Regional Updates

Some risks are familiar, but intensified:

• Sanctions evasion, individuals, entities, and even states restructuring transactions to bypass restrictions
• Use of intermediaries and shell structures to obscure ownership or counterparties
• Trade-based money laundering, where goods, invoices, and routes are manipulated to move value

But conflict also introduces a different layer of risk, one that is less about criminal intent alone, and more about context.

As formal financial systems become restricted or unstable, people and businesses adapt. Funds begin to move through informal channels, personal networks, or alternative systems that sit outside traditional oversight. These flows are not always illicit, but they are often opaque. This creates a fundamental challenge: opacity alone is no longer a reliable indicator of wrongdoing. 

At the same time, there is a surge in legitimate, urgent financial activity: humanitarian aid, remittances, emergency procurement. These transactions move quickly, often with reduced due diligence, creating opportunities for abuse.

This is where the challenge lies. From a compliance perspective, the issue is no longer simply identifying “bad actors.” It is distinguishing, often in real time and with incomplete information, between:

• survival-driven behaviour and deliberate evasion
• legitimate urgency and opportunistic exploitation
• complex but lawful structures and intentionally deceptive ones

In other words, the signal becomes harder to read. War compresses time, distorts incentives, and shifts how trust operates. And as a result, AML/CTF risk becomes not just a matter of controls, but of judgement.

Why Governance Struggles Under These Conditions?

If AML/CTF risk becomes harder to interpret in times of war, governance is what should hold the system together. In practice, it often does the opposite. Most governance frameworks are designed for control, not speed. They rely on structured escalation, periodic reporting, and clearly defined thresholds for decision-making. This works in stable environments, where risks evolve gradually and can be assessed with some degree of certainty.

Conflict removes that stability. Sanctions change overnight. Customer risk profiles shift within days. Transactions that would normally be flagged as unusual become commonplace. And yet, governance structures, committees, reporting cycles, approval layers and more, remain largely unchanged. The result is friction. Decisions get delayed because the right forum hasn’t met yet. Escalations stall because accountability is shared but not owned. Management information arrives too late to be useful, capturing a version of reality that has already moved on.

From a compliance perspective, this creates a subtle but critical shift. Oversight becomes retrospective rather than real-time. Instead of shaping decisions, governance starts to document them after the fact.

There is also a human dimension to this. Under pressure, people tend to fall back on process. This can create a false sense of control, where adherence to process substitutes for effective risk management. In uncertain environments, there is a natural tendency to seek reassurance in rules, checklists, and approvals. But in a crisis, rigid adherence to process can create blind spots. It can discourage escalation, slow down response times, and limit the space for judgement.

At the same time, senior management and boards are often operating with reduced visibility but increased accountability. They are expected to oversee rapidly evolving risks, while relying on information that may already be outdated or incomplete. This creates a disconnect between decision-making responsibility and the quality and timeliness of information available.

This is where governance frameworks are most exposed, not because they are absent, but because they are misaligned with the reality they are trying to control.

The challenge, then, is not simply to strengthen governance, but to rethink how it functions when information is imperfect, risk is changing in real time, and decisions cannot wait for the next reporting cycle.

What Effective Oversight Looks Like in a Crisis and How to Strengthen It?

If governance struggles in times of war, the answer isn’t simply more controls. It’s different behaviour, supported by practical shifts in how oversight actually works. In high-pressure environments, effective oversight becomes less about structure on paper and more about how quickly and clearly decisions can be made, challenged, and adjusted.

The first shift is clarity of accountability.

In many organisations, roles are defined but not always operationalised. In a crisis, that ambiguity creates delay. Strengthening oversight means being explicit about who has authority to act, under what conditions, and how that authority is exercised. This often requires simplifying decision layers and reinforcing the role of the Money Laundering Reporting Officer and senior leadership in real-time risk decisions for BCCD members and businesses operating in the region.

The second shift is tempo.

Traditional governance cycles are too slow for rapidly evolving risk. If you are navigating in this environment, moving towards shortened reporting and escalation loops, daily or weekly risk discussions, focused updates, and live dashboards becomes critical. The goal is not more reporting, but more relevant reporting: management information that supports immediate decisions rather than retrospective review.

Third, escalation needs to become more usable.

Formal escalation frameworks often exist, but in practice can be underused or delayed. In a crisis, effective oversight depends on early, informal escalation of concerns, even when information is incomplete. This requires reinforcing a culture where raising uncertainty is acceptable and expected, rather than waiting for fully formed conclusions.

Fourth, there is also a need to rebalance the role of boards and senior management.

Oversight cannot remain passive. Strengthening governance means enabling boards to engage more dynamically with financial crime risk. This can be through more frequent briefings, clearer articulation of emerging risks, and better-quality challenge. This is less about increasing volume and more about improving the substance of engagement for BCCD members and decision-makers across the region.

Fifth, technology and data play a supporting role but require careful use.

Real-time monitoring, sanctions screening updates, and dynamic risk scoring can significantly improve visibility. However, strengthening oversight also means ensuring data quality, clear ownership of systems, and governance over model outputs. In fast-moving environments, poor data can create false confidence just as easily as it can highlight risk.

Finally, oversight needs to be embedded into crisis response, not treated as a parallel process.

Compliance functions should be integrated into operational decision-making forums, ensuring that financial crime risk is considered as part of business continuity, not after it. This helps avoid the common pattern of compliance becoming reactive, rather than shaping decisions as they happen for you and your organisation.

Written by 

Riwa Haidar | Senior Analyst | TenIntelligence