Measuring What Matters: What Does “Effective” Financial Crime Prevention Actually Look Like?

Outcomes driven regulation means increasing expectations for organisations to demonstrate how controls reduce harm, disrupt criminal networks and achieve measurable outcomes beyond merely complying with obligations. Financial crime frameworks alone are no longer enough.

Editorial Team

Financial crime is often discussed in terms of what businesses need to do to comply with obligations, such as implement controls, file reports and maintain frameworks. But how do we know this is effective in reducing financial crime?

For victims of scams and fraud, the impact rarely stops at the initial loss. It can linger in ways that are harder to quantify, whether that’s stress, loss of trust or the effect it has on relationships. Businesses see a different version of that impact, often through reputational damage and the longer-term cost of remediation. If success is measured only by what is reported or documented, it is easy to lose sight of that broader picture.

Why effectiveness is under greater scrutiny

There is a growing recognition of this with regulators and enforcement agencies. The focus is now squarely on whether actions are achieving meaningful and measurable outcomes as opposed to merely ‘tick-the-box’ compliance. But the questions must be asked: Are fewer people being harmed? Are criminal networks being disrupted? Are illicit profits being taken out of the system?

Understanding financial crime harm

One way to think about that shift is through the idea of harm. Instead of looking at activity or financial loss in isolation, it looks more directly at where financial crime is felt. That includes individuals, communities and the system as a whole.

From this perspective, it becomes clear that not all risk carries the same weight. While some activities are higher risk, they may have a relatively limited impact. Others are less visible but can have far more damaging consequences for individuals, businesses and communities when they occur. Focusing on consequence helps cut through that and brings attention back to where effort is likely to matter most.

This way of thinking is already influencing how risk is approached at a policy level. It provides a clearer basis for deciding where effort should go, based on impact rather than volume.

This is part of the context for reforms like Tranche 2. As the expanded regime comes into effect, the focus is not only on bringing more sectors in scope, but on reducing harm and creating a more consistent level of protection across the system.

What this means for organisations

For businesses, the fundamentals remain the same. Obligations still need to be met, and frameworks still matter. The difference is that there is now a stronger expectation that organisations can explain how those frameworks are actually reducing risk and harm and on measuring the reduction of loss or harm where possible.

In practice, it tends to come down to a few simple things: Being clear about which mitigation strategies are being prioritised and why, understanding what sits behind the data being reported and being able to explain how decisions are made about where to focus effort. Over time, it changes the internal conversation from reporting volumes and activity metrics to understanding where harm is occurring and whether interventions are making a meaningful difference.

Organisations need to be able to do both. Maintain a compliance approach that is clear and defensible, while also showing how their efforts contribute to reducing harm.

Measuring impact beyond compliance

Behind every scam, fraud or money laundering event, there is a real cost borne by individuals, businesses and communities. This should drive interest in finding ways to measure harm more directly. Tools like a financial crime harm index used to measure harm are an attempt to link risk with impact in a more structured way and support better prioritisation.

These approaches are still evolving and rely heavily on historical data, which means they do not always capture emerging trends or the full extent of harm. Even so, they help make the discussion more practical, particularly when it comes to explaining why certain risks matter more than others.

Taking all of this together, the underlying shift is clear. Effectiveness is no longer judged only by whether frameworks are in place and obligations are met. That is still the baseline, but there are additional questions sitting alongside it. Are those efforts actually reducing harm? Are fewer people being affected? Are fewer funds making their way back to criminal networks?

For organisations, this changes the conversation. These questions influence where they should focus their time, how they prioritise risk and how they explain the decisions they make. They provide a clearer basis for making decisions about which risks matter most and where effort is likely to have the greatest impact. It is also likely to continue to be the lens regulators apply.

Looking for practical guidance?

For organisations preparing for AML/CTF reforms and seeking to strengthen their financial crime capability, KordaMentha’s Financial Crime Academy offers a range of online training courses covering AML/CTF obligations, financial crime risks and emerging regulatory expectations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.