Executive summary

Senior FinCrime leaders from Allianz and Generali see outcomes-based regulation, hybrid operating models, and AI-augmented human judgment as the three defining forces shaping insurance compliance. This post distills the key takeaways from SymphonyAI's recent roundtable webinar.

The growing financial crime risk in insurance

Insurance has long been viewed as a lower financial crime risk than banking, but that assumption no longer reflects reality. As such, the industry is becoming more complex than ever with regulators scrutinizing operating model effectiveness, not just policy, and technology creating real capability advantages for firms that align their people, processes, data, and AI around a coherent strategic intent. Meanwhile, firms with coordinated, intelligence-led operating models are pulling further ahead of those still running disconnected, siloed controls.

In our recent webinar session, three senior practitioners candidly spoke of the decisions shaping a FinCrime operating model that is effective today and resilient for the future:

• Lee Meng Ng – Deputy Group Chief Compliance Officer, and head of strategy and steering at Allianz SE
• Martina Cont – Group Head of Anti-Financial Crime Processes and Operations at Generali
• Charmian Simmons – Principal Strategic Advisor for FinCrime Compliance, SymphonyAI

Here are the three things that stood out most.

1. The new regulatory standard: Outcomes based rather than policy and check-box activity

The recurring theme across the discussion was the distance between a model that looks coherent on paper and one that actually works consistently across every entity, system, and team. For large, diverse groups, controls can drift over time into different risk methodologies, customer due diligence standards, screening logic, and escalation processes. Left unmanaged, that fragmentation is less sustainable under frameworks like the EU Anti-Money Laundering Authority (AMLA) regulation and mandates.

Two shifts came through clearly. The first is from rule-based to risk-based thinking. Regulators now expect a genuine understanding of a firm's own vulnerabilities, which differ from one business model and operating environment to the next. The second is from measuring activity to measuring outcomes. Counting how many alerts are generated, reviewed, or closed says little about whether the organization is identifying and mitigating real risk and being effective in preventing FinCrime.

The panel pointed to a few practices that make effectiveness demonstrable rather than assumed:

• Standardization through a central core. A consistent control framework, common data structures, and standardized monitoring, often built around a central "golden copy" with controlled local variation only where local regulation demands it.
• Independent validation over self-attestation. Moving beyond policy governance into real implementation oversight, using targeted reviews, model validation, and quality assurance to find out where gaps are isolated versus systemic.
• Traceability that holds over time. A clear line from identified risk, to the control, to monitoring of outcomes, to management action, with checks that remediation stays in place rather than quietly drifting back.

The key takeaway is that the biggest weaknesses are rarely in policy design. They show up in execution discipline, data quality, fragmented systems, and operational maturity.

2. The future operating model is hybrid with centralized intelligence but distributed execution

Both insurers described landing in the same place, a hybrid model, but arriving there from experience rather than theory.

Heavy decentralization tends to produce fragmentation in the form of inconsistent methodologies, uneven investigation quality, and limited group visibility. But go too far and you end up with excessive centralization, which creates the opposite problem - a technically standardized but operationally disconnected structure at a local level that loses the business context, local regulatory sensitivity, and agility needed for risk as it actually manifests on the ground. Even within insurance, products, customer segments, and regulatory nuances vary far more than outsiders assume.

The balance the panel converged on was to centralize the things that benefit from scale, consistency, and specialized expertise, and to keep execution close to the business:

• Centralize strategy, intelligence, standards, oversight, typology development, risk methodology, and advanced analytics, ideally in shared centers of expertise. Financial crime threats are increasingly transnational, and isolated local teams cannot see the broader patterns alone.
• Distribute operational execution, where local language, market practice, and clear management accountability matter, wrapped in strong governance and clearly defined control boundaries.

EU AMLA is asking firms to do more, and to do it differently, against ambitious timelines. A centralized KYC layer, for example, lets a firm implement an enhanced customer-understanding requirement once for the whole group, where a patchwork of local systems means changing things entity by entity at far higher cost and effort. That makes the centralization question strategic and urgent, and it is not a compliance decision alone. It needs IT, operations, the group, and the entities at the table. The right answer still depends on a firm's size, complexity, data maturity, and risk appetite, but the decision can no longer be deferred indefinitely.

3. AI earns its place when it enhances human judgment, not when it replaces it

There was strong agreement that AI is an enabler, but not a replacement for governance, judgment, or accountability. The most useful framing was using AI to augment expert decision-making, surface risk earlier, and let stretched teams cover more, rather than simply removing headcount.

Three points stood out:

• Data quality is the foundation. AI models are only as reliable as the data behind them. Poor data creates noise, a false sense of confidence, and can amplify risk rather than reduce it. Clean, certified, reliable data doesn't happen by default, getting there is its own transformation, especially given how data is held so differently across markets. 
• Keep the human in the loop by design. Effective deployments preserve principles like four-eyes review, automating early steps while leaving the final decision, and the higher-risk cases, with people. The approach should flex to the underlying risk rather than applying one model to everything.
• Automation should reallocate effort, not eliminate it. Particularly in the second line of defense, the value of automation is freeing limited expert capacity to expand the scope of controls and absorb new demands, including the wave of AMLA-driven change ahead.

Done well, AI deployment combines technology, data, and human judgment in a controlled, explainable way to strengthen effectiveness at scale, and showcase the always-on, proactive posture that regulators, boards, and internal teams increasingly expect.

The bigger picture

The thread running through all three themes is that no single component delivers a future-proof operating model on its own. Standardization without local relevance becomes bureaucratic. Centralized intelligence without distributed execution loses touch with real risk. AI without trusted data and human judgment amplifies the wrong things. The firms pulling ahead are the ones bringing people, process, data, and technology together around a clear strategic intent, and building the evidence to demonstrate it.

Watch the full session on demand to hear the panel discuss each theme in depth, and explore how SymphonyAI helps insurers build a FinCrime operating model that is effective today and resilient for the future.

‍

Related Resources:

AI-Enabled Financial Crime Prevention Toolkit for Insurance

White paper: Transforming Financial Crime Compliance in Insurance

White paper: Agentic AI & embedded risk intelligence – leader’s guide

Blog: Compliance myth-busters: Insurance edition. AML insurance – still low risk?

Webinar: Elevating Financial Crime Programs in the Insurance-Asset Management Mix: Navigating 2026 Developments, Risks, and AI-Enabled Solutions