Do AI-based anti-money laundering (AML) systems violate European fundamental rights?

Summary Machine learning algorithms can improve the fight against money laundering and the financing of terrorism (AML/CFT) by better detecting suspicious activities by bank customers and improving the handling of AML/CFT alerts by human compliance teams. However, the introduction of machine learning in AML/CFT monitoring systems will require a careful review of their compatibility with European fundamental rights and the GDPR. This article examines how algorithmic-based monitoring systems would be analysed under European fundamental rights law, and in particular the CJEU’s case law on the processing of personal data for the purpose of fighting crime. We identified five problems: first, AML/CFT laws imposing transaction monitoring are not clear and precise enough to comply with CJEU case law and Article 23(2) of the GDPR. second, it is impossible to measure the effectiveness of algorithmic monitoring systems, thereby raising questions about their ‘strict necessity’. third, monitoring systems cover a broad a range of offences going from terrorism to tax fraud, violating the CJEU’s principle that intrusive monitoring should be used only for the most serious crimes. fourth, current transparency measures are insufficient because persons targeted by individual AML/CFT alerts are never informed that they have been targeted. finally, institutional oversight mechanisms need to be improved to ensure that questions of effectiveness of monitoring systems and compliance with fundamental rights are considered together. We suggest solutions for each of the fundamental rights problems, drawing in particular from legislation on cyber-security and intelligence gathering.