Traditional Transaction Monitoring No Longer Works for LATAM

Instant payments are rapidly becoming the norm across Latin America. Brazil's Pix now processes billions of transactions every month, while digital payment systems like SPEI and Nubank continue to expand across the region. This acceleration has fundamentally changed how fast both legitimate and illicit funds move through payment systems.

Traditional transaction monitoring systems that are in use in most places are struggling to keep up with these changes because they are inherently designed for slower and more predictable environments.

To better understand the challenges facing compliance teams in Latin America and what institutions' next priority should be, we spoke with Patricia Prada, Head of Cybersecurity at Intexus, about the report recently published by Intexus and Sumsub on transaction monitoring systems in Latin America.

THE SUMSUBER: Patricia, thank you for taking the time to talk with us. As instant payment networks, digital financial services, and crypto adoption continue to grow across Latin America, what makes transaction monitoring particularly challenging compared with other regions?

PATRICIA: Latin America is uniquely difficult because so many changes hit at once. In most regions, financial systems evolve over decades. Here, widespread cash use still coexists with an explosive, near-simultaneous adoption of fintech, instant payments, and crypto—all within just a few years.

Monitoring tools built for slower, more uniform markets struggle here, partly because the data they expect—such as stable salaries, formal employment, or a consistent banking history—often doesn't exist for a large part of the population. This creates significant blind spots for traditional monitoring models. Mule account networks, smurfing, local corruption, and the ability to quickly convert crypto assets into local currencies are all problems that LATAM has to address more effectively.

On top of that, GAFILAT, LATAM’s main regional regulatory body, continues to point out the same weaknesses: the region still deals with incomplete beneficial ownership registries, underfunded financial intelligence units, and oversight that lags behind the market.

THE SUMSUBER: Financial institutions continue to invest heavily in compliance, yet the region still struggles to improve its effectiveness. Why isn't higher spending translating into better results? 

PATRICIA: In this case, it’s the fact that the money isn't being spent where it matters most. According to my research, between 90% and 95% of alerts from legacy monitoring systems in Latin America are false positives—9 out of 10, and sometimes 19 out of 20. This way of operating burns out analysts, builds backlogs, and, in many institutions, means that fewer than one or two alerts out of a hundred actually end up in a suspicious activity report. 

Many entities end up optimizing for complying with regulations rather than detection quality. They use broad, inefficient rules just to satisfy outdated audit checklists. All that noise becomes the perfect smoke screen for real criminals to slip through. Financial crime compliance costs Latin America’s institutions around $15 billion a year.

THE SUMSUBER: Real-time payments have transformed the customer experience across LATAM, but they've also changed the speed at which financial crime can happen. What do you think is the biggest risk executives and CEOs should be paying attention to? 

PATRICIA: They need to be aware that the risk of crime scales up AML exposure faster than screening frameworks can absorb. The previous year proved this with attacks on shared payment infrastructure. Money can move in seconds while risk reviews run in batches, hours or days behind, and Pix alone clears tens of billions of transactions a year. 

Brazil is the ultimate cautionary tale and a proving ground for the rest of the region. In July 2025, attackers diverted well over $100 million from bank reserve accounts through C&M Software, a technology provider that connects institutions to Pix. In September 2025, Sinqia, a second provider, was hit for about $130 million using valid credentials, leaving some two dozen banks exposed through a single point of failure. 

In both cases, it was the money mules that converted to crypto faster than any batch process could react. The lesson for institutions is that if detection doesn't trigger within minutes, you're already too late.

THE SUMSUBER: That’s a great cautionary tale indeed. What you’re saying suggests that transaction monitoring can no longer operate in isolation. Considering that, why is it becoming essential to connect identity, fraud, and AML into a single monitoring strategy? 

PATRICIA: The truth is they can no longer be managed separately, and it’s been increasingly difficult to do so. Fraud and AML teams are increasingly overlapping, since proceeds of scams and money-laundering flows run through the same accounts. When fraud and AML operate in silos, the money from a scam is refunded or written off without anyone tracing where it went next. 

Furthermore, because onboarding KYC is often disconnected from transactional monitoring, analysts fail to detect when a low-risk profile suddenly begins to behave like a money-laundering operation. The report makes it obvious that identity, fraud, and AML must become a single operational layer instead of remaining separate.

THE SUMSUBER: Your report introduces a transaction monitoring maturity model. Where do most financial institutions in LATAM stand today, and what does the journey toward a mature monitoring program look like?

PATRICIA: The report outlines a monitoring maturity model with four stages. 

The reactive model, which is the simplest one, relies on manual processes, static legacy rules, spreadsheet trackers, and hard-coded single-amount thresholds. 

The structured model offers centralized transaction monitoring across core systems, along with batch-processing rule engines and basic case management. 

The proactive model is based on dynamic customer risk scoring that continuously updates customer profiles. It also connects KYC and transaction monitoring. 

And finally, the adaptive model, which we should strive for, uses AI-assisted continuous monitoring, real-time risk responses, orchestration platforms, and contextual alerts to monitor users’ financial activity. 

One uncomfortable fact for C-level executives is that most LATAM institutions remain somewhere between the reactive and structured stages.

THE SUMSUBER: On a final note, for organizations that choose to stay with legacy monitoring systems, what are the real business consequences over the next few years?

PATRICIA: The report that I made shows that institutions that continue to rely on fragmented, reactive models will not be able to keep pace with real-time financial ecosystems. This translates into very tangible consequences: fines, reputational damage, and loss of correspondent banking relationships—as happened in June 2025, when the US FinCEN designated three Mexican financial institutions for primary money-laundering concerns, cutting off their access to the US dollar. 

Meanwhile, regulatory pressure is only increasing. Bolivia was added to the FATF grey list in June 2025 due to weak supervision and beneficial ownership gaps; the FATF adopted revised payment transparency standards, and supervisors across the region now have every reason to tighten expectations. Modernizing transaction monitoring is no longer simply a compliance initiative. Institutions and companies need to recognize that it’s becoming a business-resilience imperative.