The AML Spiral: Why It Only Turns One Way and Where It Stops

Ten years ago, enhanced checks happened to correspondent banks, offshore structures and clients from countries on a risk list. Today a pensioner who has sold a garage gets a letter asking where the money came from, and the owner of a small shop learns that his twenty-year relationship with his bank is “under review”. I run a licensed corporate service provider and see this system from the inside, so I am asked one question more and more often: where is this going, and is there a limit?

Let me say one thing first: I fully support the fight against money laundering. But every system has another side, and that side deserves a look too.

Three terms will keep coming up. AML, anti-money laundering, is the body of rules against laundering criminal money. KYC, “know your customer”, is the check a bank runs before it opens an account and for as long as it keeps it; the law calls it customer due diligence. De-risking is a bank dropping a client, or a whole category of clients, not for anything they did but because serving them is considered too risky and too expensive to check; the press calls it debanking. What to do when a bank closes your account deserves its own article. This one is about the spiral that makes de-risking inevitable.

I start the clock around 2015: the EU’s fourth anti-money-laundering directive, then the Panama Papers, then the Danske Bank scandal in Estonia in 2018. One turn of the spiral has looked the same ever since. A scandal produces new rules, and the rules raise the cost of checking. Banks drop the clients who are expensive to check, demand moves to payment companies and crypto, and new rules are written for the new layer. The pattern itself is older and started at the top: the number of banks offering US dollar clearing to other banks fell from about 100 in 2006 to about 60 in 2022. Each turn since has widened the circle of people being checked.

What the AML Numbers Show

The share of criminal proceeds actually confiscated has stayed at around 1–2% for fifteen years. The UN Office on Drugs and Crime put it at less than 1% in 2011. Europol counted 1.1% in the EU in 2017 and less than 2% in 2023. In Estonia, the state confiscated about €4 million in 2024 against an estimated €458 million a year in proceeds of crime, a 2022 figure from the Ministry of the Interior. That is roughly 1%, and the comparison was made by the head of Estonia’s own financial intelligence unit, the state office to which banks report suspicious transactions. The serious defence of the system is that it raises the cost of crime and feeds intelligence to investigators, not that it confiscates; neither effect is measured against any target.

Meanwhile the inputs keep growing. In the United States, suspicious activity reports rose from more than 2.3 million in 2019 to more than 4.1 million in 2025. In the United Kingdom, they rose from 464,000 in 2017/18 to 896,000 in 2025/26. In Estonia, of 11,055 reports of suspected money laundering filed in 2024, the financial intelligence unit’s information supported or started 10 criminal proceedings, or 0.09% of the reports filed.

The fastest-growing product of the system is exclusions. According to the UK’s Financial Conduct Authority (FCA), the number of customer relationships that banks ended for financial-crime reasons rose from 45,091 in 2016/17 to 453,230 in 2024/25, more than 1,200 a day. Tenfold in eight years, while suspicious activity reports roughly doubled over the same period: better detection does not explain it. In Estonia, Eesti Pank counted 64,928 terminated account relationships in 2024, 14,884 of them with companies, though the figure includes closures requested by clients. Refusals are unambiguous: 3,739 account applications were rejected that year, 2,058 of them from companies.

One more observation points the same way. Global fines for breaches of anti-money-laundering, due-diligence and sanctions rules fell from $6.6 billion in 2023 to $3.8 billion in 2025, while closures kept rising. The two curves fit together if closing a client is how a bank avoids a fine: it gets rid of anything doubtful in advance, and the higher the stakes, the wider the definition of doubtful.

So the real question is why a system that catches little and excludes much keeps growing, with nobody touching the brake. The answer lies in who benefits.

Who Benefits and Who Pays

The spiral turns one way not because anyone wants it to, but because those who could slow it have no interest in doing so and those who would gain from slowing it have no means.

Banks: Enforcers, Not Authors

The common view is that banks close accounts because they want to. I think they more often close them because any other behaviour would be irrational. A bank has been handed the role of investigator: find out where the client’s money comes from and whom he deals with. If it misses a criminal, it is punished with a fine and a damaged reputation. If it turns away an honest company, there is no comparable liability. Under that asymmetry any sensible employee tightens the rules, because an error in one direction costs a career and an error in the other costs almost nothing. Refusing a client is not malice in this system. It is self-protection.

On top of the asymmetry comes cost. In my experience, checking a client with €10,000 of turnover takes almost as many hours as checking one with €10 million, so a small client becomes unprofitable, and so does a small bank.

Banks have tried to get out of this. Six of the largest Nordic banks built a shared customer-verification platform, Invidem, and in April 2023 decided to shut it down, because liability for each check still sat with each bank separately. Five Dutch banks built joint transaction monitoring, Transaction Monitoring Netherlands (TMNL), and from July 2024 scaled it back to almost nothing, because the new EU rules sharply restrict data-sharing between banks. The rules allow no way out, so banks do what the rules demand.

Technology will not change this. Digital identity and interconnected registers make a single check cheaper and therefore more frequent and more universal: if checking everyone is cheap, everyone will be checked. Estonia proves that the barrier is legal, not technical. We have had electronic identity since 2002, and yet banks refuse companies for lacking a strong enough “connection to Estonia”: the government removed that requirement from the e-Residency programme in 2016, while the guidelines of Finantsinspektsioon, Estonia’s financial supervisory authority, have treated lack of such a connection as a risk factor since 2018. Until liability is shared, no shared database will survive, because the question is always who is liable if the client turns out to be bad.

The Checkers: Growth as a Condition of Survival

Over ten years a whole profession has grown up inside banks, among software vendors and in supervisory bodies. At Danske Bank alone, the financial-crime unit grew from 1,500 people in 2019 to 3,600 in 2023. And I should say plainly: I am part of this industry. The licence the company holds obliges it to check clients, clients pay for it, and the supervisory requests I describe below are addressed to my sector among others. I am criticising not people but a structure I work inside.

Any structure that lives off a problem has an institutional interest in the problem not ending. That is not an accusation; it is a law of organisations. No head of department reports to the board that risks have fallen and his budget should be cut. A flat curve, for such a structure, is a threat of cuts and replacement by software, so it finds new tasks: sanctions, reputational risk, crypto, fraud.

Supervisory powers, once acquired, are rarely handed back; where their limits lie is for the courts. In Estonia in 2026, the Supreme Court held that a mass questionnaire the financial intelligence unit had sent to hundreds of corporate service providers was unlawful, and an administrative court found no legal basis for the unit to demand account statements from a bank. The unit then proposed that its powers be put on a statutory footing.

The State: Convenient and Cheap

For the state the arrangement pays off twice over. Law-enforcement work is done and paid for by banks, not by the budget; the Dutch organisation Privacy First calls this the privatisation of crime-fighting. And fines for deficient checks have become a universal lever over banks, used for sanctions and for whatever else is considered risky at the moment.

At the same time the state does not answer for results. It publishes the number of reports and the size of fines, but, the UK’s FCA returns aside, not how many accounts were closed or refused on anti-money-laundering grounds. In December 2025 the Estonian finance minister replied to a parliamentary question that no such statistics are kept, that closing an account is a bank’s business decision, and that the state cannot oblige a bank to open one. The German government gave the same answer to its parliament three months later. A spiral with no thermometer: nobody measures how many honest people it has thrown out, so nobody is obliged to react.

Ordinary People: They Pay and Do Not Understand

The last participant is the one who pays for all of it. Today the letter asking for the “source of funds” goes to a café owner or to someone who has sold a flat. To him it is not a procedure but an accusation. He does not know the words AML or KYC, and if he asks why the bank suddenly wants to know so much, the honest answer is that the law now requires it to refresh his file on a schedule whether or not anything has changed. A person who experiences a question as an insult answers so as to be left alone, so the wider the system reaches into ordinary life, the more formally correct answers it collects and the less real information. And these people have no lobby: entrepreneurs do not vote as a bloc, pensioners do not hire lawyers, and there are no statistics on the excluded. The only participants for whom the spiral is a loss have no voice, which is why nobody presses the brake.

The Spiral Repeats One Floor Down

Demand for payments does not vanish with the account. It moves.

In May 2026 the financial intelligence units of Estonia, Latvia and Lithuania published a joint study of cross-border payments, mostly by non-residents. In that segment, flows connected to Estonia grew from €105 billion in 2021 to €136 billion in 2024, of which €84 billion went through payment companies, licensed payment and e-money institutions that are not banks, such as Wise, and €33.5 billion through crypto providers. Subtracting, traditional banks account for roughly €18.5 billion. The authors, who are the supervisors themselves, say it plainly: banks dropping clients wholesale rather than case by case has pushed risk into less regulated sectors.

The supervisors are describing a two-tier system: banks for large and “boring” clients, payment companies and crypto for everyone else. But the second tier is no refuge. Payment companies hold their clients’ money in banks and depend on the banks’ risk appetite, and since 2025 they have begun closing accounts for whole categories of clients on the same grounds. A third floor already exists: payments in stablecoins, cryptocurrencies pegged to the dollar or the euro, outside crypto trading itself came to roughly $390–400 billion in 2025 by various estimates, about double the year before. Estonia has reduced its crypto sector to a minimum, from nearly 650 licences in 2021, most of them never active, to a single standalone authorisation under the new EU crypto rules by the 1 July 2026 deadline; the real demand moved to Lithuania and beyond.

Signs of a Reversal and What They Are Worth

A reversal is discussed seriously, which is itself news, but it pays to look at what exactly is reversing. Hard law, the binding rules, keeps tightening in Europe. The single EU anti-money-laundering regulation applies from July 2027. The new EU Anti-Money Laundering Authority, AMLA, has been operating since July 2025 and will directly supervise around 40 of the largest institutions from 2028. The bank account registers of all EU countries will be interconnected by July 2029, with “immediate and unfiltered” access for financial intelligence units. AMLA’s draft guidelines on ongoing monitoring would require clients to be reviewed both on a schedule and at every significant event in their lives.

Soft law, the guidelines that bind no one directly, has begun to soften. In February 2025 the Financial Action Task Force (FATF), which sets the global anti-money-laundering standards, replaced “commensurate” with “proportionate” in those standards and told supervisors to watch for over-caution by banks. The European Banking Authority (EBA) issued guidelines against unwarranted de-risking in 2023. A real shift in tone, but none of these documents changes the asymmetry of liability.

A procedural reversal took place in the United Kingdom, and it was a political decision. For contracts concluded from April 2026, a bank must give 90 days’ notice of closure and state specific reasons, with exceptions where it cannot complete its checks or suspects serious crime.

The United States went beyond procedure. A presidential order in August 2025 told supervisors to stop using “reputational risk” as a ground, in April 2026 the banking regulators removed it from their rules, and FinCEN, the US financial intelligence unit, proposed to penalise banks “only for the most serious deficiencies”. This strikes at the asymmetry itself: the state takes on part of the responsibility for the bank’s decision. But it is a decision of one administration, and it may leave with that administration.

In Estonia, the Supreme Court in 2023 limited banks’ right to close consumers’ basic payment accounts without a compelling reason; companies received nothing comparable and keep only the right to ask for the reasons. Every European reversal follows this pattern: the reasons, the process and the paperwork of a refusal are regulated, but none of them removes a bank’s right to close a company’s account on anti-money-laundering grounds, and none shares the bank’s liability. A plateau in rhetoric and procedure, not a reversal in substance. The next real test for Europe is the guidance on de-risking that AMLA must issue with the EBA by July 2027. At the time of writing it does not exist.

If Nothing Stops It: A Plateau That Drifts

Suppose nothing slows it down. The first paragraph below contains only what has already been adopted or sits in drafts; after it comes my own extrapolation.

Ten years from now. Every client in the EU has a profile that updates at every event: you changed address, received a transfer from a new counterparty, travelled to a country on a list. The account registers of all 27 states are linked, and any country’s financial intelligence unit can see all your accounts within a minute. Cash is capped at €10,000 per transaction, lower in some countries. The digital euro is live, with a holding limit so that it does not replace banks, and an offline mode “like cash” for small amounts only.

Now what I draw from that. Every payment passes through real-time scoring against that profile and is either let through or held until you explain. The infrastructure is finished, and the industry that built it is looking for uses, so the plateau does not stand still; it drifts. A bank account works like a licence: it is not taken away for a crime, it is simply not renewed, because your profile has become too expensive to serve.

The strangest thing about this world is that it does not look frightening. Most people and companies in it are served normally, and every excluded case looks like a private misfortune rather than a systemic problem. The share of criminal proceeds confiscated is still 1–2%. Nobody remembers that a bank once did not ask where you got the money for a fridge. Europe will most likely not get all the way there, because on the way the system will start reaching people who have a voice, and politicians will trim the most visible excesses. The direction will not change, because every step in the first paragraph above has already been adopted or drafted.

What Could Break the Spiral

I see five things that could realistically do it, from the one closest to the law to the one furthest from it.

First: a court that extends the protection of private individuals to companies, a ruling at the level of the Estonian Supreme Court or the Court of Justice of the EU that an unreasoned closure of a company’s account violates the freedom to conduct a business. The groundwork exists; the precedent does not. English courts have so far sent the question back to the regulator, holding in 2024 that systemic debanking is a matter for the FCA.

Second: a transfer of liability. A rule under which a bank that has checked a client in good faith is not liable for what the check did not reveal, or a shared database of verified clients for which the state, not each bank, is responsible. This is the reform that strikes at the root of the spiral. The United States has come close to it; in the EU it is not on the horizon.

Third: politics, the only brake that has actually worked for companies in Europe so far, and it worked halfway. The spiral reverses not when entrepreneurs suffer but when someone who can be heard loses an account. In 2023 Coutts, part of the NatWest group, closed the account of the politician Nigel Farage; the affair made “debanking” a household word, and within three years Britain had a law on 90 days’ notice and mandatory reasons. One loud case did what tens of thousands of closed small-business accounts could not. The downside is that once politics picks up the subject it becomes partisan: in Britain the result was procedure, in the United States substance that may not outlast the administration.

Fourth: a telling failure. Every big scandal so far, Danske and Swedbank included, has been about banks whose checks genuinely did not work, which is why every scandal ended in tightening. Large-scale laundering through a bank that met every requirement to the letter would be the first argument for revision rather than addition.

Fifth: competition between jurisdictions. The United States has exempted its own companies from beneficial-ownership reporting, the duty to tell a state register who really owns a company, while the EU is building AMLA and linking registers. If the gap persists for five years, the EU becomes an island of high compliance, and fintechs and part of the corporate world will choose their jurisdiction accordingly. Slow, but it is the only constraint that does not require a decision inside the EU.

Six Scenarios for AML in Europe

The scenarios are not mutually exclusive: the first two are one picture seen from two sides, and the rest describe what could push it one way or the other.

I write about the scenario in which the infrastructure changes purpose with care, but it cannot be left out, and independent economists have raised it before me. Interconnected account registers, real-time payment scoring and a digital currency with limits serve equally well for finding criminals and for purposes that have nothing to do with money laundering. What I rate unlikely is use against individuals by list, and even that has a precedent. In 2022 Canada, one of the calmest democracies in the world, switched this machinery by executive decision to a public-order purpose and froze the bank accounts of protest participants on the basis of police lists, without a court order and without charges. The Federal Court in 2024, and then the Federal Court of Appeal in January 2026, found that there had been no grounds for emergency measures and that constitutional rights had been infringed; the courts ruled on lawfulness, not on motive. The government has appealed, and in October 2026 the Supreme Court of Canada agreed to hear the case. The accounts had long been unfrozen, but the precedent remains.

I do not think Europe will take that road deliberately. But the spiral has never moved deliberately. Ten years ago it would not have occurred to anyone that walking into an exchange office with more than €1,000 would mean showing your passport and having your details recorded. Today that is a legal obligation for every exchange office in Estonia, and nobody is surprised any more. Infrastructure built for one purpose sooner or later finds another, and the protection against that is not trust in the current operators but legal limits written into the system itself: who may flip the switch, on what grounds, and who is accountable for it.

The closest historical analogy for the main scenario is not Prohibition, which was repealed, but the end of Swiss banking secrecy and the American FATCA law, which obliged banks worldwide to report on American clients. Swiss banks paid more than $7.5 billion in US fines over a decade, the industry survived on declared assets, and the exclusion of “accidental Americans”, people with US citizenship by birth whom French banks refused because of the cost of reporting, became an accepted cost. Prohibition was repealed because its costs were obvious to everyone and repeal had a political beneficiary. The costs of the anti-money-laundering regime are spread across millions of people, and there is always a fresh criminal to justify keeping it. So there will be no repeal. There will be a plateau.

What This Means for an Entrepreneur

A plateau is unpleasant but predictable, and the predictable can be worked with.

Plan for two tiers from the start. A company with a foreign founder in Estonia will in most cases be served by a payment company rather than a bank unless it has real operations and people in Estonia, and the e-Residency programme’s own blog explains why an Estonian bank account is not necessary for most e-residents. Then build your file before anyone asks for it, and do not treat the bank’s questions as an accusation: source of funds, the economic logic of the structure, the connection to the country where the account is opened, real counterparties, all backed by documents. The fuller and calmer the answer, the harder it is for the bank to justify a refusal, and not answering is the surest way to lose the account.

Use procedural rights where they exist. In the UK a bank must now give reasons; in Estonia a company can at least ask for them in writing, and the Credit Institutions Act requires the bank to answer unless the anti-money-laundering act forbids disclosure. Procedure will not get the account back, but it creates a record, and records eventually turn into the statistics that do not exist today. The spiral will not stop for any of us. Knowing where it is going is the one advantage left.