Financial intelligence (FININT)

Table of contents

What is financial intelligence (FININT)?

Financial intelligence (FININT) is the collection, analysis, and dissemination of information about financial activity to understand who is moving value, how, and to what end. Analysts build FININT from bank and payment records, regulatory reporting, trade documentation, and cash reporting, then disseminate their findings that an investigator, analyst, regulator, or policymaker can act on.

Financial intelligence sits alongside is one component of intelligence and can be used in collaboration with all other disciplines. What distinguishes it from others is its source material: correspondent-banking records, wire and payment messaging, cash transaction reports, trade documentation, and the suspicious activity reports (SARs) financial institutions and financial intelligence units exchange. The industry sometimes uses the near-synonym "financial crime intelligence" to describe the same discipline.

While corporate registries, court filings, property records, and published trade statistics are public information, the majority of financial intelligence is not open source. SARs, subpoenaed account records, and the reports financial intelligence units exchange with each other are typically legally restricted, and in many jurisdictions disclosing that a report exists is itself a criminal offense.

‍

How is financial intelligence different from anti-money laundering (AML) compliance and transaction monitoring?

Compliance monitoring and financial intelligence draw on overlapping data to answer different questions: the former generally prospectively and by obligation, and the latter generally retrospectively and by investigative need. The sharpest difference is what "good" means: compliance is measured by process (reports filed); intelligence, by outcome (harm reduced).

‍

	Compliance monitoring	Financial intelligence
Primary driver	Legal obligation; the institution must monitor whether or not anything is wrong	An investigative question; work starts because someone needs an answer
Time direction	Prospective; screening activity as it happens, against rules set in advance	Retrospective; reconstructing what already happened, without knowing in advance what will matter
Data scope	What the institution can see about its own customers	Records and reporting across institutions, jurisdictions, and other intelligence disciplines
Unit of work	The alert, then the case, then the filing decision	The subject, the network, or the typology
Output	A disposition and, where warranted, a filed report	An actionable finding, lead, or product disseminated to a consumer resulting in an output or decision
Success measure	Coverage, timeliness, and defensibility of the program	Whether the finding was correct, actionable, and held up

‍

What does the process of gathering financial intelligence look like?

1. Collection

Collection has two layers. A passive feed which arrived by obligation being suspicious activity and suspicious transaction reports, currency and cash transaction reports, and cross-border wire reporting. Passive collection is high in volume. Secondly, there is tasked collection, directed by an analyst or investigator, where records are obtained under legal authority (e.g. account records, payment messaging, and subpoenaed documents) and by open records (e.g. corporate registries, litigation, property filings, and published trade data). An analyst rarely chooses the kind of data they collect; they must typically work with whatever the reporting regime and legal process produce.

2. Processing and structuring

Analysts normalize account, entity, and instrument identifiers across formats and jurisdictions; reconcile name variants and transliterations; resolve parties to entities; and preserve timestamps and provenance. This stage dominates the effort, because financial records are formatted for settlement — not analysis — and the same person appears differently in every system that touched them.

3. Analysis

Analysts reconstruct flows, map counterparties, and look for anomalies and patterns, aiming to find the party controlling the money rather than just the one moving it. An anomaly is a question; structuring-shaped deposits often have innocent explanations, and a payment routed through three jurisdictions may be ordinary trade finance. That's why analysts attach standardized confidence language to every finding rather than presenting a pattern as proof.

4. Dissemination

A financial intelligence product goes to a consumer who can act on it. What can be shared, with whom, and in what form is set by law. In most jurisdictions, a reporting institution cannot be told what happened to a report it filed, and cannot be asked about a subject in a way that reveals a report exists. That constraint is why public-private information-sharing arrangements need a legal channel to function at all.

Financial intelligence establishes that value moved between accounts, but rarely establishes who controlled those accounts. That resolution typically comes from corporate ownership records, identity data, and other intelligence disciplines fused together in an all-source investigation.

‍

What are national financial intelligence units (FIUs)?

A financial intelligence unit (FIU) is the national agency that receives regulated institutions' suspicious activity and transaction reporting, analyzes it, and disseminates findings to law enforcement, supervisors, and counterpart units abroad. Most countries have one, serving as the connective tissue between the private sector's reporting obligations and the state's investigative capacity.

FIUs exist to solve a coordination problem: they give every reporting institution a single lawful destination for reporting, and give every country a single lawful conduit for exchanging that information across borders. The Egmont Group, an international network of FIUs, sets operational standards for that exchange and provides the secure channel through which units share information with each other.

Where an FIU sits changes what it can do with what it receives. Administrative FIUs sit inside a ministry or regulator: Financial Crimes Enforcement Network (FinCEN), within the US Treasury, receives industry reporting at arm's length from investigators, which keeps banks willing to report but places the unit a step from the case. Law enforcement FIUs sit inside a police body: the UK Financial Intelligence Unit, inside the National Crime Agency, feeds reporting straight into investigations and reaches police intelligence. Judicial FIUs sit with prosecutors and can order freezes or seizures. Hybrids combine these roles; AUSTRAC pairs the FIU function with financial regulation. Across all four, an FIU analyzes reporting, requests further information, can suspend a transaction for a set period, and refers cases onward. It rarely prosecutes or runs its own case docket.

‍

Why is financial intelligence important?

Almost every profit-driven crime eventually moves money through a recorded system. Communications can be encrypted, identities can be fabricated, and logistics can be routed through intermediaries, but proceeds have to be stored, moved, and spent — leaving behind a record held by an institution with a legal obligation to keep it.

Financial data is one of the most consistently available evidence trails across otherwise unrelated crime types, enabling outcomes like:

Network discovery: Payment relationships reveal structure that few other sources show, including who gets paid regularly, who controls disbursement, and which nominally separate entities share a counterparty.
Cross-typology reach: The same discipline works on narcotics proceeds, fraud, sanctions evasion, procurement networks, human trafficking, and terrorist financing, because all of them have to settle payments somewhere.
Sanctions and proliferation: Payment routing and trade documentation are frequently the only visible sign that a party under sanctions is being serviced through intermediaries.
Asset recovery: Knowing where value came to rest is the precondition for a freeze, a restraint, or a return to victims.

‍

How are AI and agentic crime changing financial intelligence?

Generative AI and agentic tools have lowered the cost of the two things financial crime has always needed most: a plausible identity and a plausible narrative. Synthetic and manipulated documents can defeat manual onboarding and trade-documentation review. Generated corporate paperwork can make shell entities look operational. And agentic tools enable malicious networks to open, fund, and cycle accounts across many institutions faster than any single institution's monitoring can see, a pattern that only becomes visible once data is pooled — part of the broader shift toward AI-enabled crime.

But investigators have gained ground too. Entity resolution now runs across inconsistently formatted records at a scale manual review can't reach, and anomaly detection finds structure instead of matching predefined rules. Multi-hop traversal across records, registries, and reports can happen in a single query rather than weeks of manual reconciliation. Most of that gain attacks the processing bottleneck described above, which is where most analyst time goes.

Speed only counts if the output stays sourced and auditable. Every AI-assisted finding needs a documented chain of custody back to the specific record it came from. Financial findings routinely end up in a restraint order, designation, or prosecution; an inference that can't be walked back to a source document ultimately isn't defensible.

‍

Who uses financial intelligence?

Audience	How they use it
Financial intelligence units and regulators	Triage incoming reporting, publish typologies, and decide what gets referred onward for investigation
Law enforcement and investigators	Establish that value moved, identify the party controlling it, support a production order or restraint application, and build the payment timeline a prosecution is organized around
National security and defense analysts	Track procurement and proliferation financing, sanctions evasion facilitation networks, and the payment infrastructure supporting state-linked activity
Financial crime and compliance teams	Pick up where an alert closes: escalations, network-level reviews, information-sharing requests, and exposure assessments that reach beyond the institution's own customers
Corporate security and fraud investigators	Surface insider activity, procurement fraud, vendor and payroll schemes, and third-party exposure that only becomes visible in payment records
Cyber threat intelligence (CTI) analysts	Follow the money behind ransomware, initial-access brokerage, and hosting infrastructure, where the payment trail is often the only non-technical thread available

‍

What sources feed financial intelligence?

Source	What it yields	Access reality
Suspicious activity and transaction reports	A regulated institution's own suspicion, with supporting narrative and account detail	Non-public, restricted by law; records a suspicion, not a finding
Cash and currency transaction reporting	Deposits, withdrawals, and cross-border movement above reporting thresholds	Non-public, threshold-driven; the primary detection surface for structuring
Payment and wire messaging	Originator, beneficiary, intermediary chain, amount, timing, and stated purpose for one leg of a transfer	Held by the institutions that processed it, obtained under legal authority; any one institution sees its leg, not the whole journey
Correspondent banking records	How a foreign institution reaches the domestic payment system, and which relationships sit behind it	Partial by design; nested relationships obscure the true originator
Account and customer records	Ownership, control, signatories, and beneficial owners	Obtained under legal authority; quality varies by institution and jurisdiction
Trade and shipping documentation	Invoices; bills of lading; letters of credit; customs declarations; and the price, quantity, and route they assert	Fragmented across private parties and customs authorities; often the hardest tier to obtain
Public records and registries	Corporate ownership, directorships, litigation, property, and licensing	Open source
Onchain and virtual asset data	Transfers, addresses, and counterparties on public ledgers, where virtual assets are involved	Public but pseudonymous; requires attribution before it becomes useful

‍

Several jurisdictions have built lawful public-private information-sharing arrangements, like TRM’s Beacon Network, because it’s unlikely that any single institution can see a full network on its own.

‍

What are the challenges of financial intelligence?

Challenge	Why it slows investigations	What addresses it
Partial visibility	Each institution sees its own leg of a payment	Cross-institution analysis and lawful information sharing
Identity fragmentation	The same person or entity appears differently across name variants, transliterations, and identifiers	Entity resolution across sources, with the resolution logic documented
Volume and low signal density	Reporting arrives at a volume no single analyst can read, and most of it describes lawful activity	Automated triage and anomaly detection, with the audit trail preserved
The tipping-off prohibition	Findings can't flow back to the institution best placed to act on them	Formal information-sharing channels and legal review
Data formatted for settlement	Payment and account records are built to move money, not to describe relationships	Structuring and normalization as a first-class stage
Jurisdictional friction	Authority, retention, and exchange rules differ by country, and mutual legal assistance is slow	FIU-to-FIU channels where they exist, plus realistic timelines built into the investigative plan
Suspicion is not proof	A filed report and a detected anomaly are both unproven by construction	Explicit confidence language on every assessment, and corroboration outside the reporting channel

‍

Frequently asked questions (FAQs)

1. What does FININT stand for?

FININT stands for financial intelligence, the discipline of collecting, analyzing, and disseminating information about financial activity to support an investigation, a regulatory decision, or a national security assessment.

2. What is the difference between financial intelligence and AML compliance?

Anti-money laundering (AML) compliance is a regulatory obligation: institutions must monitor customer activity and file reports whether or not anything turns out to be wrong. Financial intelligence is what happens to that reporting afterward; an investigative discipline that uses financial records, retrospectively, to answer a specific question about who moved money and why.

3. What does a financial intelligence unit do?

A financial intelligence unit (FIU) receives suspicious activity and transaction reporting from regulated institutions, analyzes it, and disseminates findings to law enforcement, regulators, and FIUs in other countries through channels such as the Egmont Group.

4. Is a suspicious activity report (SAR) considered evidence?

No. A suspicious activity report records an institution's suspicion, not a proven fact. In most jurisdictions, its existence is protected from disclosure, and it can't be treated as evidence on its own without further investigation and corroboration.

5. Why can't a bank find out what happened to a report it filed?

Most jurisdictions prohibit "tipping off" — telling a customer, or often anyone outside the reporting chain, that a report has been filed. That rule protects active investigations, but it also means the reporting institution typically never learns the outcome. Lawful public-private information-sharing arrangements exist specifically to work around this constraint.

6. Is financial intelligence open source?

Partly. Corporate registries, court filings, and property records are open source. Suspicious activity reports (SARs), subpoenaed account records, and the reports FIUs exchange with each other are not — they're legally restricted, and disclosing them is a criminal offense in many jurisdictions.

7. What is trade-based money laundering, and how is it detected?

Trade-based money laundering disguises the movement of criminal proceeds through international trade transactions, typically by misstating the price, quantity, or type of goods being shipped. In financial data, it shows up as documentary and pricing inconsistencies measured against an external benchmark, rather than as a single dramatic red flag. See money laundering for the underlying typology.