Strengthen Resilience & Compliance

Protect what matters most

Generative AI has broken the economics of financial crime. Majority of the fraud now involves AI, deepfake attacks on financial institutions have surged by orders of magnitude, and regulatory pressure is intensifying as Digital Operational Resilience Act (DORA), AI governance frameworks, and cross-border compliance are all expanding simultaneously. Financial institutions must defend against more sophisticated threats while demonstrating responsible AI use across jurisdictions.

Protect what matters most

Why AWS

143 security standards and compliance certifications; designated Critical Third-Party Provider
under DORA
Purpose-built AI services with financial-grade controls to detect anomalies sooner, reduce false positives, and speed investigations
Real-time agent observability and policy controls (AgentCore) to ensure AI systems operate
within boundaries
Adaptive, data-driven crime prevention across the full customer lifecycle from onboarding through post-transaction resolution
18+ years supporting the world’s most security-sensitive financial institutions

"AWS helps institutions proactively build scalable governance capabilities. Irrespective of the regulatory or compliance regime, embedding AI requires robust AI governance. And robust AI governance requires an organization to have capabilities to federate out accountability across the organization."

Eric Fish, Senior Manager Cloud IT Compliance, AWS

How agentic AI is strengthening fraud detection and compliance
Connecting fraud screening, sanctions checks, and audit trails into a single intelligent flow

Transforming financial crime management with AI technologies
A practical guide to how AI and ML are reshaping fraud detection, and where agentic systems take it next

Tokenized money is here to stay
Stablecoins and tokenized deposits are expanding the attack surface in real time. What security, fraud, and compliance teams need to know now

The AWS Guide for financial services risk management of generative AI
16 risk categories mapped to the controls that keep generative AI deployments audit-ready

Navigating the new threat and compliance landscape

What's changing in fraud, financial crime, and regulatory risk, and the frameworks needed to stay ahead. Take a closer look here.

The AWS guide for financial services risk management of generative AI

"At AWS, security is our top priority. AWS is architected to be the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads."

Key takeaways

16 risk categories mapped to regulatory requirements, model accuracy, and data security
Incorporates established frameworks (OWASP GenAI Top 10, MITRE ATLAS, etc.)
Practical guidance for Amazon Bedrock Guardrails, SageMaker Clarify, and AWS WAF
Recommendations for integrating AI into existing processes

Why it matters

Financial services firms don't get to experiment with trust. Generative AI introduces risks – prompt injection, hallucination, model poisoning – that sit outside traditional IT risk frameworks and require specific controls. Getting those controls right early means moving faster with confidence, not slower with caution.

Generative AI moves fast – and so do its risks. This guide gives financial services teams a clear, practical framework for identifying and managing the risks specific to generative AI deployment, from model accuracy and data security to regulatory compliance.

Read more

Deepfake-driven identity fraud has grown 2,137% in just a few years. AML penalties surged 417% in the first half of 2025 alone. Drawing on interviews with banking leaders across the globe, this report maps how AI and ML are reshaping fraud detection, KYC, and AML operations today – and where generative AI and agentic systems are taking it next.

The AI imperative: Transforming financial crime management with AI technologies

"Without AI, the sheer volume would overwhelm manual teams." Oskar Wismierski, Head of Fraud Analytics and Threat Management, NatWest Group

Key takeaways

67% of banks expect GenAI to reduce fraud losses; 74% of pioneering banks expect over 10% ROI from their most advanced generative AI initiatives by 2026
Generative AI is automating the most labor-intensive parts of investigations – delivering 30–70% productivity gains in early deployments
The biggest barriers to full-scale adoption are regulatory concerns, data privacy and legacy infrastructure – not the technology
Agentic AI could deliver 200–2,000% productivity gains

Why it matters

Financial crime is a technology arms race and standing still is not an option. The institutions pulling ahead are building layered defenses that combine rules, ML and generative AI into a single, orchestrated system. Those still relying on manual processes and siloed teams face growing regulatory exposure, rising fraud losses and an increasingly unmanageable alert burden. This report is a practical guide to closing that gap.

Read more

Stablecoins and tokenized deposits are creating new security, fraud and compliance imperatives for financial institutions. As programmable money flows across borders in real time, the attack surface expands, anti-money laundering obligations multiply and compliance frameworks struggle to keep pace. This report examines what security and compliance leaders must do to stay ahead.

Tokenized money is here to stay

"We’ve been inundated with interest and inbound dialogue from a whole spectrum of TradFi players [this year]. They’re not just coming to us for solutions, but for counsel."
Senior executive at one of the world’s largest cryptocurrency exchanges

Key takeaways

Real-time, borderless transactions demand real-time fraud and AML controls
GENIUS Act requires full asset backing, customer fund segregation, AML/KYC compliance under the Bank Secrecy Act, and regular audits for the largest issuers
Programmable money must be auditable and governed
Technology choices may need revisiting within months as regulations across jurisdictions continue to evolve

Why it matters

For security, fraud and compliance teams, tokenized money is no longer a future concern – it's an active, growing exposure. GENIUS Act, MiCA, and the UK CTP Regime are all expanding compliance obligations simultaneously. Institutions that delay building a clear strategy risk falling behind on both the regulatory and the threat landscape, as early movers establish the controls, client relationships, and proprietary infrastructure that will be difficult to replicate.

Datadog: How end-to-end observability can accelerate digital modernization in banking

FICO: Decide smarter, move faster. How FICO platform transforms financial services

PagerDuty: From resilience to autonomy. Governing the next chapter of financial services operations

Smarsh: AI-powered compliance and governance

Splunk: Harnessing AI to meet today’s security threats while enabling the business

Partner insights

AWS partners are at the forefront of financial services innovation, building solutions that help institutions modernize faster, deploy AI at scale, and stay ahead of an industry that never stands still. You can explore their work here.

S&P Global: Ensuring AI agent safety with Amazon Bedrock AgentCore
Near real-time observability across all deployed agents

WEX: Building a secure agentic AI platform
AgentCore helped WEX democratize agent development securely and at scale

Nubank: Scaling fraud detection to 450 million events daily
Real-time fraud scoring decisions on every transaction while maintaining high availability

Defending at scale

Real-world proof of how financial institutions are deploying AI to detect fraud, enforce compliance, and safeguard operations. Read the results below.

In scaling agentic AI, S&P Global faced three challenges early: regulatory compliance, unpredictable costs, and humans becoming the bottleneck. The solution came with common agentic reference architecture, a safety control panel for session-level intervention, and a FinOps circuit breaker that shuts down runaway spend before it becomes a crisis.

S&P Global: Ensuring AI agent safety with Amazon Bedrock AgentCore

"We can only move fast if we have real confidence that the agents we're deploying are not going to go rogue and we're going to be able to control them with the necessary guardrails in place." Todd Jones, VP, Cloud Engineering and Shared Services, S&P Global

Key takeaways

A common reference architecture gets all developers building the same way
The safety control panel operates at four levels: session, user, customer, and agent–precision intervention or full shutdown
Circuit breaker and control panel together create defense in depth – one deterministic, one human-in-the-loop
Terminated sessions are added to a control list, preventing them from being restarted even if the session ID still exists

Why it matters

Most organizations focus on what agents can do. The S&P Global session demonstrates the equal importance of what agents can be stopped from doing. In a regulated environment where a rogue query can spike costs or trigger a compliance breach, governance architecture is as important as the agents themselves.

Nubank serves 131 million customers across Brazil, Colombia, and Mexico. Protecting that scale in real time means processing 500 million fraud detection events every day, across 400 policies and 300 features, with 5 million requests per minute. The Defense IO team built the engine behind it: a declarative, cloud-native fraud platform that evolved from engineer-heavy code deployments to a self-service system where fraud analysts can create and modify policies in real time.

Nubank: Scaling fraud detection to 450 million events daily

"If we create a rule the wrong way, we might be stopping millions of customers from being able to do their transactions. We want to make sure that all the protections we have make sense." Defense IO Team, Nubank

Key takeaways

Policy release time went from 3-5 weeks to 1-2 days, and the number of defense builders grew from 10 to 50+ with 300+ policies in production
Shadow mode lets new policies run against live production traffic asynchronously
An MCP-based agent plugin now lets fraud prevention teams create and modify policies through any AI interface
Quality and security are the scaling bottlenecks – every rule change at this volume has operational consequences for millions of customers

Why it matters

Most fraud platforms are either fast or controlled. Nubank's evolution from code-centric to declarative to AI-assisted shows a credible path to both. The ability to ship fraud protection at the speed of threat – without breaking transactions for millions of customers – is a genuine competitive differentiator.

WEX wanted to scale AI-driven productivity without compromising security or compliance. Using Amazon Bedrock AgentCore, the company deployed a virtual engineering assistant and a secure platform for agent development. The result is growing agent adoption, lower costs, and a foundation for innovation at scale.

WEX: Building a secure agentic AI platform

"AgentCore had the primitives, the security, the controls, the guardrails – everything we needed to allow folks to build their own agents."
Ed Taggart, Senior Director Cloud Engineering, WEX Inc.

Key takeaways

Three governance layers – registry, gateway and policy – keep agent deployment controlled and auditable at scale
Every agent action is traceable end-to-end via OpenTelemetry – a full audit trail
On-behalf-of identity means agents can only access what the requesting user is authorized to see
WEX's Agent Builder turns a plain language description into a spec doc and GitHub repo – agents building agents

Why it matters

The hardest part of scaling agentic AI in a regulated business is governance – not the technology. WEX's platform shows what it looks like to solve that problem in production: approval workflows for every tool, deterministic policy enforcement, immutable audit logs, and identity controls that follow the user, not the agent.