As 2025 draws to a close, the financial services sector finds itself navigating one of the most complex and rapidly evolving regulatory landscapes in recent memory. This has been a year of reckoning, one that has challenged fundamental assumptions, exposed systemic weaknesses, and illuminated the widening gap between regulatory ambition and operational capability. Yet it has also been a year of resilience and adaptation. Institutions across the Global Compliance Institute’s international network, spanning regulators, supervisors, CROs, MLROs, and senior compliance leaders, have demonstrated remarkable agility in the face of escalating geopolitical volatility, heightened enforcement intensity, and the accelerating fusion of cyber, data, and financial crime risks.
The central theme of 2025 has been convergence: the convergence of digital and traditional finance, the merging of cyber and financial crime typologies, and the increasing alignment of global regulatory expectations. This convergence has forced institutions to rethink long-standing operating models, restructure fragmented control environments, and redefine compliance not as a functional requirement, but as a strategic capability fundamental to institutional resilience and public trust.
The insights gained throughout this year offer a critical lens through which to consider what 2026 will demand. In a world where regulatory expectations evolve faster than organisational change cycles, compliance has become anticipatory, not reactive; strategic, not procedural. The coming year will test every institution’s ability to convert regulatory intent into day-to-day execution with clarity, evidence and accountability.
Below is a comprehensive analysis of the most significant developments of 2025, followed by a strategic projection of what compliance leaders must prepare for in 2026.
2025: A Year of Convergence, Acceleration, and Redirection
Cybersecurity and Financial Crime Became Indistinguishable
Perhaps the most striking shift in 2025 was the definitive convergence of cybersecurity and financial crime. Where these disciplines were once treated as parallel control environments, 2025 demonstrated unequivocally that they now operate as a single risk ecosystem. The FCA’s Cyber Thematic Review (May 2025), the NCA’s Digital Fraud Threat Briefing (2025), FATF’s assessment of virtual-asset typologies (2025), and a range of cross-border supervisory statements all emphasised the same conclusion: cyber events are now financial crime events, and financial crime events frequently originate through cyber compromise.
This was not theoretical. Ransomware gangs increasingly use privacy-enhanced cryptocurrencies to mask extortion flows, layering transactions through decentralised finance (DeFi) platforms at speeds traditional AML systems could not match. Fraud networks deployed AI-driven tools to generate deepfake identities that bypassed facial-recognition systems still reliant on static biometric templates. Several Tier-1 institutions publicly confirmed incidents in which cyber intrusions were followed, within hours, by large-scale mule-account activation, proof of operational partnerships between cyber actors and organised financial crime groups.
Institutions that continued to treat cyber, AML, fraud and sanctions as separate domains found themselves operating with fragmented situational awareness. By contrast, the leading organisations, particularly in the Nordic, Canadian and Asia–Pacific region markets, established integrated financial crime fusion centres where cyber telemetry, fraud analytics, AML signals, sanctions hits and customer behaviour data were analysed within a unified intelligence framework. This model is not exceptional; it is the emerging baseline. In 2026, regulators will expect integration, not simply coordination
KYC Weaknesses Were Exposed, Accelerating the Shift Toward Perpetual Monitoring
If convergence was the defining theme of 2025, then perpetual monitoring was its operational consequence. Regulatory reviews throughout the year repeatedly identified weaknesses in KYC programmes, particularly around ongoing monitoring and periodic refresh. Many institutions remained locked into outdated review cycles, annual, biennial or triennial, that were designed for an analogue era, not for an ecosystem where customer behaviour, geopolitical dynamics and digital-identity risk evolve in real time.
Supervisors and enforcement authorities published multiple examples illustrating how traditional periodic KYC had failed to detect critical risk indicators. Customers who underwent significant life changes, changes that materially affected their risk profile, remained classified as low risk simply because their next scheduled review was months away. Mule accounts sat dormant for extended periods and then became active within 24–48 hours, exploiting predictable gaps in institutional awareness. Transaction-monitoring engines generated false positives because they relied on stale customer data, while negative news and sanctions-adjacent developments went unincorporated into risk scoring for weeks.
One UK institution disclosed that more than 1,400 high-risk customers had undergone material profile changes, employment, residency, legal actions, financial stress, since their last KYC review, yet their risk ratings remained unchanged. A European digital bank uncovered an entire mule-account network only after implementing behavioural-network analytics capable of detecting non-obvious relationships between customer accounts. A US regulatory action cited an institution for failing to adjust risk ratings despite repeated adverse-media hits on several customers whose reviews were not due for months (OCC Enforcement Summary, 2025).
These cases demonstrate why perpetual KYC, continuous, event-driven, data-informed and behaviourally calibrated, is no longer aspirational. It is essential. In 2026, regulators will shift from encouraging perpetual monitoring to expecting it, and institutions that continue relying on periodic reviews will be left exposed.
AI Governance Moved from Innovation to Enforcement Priority
Artificial intelligence continued to redefine financial services during 2025, but its rapid adoption introduced governance risks that regulators were no longer willing to treat as emerging issues. The FCA’s “AI in Financial Services” Review (April 2025), MAS’s updated Model Risk Principles, the European Union’s AI Act operationalisation phase, and guidance across the U.S., Middle East and Australia all centred on the same concerns: explainability, fairness, auditability, data lineage, model drift, and accountability.
Throughout 2025, supervisors adopted a more assertive stance, asking institutions to demonstrate the provenance of training data, the robustness of validation techniques, the existence of challenge frameworks, and the clarity of human oversight structures. These questions were not academic; they were triggered by real failures.
In one case, a UK lender’s machine-learning model approved credit at significantly different rates depending on demographic profiles, disparities that could not be justified by risk factors and were immediately deemed unacceptable. An insurer faced regulatory challenge after using behavioural proxies, browser patterns, mobile-device metadata and inferred preferences, that resulted in unfair price differentiation. A wealth manager was warned that its automated suitability engine produced inconsistent investment recommendations, blurring the boundary between execution and regulated advice.
These failures accelerated regulatory intervention. In 2026, AI governance will be a board-level requirement, not an operational responsibility buried within data-science teams. Institutions will be expected to maintain transparent audit trails, explain model decisions in a way customers and supervisors can understand, and demonstrate “ethical control” over algorithmic processes. AI will no longer be judged solely on accuracy or efficiency, but on fairness, accountability and resilience.
Geopolitical Volatility Made Sanctions Compliance More Challenging Than Ever
2025 also marked a turning point in the complexity of sanctions compliance. Sanctions regimes evolved at a speed that outpaced many institutions’ ability to adapt. The year saw a spike in coordinated U.S., UK and EU actions targeting cyber actors, digital-asset facilitators, emerging technology suppliers, logistics intermediaries and entities linked to geopolitical tensions. Sector-based and activity-based sanctions broadened considerably, making static lists and basic screening increasingly ineffective.
Several enforcement notices highlighted cases where institutions failed to identify indirect or beneficial-ownership links between customers and sanctioned entities because of outdated corporate-registry data or inadequate relationship-mapping capabilities (EBA Sanctions Compliance Report, Q3 2025). Others struggled to interpret the extraterritorial impact of U.S. secondary sanctions or to evaluate sanctions-adjacent risk, entities not explicitly designated but operating in high-risk jurisdictions or sectors.
In 2026, sanctions compliance will require a combination of geopolitical understanding, network-analysis capabilities, corporate-registry intelligence, and dynamic risk scoring. Screening alone will not be sufficient. Institutions must demonstrate contextual reasoning and timely escalation based on real-time global developments.
The Compliance Landscape in 2026: Strategic Priorities, Emerging Risks, and Regulatory Expectations
Heightened Transparency and Demonstrable Governance
The regulatory direction of travel is clear: supervisors expect demonstrable governance, not theoretical frameworks. In 2026, firms will be expected to show evidence supporting every significant risk and compliance decision, including detailed audit trails, rationale statements, escalation documentation, and outcomes testing. The emphasis will be on record-keeping, challenge processes, cultural indicators and how risk appetite is operationalised. Regulators will scrutinise not only what decisions were made, but how and why those decisions were reached.
Real-Time, Intelligence-Driven Compliance
The transition from retrospective monitoring to real-time intelligence is now underway. Compliance functions must build dynamic risk-scoring models, deploy real-time analytics and integrate behavioural insights into monitoring frameworks. Supervisors will expect institutions to respond quickly and proportionately to emerging threats, especially those involving cyber compromise, synthetic identities or sanctions escalation. Manual or siloed processes will not withstand supervisory scrutiny in 2026.
Integration of Financial Crime and Cyber Operations
Fragmentation across fraud, AML, cyber, sanctions and transaction-monitoring functions has long been a supervisory concern. In 2025, regulators repeatedly emphasised the need for unified governance, aligned risk assessments, shared intelligence and harmonised escalation pathways. In 2026, institutions will be expected to demonstrate integrated financial crime operating models. Failure to converge these risk domains will be viewed as a structural weakness.
ESG Crime and Sustainability-Related Financial Risk
The rise of ESG-linked financial crime was one of the most important but under-discussed developments of 2025. Regulatory attention is increasingly focused on illicit supply chains, environmental offences, carbon-credit manipulation, greenwashing and ESG-related corruption. Institutions will be expected to integrate environmental and social risk typologies into their monitoring frameworks, enhance due diligence on ESG-sensitive sectors and strengthen oversight of third-party relationships in high-risk jurisdictions. ESG crime is poised to become a central thematic priority in 2026.
The Expanding Skills Gap
As compliance becomes more digital, data-driven and behaviourally nuanced, institutions face a growing skills deficit. In 2026, competence in data science, AI governance, cyber resilience, ESG risk, behavioural analysis and digital-asset compliance will be essential. Institutions must invest in talent strategies that combine traditional compliance expertise with advanced technical capability.
Reflections
2025 challenged the financial services sector in unprecedented ways, but it also demonstrated the industry’s capacity for adaptation, collaboration and innovation. The lessons learned this year underline that compliance is no longer a peripheral function. It is central to organisational resilience, customer trust, regulatory credibility and long-term sustainability.
In 2026, firms will be judged not only on the sophistication of their controls, but on the clarity of their decision-making, the resilience of their governance, the strength of their culture and the integrity of their outcomes. The coming year will demand agility, strategic foresight and a willingness to rethink long-standing assumptions.
Our responsibility as compliance professionals is to guide institutions through this transition with precision, courage and clarity, ensuring that financial systems remain safe, transparent and worthy of public confidence.