Manual Review Still Weighs Heavily on Europe's Fraud and Compliance Teams

Europe’s financial institutions are not struggling to understand what regulators want. Instead, they strain to keep up with everything they're required to deliver.

That is one of the clearest signals from Sumsub’s The State of European Financial Services: 2026 report, based on responses from 804 financial services professionals across Europe. The respondent base is heavily operational, with most respondents working directly across fraud, compliance, AML, investigations, systems, and workflows.

Only 17% identify interpreting new regulatory requirements as a leading challenge. Staff capacity ranks much higher, at 36%, followed by integrating new controls at 34%, budget at 33%, and data quality at 32%.

If teams already understand the requirements, adding more guidance or another compliance tool does little to solve the problem. The pressure is increasingly about execution: processing alerts, investigating cases, connecting data, producing evidence, and making decisions quickly enough, because much of that work still requires a human.

Most compliance work is still manual

Manual review is the clearest sign of a problem, and too much of it is the biggest operational weakness reported by financial institutions – cited by 36% of respondents, followed by slow investigations and false positives.

That creates a particular problem for financial crime teams. The issue isn’t the volume of risk they need to identify, but that risk still arrives in a form an analyst must interpret, investigate, document, and resolve.

Some parts of the process are already automated. FIU, SAR, and STR preparation are good examples. Half of respondents say these processes are partially automated, while 23% report full automation. Yet, the report finds that this hasn’t necessarily made the wider compliance workload easier – automating the final reporting step doesn't remove the work that happens before it.

False-positive alerts still need to be reviewed. Investigations need to be completed on time. Customer information still needs to be checked, evidence gathered, and policies kept up to date with regulatory changes.

In other words, automation has reached parts of the paperwork without necessarily changing the workflow that produces the paperwork.

That distinction is likely to become more important as financial crime controls have to operate faster and across more parts of the customer lifecycle. Fraud is often detected after onboarding, during account access, payment initiation, or even after a customer complaint. The control environment therefore has to keep working after the initial identity check, rather than treating onboarding as the end of the risk decision.

AI agents could take on some of the work

This is where AI agents become relevant: the obvious temptation is to ask where AI can be added to an existing fraud or compliance stack. However, that’s probably the wrong starting point.

The more useful question is which parts of the workflow are controlled enough for an AI system to act within them.

Plenty of repetitive work doesn't require an analyst to start from scratch every time. An agent could help triage alerts, review case files, check policies, identify anomalies, gather relevant evidence, or prepare an investigation for human review. These tasks consume time without necessarily requiring a final autonomous decision.

That could be particularly relevant in areas where financial institutions are still building capability for including these systems. The report identifies real-time decisioning, behavior monitoring, and network analytics among the areas with the largest investment gaps.

But adding an agent to those workflows also changes the requirements around control.

Once an AI system starts ranking alerts or preparing a recommendation, an institution needs to know what happened inside the workflow. What evidence did the system use? Which rules or permissions governed its action? When should a human take over? Can the decision be reconstructed later?

These questions are less interesting than the promise of autonomous AI, but they’re much closer to the practical problem financial crime teams have to solve.

Automation only works when the underlying workflow does

There’s another constraint that AI cannot solve on its own: fragmented infrastructure.

Only 9% of organizations surveyed operate an integrated fraud and compliance platform, while 18% have fully real-time integrated data covering identity, fraud, AML, and payments. That means many institutions face gaps between individual controls.

A fraud signal may sit in one system, customer information in another, and transaction activity somewhere else entirely. An investigator then has to bring those pieces together before making sense of the alert.

An AI agent placed on top of that structure doesn’t automatically create a connected view. If the underlying data is incomplete, delayed, or difficult to access, the agent inherits those limitations.

This is why the next stage of automation is likely to be less about replacing individual manual steps and more about connecting the workflow around them.

A useful starting point is not the most sophisticated use case, but the process with high volumes, clear outcomes, measurable performance, and defined ways to detect and correct mistakes. Evidence gathering and investigation preparation are easier to control than decisions that directly affect a customer's account or trigger a regulatory obligation.

Regulatory filings, transaction execution, data deletion, and final customer-impacting decisions require clear human accountability. An AI system can support the work around those decisions without becoming ultimately responsible for them.

Europe’s compliance problem is becoming an execution problem

The broader picture from the report points in the same direction.

Financial institutions are entering a regulatory environment that increasingly expects controls to work continuously and in connection with one another. Faster payments shorten decision windows. Fraud now often happens after onboarding. Compliance teams have to produce evidence that controls work in practice, not simply document that procedures exist. At the same time, the people running those controls face manual reviews and slow investigations, with disconnected data and limited capacity.

That puts financial institutions in an awkward position. They need to automate more, but adding automation for its own sake risks creating another disconnected layer on top of an already fragmented workflow.

AI agents could help with the workload, but their value will depend less on how autonomous they are and more on whether institutions can define where they can act, what information they can use, and when a human has to take over.

The question for financial crime teams is shifting from how much of the compliance process can be automated. It’s now crucial to know how much of that process can be automated without losing control of it.