Financial Crime Management Solutions

This is a planned Forrester category. It merges two markets Forrester has evaluated separately: anti-money-laundering solutions, most recently in Q2 2025, and enterprise fraud management. No combined evaluation has published yet. What follows is what the two predecessor markets established and what the merge changes.

A bank running anti-money-laundering monitoring and a bank running fraud detection are watching the same transactions for opposite reasons.

Fraud asks whether the customer is really the customer, and whether this payment is one they authorised. The institution loses money when the answer is no, so the incentive to detect is direct and financial.

Anti-money-laundering asks whether a legitimate customer, correctly authenticated, making a payment they fully intended, is moving proceeds of crime. The institution loses nothing when the answer is yes. It loses when a regulator later decides it should have noticed.

Those two questions produced two software categories, two teams, two vendor markets, and two sets of alerts generated from the same transaction stream. Merging the analyst coverage acknowledges what practitioners have argued for years: that the separation is an artefact of how the disciplines grew up rather than a description of how criminals operate.

The two markets being joined

Forrester's anti-money-laundering coverage runs back at least to a Q3 2019 Wave, where NICE Actimize took the highest possible scores in both current offering and strategy, with maximum marks in criteria including data integration, users and roles, watch list management and screening, case management, transaction types, reporting, and scalability by transaction volume.

The Q3 2022 edition scored fifteen providers against twenty six criteria: ACI Worldwide, Azentio Software, BAE Systems, ComplyAdvantage, Dow Jones, Featurespace, Feedzai, FICO, Fiserv, Fourthline, LexisNexis Risk Solutions, NICE Actimize, Quantexa, SAS, and Verafin.

The Forrester Wave: Anti-Money-Laundering Solutions, Q2 2025, published on 8 April 2025, scored fifteen providers against eighteen criteria grouped into current offering and strategy.

SAS placed as a Leader, positioned by Forrester for enterprises with existing SAS deployments and data science capability that want advanced AI and machine learning risk-scoring strategies, and credited with a strong framework for quantifying the return on investment of its AML programme. Forrester also noted its acquisition of synthetic data technology as likely to accelerate adoption of larger data models and generative techniques across its financial crime compliance portfolio.

NICE Actimize is reported among the Leaders in that edition alongside DataVisor and SymphonyAI, though I could confirm only SAS's placement directly from the vendor.

Hawk placed as a Strong Performer in its first appearance, on an AI-native platform whose stated differentiators are explainability and model governance.

The enterprise fraud management side is the other half of the merger, and Forrester evaluates it separately including a dedicated Asia Pacific edition. Its scope covers integration of data from payment and non-payment transaction systems, online portals, and threat intelligence, delivering transaction monitoring, risk scoring, case management, and reporting across online and offline channels.

Note the overlap in that description. Transaction monitoring, risk scoring, case management, and reporting appear in both category definitions. The merge is not creating something new so much as admitting that two evaluations have been scoring the same capabilities against different buyers.

Why they were separate

The split has a rational history worth understanding, because it explains what the merge has to reconcile.

Fraud detection optimises for speed and precision at the moment of transaction. A decision is needed in milliseconds, the outcome is measurable within days when a chargeback or a customer complaint arrives, and the model can be retrained on labelled results continuously. It is, in machine learning terms, an unusually well-conditioned problem: fast feedback, clear labels, direct financial consequence.

Anti-money-laundering optimises for coverage and defensibility over long horizons. A suspicious pattern may take months to establish, the institution rarely learns whether its suspicion was correct, and the feedback loop that makes fraud models improve barely exists. A report filed with a financial intelligence unit disappears into an investigation the bank will never hear about again.

Different time horizons, different feedback, different definitions of a correct answer. Two disciplines that look similar from outside and feel entirely different to operate.

What the merge fixes

The argument for combining them is that criminals do not respect the boundary, and the evidence has accumulated.

Authorised push payment scams are the clearest case. A victim is manipulated into sending money themselves. There is no fraud in the classic sense, because the customer authenticated correctly and authorised the payment. The receiving side is the money laundering problem, because the funds are proceeds of crime moving through mule accounts. A fraud system looking at the sending institution sees a legitimate transaction. An AML system looking at the receiving institution sees a new account with unusual velocity. Neither alone reconstructs the event.

Mule networks generally sit in the same gap. The accounts are opened by real people with real documents, often recruited rather than stolen, and their behaviour is anomalous only in aggregate across institutions.

Synthetic identity is the third. A fabricated identity built from a mix of real and invented elements, nurtured over months to establish credit history, defeats controls designed to detect stolen identities because no victim exists to report anything. Whether that is fraud or laundering depends on what the identity is eventually used for, which is not knowable at onboarding.

Bringing the data together produces genuinely better detection in all three cases. The fraud signal about how an account behaves and the AML signal about where its money goes describe one picture.

What the merge does not fix

The harder problem is that the two disciplines are measured differently, and combining the software does not combine the incentives.

Fraud has a profit and loss. A fraud team can state what it prevented, what it cost, and what the false decline rate did to revenue. It is accountable to a business.

Anti-money-laundering has a regulator. Its output is not money saved but a defensible record: that appropriate systems were in place, that alerts were investigated, that reports were filed, and that the model can be explained if examined.

That difference explains why Hawk leads with explainability and model governance rather than detection rate, and why it is a credible differentiator. In fraud, a model that catches more is better and nobody asks how it works. In AML, a model nobody can explain to a supervisor is a liability regardless of what it catches.

It also explains the industry's most persistent operational complaint. False positive rates in AML transaction monitoring are notoriously high, with the overwhelming majority of alerts closing without a filing. Under a fraud incentive, that rate would be attacked hard, because every false positive costs money. Under an AML incentive, tuning thresholds down is a decision someone has to defend to an examiner after the fact if something is missed, so the rational institutional choice is to over-alert and staff the review queue.

A merged platform does not resolve that. It puts both models in one place, where the fraud team's pressure to reduce noise meets the compliance team's incentive to preserve it.

The uncomfortable effectiveness question

There is a broader debate about this category that any honest write-up should acknowledge.

Widely cited estimates suggest that only a small fraction of laundered funds are ever interdicted, and academic critics of the anti-money-laundering regime have argued that the global system imposes very large compliance costs relative to the criminal proceeds it actually recovers. Those estimates are contested, the underlying figure for total laundering is itself an approximation, and the counterfactual is unknowable, so the debate does not resolve cleanly.

What is not contested is that the compliance costs are substantial and that they fall on institutions rather than on the state.

This matters for reading the category because it clarifies what the software is optimising. A vendor competing on regulatory defensibility, audit trail quality, and explainability is responding accurately to what its buyers are accountable for. A vendor competing purely on detection performance is solving a problem its buyers care about, but not the one that determines whether they get fined.

Merging with fraud management shifts that balance somewhat, because fraud brings a profit-and-loss discipline into the same platform. Whether that changes institutional behaviour or simply produces one system serving two unchanged incentives is the open question the merged category will eventually answer.

The regulatory direction

The pressure behind this market keeps increasing rather than stabilising.

The European Union has established a dedicated anti-money-laundering authority intended to bring more direct supervision and greater harmonisation across member states, replacing a patchwork of national implementations that produced inconsistent standards. That is a structural change in how European institutions are examined, and it is the most significant development in the region in years.

Alongside it, expectations on screening have broadened: continuous rather than periodic monitoring, complete and multilingual data coverage, and the ability to keep pace with sanctions regimes that now change at a speed the previous generation of systems was never built for.

Instant payment schemes compound all of it. When settlement is irrevocable within seconds, the window for intervention closes, and a monitoring architecture designed around batch review of completed transactions is structurally too late.

What to expect from the combined evaluation

When Forrester publishes the merged category, three things will be worth reading closely.

Whether the criteria weight detection or defensibility, because that choice reveals which buyer Forrester considers primary. An evaluation weighted toward model performance describes a fraud market. One weighted toward explainability, audit trail, and regulatory reporting describes a compliance market.

Which vendors survive the merge. The two predecessor lists overlap substantially, with several names appearing in both, but the pure-play specialists on each side face a category that now rewards breadth over depth.

And how it handles the criteria contraction already visible. Anti-money-laundering criteria fell from twenty six in 2022 to eighteen in 2025, which normally indicates capabilities becoming table stakes. A merged evaluation adding fraud scope to a narrowing AML criteria set will have to decide what it stops measuring.

Until then, the two existing evaluations remain the relevant research, and the practical caution is the same one that applies whenever a category merges: a Leader in one predecessor market is not automatically strong in the other, and vendors will cite whichever placement suits the conversation.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy. Nothing here is financial or legal advice.