap in different time periods.
4.5.1 The State of the Art: 2025
4.5.1.1 Weak Signals
AI for Emotional Face Recognition: This technology signifies a subtle yet growing interest in enhancing AI’s understanding of human emotions through facial cues. As a weak signal, its potential use in AML could be groundbreaking. It might enable systems to detect suspicious behaviours or stress during transactions, which are often subtle indicators of fraudulent activities. However, its emergence could raise ethical questions about privacy and consent and will most likely not be accepted within the EU if the AI tools are not in compliance with the AI Act (European Union, 2024).
Global Black Hacker Industry: The rise of a sophisticated hacker industry, working on a global scale for profit and power reflection, represents a weak signal with significant implications for financial crime. This burgeoning shadow industry can pioneer methods to circumvent traditional security measures, necessitating advanced AI tools for early detection and prevention of such threats in financial transactions. State-sponsored hacker groups have been involved in every recent conflict (CSIS, 2024; UK National Cyber Security Centre, 2024) and are becoming more professional and more powerful.
4.5.1.2 Trends
Augmented Reality Interface: AR interfaces are increasingly attracting public attention, transforming user interaction with digital systems. In AML, such interfaces could enable investigators to visualise complex transaction networks or to identify risks within immersive data representations, enhancing analysis and decision-making capabilities. However, AR environments, like proprietary metaverse implementations, are searchable only for the owner. Thus, searching for pattern of ML becomes more difficult.
Specific AI (Narrow AI): The trend towards developing AI with specialised capabilities – or Narrow AI – is significant for AML. Tailored AI systems can be more effectively trained on specific types of financial crime, resulting in higher precision in anomaly detection and regulatory compliance. Artificial general intelligence (AGI) systems are only on the horizon.
Improving Law Against Money Laundering: There is a discernible trend towards strengthening legal frameworks against money laundering. AI can play a role in this by providing regulatory bodies with tools for monitoring compliance and flagging deviations more efficiently (Joseph and Turksen, Reference Franssen, Berrendorf, Vermeulen, Peršak and Recchia2022).
Increasing Divide in Society Caused by Social Media: The trend of social media exacerbating societal divides can indirectly impact AML efforts. It can influence the political and regulatory environment surrounding technology adoption and privacy laws, which in turn affect how AI is implemented in AML processes. The weak and poor in the society are becoming less protected, as they might get involved in illegal groups, without the attention of LEAs and mass media.
4.5.1.3 Disruptive Events
Geopolitical Conflicts and Corruption: These events can drastically change the AML landscape by shifting the focus and resources to emerging hotspots of financial crime. The actual formation of BRICS (BRICS, 2025) as opponent to NATO might lead to different groups of nations, involved in a sanctions regime and thus avoiding exchanging AML information. AI systems may need to adapt rapidly to new patterns of money laundering that arise as a result of such disruptions.
AI-Generated Fake Information for Fraud and Money Laundering: The potential of AI to create convincing fake information could be a disruptive event, challenging existing AML mechanisms. This necessitates the development of sophisticated AI that can distinguish between genuine and AI-generated fraudulent information.
4.5.1.4 Threats
Big Data for Hackers: The availability of large, leaked data sets could empower hackers and posing a threat by enabling them to devise new methods for committing financial crimes. In response, AML systems powered by AI will have to evolve to outsmart such threats, perhaps by using the same data for predictive analytics and defence mechanisms.
4.5.1.5 Innovation
Fake Detection: Innovations in detecting fakes, such as deep fakes or doctored documents, are crucial for AML. By leveraging AI’s pattern recognition capabilities, these systems can identify discrepancies or anomalies that human analysts might miss.
Specific AI Chips: The development of AI chips designed specifically for AI AML tasks could greatly enhance processing capabilities. These chips could accelerate data analysis, pattern detection, and real-time monitoring, thus significantly strengthening the technological infrastructure against money laundering activities.
Each of these elements highlights the dynamic interplay between the evolving capabilities of AI and the persistent adaptations of money laundering tactics in the years around 2025 and are considered state of the art. The future of countering financial crime and AML starting from 2026 will likely be characterised by a technological arms race, with both sides (criminals and public authorities) wielding AI as either a tool for perpetration or prevention. The challenge will be in developing AI that not only keeps pace with these changes but also anticipates and mitigates potential risks before they materialise (Hutter and Hutter, Reference Finocchario2021).
4.5.2 2026 (Near Future)
In 2026, the application of AI in AML will continue to evolve, responding to new weak signals, disruptive events, threats, and innovations. Here is an exploration of these elements.
4.5.2.1 Weak Signals
Supervised ML for AML Pattern Identification: Although such an AI is in use right now, quality improvements could be expected. The use of supervised ML to detect known money laundering patterns, for example, will continue to refine the accuracy of predictive models. These models will be trained on historical data to identify transactions that closely resemble known money laundering cases, increasing detection rates.
Unsupervised ML for AML pattern identification: Similar to supervised ML, quality improvements and advancements in this sphere could be expected. Unsupervised ML approaches will play a significant role in discovering new, previously unidentified patterns in money laundering. By analysing data without pre-labelled outcomes, these models can unearth subtle correlations and anomalies that humans and supervised models may miss.
AI-driven data analysis in cloud data and blockchain data: As more financial transactions move to the cloud and blockchain, AI-driven analytics will become paramount in monitoring these platforms for signs of money laundering and other malfeasant activities. The decentralised nature of blockchain and the vast amount of cloud-stored data present unique challenges that AI is well-equipped to manage.
Smart Contracts (SC): Smart contracts will diffuse in all corners of business, in particular everyday business to business activities. SC on blockchain platforms will be scrutinised through AI to ensure they are not coded to facilitate money laundering. For instance, AI could potentially be used to analyse the terms of these contracts to identify those designed to obfuscate the origin of funds.
Heterogeneous Graph Transformer Networks (HGTN): These advanced neural network architectures will be capable of analysing data from various sources and types, providing a more holistic view of existing financial networks and forecast future networks. Their ability to handle heterogeneous data will make them particularly effective in AML applications.
Spatial Computing: This technology, which enables the interaction of computers with the three-dimensional space, as presented by Apple (Apple, 2025) and other technology firms, could be used to visualise and analyse the geography of financial transactions, potentially revealing high-risk zones for money laundering activities. There is a potential overlap with AR/VR and metaverse technologies, named by different bands differently. The future needs to decide, whether special computing is different from metaverse, as Apple did claim (Euronews, 2024).
4.5.2.2 Trends
There are no new trends, compared to 2025, which indicate that the developments established in the previous year could continue to mature and become mainstream practices in AML efforts (Financial Conduct Authority, 2025).
4.5.2.3 Disruptive Events
APTs with Intelligent Cyber Agents: Advanced Persistent Threats (APTs) employing intelligent cyber agents could significantly disrupt financial cybersecurity. These agents could autonomously adapt and evolve to bypass security measures, requiring AI-driven defence systems to be equally adaptive. It is very likely, that these systems are in development (Mutalib et al., Reference Gentzel2024; Shami and Rohatgi, Reference Shami, Rohatgi and Shrivastava2024). The next step would be to see such a system in operation. Machine learning could be a component in these systems, which tactically prepare for cyber operations.
Hybrid Warfare Conflicts: The use of cyber warfare tactics alongside conventional warfare could impact global financial stability. AI will be crucial in detecting and responding to financial attacks that form part of these hybrid warfare strategies. Machine learning and AML might get part of non-conventual conflicts and countries need to prepare for this.
4.5.2.4 Threats
In-game Communication: As video games have become more social, they have been exploited for covert communication between criminals and terrorist. It is very likely that money launderers are offering their services and organising their customer relations in these closed systems. Monitoring these platforms for suspicious activities without infringing on privacy will be a delicate and yet unsolved challenge for AI-driven AML solutions.
4.5.2.5 Innovation
AI-generated Shell Company in Ethereum (DAO/DeFi): The creation of decentralised autonomous organisations (DAOs) and decentralised finance applications (DeFi) on the Ethereum blockchain as shell companies for money laundering is a potential avenue for OC groups. To address this innovation, AI would need to differentiate between legitimate and AI-generated DAOs used for illicit purposes.
Smart Gaming Infrastructure: Gaming platforms might implement smart technologies to prevent their misuse for money laundering. AI innovations could monitor transaction patterns within games for suspicious financial activities, integrating AML mechanisms within the gaming industry’s infrastructure.
By 2026, AI’s role in AML will have expanded significantly, not only in detecting and preventing traditional forms of money laundering but also in adapting to the newer modalities that technology and innovation bring forth. AI’s versatility and learning capabilities will be central to maintaining the integrity of increasingly digital financial systems (Basu and Tetteh, 2024; Leitner et al., Reference Leitner, Singh, van der Kraaij and Zsámboki2024).
4.5.3 2030 (Mid-term 1)
Looking towards 2030, the landscape of AML is expected to be significantly shaped by advancements in AI technologies and changing global dynamics. Here is an exploration based on the collected information.
4.5.3.1 Weak Signals
Convolutional Neural Networks and Autoencoders for Graph Deep Learning: The application of these sophisticated AI models will likely advance the detection of complex money laundering schemes embedded in financial networks. Their ability to process and learn from graph-structured data will enhance the mapping and understanding of transaction flows.
AI for Profiling in Large Data Sets: Profiling within large datasets will become more nuanced with AI, allowing for the identification of risky profiles and behaviours with greater accuracy. This will enhance due diligence and ongoing monitoring efforts.
Explainable AI (XAI): As AI systems become more integral to AML, the need for transparency in AI decision-making processes will grow. XAI will be critical for gaining the trust of regulators and users by providing understandable explanations for AI’s conclusions and actions. Future AML AI systems will highly likely be based on XAI concepts.
4.5.3.2 Trends
Quantum Computer in Operation: The deployment of quantum computing will revolutionise AML efforts by exponentially increasing the speed and capacity to analyse complex datasets and recognise patterns that are beyond the scope of classical computing. However, this will only work on very specific and hard to solve solutions such as decrypting asymmetric encryption.
AI ML Pattern Recognition: Pattern recognition capabilities of AI will not disappear because of AGI models. Instead, they are highly likely to evolve, becoming adept at sifting through noise to detect the subtlest signs of illicit activities, because of XAI.
AGI: If achieved, AGI will represent a monumental shift in AI capabilities, potentially outperforming human intelligence in AML tasks, and being capable of solving complex problems with little to no human intervention. However, it is highly likely, that the AGI models will use XAI and AI ML to improve the efficiency, transparency, and reliability.
Mesh Ad Hoc Networks: As decentralised, self-configuring networks become more prevalent in hacker communities, AML systems will need to adapt to monitor transactions in these less centralised environments. However, this is an unclear trend, as it might highly likely be, that comfort is prioritised against security. In combination with many devices, mesh networks seem to have an advantage, but it remains open, whether cryptocurrency exchange could go via network devices, by direct concept. This would make a cryptocurrency very equal to cash.
4.5.3.3 Disruptive Events
Geopolitical Shifts in Cyber Innovation from Industrialised Countries to New Economies: The shift of technological innovation to emerging economies may alter the AML landscape by introducing new technologies and methodologies at a rapid pace. It is very difficult to forecast geopolitical trends until 2030, but as it looks today, it is likely that we will be in a multi polar world, with different aggressions appearing and disappearing until we have a clear balance of power.
4.5.3.4 Threats
Cyber Warfare Realised: It is likely that by 2030 the first cyber warfare operations will become visible. By 2025 there have been a lot of hacking and other cyberattacks (World Economic Forum, 2023). However, these are single activities and not embedded in a military concept. Arguably, Stuxnet was the first military cyber operation, (Knapp and Langill, Reference Fritz-Morgenthal, Hein and Papenbrock2015) yet this was to avoid a war, not to win a war. It is likely that the use of unconventional nonmilitary organisations (e.g., state-sponsored and contracted independent hacker groups/cyber mercenaries) will become more important in military operations. AML strategies will need to become more sophisticated to combat state-sponsored and highly organised cybercrime syndicates.
Metaverse and the New Dark Nets: The emergence of extensive virtual environments like the metaverse may create new avenues for financial crime and money laundering, similar to the darknet, but with potentially greater complexity and scale. In 2030 the landscape of metaverse providers is likely to be more diverse, than of 2025. These different proprietary platforms offer good opportunities for AML, without being detected.
4.5.3.5 Innovation
Multimodal AI: AI capable of processing and interpreting multiple types of data simultaneously (e.g., text, images, and sensor data) could provide a holistic view of financial activities for better monitoring and detection of illicit actions.
Quantum CPU Operational: Once available with the relevant number of qubits, quantum processors will bring about breakthrough capabilities in data processing for AML, possibly enabling the cracking of previously unbreakable encryption methods used in financial crimes.
Genetic Robots: While not directly related to AML, the development of robots that can interact with genetic material may influence cybersecurity if such technology is applied to biometric security measures. If used on cash, it might be possible to use xenobots as marker for cash in 2030.
By 2030, AML efforts will have to contend with an increasingly complex and interconnected technological environment. Advancements in AI will offer unparalleled tools for financial security, while also introducing new challenges that will need to be addressed to keep illicit activities in check. Quantum computing, AGI, and multimodal AI will be at the forefront of detecting and preventing sophisticated money laundering operations, necessitating a proactive and innovative approach to AML policy and practice.
4.5.4 2035 (Mid-term 2)
By 2035, the landscape of AML efforts will continue to be profoundly influenced by advanced technological developments and shifts in the geopolitical and cyber landscape. Not surprisingly, technology will be faster, more precise, and more intelligent. Here is an exploration based on the collected information:
4.5.4.1 Weak Signals
Biological Neurons as CPU: This groundbreaking development indicates a fusion of biological components with computing technology, leading to a new era of processing capabilities, by using brain cells to form a neuronal network. First results have been surprisingly successful (Khullar, Reference Frey, Patton, Gaskell and Mcgregor2025; Reuters, 2024). For AML in 2035, this could mean unparalleled data processing and pattern recognition abilities, allowing for real-time analysis of complex financial networks with a level of nuance and adaptability that mimics the human brain.
4.5.4.2 Trends
Competition of different Geopolitical Large-Scale C2 (Command and Control) Systems: The very different approaches and sometimes the rivalry among countries to develop superior command and control systems for surveillance, data analysis, and cyber operations will significantly impact global efforts to counter financial crime and money laundering. The effectiveness of AML measures will be closely tied to the capabilities of these systems, influencing how quickly and efficiently illicit financial activities can be detected and countered.
Transfer of Human Capabilities to Machines: The trend of endowing machines with skills and decision-making processes that were traditionally human will redefine AML strategies. AI systems in AML will not only analyse data but also make complex decisions about the risk associated with various transactions and entities, incorporating ethical and legal considerations in the future.
4.5.4.3 Disruptive Events
Intelligent Sensors and Tracking, Finding Anything, Anywhere, Anytime: The ubiquity of intelligent sensors from any smart device, capable of tracking financial transactions and assets across the globe will make it exceedingly difficult for money laundering activities to go undetected. However, this also raises significant privacy and surveillance concerns that will need to be addressed.
All Domain Liquid Mosaic Warfare Conflicts: This new form of warfare, characterised by highly fluid and adaptive strategies across multiple domains (not just land, sea, air, cyber, and space, but also cognitive domain, information, and psychology), in addition to hybrid tactics, will pose unique challenges to AML efforts. Financial systems might become targets or tools within these conflicts, necessitating AI-driven systems that are as adaptive and multifaceted as the warfare strategies themselves.
4.5.4.4 Threats
Asymmetric Encryption is Broken: If the foundational security mechanism of asymmetric encryption is compromised, for example, by an operational quantum computer, or by a biological computer, the integrity of all digital financial transactions could be at risk. AML strategies will need to evolve to counter the heightened risk of financial data breaches and fraudulent transactions.
Swarm of Intelligent Agents for Money Laundering Working Effectively in Different Metaverses: The use of coordinated, intelligent agents operating across various digital realms in the metaverse to launder money will challenge traditional AML frameworks. These agents, capable of executing complex laundering schemes across multiple platforms, will require equally sophisticated AI-driven countermeasures.
4.5.4.5 Innovation
Metaverse Forensic Framework: In response to the new challenges posed by digital universes, an innovative forensic framework will be developed for the metaverse. This will enable the tracking, analysis, and investigation of financial crimes within these expansive digital spaces, leveraging AI to navigate and make sense of the complex, immersive environments.
By 2035, AML efforts will need to be highly adaptive, leveraging cutting-edge AI to keep pace with rapidly evolving financial crime strategies. The intersection of AI, biocomputing, and new digital frontiers will redefine the battleground for financial security, requiring a balance between innovation, privacy, and regulatory oversight.
4.5.5 2040 (Long-Term Future)
The long-term foresight is particularly challenging. For epistemic reasons it is not possible to produce a precise technology forecast and by definition, it is not possible to capture unexpected disruptive innovation. Nevertheless, it is possible to extend existing technology trends and to develop scenarios, based on the interdependence of existing basic research results and possible future technology innovation, which is based on existing knowledge and future needs, which can be derived from reliable trends like demographic trends, environmental trends, trends in future use of resources trends in societal challenges and possible innovations, based on these scenarios. Given these trends, by 2040, the landscape of AML will be profoundly influenced by advanced AI technologies and significant shifts in the global technological infrastructure. Following is an overview of these developments, as far as possible.
4.5.5.1 Weak Signals
Genetic Robots (Xenobots) in Operation: The emergence of xenobots, robots designed with biological materials, signifies a blurring of the lines between biological and artificial systems. From today’s perspective, these xenobots might be used to imitate biological marker. However, if these bots could be used to parallelise calculations of AML algorithms or other threat detection systems. In the far future these xenobots could be deployed for tasks that require a physical presence, such as inspecting physical assets or locations involved in financial transactions. However, this is highly speculative.
Quantum Computer in Operation: The operational use of quantum computers will offer unprecedented computational power in selected algorithm (Bravyi et al., 2022). This could enable the processing of complex AML algorithms and large datasets at speeds unattainable by classical computers and enhance pattern recognition and anomaly detection in financial transactions.
AI in 6G Networks Supporting Investigations: The integration of AI into 6G networks will facilitate faster, more reliable communication and data analysis capabilities (Chataut, Nankya and Akl, 2024). This could be used to support real-time AML investigations and enhancing cross-border collaboration.
4.5.5.2 Trends
Artificial Super Intelligence (ASI) to Avoid Corruption in Political Decisions: The involvement of ASI in political decision-making could lead to more transparent and corruption-resistant governance structures, supporting AML and counter financial crime efforts by reducing the opportunities for dishonesty crimes. However, it is not clear whether a society would accept this.
Digital Currencies Used in Daily Life: The widespread adoption of digital currencies will necessitate advanced AML measures to monitor and secure digital financial ecosystems against money laundering activities.
Human-Brain Interface in Investigative Operations: The use of human-brain interfaces in investigations could revolutionise data analysis and decision-making processes, enabling investigators to interact directly with AI systems for deeper insights and intuitive understanding of complex patterns.
Transfer of Human Capabilities to Machines: The ongoing trend of endowing machines with human-like capabilities will enhance AI’s effectiveness in identifying and adapting to new money laundering tactics, offering a more nuanced and adaptable approach to AML.
4.5.5.3 Potential Disruptive Events
ASI in Political Decisions Can Avoid Corruption: The integration of ASI in governance could disrupt traditional power structures and decision-making processes, potentially eliminating many of the systemic vulnerabilities that money launderers exploit.
Digital Currencies Used in Daily Life: The normalisation of digital currencies will disrupt traditional financial systems, requiring a complete re-evaluation and redesign of AML strategies to address the unique challenges posed by digital/crypto and decentralised financial systems.
4.5.5.4 Threats
AGI for Organised Crime: The use of AGI or even ASI by organised crime groups could escalate the sophistication of money laundering schemes, presenting complex challenges for AML systems to identify and counteract such advanced threats.
4.5.5.5 Innovation
New Rules for AGI in Daily Life: The establishment of new regulatory frameworks for AGI’s role in society will be crucial in ensuring these systems are used ethically and responsibly, particularly in sensitive areas like AML.
Intelligent Investigation Agents: The development of AI-powered agents specialised in investigations will transform AML processes, enabling proactive and highly nuanced analysis of financial activities.
Neuromorphic Computing: This innovation, which involves designing computer chips that mimic the human brain’s structure, will provide AI systems with enhanced learning and processing capabilities, ideal for the complex demands of AML.
God-like AI: The concept of AI with God-like capabilities (Werner, Reference Werner2024; Uyar, Reference Gutowska2024), in terms of intelligence and decision-making, raises both opportunities and challenges for AML, as it could either be a powerful tool in combating financial crimes or a formidable adversary if misused.
Quantum Supremacy: Achieving quantum supremacy, where quantum computers can perform tasks beyond the reach of classical computers, will revolutionise AML by enabling the analysis of encrypted data and complex networks at an unprecedented scale and speed.
By 2040, the integration of these advanced technologies into AML efforts will necessitate a paradigm shift in how financial security is maintained, requiring innovative approaches to harness these capabilities responsibly and effectively while safeguarding against their potential misuse.
This roadmap is indicative of a projected evolution of AI capabilities in relation to societal changes and challenges, particularly focusing on countering financial crime and money laundering. It suggests a progressive integration of AI with various systems and societal structures, hinting at significant technological advancements and possible geopolitical events that could impact the development of AI in this compiled context.
4.6 Recommendations and Conclusion
The confluence of rapidly evolving AI technologies and shifting geopolitical landscapes presents both unprecedented opportunities and challenges. As we stand on the cusp of significant technological breakthroughs, from quantum computing to AGI, the need for a robust, dynamic, and forward-thinking approach to countering financial crime and money laundering cannot be overstated. Based on the analysis of how AI can be leveraged in financial crime investigation and where the AI technology may be heading in the future, the following recommendations are put forward. The key aim behind these recommendations is to equip LEAs with the strategic foresight and agility required to harness the benefits of AI advancements while mitigating associated risks.
While doing the horizon scanning exercise, it became obvious that the intricate interplay of technological innovation, regulatory adaptation, and international cooperation is essential for countering financial crime and money laundering effectively. The landscape is characterised by the emergence of sophisticated AI applications capable of enhancing AML efforts but also by the potential for these same technologies to be co-opted for nefarious purposes. Thus, any country’s approach must be holistic, encompassing not only the enhancement of AI capabilities in AML efforts but also the ethical, legal, and societal implications of such technologies.
It is important to recognise that the path forward requires a concerted effort across multiple fronts. This includes strengthening regulatory frameworks, fostering ethical AI development, enhancing international collaboration, and investing in future-ready technologies and training of law enforcement staff. The ultimate goal should be to create an AML ecosystem that is not only resilient in the face of emerging threats but also conducive to ethical and sustainable technological advancement.
Based on the roadmap with a comprehensive overview of the anticipated developments in AI against money laundering up to 2040, drawing on the trends, weak signals, disruptive events, threats, and innovations outlined, here are several recommendations:
Enhance Regulatory Frameworks: Given the fast pace of AI development and its applications in countering financial crime and AML, LEAs should continuously update and enhance its regulatory frameworks to ensure they remain effective and relevant. This includes privacy, data protection, and AI ethics, particularly in light of emerging technologies such as emotional face recognition and the use of AI in financial transaction monitoring.
Promote Ethical AI Use: There needs to be clear guidelines and standards for the ethical use of AI, balancing technological advancement with fundamental rights and freedoms. This includes considerations around consent, transparency, and accountability, particularly with technologies like AI-driven emotional recognition, predictive decision-making, and unsupervised ML for AML patterns.
Establish AI Ethics and Governance Bodies: There should be dedicated authorities for overseeing AI ethics and governance, particularly in sensitive areas of AML and AI. These would be responsible for setting standards, conducting audits, and ensuring compliance with ethical AI use in AML. This would help address concerns related to privacy, bias, and accountability in AI systems used for AML purposes.
Foster International Cooperation: The global nature of financial crime necessitates international collaboration. Countries should lead, support and participate in global initiatives to standardise AML practices, share intelligence, and harmonise regulatory environments, especially in light of geopolitical shifts and the potential fragmentation of AML efforts.
Strengthen Cybersecurity Measures: With the increasing sophistication of cyber threats, the authorities should prioritise the development and implementation of advanced cybersecurity measures to protect financial systems. This includes preparing for the potential threats posed by quantum computing to encryption standards.
Develop Skills and Expertise: There is an urgent need to build a skilled workforce capable of designing, implementing, and managing advanced AI systems in the AML domain. This includes education and training programmes in AI, cybersecurity, and financial regulations.
Encourage Responsible Innovation: While promoting innovation in AML strategies, new technologies shall be developed and implemented responsibly, with due consideration for potential social, ethical, and privacy implications.
Adapt to New Financial Ecosystems: As digital and decentralised financial systems become more prevalent, AML strategies must adapt to these new environments. This includes understanding and regulating emerging technologies such as blockchain-based SC, crypto currencies and non-fungible tokens.
Prepare for Geopolitical Shifts: There is need to remain agile and responsive to geopolitical shifts that could impact AML efforts, including the rise of new economic powers and the potential for cyber warfare. This includes developing contingency plans and strategic alliances.
Invest in Research and Development: To stay ahead of sophisticated financial crime schemes and money laundering tactics, LEAs should invest in R&D for advanced AI technologies, including quantum computing, AGI, and multimodal AI. This should include public-private partnerships to drive innovation in AML strategies.
Enhance Data Sharing Mechanisms: As the relevant information and evidence related to cross- border crimes are captured in different jurisdictions, there is a need to develop secure and efficient data sharing mechanisms to facilitate the exchange of information related to AML between different stakeholders, including financial institutions, regulatory bodies, and international partners. This would improve the detection and prevention of money laundering by leveraging collective intelligence and resources.
These recommendations can create a robust, dynamic, and responsive policy that leverages AI’s potential while addressing the challenges and risks associated with rapid technological advancements.
Open access