Financial crime management is often discussed as a compliance obligation. That framing is too narrow.
Financial Crime Management (FCM) is the set of controls, judgements and behaviours that protect an institution's integrity. It helps a bank know who it is doing business with, understand where money has come from and recognise activity that does not fit the customer it claims to be. Done well, it supports sound commercial decisions, not only regulatory ones.
The distinction matters because a compliance programme can look complete and still fail the test of protection. A policy can be approved. A committee can meet. A review can be closed. None of those facts, on its own, shows that a decision changed for the better.
Presence is not performance
Controls are often assessed by whether they exist. Is there a policy? Is there an owner? Is the review complete? These are necessary questions, but they describe the machinery, not the outcome.
A more useful question is what the control helps someone do. Does it help an analyst recognise a customer whose behaviour no longer fits? Does it help a relationship manager escalate a concern without treating the customer as guilty? Does it help a committee understand where risk is accumulating rather than how many papers it received?
If the answer is unclear, the control may be producing activity without producing judgement.
Customers feel control through operations
Trust is built and eroded in ordinary moments. A payment delayed without explanation. A request for the same document three times. An account opened without proper checks. A concern raised and then apparently lost.
Customers rarely see the control framework. They experience its consequences. That is why control quality is not only a regulatory question; it is part of the institution's operating reputation.
A well-designed control can still create a poor experience if it is applied without context. A poorly designed control can create a good experience while missing the risk. The aim is not more friction or less. It is the right decision, made consistently, with a reason that can be explained.
Four tests worth applying
1. What decision does this control support?
If the answer is only “completion”, the control is probably measuring itself.
2. What would it catch that another control would not?
Controls should earn their place in the framework. Duplication is not depth.
3. Who is expected to exercise judgement?
Automation can produce a signal. People still have to decide what it means.
4. What evidence shows the control changed an outcome?
Look for decisions, escalations, exits, enhanced reviews and the reasoning behind them — not only volumes.
The practical starting point
Ask what each control is for, not only whether it exists. A policy can be present and still add little. The test is whether the control changes a decision for the better.
That question is uncomfortable because it moves the conversation from completion to judgement. It also makes the work more useful. A control that cannot explain its purpose is unlikely to protect the institution when the situation is difficult.
Where does your organisation draw the line between compliance activity and genuine protection?
This note is general commentary, not legal or regulatory advice.