Editor's note: This piece is adapted from Thalia Pillay's talk at the ACAMS South Africa Chapter webinar "FRAML in the age of financial crime transformation" on 7 October 2026.

‍

I love FRAML. I know plenty of people hate the word (I've watched people gag when I say it), but after years of watching fraud and AML teams try to work together, I think the idea behind it deserves more affection than it gets.

I spoke about this at the ACAMS South Africa Chapter recently, under the title "Everyone agrees, nobody's done it." Nearly every fraud or compliance leader I speak to thinks the two functions belong closer together. Very few have got there.

Part of what I love is that FRAML lets you read the whole story. Fraud knows how the money was taken and AML knows where it went, so on their own each team holds half the book. It's also honest about where the difficulty sits. Convergence only works when two teams measured on different things decide to share, and I find that a more interesting problem than any model.

What follows is my attempt to explain the gap between agreeing and doing, and where I'd start closing it.

One case, two files

Criminals don't have a fraud department and an AML department. They run one operation, with one plan and a lot of money to move. Scam syndicates and mule networks behave like the most agile, collaborative startups you'll ever meet, and we meet them with two teams that barely talk.

SABRIC's 2025 figures put reported digital banking crime in South Africa at R2.41 billion across 110,074 incidents. That's about 301 a day, and more than double the 2023 total. Banking apps account for about 89 percent of cases, and most of that crime gets in through people rather than systems, by impersonation and the familiar call asking someone to move their money to a "safe account".

All of that money had to go somewhere, yet nobody publishes the laundering figure for the same rand, because a different team counts it. Fraud is one of the designated categories of offences in FATF's standards, so the proceeds of every one of those incidents become a money laundering problem the moment they start to move.

In a single case it looks like this. An account is opened on a Monday and funded that afternoon. By Tuesday the money has been emptied across five linked wallets, and by Wednesday the account is abandoned. The fraud team blocks a transaction, closes the account and marks the case resolved. Three weeks later AML spots the suspicious flow and opens a new case from scratch. Same person, same money, two files.

Two clocks, one desk

ACAMS surveyed 1,389 anti-financial crime professionals for its Global AFC Threats Report 2026, and 84 percent said their teams focus on scams and fraud against individuals. In Africa the figure was 90 percent, the highest of any region. If you work in compliance and think of fraud as someone else's problem, it probably landed on your desk some time ago.

The two teams still run on different clocks. Fraud decisions happen in milliseconds. AML works in days or weeks, and even a rule change can need backtesting and committee sign-off while an attack pushes thousands of transactions through. Generative AI is speeding up the fast clock. Seventy-five percent of the ACAMS respondents rate its malicious use as a high or very high risk, and syndicates already vibe-code convincing shopfronts, run ads against them and buy card testing as a service.

On African rails the gap is wider. Mobile wallets and vouchers don't have the dispute and chargeback machinery that cards do. And when someone has been socially engineered and their wallet is controlled by someone other than its registered owner, "was the victim tricked?" and "who really owns this wallet?" turn out to be the same question, asked by two different teams.

Where the handoff breaks

When we started Orca, we spent about three months interviewing more than 150 fraud heads, MLROs and compliance leads across 40 African markets. Many described teams buried in alerts and reporting, with too few people to clear them. One head of fraud at a tier one Nigerian bank summed up the handoff in a sentence: "I find out about confirmed mules in the monthly meeting."

Most organisations are strong on one side. Mobile money operators tend to have good fraud teams and thinner AML, and banks are often the reverse. The two functions usually run on tools bought in different years from different budgets, and report into different parts of the business.

In practice the handoff goes like this. Fraud confirms a mule, exports it to a spreadsheet and emails compliance, where someone re-keys it, rewrites the narrative and files. In our interviews, that took a median of 12 days from fraud confirmation to STR, and up to six weeks in one organisation. Behavioural evidence and case history get lost on the way, and customers can be contacted twice with different messages. Often the whole bridge depends on one person, and when they resign, the convergence goes with them.

Why it stalls

I'm an engineer, so I expected the hard part to be technology. It almost never is. FRAML stalls on politics.

The two teams have different bosses and different KPIs. Fraud is measured on losses and friction, AML on the quality of its filings. Converging means someone has to retire a system, and people are attached to theirs. (Every team swears it has stopped using Excel, and Excel always turns up.)

Confidentiality becomes a shield as well. Some of the concerns are real, internal fraud and tipping-off among them, but not coordinating is often the bigger tipping-off risk. If fraud calls a customer without knowing AML has filed, that call can give the game away.

A couple of years ago, a consumer app went viral and its KYC provider couldn't keep up. The app switched to manual checks to keep onboarding moving and let in people who shouldn't have been there, including minors. Fraud eventually closed the gap, and AML was left reviewing and offboarding everyone who had already got through. In engineering we'd call that an incident, and an incident has one owner. Here, nobody owned the whole thing.

Merging the teams first doesn't solve this. You end up with one team, two systems, two queues and a morale problem. As someone put it to me recently, FRAML works when you share systems and intelligence, not accountability and processes.

What a working setup looks like

The best setups we've seen use a small cross-functional team of fraud, AML and data people with a single reporting line. It sits between the specialist teams rather than replacing them. Shared data, rules and cases get one owner, so collaboration stops being a favour and becomes the job.

That team can run one timeline across the customer journey. KYC, PEP and sanctions data from onboarding feeds fraud decisions. Device fingerprints, which usually sit in the fraud tool, strengthen STR narratives. Behavioural analysis takes the place of rules firing in isolation. Blocking an account and filing a report remain separate decisions with different evidentiary bars, but both are made with the full picture.

Where the market sits

In our interviews, about three quarters of organisations were siloed or coordinated, and about one in ten was integrated. Plenty are waiting for their data to be ready before they start. The syndicates moving money through their accounts aren't waiting on anything.

African businesses have an advantage here that's easy to miss. We have fewer resources than a US tier one bank, but many PSPs and mobile money operators never bought two stacks in the first place. Converging from there is far easier than unpicking two systems later.

Where I'd start

A few honest questions will tell you where you stand:

• Can a fraud analyst and a compliance officer pull up the same customer and see the same thing?
• Is a customer scored once, or twice by engines that disagree?
• When fraud confirms a mule, how does AML find out?
• Who signs off a threshold change that helps one team and hurts the other?
• And is any of your intelligence coming from outside your own walls?

If I were starting this week, I'd begin with reporting rather than the org chart, because it pays back fastest and needs no reorg. Next I'd fix the data model, a single customer identifier above all, before touching team structure. I'd write down, product by product, which decisions really need to happen in real time. And I'd name someone above both leaders to own the trade-off between fraud losses and AML alerts.

One number for both teams

None of this needs a new system to begin. The smallest first step is a single measure: the hours it takes a confirmed fraud case to reach your MLRO as an STR, and how many of those hours go on retyping. I'd ask every Head of Fraud and MLRO reading this to find that number and write it down this month.

It's the one figure that belongs to both teams, and it can be measured with what you already have. Once it's on the table, the conversation about convergence has something more useful than agreement to work from.