Key Takeaways
- Nasdaq Verafin's 2026 Global Financial Crime Report puts illicit financial activity at $4.4 trillion in 2025 - up $1.3 trillion since 2023 - with fraud scams and bank fraud schemes together accounting for $579.4 billion of recorded losses, and 90% of financial-crime professionals reporting more AI-driven attacks on their own institution over the past two years (Nasdaq Verafin, 2026).
- The UAE's Federal Decree-Law No. 6 of 2025 - already examined on this publication for its technology-licensing perimeter - separately requires regulated institutions to maintain fraud prevention and detection mechanisms, report incidents to the Central Bank, and holds management directly accountable where customer funds are lost to gross negligence (Federal Decree-Law No. 6 of 2025, cited in Facephi, 2026).
- This publication's 14 September analysis found most transaction-monitoring estates were architected for batch review, not the single-digit-second settlement windows of modern real-time payment rails - a gap that is primarily architectural, not a matter of model accuracy.
- A core-modernization business case built only on customer experience and efficiency competes for budget against every other digital initiative on roughly the same terms. A business case that can also quantify the regulatory and financial-crime exposure the investment retires is a different, and often stronger, argument to a CFO and a board risk committee.
- This is not a case for spending without discipline: not every core-modernization dollar reduces financial-crime exposure, and institutions should be able to show which specific capability gap a given investment closes, not simply invoke the regulatory backdrop as a blanket justification.
Introduction
Core banking modernization business cases follow a familiar script. Faster onboarding. Fewer manual workarounds. A better mobile experience. Lower cost to serve. These are legitimate justifications, and they are also the justifications every other digital initiative in the institution is making for its own share of a finite budget - which is precisely why core-modernization programmes so often stall in prioritisation, Stage 3 of the investment committee's process, rather than ever reaching Stage 4 approval.
2026's regulatory and loss data gives CFOs a materially different lens to apply to the same investment. Financial crime losses have grown sharply enough, and enough jurisdictions have converted real-time detection from best practice into binding obligation, that a core-modernization case can now be built - credibly, with evidence - on regulatory-exposure reduction rather than efficiency alone. That reframing does not replace the CX and cost case. It adds a third pillar that speaks a CFO's and a risk committee's language more directly than a faster onboarding flow ever will.
The scale of what's actually at stake
Nasdaq Verafin's 2026 Global Financial Crime Report, published 11 March 2026, estimates illicit financial activity at $4.4 trillion in 2025 - a rise of $1.3 trillion since the firm's 2023 estimate. Fraud scams and bank fraud schemes together account for $579.4 billion of the losses the report quantifies directly, and 90% of surveyed financial-crime professionals reported more AI-driven attacks against their own institution over the preceding two years (Nasdaq Verafin, 2026). Whatever precision caveats apply to any single global estimate of illicit activity - and they should apply, since this is inherently hard to measure - the direction and the order of magnitude are not in serious dispute: this is a growing, not a stabilising, cost category.
That growth is landing on infrastructure this publication has already examined in detail. The 14 September analysis on this site found that most institutions' transaction-monitoring estates were built for an era when a bank had hours to review a transaction before money moved, not the single-digit-second settlement windows real-time retail payment rails now operate on - and introduced the Interdiction Clock, a diagnostic that separates the problem into signal, decision and action latency, each of which must fit inside the rail's own settlement window rather than the institution's historical batch cadence. The core finding bears repeating here because it is the specific mechanism linking financial-crime exposure to core-system investment: a highly accurate fraud model that reports its verdict after a real-time payment has already settled is operationally equivalent to no model at all under the frameworks regulators are now writing.
The regulatory backdrop has teeth, not just guidance
Three regulatory developments this publication has already covered this year converge on the same underlying demand: detection and intervention capability has to live inside the payment rail's own clock, and failing to deliver it now carries financial and legal consequences, not just supervisory disapproval. Singapore's Shared Responsibility Framework places uncapped liability on institutions that have not implemented real-time surveillance and blocking. The UK's mandatory reimbursement regime has already returned £316 million to victims since October 2024, funded by industry. Australia's Scams Prevention Framework, in force from 1 September 2026, builds pre-transaction intervention obligations directly into its Banking Code.
The UAE adds a fourth, more direct data point for this specific argument. Federal Decree-Law No. 6 of 2025 - the same consolidated central bank law this publication analysed on 1 October for its technology-provider licensing perimeter - separately requires regulated institutions to maintain fraud prevention and detection mechanisms, report incidents to the Central Bank, and holds management directly accountable where customer funds are lost through gross negligence (Federal Decree-Law No. 6 of 2025, cited in Facephi, 2026). It is worth being precise about sourcing here: this summary of the law's fraud-detection provisions comes from a vendor-published commentary rather than the primary legislative text, and should be independently verified against CBUAE's own guidance before being treated as a complete statement of the obligation. What is not in doubt, because it is consistent across every regime this publication has reviewed this year, is the direction: a fraud-detection capability is moving from an operational best practice an institution chooses to invest in, to a legal obligation a regulator can enforce against, with management liability attached in at least one jurisdiction.
>> Read more: Why the UAE's New Central Bank Law Also Regulates Your Technology Partner
Reframing the business case
A conventional core-modernization business case asks: what does this investment save or earn? A regulatory-exposure-reduction case asks a complementary question: what specific regulatory or financial-crime exposure does this investment retire, and what is that exposure worth avoiding?
The two questions produce different evidence requirements, and conflating them weakens both. A CX and efficiency case is well served by cycle-time and cost-per-transaction metrics. A regulatory-exposure case needs to show, specifically, which of the three Interdiction Clock latencies - signal, decision or action - the investment closes, against which named regulatory obligation in which jurisdiction the institution actually operates in, and what the institution's current exposure looks like under that specific regime (uncapped liability, mandatory reimbursement cost, or a documented compliance gap). A board risk committee can evaluate that kind of claim. It cannot meaningfully evaluate a generic assertion that modernization "reduces risk," because that claim is unfalsifiable and every vendor makes it about every product.
Business and technology implications
For a CFO, this means the investment committee paper for a core-modernization programme should carry two separate return calculations side by side: the conventional efficiency and CX return, and a named regulatory-exposure-reduction estimate tied to the specific obligations the institution is subject to - the cost of a documented Singapore SRF gap, the UK's reimbursement economics, Australia's Banking Code intervention requirements, or the UAE's fraud-detection and incident-reporting duty, whichever applies.
For a CTO, it means the modernization roadmap should be sequenced so that the components closing a specific, named regulatory gap are prioritised ahead of components that only improve an already-compliant capability, rather than sequencing purely by architectural convenience.
For Risk and Compliance, it means being the authoritative source inside the institution for which specific obligations are currently unmet, so the business case for the fix is built on a documented gap rather than an assumed one.
A fair counterargument
It would overstate the case to claim every core-modernization dollar reduces financial-crime exposure, or that regulatory exposure alone justifies an unlimited technology budget. Much of what a core-modernization programme delivers - a better mobile onboarding flow, faster account opening, cheaper transaction processing - has no meaningful connection to financial-crime detection latency at all, and dressing up a CX investment in regulatory-exposure language because the framing is currently fashionable would be exactly the kind of unfalsifiable claim the previous section warned against. The discipline this argument requires is specificity: a CFO should be able to point to the named regulatory obligation, the named latency gap, and the named investment component that closes it - not simply invoke "financial crime" as a general-purpose justification for the whole programme.
>> Read more: Financial Crime Didn't Get Smarter. Transaction Monitoring Got Slower Relative to It
What leaders should do next
Before the next core-modernization business case goes to the investment committee, map it against the Interdiction Clock's three latencies and the specific regulatory regime the institution operates under, and separate out which line items in the proposed spend actually close a named gap under that regime versus which deliver CX or efficiency value only. Where a genuine gap exists - a signal, decision or action latency that does not currently fit inside the applicable settlement window or regulatory deadline - quantify the specific exposure (uncapped liability, mandatory reimbursement cost, documented compliance finding) rather than citing the global financial-crime figures as a general backdrop. That specificity is what turns a defensible argument into an approvable one.
The sourceCode’s perspective
In our delivery work across banking clients in Australia, Southeast Asia and the Gulf, the core-modernization business cases that clear an investment committee fastest are rarely the ones with the most polished customer-experience mockups. They are the ones that can show, specifically, which regulatory obligation the institution currently cannot meet, and which component of the proposed investment closes that gap - because that is the version of the business case a board risk committee can actually interrogate and approve, rather than simply nod along to.
Pairing the CX case with a named, evidenced regulatory-exposure case is not a marketing reframe. It is giving the CFO and the risk committee the specific evidence their own governance process requires before they can say yes. Contact us here for further discussion!
Conclusion
Financial crime losses are growing faster than most institutions' core infrastructure, and the regulatory response - across Singapore, the UK, Australia and now the UAE - has moved from guidance to binding obligation with financial and, in at least one case, personal management consequences. A core-modernization business case that only argues efficiency and customer experience is leaving a legitimate, increasingly urgent justification unused.
The institutions that will clear investment committee approval fastest through 2027 are the ones that can show, specifically, which regulatory exposure a given investment retires - not the ones that simply cite a bigger global financial-crime number and hope the board connects the dots themselves.
Frequently Asked Questions
How large is the global cost of financial crime in 2026? Nasdaq Verafin's 2026 Global Financial Crime Report estimates illicit financial activity at $4.4 trillion in 2025, up $1.3 trillion since 2023, with fraud scams and bank fraud schemes together accounting for $579.4 billion of the losses it quantifies directly (Nasdaq Verafin, 2026).
Does the UAE's new Central Bank law require banks to have fraud detection systems? Commentary on Federal Decree-Law No. 6 of 2025 indicates it requires regulated institutions to maintain fraud prevention and detection mechanisms and report incidents to the Central Bank, with management directly accountable for gross negligence over customer funds. This summary is sourced from vendor commentary rather than primary legislative text and should be verified against CBUAE's own guidance before being relied on as a complete statement of the obligation.
What is the Interdiction Clock, and how does it relate to a core-modernization business case? It is a diagnostic introduced in this publication's 14 September 2026 analysis that separates fraud-detection latency into three components - signal, decision and action - each of which must fit inside a payment rail's settlement window. A core-modernization business case built on regulatory-exposure reduction should specify which of these three latencies the investment actually closes.
Should every core banking modernization investment be justified on financial-crime grounds? No. Many modernization components deliver customer-experience or efficiency value with no meaningful connection to financial-crime detection. The recommended discipline is specificity: name the regulatory obligation, the latency gap, and the investment component that closes it, rather than citing financial-crime statistics as a blanket justification for an entire programme.
What should a CFO ask for before approving a core-modernization business case built on this argument? A named regulatory obligation the institution is currently exposed under, a specific description of which latency or capability gap causes that exposure, and a clear mapping from the proposed investment's line items to the gap being closed - rather than a general assertion that modernization reduces risk.
Reference List
Facephi (2026) Cybersecurity and digital identity in UAE banking 2026. Available at: https://facephi.com/observatory/en/cybersecurity-digital-identity-banking-uae-2026/ (Accessed: 27 October 2026).
Nasdaq Verafin (2026) 2026 Global Financial Crime Report. 11 March. Available at: https://verafin.com/news/nasdaq-verafin-2026-global-financial-crime-report/ (Accessed: 27 October 2026).
sourceCode (2026) Financial Crime Didn't Get Smarter. Transaction Monitoring Got Slower Relative to It. 14 September. https://www.sourcecode.com.au/blog/real-time-transaction-monitoring-latency-gap-bfsi (Accessed: 27 October 2026).
sourceCode (2026) Why the UAE's New Central Bank Law Also Regulates Your Technology Partner. 1 October. https://www.sourcecode.com.au/blog/uae-central-bank-law-technology-provider-licensing (Accessed: 27 October 2026).