Why AML controls on paper fail to prevent harm

Dr Nicola Harding, Financial Crime Lab

Speaking at the International Anti-Financial Crime Summit in London this month, Beth Harris, the Financial Conduct Authority's Head of Financial Crime, offered one of the more candid assessments a regulator has made of its own field. "For too long," she said, "financial crime frameworks have sometimes rewarded activity rather than effectiveness." A firm could point to its policies, processes and controls "without demonstrating clearly whether they are preventing harm" (AML Intelligence, 2026). She warned against "controls on paper", and observed that "a framework that measures activity without examining results can create reassurance without resilience".

The following day, the United States offered a case study. On 8 October 2026, the Office of the Comptroller of the Currency announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank for deficiencies in its Bank Secrecy Act and anti-money laundering programme (OCC, 2026a). In this piece I want to argue that controls on paper are not a failure of diligence that more paperwork can fix. They are a predictable organisational response to the environment in which compliance operates, and organisational sociology has been describing that response for almost fifty years.

A programme that existed, aimed at the wrong business

The detail of the American Express order is instructive precisely because the bank did have a programme. What it lacked was a programme connected to its actual risks. The OCC found that the bank's risk assessment focused on its "relatively narrow" deposit account products and insufficiently on its "more dominant" credit and charge card business (OCC, 2026a). The consequence was a failure to identify, evaluate and report approximately $13 billion in suspected trade-based money laundering processed between approximately June 2014 and May 2025, including in certain instances through accounts associated with bank insiders (OCC, 2026b). The regulator also identified inadequate resources, staff without sufficient expertise, weak independent testing and weak training for employees and directors.

Each of these elements would ordinarily appear on a compliance checklist: a risk assessment, a monitoring function, independent testing, training. Each existed in some form. The failure lay not in the absence of controls but in the gap between the controls and the business they were meant to govern.

Myth, ceremony and decoupling

Meyer and Rowan (1977) argued that organisations frequently adopt formal structures not because those structures make the work more effective, but because the institutional environment expects them. Such structures confer legitimacy, resources and survival. Where the demands of legitimacy and the demands of the work diverge, organisations protect legitimacy by decoupling formal structure from day-to-day activity. In their words, "in place of coordination, inspection, and evaluation, a logic of confidence and good faith is employed" (Meyer and Rowan, 1977).

Harris's phrase, reassurance without resilience, is close to a restatement of that thesis. A policy library, a risk assessment template and a training completion rate are visible signals that a firm takes financial crime seriously. They are what boards, auditors and supervisors have historically been able to inspect. They are not, in themselves, evidence that it has become harder for criminals to use the firm.

Bromley and Powell (2012) refined the concept in a way that fits anti-money laundering closely. They distinguished policy-practice decoupling, where a policy is adopted but not implemented, from means-ends decoupling, where a policy is implemented in full but its relationship to the intended outcome is opaque. They argued that the second form has become more prevalent, and that its consequences include increasingly complex internal structures, a state of "perpetual reform", and the diversion of resources away from core goals (Bromley and Powell, 2012).

Much of the anti-money laundering system is means-ends decoupled in exactly this sense. Alerts are reviewed, suspicious activity reports are filed and customers are risk-rated, but the link between those activities and reduced criminal harm is rarely measured. Pol's (2020) analysis of the global regime estimated that anti-money laundering measures have less than 0.1 per cent impact on criminal finances, while compliance costs exceed recovered criminal funds more than a hundred times over. Pol is explicit that the underlying data are poorly validated and his findings cannot be definitive (Pol, 2020). Even allowing for wide margins of error, however, the scale of the gap between effort and outcome is difficult to dismiss.

Why paper controls spread

If decoupling explains why controls drift away from risk, institutional isomorphism explains why paper controls proliferate across a sector. DiMaggio and Powell (1983) identified three mechanisms through which organisations in the same field come to resemble one another: coercive pressure from regulators and other powerful actors, mimetic copying in response to uncertainty, and normative pressure from professional standards (DiMaggio and Powell, 1983). Mimetic isomorphism is particularly relevant. When it is unclear what works, organisations copy what appears legitimate elsewhere.

The FCA has recently described this pattern almost exactly. In its statement on Annex 1 firms, the regulator warned that firms have relied too heavily on the financial crime controls of their parent companies, and that they "can't rely on off-the-shelf procedures designed for a different company" (FCA, 2026a). An imported procedure is the purest form of a control on paper. It carries the legitimacy of the organisation it was designed for, and none of the knowledge of the organisation that adopts it.

Edelman's (1992) work on civil rights law adds a further layer. She showed that where legal requirements are broad and ambiguous, organisations construct the meaning of compliance themselves, initially by elaborating formal structures that serve as visible symbols of compliance. In doing so, they mediate the effect of the law on society (Edelman, 1992). The risk-based approach to anti-money laundering is deliberately non-prescriptive, which gives firms precisely this latitude. The implication is uncomfortable but important. Symbolic compliance is not only something firms do to regulators. It is co-produced with them, because for as long as supervision rewards the presence of structures, structures are what firms will build. Harris's acknowledgement that frameworks have "rewarded activity" is, read this way, a statement about the regulatory system as a whole, not only about firms.

What effectiveness should mean

The FCA's shift is therefore welcome, and the regulator has begun to act on it. Earlier this year it restricted BeAccount Ltd, an e-money institution trading as Payine, after it was not satisfied that the firm had "the operational effectiveness and adequacy required" to manage financial crime risk (AML Intelligence, 2026). Steve Smart, the FCA's executive director of enforcement and market oversight, has framed the objective as "creating friction for the criminals" rather than "overloading firms with requests and paperwork" (FCA, 2026b).

Criminology can help give that objective a practical shape. Situational crime prevention asks a simple question of any intervention: does it increase the effort or risk of offending, reduce its rewards, reduce provocations or remove the excuses that make offending easier? Cornish and Clarke's (2003) revised classification of twenty-five situational techniques is organised around these five mechanisms (Cornish and Clarke, 2003). Applied to financial crime controls, that question produces tests that a policy library cannot pass on its own. Was the risk assessment built from the firm's actual products and customer flows, or from a template? Has the control been tested against a real typology, such as mule chains, where funds typically leave the system by the second account? Can the firm show a case in which a control changed an outcome, rather than simply recording that the control ran? And does management information measure time to detection and repeat exploitation, rather than throughput?

There is one further caution. Bromley and Powell's warning about perpetual reform applies to regulators as much as to firms. If effectiveness becomes a new set of templates, metrics and attestations, it risks becoming the next ceremony. The measure of this shift will not be whether firms produce effectiveness reports. It will be whether the gap between what firms say they do and what criminals are able to do begins to narrow.

The lesson of the American Express order is not that the bank lacked controls. It is that controls designed for one business were left to stand guard over another for more than a decade. A control is only as good as its connection to the harm it exists to prevent. Everything else is reassurance.

References

AML Intelligence (2026) 'NEWS: FCA targets "AML controls on paper" at UK firms as it shifts compliance focus', 7 October. Available at: https://www.amlintelligence.com/2026/10/news-fca-targets-aml-controls-on-paper-at-uk-firms-as-it-shifts-compliance-focus/

Bromley, P. and Powell, W. W. (2012) 'From smoke and mirrors to walking the talk: Decoupling in the contemporary world', Academy of Management Annals, 6(1), pp. 483-530. Available at: https://doi.org/10.5465/19416520.2012.684462

Cornish, D. B. and Clarke, R. V. (2003) 'Opportunities, precipitators and criminal decisions: A reply to Wortley's critique of situational crime prevention', in Smith, M. J. and Cornish, D. B. (eds) Theory for Practice in Situational Crime Prevention. Crime Prevention Studies, Volume 16. Monsey, NY: Criminal Justice Press, pp. 41-96. Available at: https://popcenter.asu.edu/sites/g/files/litvpz3631/files/library/CrimePrevention/Volume_16/TitlePages.pdf

DiMaggio, P. J. and Powell, W. W. (1983) 'The iron cage revisited: Institutional isomorphism and collective rationality in organizational fields', American Sociological Review, 48(2), pp. 147-160. Available at: https://doi.org/10.2307/2095101

Edelman, L. B. (1992) 'Legal ambiguity and symbolic structures: Organizational mediation of civil rights law', American Journal of Sociology, 97(6), pp. 1531-1576. Available at: https://doi.org/10.1086/229939

Financial Conduct Authority (2026a) FCA applying increased scrutiny to Annex 1 firms. Statement, 7 August. Available at: https://www.fca.org.uk/news/statements/fca-applying-increased-scrutiny-annex-1-firms

Financial Conduct Authority (2026b) Financial crime: protecting the hive. Speech by Steve Smart at the Law Society Economic Crime Conference, 17 September. Available at: https://www.fca.org.uk/news/speeches/financial-crime-protecting-hive

Meyer, J. W. and Rowan, B. (1977) 'Institutionalized organizations: Formal structure as myth and ceremony', American Journal of Sociology, 83(2), pp. 340-363. Available at: https://doi.org/10.1086/226550

Office of the Comptroller of the Currency (2026a) OCC assesses $350 million civil money penalty against American Express. News release NR 2026-87, 8 October. Available at: https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87.html

Office of the Comptroller of the Currency (2026b) Consent order for the assessment of a civil money penalty, American Express National Bank, AA-ENF-2026-47. Available at: https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87b.pdf

Pol, R. F. (2020) 'Anti-money laundering: The world's least effective policy experiment? Together, we can fix it', Policy Design and Practice, 3(1), pp. 73-94. Available at: https://doi.org/10.1080/25741292.2020.1725366