The first question any firm should ask before deploying AI in a financial crime (FinCrime) context is a deceptively simple one: what data do we actually have, and where does it come from?
What data do we actually have?
In practice, FinCrime teams typically draw on a wide range of data sources and the diversity of those sources creates complexity that is easy to underestimate.
Internal sources might include onboarding data captured through KYC processes, transaction records from core banking or payment systems, alert and case management data from TM platforms, and customer communications or behavioural data from other channels such as internal chat logs (Slack, Teams), geolocation data, IP addresses and device identifiers. External sources might include sanctions and PEP lists from screening vendors, adverse media feeds, commercial data enrichment providers, corporate records such as Companies House filings (useful, for example, for verifying SIC codes and company officers), open-source information such as web searches and company websites, and for firms with crypto exposure, blockchain analytics outputs.
Each of these sources has its own format, update frequency, quality characteristics and coverage gaps. The challenge for firms is not simply assembling these sources but understanding how they interact, where they overlap, where they contradict each other, and what happens to AI outputs when a key source is missing, stale or unreliable.
How is data being stored?
The way data is stored, its architecture, accessibility and structure has a direct bearing on what AI can do with it. Many firms, particularly those that have grown quickly or through acquisition, hold data across multiple disconnected systems: customer records in one platform, transaction data in another, case management notes in a third. These systems may have been integrated at a surface level, enough for human analysts to navigate between them but not in a way that makes the underlying data accessible to AI tools without significant engineering work.
The result is that AI systems may be able to see some of the picture but not all of it. Worse, they may not be able to signal what they cannot see which produces outputs that appear confident but are based on incomplete inputs.
How is data kept up to date?
A data source that was accurate at onboarding may not be accurate six months later. A customer risk profile built on transaction history from eighteen months ago may not reflect how that customer behaves today. For AI systems that depend on current, accurate data to produce reliable outputs, data freshness is not a technical detail, it is a material risk factor.
This is particularly acute in FinCrime contexts where customer circumstances change, beneficial ownership structures shift, businesses expand into new geographies, transaction volumes grow or contract significantly. Where periodic review cycles are long, or where trigger-based reviews are not reliably initiated, the data an AI system is drawing on may be materially out of date without anyone having explicitly flagged that as a problem.
What happens when data is missing?
Missing data is not an edge case, it is a routine feature of real-world financial crime operations. A customer may not have provided certain documentation. A transaction counterparty may be in a jurisdiction where data coverage is limited. A field may have been populated inconsistently across different onboarding cohorts.
This is where the risk becomes most acute. Where data is absent or incomplete, AI systems and investigators alike are forming assessments without a full picture of the client, their profile or their use of the account. Key risk indicators go undetected, not because the risk isn't there, but because the data needed to surface it never made it into the system. During an assessment or review, those gaps mean that the conclusions drawn may be materially incomplete, and the firm may have a false sense of confidence in risk ratings that were never properly grounded in the first place.
Should models be capable of evaluating their own data quality?
A more sophisticated question, and one that is increasingly relevant as AI matures in FinCrime contexts, is whether models should be capable of assessing the quality of the data they are consuming and adjusting their behaviour accordingly.
Rather than treating all inputs as equally reliable, a data quality-aware model maintains an assessment of data quality at the source or record level and uses that assessment to weight outputs, flag uncertainty, or escalate cases where data quality falls below a defined threshold for example, data collected through a trusted ID&V provider should be ranked as more trustworthy than data taken from publicly available sources such as Companies House. In practice, this means a model that produces a confident risk score when all key fields are populated with recently verified data, but flags a case for human review when critical fields are missing or stale rather than producing an output that appears equally certain in both situations.
This capability matters for two reasons. It makes AI outputs more reliable by surfacing the cases where the model is effectively working with one hand tied behind its back. And it supports better governance by making data quality limitations visible to decision-makers, rather than absorbing them silently into a score that a human reviewer has no reason to question.
Data enrichment as a practical response
Where internal data is incomplete, data enrichment supplementing internal records with external sources or revised internal sources can be a proportionate and practical response. In a FinCrime context this might involve cross-referencing customer records against commercial databases, incorporating open-source intelligence to fill gaps in adverse media or beneficial ownership coverage, or drawing on blockchain analytics for customers with crypto exposure.
Enrichment can meaningfully improve the completeness of the picture AI systems are working from. But it is not a substitute for good internal data management, it is a complement to it. Firms that use enrichment to paper over fundamental gaps without addressing root causes are likely to find those issues resurface, often at the point where it matters most.
Final thoughts
The data management questions explored in this piece are not preliminary work to be completed before the real AI project begins. They are the AI integration project, or at least the part that determines whether everything else will succeed or fall short.
Firms that take these foundations seriously, and build the operational disciplines to maintain them over time, will find that AI delivers on its potential more reliably and more defensibly than those that treat data management as a problem to be solved later. The firms that don't will find themselves in reviews and assessments forming conclusions from an incomplete picture and in financial crime, an incomplete picture is not a minor inconvenience. It is a risk in itself.
FINTRAIL & Cosegic supports FinCrime and compliance teams with data readiness assessments, AI integration advisory and broader financial crime programme design. If you would like to discuss how these themes apply to your firm, please get in touch with our team.