Privacy group warn of a surveillance state built on money laundering algorithms

Draft standards for private companies’ anti-money laundering monitoring could reduce fundamental rights to a mere illusion. The civil rights organization Privacy First warns of this risk in response to guidance from the EU’s new Anti-Money Laundering Authority (AMLA). The Dutch activists are calling for a clear ban on automated risk profiles. This software analyzes customer data to identify potential money laundering risks.

According to Privacy First, the initiative threatens to create a financial surveillance state. Amnesty International recently raised similar concerns. Civil society groups argue that automated profiling can be discriminatory, opaque and difficult to challenge in areas such as law enforcement, social benefits and immigration.

Private companies’ surveillance

The AMLA drafts are based on the EU Anti-Money Laundering Regulation, which is scheduled to apply starting in July 2027. The authority calls on private entities to consider using algorithms, machine learning and artificial intelligence to improve risk detection. It stresses technological neutrality and provides for human oversight, as well as opportunities to review and appeal decisions. Even so, critics warn that private companies could subject large numbers of people to comprehensive surveillance.

Automated systems face a trade-off between false alarms and missed suspicious cases, Privacy First points out. The more sensitive a system is, the more likely it is to identify potential criminals. At the same time, however, more innocent customers come under scrutiny. Privacy advocates therefore call for a risk-based approach that reduces checks on low-risk customers and focuses on high-risk groups.

The Netherlands: High costs, unclear benefits

The Netherlands is considered a testing ground for anti-money laundering monitoring. Banks there reported more than 530,000 unusual transactions in 2024, compared with just under 250,000 in 2020. The eight largest banks employed around 13,000 full-time staff for this work. Costs totaled around €1.6 billion. According to the Dutch Court of Audit, little is known about how effective the measures are.

In 2024, the Financial Intelligence Unit of the Netherlands (FIU-NL) classified only a small share of reported transactions as actually suspicious. It remains unclear how many reports involved money laundering. That makes it impossible to determine a reliable error rate.

There are also indications of discrimination. Auditors examining hundreds of reports of potential money laundering found that people with foreign-sounding last names were involved in more than 60% of cases. Mosques were asked about the purpose and origin of transactions far more often than Christian churches. The state commission against discrimination and racism therefore called on the government to stop using data-driven profiling to fight crime.

One reason for these monitoring practices is banks’ fear of steep fines from regulators. Worried about overlooking risks, they would rather rate customers’ risk too high than too low. The result is repeated requests for information and excessive checks. Based on these experiences, civil rights advocates consider digital risk profiling immature and are calling for a ban on automated analysis to detect crime. Experts such as legal scholar Carolin Kaiser consider national financial intelligence units (FIUs) far too powerful. In 2021, European Data Protection Supervisor Wojciech Wiewiórowski opposed the relevant anti-money laundering legislative package.

(vbr)