FRAML: Why Fraud and AML Teams Are Converging

Fraud and anti-money laundering have traditionally been separate functions at banks, payment firms and fintechs. Fraud teams focus on preventing or recovering losses from scams, stolen credentials and deceptive transactions. Anti-money laundering, or AML, teams monitor for activity that may involve criminal proceeds and, where required, report suspicions to authorities.

That separation is becoming harder to sustain. The same customer account, payment or device may produce signals relevant to both disciplines. FRAML, a term combining fraud and AML, describes efforts to bring the functions together through shared data, tools, workflows or, in some firms, organisational structures.

What FRAML means

FRAML is not a single product or regulatory category. It is an operating model that treats fraud risk and financial-crime risk as connected problems. Its most practical form is a shared view of a customer and their activity: identity and onboarding information, account behaviour, payment patterns, linked devices, counterparties, alerts and prior investigations.

The degree of integration varies. A firm may keep separate fraud and AML teams while giving them access to common intelligence and a common case-management platform. Others may create a financial-crime investigations unit that handles both fraud and AML referrals. In either model, the goal is not simply to combine alert queues. It is to make connections visible early enough to stop harm and meet reporting obligations.

Why fraud and AML overlap

Fraud generates proceeds that criminals often need to move, disguise or convert before they can use them. A scam victim's payment may be routed through several accounts, withdrawn as cash, exchanged for cryptoassets, or sent onward to businesses that make its source harder to trace. Those movements can create classic AML indicators, including rapid pass-through activity, unusual links between accounts and transactions inconsistent with a customer's profile.

Money mule accounts sit at the center of this overlap. A mule is a person whose account is used to receive and transfer illicit funds, knowingly or otherwise. A fraud team may identify the account because it receives payments from scam victims. An AML team may identify it because it has patterns associated with layering, the movement of funds intended to obscure their origin. Acting on only one view can miss the wider network.

Authorised push payment fraud, in which a victim is manipulated into sending a payment, can also produce AML signals at the receiving institution. So can account takeover, where a criminal gains control of a legitimate customer's account through compromised credentials, social engineering or other means. Sudden changes in login behavior, new payees, unfamiliar devices, altered contact details and unusually fast outbound transfers may be both fraud indicators and evidence requiring AML assessment.

What convergence looks like in practice

A mature FRAML program starts with a shared customer risk view. This does not mean every employee can see every data point. It means authorized staff can assess relevant fraud, AML and identity signals together, with access controls and an audit trail. Customer due diligence, the checks used to understand who a customer is and their expected activity, can then inform fraud decisions as well as AML monitoring.

Shared case management is another common step. Instead of separate teams opening parallel investigations into the same account or payment, a platform can link related alerts, evidence, actions and decisions. The workflow should still distinguish the reasons for an alert. A fraud loss decision, account restriction and suspicious-activity review may have different owners, deadlines and documentation requirements.

Joined-up investigations can extend beyond a single account. Analysts may map beneficiary accounts, devices, phone numbers, business entities and payment routes to identify a coordinated fraud ring or mule network. This is particularly useful in faster-payment environments, where the first payment may be gone before a conventional, sequential handoff between teams is complete.

• Common FRAML capabilities include a unified alert and case record, with fraud and AML labels retained for reporting and audit purposes.
• Link analysis can connect accounts, devices, beneficiaries and transactions that would otherwise be reviewed in isolation.
• Shared intelligence should support rapid intervention, such as pausing a suspicious transfer or restricting an account, subject to legal and operational rules.
• Clear escalation paths are needed for regulatory reporting, law-enforcement requests, victim reimbursement and customer appeals.

The obstacles to integration

Fraud and AML are related, but they are not identical. AML programs are shaped by specific legal duties, including customer due diligence, recordkeeping, sanctions screening where applicable, and reporting to financial intelligence units. In the United States, institutions may file suspicious activity reports. Across the European Union, reporting is made to national financial intelligence units under EU and national AML rules. Fraud teams may instead be measured on prevention, loss reduction, customer friction and recovery.

These differences matter for data handling and decisions. A fraud model may prioritize speed and customer protection, while an AML investigation may require a documented assessment of suspicion. Firms must also manage privacy, data-minimization and purpose-limitation requirements, particularly under the EU General Data Protection Regulation. Sharing data internally can be justified, but it should be governed, necessary and appropriately controlled.

Legacy technology is a practical barrier. Fraud, AML, onboarding and payments systems often use different identifiers, data formats and retention policies. Team culture can be just as difficult. Fraud specialists may be accustomed to real-time action, while AML investigators may work through longer, evidence-led cases. Combining teams without aligning authority, training and quality assurance can create confusion rather than better outcomes.

Benefits, and the risk of over-combining

Done well, FRAML can help firms identify connected crime sooner, reduce repeated customer outreach and avoid duplicate investigations. It can improve decisions on high-risk accounts by placing a disputed payment, a suspicious beneficiary and an unusual account history in one context. It may also help firms preserve evidence and respond more coherently to law enforcement and regulators.

The risk is that convergence becomes a merger of labels rather than capabilities. Fraud expertise in scam typologies, authentication and victim treatment can be diluted. AML specialists may lose the time or independence needed for complex investigations and regulatory reporting. Broad data sharing can also increase privacy and access-control risks. The strongest FRAML programs therefore connect intelligence and workflows while retaining specialist ownership, clear accountability and separate controls where the law or the task demands them.