For two decades, the assumption within compliance departments was that a transaction monitoring system, once installed and tuned, would do its job in the background. Alerts would fire, analysts would clear them, and an annual independent test would satisfy the regulatory box. That assumption is gone.
In 2025, U.S. enforcement totaled more than $1.1 billion in anti-money laundering (AML) and counter-terrorist financing penalties, with crypto exchanges absorbing roughly $927 million of that figure and money transmitters another $161 million.1 Notably, no major U.S. bank was hit with a headline AML penalty during the year, breaking a 20-year pattern, but the agencies have not slowed down.1 They have shifted their attention to the systems doing the detection work and to whether anyone has independently verified that those systems are still fit for purpose.
