Federated Learning for AML Across Financial Institutions

Money laundering exploits the seams between banks, and privacy law is what carves those seams. GDPR and similar cross-border data rules stop banks from pooling customer records freely, which is the right policy and also the reason laundering networks can move dirty money through three institutions while each one sees only its own slice. Federated learning is the first serious attempt to close that gap without asking anyone to break the privacy law that opened it, and the early results are strong enough that banks slow to adopt it will be the ones explaining their false-positive rates to regulators in a few years.

Launderers split a large deposit into smaller amounts and route them through several banks on purpose, betting correctly that no single institution can reconstruct the full shape of the transaction from its own records. A leading international body focused on crime and drug policy once put global laundering at up to $2 trillion a year; more recent estimates narrow that to around $1.6 trillion, roughly 2.7% of global GDP. The exact figure matters less than the shape of the problem. This is a network crime being fought bank by bank, and the network wins that fight almost by default.

The cost of fighting money laundering without cross-institution visibility

Banks are pouring money into a system that catches this badly and keeps getting more expensive at the same time. Global AML compliance spend across fintechs and banks runs to an estimated $206 billion. EMEA institutions spent $85 billion in 2023 alone, and US and Canadian institutions passed $60 billion in 2024. At many firms, compliance now eats close to 19% of annual revenue, a cost center that has become a second product line nobody asked to build. That's a second product line nobody asked to build, grown out of what compliance spending has become. That's a second product line nobody asked to build.

The spending isn't buying improvement, and the numbers say so directly. Ninety-eight percent of institutions reported compliance costs rising in 2023 versus the year before. The Bank Policy Institute found staff hours on compliance work up 61% between 2016 and 2023, with IT budgets earmarked for compliance climbing from 9.6% to 13.4% of total IT spend over the same stretch. More money and more people are going into a system that's getting less efficient by most measures, not more.

Fragmented visibility across separate banks' AML screening pushes false positives to 90-95% of all alerts. Large institutions do worse than small ones on this exact metric, hitting rates as high as 95% against 42% for smaller banks, which works out to roughly 950 false alerts per million transactions processed at large institutions. Analysts spend the bulk of their working hours clearing noise from a system that was supposed to be catching criminals, not sorting through the paperwork of people who aren't.

What federated learning is and the data-sharing barrier it routes around

Federated learning trains one shared detection model across many banks without any bank ever handing over its raw transaction data. Instead of pooling records in a central database, the training runs locally, inside each bank, on data that never leaves its home server.

The loop works like this. Each bank trains a model on its own transactions, then sends only the gradients, the mathematical updates describing how the model shifted, to a central coordinator. The coordinator averages updates from every participating bank into one sharpened global model, sends that model back out, and each bank refines it further on the next round. Customer records never move at any point in that loop. Privacy here is built into the mechanics of how the model learns. It's built into the mechanics of how the model learns.

That's what makes the approach fit so naturally under GDPR's limits on cross-border data movement. Compliance and collaboration stop competing under this design; they become the same requirement, satisfied by the same architecture. Federated learning's move into AML detection is recent enough that the results are still being stress-tested. What's published so far backs up the import anyway.

What the evidence shows about federated AML detection accuracy

The number cited most often is a 30% gain in accuracy identifying suspicious activity, compared to banks working alone. That's a ceiling figure observed under favorable conditions, deserving to be read as such, and no one should expect it as an average on day one.

The surrounding evidence still points one direction. AI systems that include federated learning have cut false positives by as much as 70% in some assessments while lifting detection of serious threats by 30%. That's the false-positive crisis from the section above, solved from the same underlying signal: fewer wasted alerts, more caught criminals, no new data pipeline required.

Cross-border payments make the case hardest to argue with. Research has found a unified federated defense to be twice as effective at detecting fraud and illicit flows compared to banks running their own separate systems. That gap opens widest exactly where manual review already fails: high-volume, high-speed cross-border rails no compliance team can watch in real time.

None of this is a new idea dressed up for a new audience. One national regulator's TechSprint, an early landmark in the field, showed a 20% performance improvement from banks training jointly without ever exchanging raw data. That result remains one of the field's most-cited early reference points.

Privacy risks that survive the gradient-only architecture and the researchers addressing them

Keeping raw data local doesn't stop the gradients themselves from leaking information back to whoever holds them. Research on tabular data reconstruction, including work known as TabLeak, has shown financial records in tabular form are genuinely vulnerable to reconstruction attacks built from those gradient updates. A framework called DPxFin was built to address gradient-level privacy vulnerabilities in federated AML systems.

Membership inference attacks, in which an adversary tries to identify whether one specific person's data trained the model, serve as the standard stress test for a privacy scheme. A framework called FAML pushed attack accuracy down close to 50%, essentially a coin flip. That's the right target. A model leaking nothing useful sends an attacker back to guesswork, with no shortcut available.

Model inversion attacks aim to reconstruct training examples straight from a finished model, and the secure aggregation protocol running the training process is designed to limit what any single party can extract from the shared model updates. Its secure aggregation held information-theoretic security against a server that's honest but curious, so long as at least two participating banks stay honest. That's a real, quantifiable guarantee grounded in mathematical proof, unlike a marketing claim about "bank-grade encryption.""

Architectural advances pushing federated AML beyond the baseline

Standard federated learning has a real design flaw. Applying identical differential privacy noise to every bank punishes the ones behaving well and under-protects against the ones that aren't. DPxFin fixes this with what it calls reputation-guided adaptive differential privacy. It measures each bank's reputation by checking the Euclidean distance between that bank's local model and the shared global model, then adjusts noise accordingly: banks with high reputation get less noise applied to their updates, banks with low reputation get more noise applied to their updates, and the score adjusts dynamically rather than staying fixed. Tested on AML data under both IID and non-IID conditions using a multi-layer perceptron, DPxFin beat both standard federated learning and fixed-noise differential privacy on the accuracy-privacy tradeoff, and held up against tabular leakage attacks. Treating trust as continuous and adjustable, instead of a yes-or-no gate at the door, is the actual innovation here.

A separate approach, Hybrid Federated Continual Graph Contrastive Learning, goes after a different failure. Laundering schemes shift shape over time, and a model trained once and left alone degrades as criminals adapt around it. Continual learning lets the model absorb new patterns incrementally without erasing what it already knows, working around a known failure mode called catastrophic forgetting in sequential machine learning. The graph structure fits how laundering actually happens: spread across multiple accounts and multiple institutions at once, not sitting neatly inside one bank's books.

Research published by Manna et al. in 2026 at ICETI, the 3rd International Conference on Emerging Trends and Innovation, through Springer, tested a plainer combination: horizontal federated learning paired with differential privacy, local logistic regression aggregated into one global model. Across a three-client experiment, local accuracy landed at 69.35%, 69.95%, and 70.25%. The top client posted an F1-score of 67.47%, precision of 56.32%, and recall of 84.13%. Recall is the number that matters here. A missed laundering case costs far more than a false alarm, so a system catching the large majority of real cases, even with mediocre precision, is doing genuinely useful work.

A fourth line of research, Edge-Driven Federated Learning for Financial Data Sharing, published through EAI, tackles a more mundane constraint that still breaks real deployments: banks don't run on the same hardware, bandwidth, or data volume. It's built for uneven edge environments and adversarial conditions on top of the usual non-IID data problem, treating edge deployment as a requirement rather than a nice-to-have, for institutions that can't promise an always-on connection to a central server.

Government and regulatory engagement with federated AML

Regulators across two allied regions have put money behind this, not just interest. A government-backed challenge solicited technical solutions for financial crime prevention, with one track dedicated specifically to identifying financial crime and another aimed at pandemic forecasting. That two-government partnership signals something real: policymakers are treating privacy-enhancing technologies, federated learning included, as a credible route to catching financial crime.

In the EU, GDPR and the AI Act aren't obstacles federated learning has to work around. They're the reason its architecture looks the way it does. The fit reads as purpose-built, not lucky.

In the US, FinCEN's Federal Register notice proposed a survey to collect direct data on AML and counter-financing-of-terrorism compliance costs among non-bank financial institutions. A regulator asking whether the current compliance system is worth what it costs opens real space for federated alternatives to make their case with actual numbers, not projections.

The gap that remains is deployment. A systematic review published through Springer found cross-institution federated AML systems still thin on the ground outside trials and pilots, pointing to unresolved governance questions as a significant barrier to broader rollout, including what oversight a consortium of banks needs to satisfy regulators. The technology has cleared its hardest test already. The scaffolding of governance and liability around it hasn't caught up, and that gap, not accuracy, is the real bottleneck left standing.