Between a rock and a hard place: managing the conflict between anti-money laundering and financial inclusion

Banks in developed countries are currently facing two conflicting expectations. On the one hand, banks are obliged to prevent financial crimes and discontinue business relationships with customers if, for example, the bank is unable to comply with customer due diligence (CDD) requirements (Financial Action Task Force [FATF], 2025a). On the other hand, banks are required to advance financial inclusion (FI) in society by providing banking services (European Banking Authority [EBA], 2023). Based on previous studies (Ofoeda, 2022; Urooj, 2024), in highly developed countries, excessive anti-money laundering and countering the financing of terrorism (AML/CFT) regulations have a detrimental impact on FI. Therefore, banks in modern societies have the conflicting roles of preventing ML and the financing of terrorism and providing financial access.

There is a lack of research examining the conflict between AML/CFT and FI in developed countries. This study contributes to the issue by aiming to expand the understanding of how these conflicting expectations can be managed in the banking sector so that banks have effective AML/CFT measures in use without unnecessarily restricting the population’s access to financial services. This article addresses the research gap with the following research question:

The article is structured as follows. Section 2 provides a background on the dilemma of the study: Section 2.1 introduces the banks’ role in AML; Section 2.2 provides the context of FI; and Section 2.3 conceptualizes the contradiction between the two. Section 3 presents the research methodology and details of the expert interviews, while Section 4 addresses the results. Section 5 reflects on the results and, finally, Section 6 concludes the article. The empirical data of the study were collected in Finland, a highly developed country that is a FATF member (FATF, 2025b).

ML is the processing of criminal proceeds to disguise their illegal origin (United Nations Office on Drugs and Crime [UNODC], 2024; FATF, 2024a). ML is critically important for criminals, as it enables them to enjoy profits without jeopardizing their source (UNODC, 2024). Terrorist financing (TF) means the financing of terrorist acts and of terrorists and terrorist organizations (FATF, 2025a). Unlike ML, which requires a predicate crime, such as smuggling, tax crimes or human trafficking (FATF, 2025a), TF can involve legitimate funds. Despite different risk attributes, both aim to place funds related to criminal activity into the financial system (Dill, 2019). Hence, the fight against financial crime is usually referred to as AML/CFT (e.g. FATF, 2025a; EBA, 2023a).

According to He (2010), a banking institution is the most frequently used instrument by money launderers. He argues that there are several reasons for this; banks provide various services that can be used for laundering, such as deposits, loans and foreign exchange. With the global economy and integrated financial markets, transferring money across international borders is convenient and rapid (He, 2010). Moreover, the principle of banking secrecy present in almost every country also protects criminal activities (Ping, 2004; He, 2010).

Because of the risk of banking service misuse, banks are obligated to prevent financial crimes and the financing of terrorism, and they are heavily regulated to ensure that they fulfill this obligation. EU countries follow the EU-wide AML Directives that they implement within their local legislation. The first Directive was adopted in 1990 to prevent the misuse of the financial system for the purpose of money laundering (European Commission, 2024). The EU has since updated the Directive several times – the sixth Directive came into force in July 2024 – and extended the scope of requirements following the development of the 40 Recommendations within the FATF (European Commission, 2024; European Court of Auditors, 2021; Lannoo and Parlour, 2021). However, it has been argued that while the scope of AML actions has expanded greatly, the success of AML policies has been very limited (European Court of Auditors, 2021; Lannoo and Parlour, 2021).

The seriousness of the criminal activities that underlie ML/TF and the volumes of ML explain the intense regulatory focus on the AML/CFT (Dill, 2019). Estimates suggest that an amount corresponding to 1.23% of the global gross domestic product is laundered yearly (Nazar et al., 2024). Strong AML/CFT regimes are often seen as a disincentive for criminal involvement in the economy (Schott, 2006). However, this disincentive is not without significant costs. As Dill (2019) has stated, the regulation of AML/CFT is globally one of the costliest and most resource-intensive sources of risk management and compliance obligations for banks. Notably, despite these efforts, global ML activity remains largely undiminished (Nazar et al., 2024).

Given the resource-intensive nature of AML/CFT compliance, banks must assess how and to what extent they invest in AML/CFT risk management to reduce the inherent compliance risk (Dill, 2019) and engage in cost-effective and efficient actions against financial crime. At the same time, if a bank’s AML/CFT controls fail, the impact on the bank’s operations (Khelil et al., 2024) and reputation may be severe – though possibly short-term (Tiemann, 2024). This tension between high compliance costs and failure risks illustrates the difficulty banks face in striking a balance between these two matters.

Owing to extensive AML/CFT regulations and other requirements, banks maintain a wide range of preventive measures. According to the FATF Recommendations (2025a), banks have an obligation to conduct activities such as CDD, transaction monitoring and the reporting of suspicious transactions to the local financial intelligence unit (FIU). Banks must ensure that the transactions being conducted are consistent with the bank’s knowledge of the customer, business and risk profile and, where necessary, understand the source of the funds (FATF, 2025a).

If a bank is unable to comply with sufficient CDD requirements – for example, the purpose and nature of the business relationship is not understandable – it is required to decline to open a business relationship or perform transactions, or, if the relationship already exists, it should be terminated (FATF, 2025a). In practice, this means that the bank restricts the customer’s use of banking products and services (e.g. blocks access to a bank account) or fully terminates the business relationship. Unlike many other AML/CFT measures, restricting or terminating the business relationship directly affects the customer and his/her ability to act in a developed society, such as paying rent or receiving a salary.

When assessing whether to terminate or restrict a customer’s access to banking services, banks are not expected to withdraw entire customer categories associated with higher ML/TF risk (a practice known as de-risking) (EBA, 2022). Instead, they are required to assess each case with a risk-based approach (RBA) (FATF, 2025a; EBA, 2023b). According to the FATF (2025a), the general principle of the RBA is that a financial institution should implement enhanced measures where the risks are higher and permit simplified measures where the risks are lower. In addition, the AML/CFT measures should be proportionate, meaning the measures appropriately correspond to the level of identified risk and mitigate the risks effectively (FATF, 2025c).

While the RBA provides flexibility to banks, guidance on its practical implementation may remain relatively general, leaving decisions on whether to restrict or terminate the business relationship with a customer largely to each bank’s discretion (see e.g. Regulations and Guidelines 2/2023 issued by the Finnish Financial Supervisory Authority). These decisions depend on the risk appetite of each bank – that is, the amount and type of risk a bank is willing to accept in pursuit of its strategic and financial goals (Dill, 2021).

The aim of risk management is not to eliminate or minimize risk, but to determine its optimal level (Stulz, 2022). However, the flexibility of the RBA may also lead to uncertainty and risk-averse behavior, especially when regulatory expectations are high. For example, a low-risk appetite may arise from the fear of noncompliance with AML/CFT requirements or simply because maintaining high-risk customers is too costly. Hence, the bank may adopt a stricter course of action than required by a regulator or supervisor. If a customer exceeds the bank’s risk appetite, the bank can restrict or terminate the customer’s services and, eventually, force the customer to apply for banking services from other financial institutions. In some cases, however, such customers may be unable to open a business relationship elsewhere (EBA, 2022), ultimately meaning that they have been excluded from formal financial services.

FI means individuals and businesses have access to useful and affordable financial products and services that meet their needs – transactions, payments, savings, credit and insurance – delivered responsibly and sustainably (World Bank, 2022; Demirgüç-Kunt et al., 2022). Access to financial products allows users to safely and reliably store, send and receive money for everyday needs, plan for emergencies and make productive investments for the future, such as in health, education and business (Demirgüç-Kunt et al., 2022). People without an account, by contrast, must manage their funds using informal mechanisms that may be less safe, less reliable and more expensive than formal methods (Demirgüç-Kunt et al., 2022; Corrado and Corrado, 2015). Globally, around 76% of people have an account either at a bank or similarly regulated deposit-taking financial institution (Demirgüç-Kunt et al., 2022).

FI is usually noted as a positive matter in the literature; it helps to improve social inclusion in many societies (Bold et al., 2012; Ozili, 2020a), and it can help to reduce poverty levels to a desired minimum (Chibba, 2009; Ozili, 2020a), decrease income inequality (Neaime and Gaysset, 2018) and bring other socio-economic benefits (Sarma and Pais, 2011; Ozili, 2020a). Evidence shows that households and businesses that have financial access are better able to withstand financial shocks than those that do not (Moore et al., 2019; Demirgüç-Kunt et al., 2022). In addition, financial services strengthen gender equality; studies show that for women, accounts enable financial independence and household decision-making (Ashraf et al., 2010; Demirgüç-Kunt et al., 2022). Because of the several benefits of FI, many countries have embraced it as the key economic empowerment action and a solution to rising poverty levels (Ozili, 2021).

FI has been conceptualized by Ozili (2020b) as a public good – a benefit that should be accessible to all members of society without exclusion. The public good theory argues that the delivery of formal financial services to the entire population and the guarantee of unrestricted access to finance for everyone should be treated as a public good for the benefit of society. The theory even suggests that any individual or small business can open a bank account, and they are offered related services to perform transactions for free. From this perspective, suppliers of financial services, such as banks, should bear the costs as a sunk cost of doing banking business.

Considering FI as a good that belongs to anyone also supports the idea of extreme FI, which means that everyone can access the formal financial sector – including criminals, hackers and fraudsters (Ozili, 2020a) as well as customers who cannot pay back their debts. Proponents argue that such broad access may contribute to AML/CFT objectives by bringing more financial activity under regulatory oversight (Durner and Shetret, 2015). However, while the public good perspective provides a compelling rationale for universal access, it also introduces a fundamental challenge: banks operating under strict AML/CFT regulations are simultaneously expected to identify high-risk customers and restrict access for those deemed suspicious (FATF, 2025a).

Significant research on FI has emerged since 2016, with most of the studies focusing on developing countries and the Asian and African regions (Ozili et al., 2023) ^[1]. The geographic concentration is understandable given that the vast majority of the world’s unbanked people live in developing countries (Esoimeme, 2020; Durner and Shetret, 2015). In contrast, developed economies are often viewed as having effectively resolved FI, an assumption typically based on indicators such as high rates of account ownership. For instance, The Global Findex Database shows that account ownership in Finland in 2021 was 99%–100%. Moreover, financial access in Finland is secured by law: according to the Act on Credit Institutions 610/2014 (2014), natural persons legally residing in an EEA state have the right to basic banking services, meaning a payment account, related payment services and electronic identification services. A bank can refuse to open an account only for a few reasons, one of which is AML/CFT-related.

Owing to the legal and statistical assurances of FI, academic literature largely overlooks the potential tensions between extensive AML/CFT obligations and FI in high financial access contexts such as Finland. Existing literature offers limited insight into how banks manage this tension in practice – that is, how they reconcile regulatory compliance with the inclusive provision of banking services.

Interest in the connection between banks’ AML/CFT measures and FI has risen considerably in recent years (Durner and Shetret, 2015). Owing to the increased demands and costs of AML/CFT, financial institutions have opted to exit or restrict business relationships with customers assessed as being of high risk, unprofitable or simply too “complex” (Durner and Shetret, 2015), such as nonprofit organizations or customers with connections to high-risk countries. Applying an overly cautious, non-RBA to AML/CFT can have the unintended consequences of excluding legitimate individuals and businesses from the financial system (FATF, 2017) and consequently cause harm to industries and especially vulnerable individuals (EBA, 2023b).

The impact of AML/CFT on FI has been recently raised by the EBA and FATF (see, e.g. FATF, 2024b; EBA Guidelines, 2023b; EBA, 2022). Despite the interest in the topic, there are few studies concerning the role of FI in preventing financial crime (Ozili, 2024). The existing literature suggests that the connection between AML/CFT and FI is different depending on whether it is examined on the global level or by only looking at developing versus developed countries.

Several scholars have suggested that the objectives of AML/CFT and FI can be mutually reinforcing rather than inherently in conflict. Durner and Shetret (2015), for example, argue that proportionate AML/CFT measures can help to advance FI goals by drawing more economic activity into the formal banking sector and consequently enhancing transaction monitoring and CDD, which in turn helps to advance AML/CFT goals as well. Similarly, Jayasekara (2021) reports a strong positive correlation between the strength of the AML/CFT regime and FI. Supporting this view, Esoimeme (2020) adds that, on the contrary, the prevalence of a large informal, unregulated and undocumented economy negatively affects AML/CFT efforts and the integrity of the financial system. From this perspective, expanding FI is not only compatible with AML/CFT objectives but also essential to their long-term effectiveness.

However, even if FI can help to combat financial crime, for example by leaving an audit trail behind, there are also potential vulnerabilities associated with it (Ozili, 2024). A growing body of research has drawn attention to the inherent tensions between these goals – especially in developed economies. Ofoeda’s (2022) comparative study of developed, developing and African countries indicates that the impact of AML regulation on FI ^[2] is sensitive to its intensity. While moderate levels of regulation may promote FI, excessive regulation – often found in developed countries – tends to deter it.

Urooj (2024) found similar results when examining the effect of FATF compliance and the degree of FI ^[3] across 174 economies. While FATF compliance appears to improve account ownership and customers’ confidence in the financial system on a global level, it correlates negatively with all used indicators of FI in developed countries. Urooj states that the FATF compliance cost is a huge burden for developed countries, and it does not support FI, leading to customer exclusion and a reduced number of bank branches.

Together, the findings from developed countries suggest that excessive AML/CFT regulation and measures can contradict the goals of FI, causing conflicting expectations of banks. When AML/CFT requirements become overly stringent, they may compel banks to adopt risk-averse strategies – such as declining to open business relationships with certain customers – which directly conflict with the goals of FI. These conflicting expectations are particularly problematic when banks have limited resources for risk management, making their efficient use critical.

Moreover, considering the increased interest in FI within the EU’s AML/CFT community, banks and financial sector authorities must find ways to manage these contradictory values and, consequently, develop current AML/CFT approaches. This study addresses this dilemma by examining the practices and processes through which banks can navigate the conflicting demands of AML/CFT regulations and FI.

The aim of this study is to expand the understanding of managing contradictory interests, which is why a qualitative approach was selected for the research method. One advantage of qualitative research is that it supports in-depth research (Goertz and Mahoney, 2012; Miles and Huberman, 1994). The study contributes to the dilemma of the conflict between FI and AML/CFT in the banking sector through interviews with experts in the field. The expert interviews were analyzed using thematic analysis.

The semi-structured interview method was selected for its flexibility, allowing follow-up questions and conversational interaction (Basias and Pollalis, 2018), which is particularly beneficial when discussing sensitive topics such as AML. The interviewees were selected based on their expertise in the research topic, ensuring different perspectives. Interviews were conducted until the relevant perspectives were represented and the data reached saturation.

With these principles, 11 experts were engaged in interviews. Interviewees 1–7 were from various financial sector-related organizations and authorities, and Interviewees 8–11 worked at banks operating in Finland. The banks were selected based on their willingness to participate in the research. The names and titles of the interviewees and the names of the banks have been kept confidential due to the nature of the interviews’ contents. All interviewees’ views and opinions presented in this article are their own and do not represent the official view of their organization. The interviewee information is summarized in Table 1.

The interviews were carried out in the local language, Finnish. The direct quotes in Section 4 (Results) were translated from the local language into English by the author. In the interviews with the Finnish Financial Ombudsman Bureau and Non-Discrimination Ombudsman, there were two interviewees in each session to ensure a comprehensive perspective on the topic. In the rest of the interviews, there was only one participant in each session. The participants knew the interview topics in advance but not the exact questions. The interviewees were guided in the interview by the questions presented in Table 2. The sections of the interview outline follow the same order as the theory of this article. All the interviews were recorded.

The data were analyzed using the inductive thematic analysis method following the process described by Braun and Clarke (2006): familiarizing yourself with your data (1), generating initial codes (2), searching for themes (3), reviewing themes (4), defining and naming themes (5) and finally, producing the report (6).

First, the recorded interviews were transformed into a written transcript. In phase two, the data were coded to identify factors relevant to the RQ. The coding process was data-driven, meaning the relevant codes or themes were not predetermined but instead emerged from the data. In phase three, the goal was to consider how different codes might be combined to form overarching themes. The codes were first organized into unitive subthemes, and later the subthemes were consolidated into main themes that provided a unifying framework. In phase five, the three main themes were defined and named to accurately reflect their nature. Finally, the themes were analyzed and reported in Section 4. The analysis process is described in Table 3 in Section 4.

Three main themes were identified through thematic analysis: the principle of least harm (1), the maturity of risk management (2) and the common approach and responsibility (3). This section is structured following the main themes. In each section, the relevant findings are described and illustrated by direct and indirect quotes from the interviewees. The themes and analysis process are described in Table 3.

In addition to the emerging themes, a valuable additional finding was that the interviewees strengthened the previous literature’s theory of conflicting goals. Interviewees 10 and 11 concurred that in some situations, the interests of FI and the bank’s risk management clearly conflict, and all the bank interviewees indicated that they were actively striving to balance these matters.

“Shooting immediately with the biggest gun possible is a big problem.” (Interviewee 6).

The first identified theme was the principle of least harm in risk management measures. The theme covers two ideals for AML/CFT measures: an RBA and measures that restrict the customer the least.

Many of the interviewees pointed out that the current AML/CFT measures used by banks are not always proportionate to the actual ML/TF risk banks face. The results strongly suggest that AML/CFT measures should be risk-based and reasonable toward the customer. Interviewee 7 stated that the aim of AML/CFT is not to eliminate the risks completely, but to identify, assess and understand the risk to which the bank is exposed and to take the appropriate mitigation measures in accordance with the level of risk. According to the results, flexible and reasonable actions are important, especially in the case of vulnerable customers. Interviewee 4 emphasized that solutions for ensuring financial access for vulnerable people must be found. In addition, Interviewee 7 called for flexibility to ensure that the customer is not put in an unreasonable situation. For example, if the customer is an elderly person living in institutional care and his/her identity verification documentation has expired, the bank could think in a risk-based way and look for flexible solutions to verify the customer’s identity.

According to Interviewees 1, 7, 8 and 10, even if the customer is high-risk, banks should aim to mitigate the risk by engaging in, for example, product restrictions or enhanced transaction monitoring instead of fully exiting the customer. Additionally, interviewee 6 highlighted that banks should start from actions causing the least harm to the customer. By restricting the use of only certain products, the customer could still be included in the financial sector but with limited services. Interviewee 10 pondered whether banks should be encouraged to set service limitations only while maintaining a business relationship with high-risk customers. On the other hand, the interviewees agreed that in certain circumstances, banks must have the option of exiting the customer. Clear indications of illegal activity or a situation where the bank cannot identify and verify the customer were seen as examples of such circumstances.

However, according to the results, it takes more than just willingness to make risk-based actions. Interviewees 7 and 10 believed that technical solutions are essential for being able to work risk-based with high customer volumes. In addition, Interviewee 4 argued that the current AML/CFT regulations do not sufficiently support the banks’ opportunities for the RBA. Interviewee 4 explained: “If an enormous amount of [KYC] information has to be obtained in every situation, regardless of how the bank itself assessed the need, we are in a difficult situation”.

“The maturity of the organization greatly affects the proportionality of risk management measures.” (Interviewee 10)

The second emerging theme was the maturity of the bank’s risk management. The results show that the maturity consists of several factors, the most significant of which were well-developed controls and processes. These include technology, the knowledge of the bank’s employees and clear internal instructions for customer communication. Based on the interviews, there are differences between the banks’ readiness and maturity within the same market area in Finland.

The results show that the maturity of a bank’s risk management advances justified risk decisions, which consequently support the balancing. Interviewee 10 also stated that sufficient resources for risk management support proportionate actions toward customers. Interviewee 10 explained: “If there’re too few resources [for AML/CFT], then it can lead to […] having to restrict [customers] in situations where it would not be necessary”.

According to the results, risk management should not be simplifying; instead, it should consider different angles of the customer case. For example, Interviewee 6 said that banks should emphasize the right to equal banking services in their AML/CFT training. Internal training is an important factor in building knowledge and understanding among the bank’s employees. However, according to Interviewees 5 and 6, the responsibility for how to act in different situations should not rest on the individual employee; the organization should have clear structures and instructions to follow. The structures should ensure the harmonization of the Act on Preventing Money Laundering 444/2917 (2017) and the Terrorist Financing and Non-discrimination Act in Finland (Non-discrimination Act in 1325/2014, 2014). In addition, Interviewee 6 emphasized that banks need to ensure they do not profile customers on the wrong basis or take action based on prejudice. To understand the behavior of customers, banks need to understand changes in society, such as customers’ diverse revenue sources, as working life changes.

Many of the experts considered the bank’s customer communication an important part of the maturity of risk management. Interviewee 7 mentioned that in some cases, banks do not sufficiently inform customers about AML/CFT measures that affect their use of services. Furthermore, Interviewee 9 noted that customers do not necessarily understand the background behind the bank’s exit decision and stated that customers should be given better opportunities to justify their behaviour or need for banking services.

“[In joining forces] there would be synergies, costs effects, but it would also for real enhance the prevention of money laundering.” (Interviewee 11).

Finally, the results show that there is a need for better collaboration and alignment among the banks in Finland, leading to the third theme. A common approach across banks was considered valuable to ensure that AML/CFT measures are proportionate, not just at one bank but in society as a whole.

Interviewee 11 pointed out that banks should have a common responsibility to retain a high-risk business relationship with customers, because otherwise, the risks could be unevenly distributed in the market area. Interviewee 11 explained, as an example, that if some banks make de-risking decisions and exit a high-risk customer group, these customers would turn to other banks. This can be an issue, especially in a small market area. Additionally, Interviewee 2 shared the view that ideally, banks should not have different courses of action in the fundamentals of AML/CFT.

According to the results, banks face pressure to do enough – but not too much – in financial crime prevention. Many interviewees felt that the expectations toward banks are contradictory and the current AML/CFT work of banks is not as effective as it should be. Interviewees 1, 2, 10 and 11 agreed that clear and unequivocal regulation and guidance from authorities play a key role in proportionate AML/CFT and enable alignment between banks’ measures. Interviewee 1 explained:

Many interviewees highlighted the need for better collaboration between banks and opportunities to share information. Interviewees 8, 9 and 11 hoped that banks could share more information with each other, and interviewees 10 and 11 expressed the need for sharing more information with the local FIU.

Based on the previous studies (Ofoeda, 2022; Urooj, 2024), AML/CFT regulations and FATF compliance can contradict with the goals of FI, causing conflicting expectations of banks in developed countries. This study strengthens this claim by showing that in the everyday work of banks, the interests of AML/CFT and FI are conflicting, thus validating the need to find ways to manage the conflict.

This study contributes to the discussion by presenting three themes that include practices and processes through which the conflict can be managed in the banking sector, particularly in Finland. These themes also have mutual connections. The first theme, the principle of least harm, provides the fundamentals of AML/CFT measures so that as little harm as possible is caused to FI. Hence, the principle of least harm is the main finding of this study, and the two other themes support the implementation of these fundamentals.

Ozili (2020b) has presented the public good theory, where individuals and small businesses should have unrestricted access to financial services. The main finding of this study, the principle of least harm, supports the theory by providing evidence that banks should aim to take risk-based measures that cause as little harm to customers as possible. Banks need to find new ways to control the risks with internal controls that are not visible to customers. According to the EBA (2022), in certain situations, offboarded customers may not be able to open a business relationship with another bank either, causing financial exclusion. Therefore, instead of exiting high-risk customers, the aim should be to retain the business relationship by applying targeted controls, such as enhanced monitoring or applying restrictions only to certain selected banking services. In addition, retaining even those customers with the highest risks enables their transactions to be tracked and, if needed, reported to the FIU. The responsibility to maintain such customers should apply especially to large banks, which have ample resources to maintain enhanced measures. However, contrary to the public good theory, this study shows that banks must still have the opportunity to exit a customer as the ultimate measure if other controls do not sufficiently mitigate the risks and the residual risk is unacceptable, for example, if clear indications of criminal activity are observed. Opening the doors to everyone would expose banks to significant ML/TF risks and likely compel them to exceed their risk appetite.

The second theme, the maturity of risk management, provides practices for banks to ensure their capability to implement the principle of least harm. Banks need to ensure that they have well-developed processes and technology in use and enable risk-based decisions in AML/CFT, even if customer volumes are high. It is crucial to ensure that employees have the competence required to balance various risks in risk management, not only focusing on mitigating ML/TF risk but also addressing the impact of this mitigation on FI. Effective AML/CFT is a valuable goal in society as well as at the level of an individual bank, but it does not outweigh all other priorities; banks have an important role in providing financial access within the population, and this must be considered in risk management measures.

Based on the findings of the third theme, for a single bank to be able to follow the principle of least harm and maintain a business relationship with high-risk customers, there is a need for a common approach across banks in the same market area. The risk appetite reflects the risk exposure that a bank is prepared to accept (Dill, 2021), and banks in the same market can have different risk appetites reflecting their business strategies. However, according to the results, alignment on restrictive AML/CFT measures would be beneficial from a FI perspective. Such alignment would ensure that high-risk customers are not unevenly distributed among banks, preventing some from being forced into excessive risk-taking. Regulation and guidance from authorities should advance common practices within the banking industry and address the conflicting expectations banks currently face. Additionally, improved legislation enabling information sharing among banks as well as between banks and authorities would facilitate effectiveness and proportionality in AML/CFT.

The purpose of this study was to understand the practices and processes through which the conflict between AML/CFT regulations and FI can be managed. Based on the research findings, banks can manage the conflict by implementing the principle of least harm in AML/CFT measures. Mature risk management practices and processes, as well as collaboration and alignment within the banking sector, support the implementation.

The main finding of this study, the principle of least harm, provides the AML/CFT fundamentals for banks. It proves that banks should follow the RBA and aim at AML/CFT measures which are the least restrictive for customers. As a core principle, the primary aim of risk management should be to maintain business relationships also with high-risk customers by applying only targeted controls. An exit decision should be the ultimate measure if the residual risk in unacceptable.

The second theme, the maturity of risk management, provides banks practices to enhance their risk management, enabling the implementation of the principle of least harm. These practices include developed controls and processes that enable making risk-based decisions, internal training and instructions to ensure a comprehensive risk understanding as well as clear and coherent customer communication.

The third theme, the common approach and responsibility, provides recommendations particularly for regulators and authorities on how to ensure that an individual bank can successfully follow the principle of least harm. It shows that collaboration and interaction within the banking industry, including information sharing, would advance effective and proportionate AML/CFT measures. A shared responsibility to retain high-risk customers would ensure an even distribution of risk among banks in the same market area. Clearer regulation and guidance from authorities would support the implementation of common principles and practices.

This study has certain limitations arising from the research method. Interviews inherently pose a risk of bias, as interviewees share their own subjective perspectives. Furthermore, qualitative analysis relies on the researcher’s interpretations of the world, which introduces the risk of preconceptions influencing the findings. There are also limitations on how the results can be generalized. The data were collected from organizations operating in Finland, and if the results are to be generalized to equivalent societies, such as the other Nordic countries, cultural and legislative differences must be considered. In addition, even if the study highlights the need for legislative improvements, for example, in information sharing, it does not offer detailed suggestions for regulatory changes. Such suggestions, as well as how increased AML/CFT regulations have impacted FI in different developed countries, would be a fruitful area for future research.

The author wants to thank the funders Liikesivistysrahasto, Nordea Pankin säätiö, Säästöpankkien Tutkimussäätiö and Vakuutustiedon Kehittämissäätiö for supporting this research. The funders have provided financial support, allowing the author to take study leave from her regular duties, facilitating data collection, analysis and the writing of this article.