{"id":7515,"date":"2026-05-18T09:58:57","date_gmt":"2026-05-18T07:58:57","guid":{"rendered":"https:\/\/www.rolling-funds.com\/?p=7515"},"modified":"2026-05-18T09:58:59","modified_gmt":"2026-05-18T07:58:59","slug":"the-new-kyc-rules-in-2026-what-compliance-officers-really-need-to-know","status":"publish","type":"post","link":"https:\/\/www.rolling-funds.com\/en\/articles\/les-nouvelles-regles-du-kyb-en-2026-ce-que-les-responsables-de-la-conformite-doivent-vraiment-savoir\/","title":{"rendered":"The new rules of KYB in 2026: what compliance leaders really need to know"},"content":{"rendered":"

Regulators are no longer reading your policies. They\u2019re auditing your product.<\/strong><\/h2>\n\n\n\n

The most striking shift concerns how regulators now evaluate compliance frameworks. It\u2019s no longer about submitting a 70-page KYC\/KYB policy and hoping the narrative holds up. <\/p>\n\n\n\n

In recent licensing processes, regulators have asked for something unprecedented: detailed flowcharts accompanied by real screenshots of every step in onboarding journeys. What information is collected, in what order, and at which stage, not a summary, but the reality as it actually exists. <\/p>\n\n\n\n

This marks a fundamental shift. Regulators are no longer auditing what you say you do. They are auditing what your system actually does in production. Your onboarding flow is now a compliance artifact, whether you designed it that way or not.  <\/p>\n\n\n\n

The implication is clear: compliance must be embedded from the product and UX design phase. If you\u2019re trying to bolt compliance controls onto an onboarding flow that\u2019s already been built, you\u2019re already behind.<\/p>\n\n\n\n

DORA has changed the game and most teams weren\u2019t ready<\/strong><\/strong><\/h2>\n\n\n\n

If you work in a regulated financial institution in Europe, DORA has likely taken up a significant portion of your past twelve months. What surprised us, however, is how much this regulation is reshaping the compliance function itself. <\/p>\n\n\n\n

DORA is one of the most complex compliance challenges teams have faced. The documentation burden alone (policies, procedures, incident response plans, third-party risk assessments, dedicated risk registers, etc.) is comparable to what teams already produce for AML\/CFT, except this time it\u2019s about cybersecurity, requiring an entirely different skill set. <\/p>\n\n\n\n

What makes DORA particularly critical for compliance leaders is the intersection it creates between AML\/CFT and cybersecurity. A cyber incident is no longer just an IT issue, it can instantly become an AML\/CFT event, a threat to market integrity, or a breach of customer protection. Compliance and security teams that do not work closely together are carrying risks they cannot see. <\/p>\n\n\n\n

Regulators now treat security audits almost like financial audits: recurring, evidence-based, and with clear remediation timelines. If your compliance team does not have a direct line of communication with cybersecurity, it\u2019s time to build one.<\/p>\n\n\n\n

AMLA will eventually put an end to regulatory arbitrage<\/strong><\/strong><\/strong><\/h2>\n\n\n\n

The anti-money laundering authority is being rolled out in two phases. The first targets around 40 of the most significant entities, think major crypto platforms and top-tier banks with the highest risk profiles. Most fintechs and smaller regulated entities will not be part of this initial wave. <\/p>\n\n\n\n

The second phase is the one that will truly matter. AMLA aims to harmonize AML\/CFT requirements across all EU Member States, and the direction is clear: upward convergence. <\/p>\n\n\n\n

Out of roughly 90 registered PSANs (crypto-asset companies) in France, only about 30% are currently applying for a MiCA license with the French regulator. The others are likely seeking licenses in jurisdictions perceived as faster or more accommodating.<\/p>\n\n\n\n

AMLA is specifically designed to put an end to this dynamic. France and Germany currently enforce some of the strictest AML\/CFT regimes in Europe. The expectation is that other jurisdictions will have to rise to that level, not the other way around.<\/p>\n\n\n\n

For compliance teams operating internationally, the right strategy is to build from the outset to meet the highest standard. Designing lighter onboarding flows depending on jurisdictions is an approach with a shrinking lifespan. <\/p>\n\n\n\n

That said, we remain realistic: this is a political issue at the European level, and full harmonization will take time. But the trajectory is unmistakable.<\/p>\n\n\n\n

AI will help you. It won\u2019t save you.<\/strong>\u00a0<\/strong><\/h2>\n\n\n\n

AI is already delivering value in compliance processes<\/a>. For example, AI-powered suggestions help analysts process screening alerts faster by flagging likely false positives based on inconsistent nationalities or other obvious indicators. This saves time, and the suggestions are becoming increasingly accurate.\u00a0<\/p>\n\n\n\n

This is an honest assessment and reflects what we observe across the market. We are clearly in a semi-automation phase: AI suggests, humans decide. Every decision still goes through manual review. <\/p>\n\n\n\n

There is a useful analogy here with autonomous driving. We are at level two, your hands must remain near the wheel, and you must be ready to take control at any time. The question everyone is asking is when we will move to level three or four. The answer: not yet, and not without first building a solid track record of performance.<\/p>\n\n\n\n

The path toward greater automation<\/a> is sequential, not a leap:<\/p>\n\n\n\n

    \n
  1. Start by using AI as a suggestion engine<\/li>\n\n\n\n
  2. Build a track record and performance metrics over time<\/li>\n\n\n\n
  3. Gain trust through data, not assumptions<\/li>\n\n\n\n
  4. Gradually expand the scope of automated decisions<\/li>\n<\/ol>\n\n\n\n

    What is crucial and reinforced by the AI Act is explainability. If you cannot explain why AI suggested a particular KYB decision, you are exposed, even if the decision was correct. Every AI-assisted decision must be traceable and defensible. Black-box outputs, no matter how accurate, will not satisfy a regulator.<\/p>\n\n\n\n

    It is almost certain that in the coming months, entities that have automated too aggressively will face regulatory action. The temptation to move fast is real, especially as tools become more powerful. But moving fast without proper controls introduces a different kind of risk.<\/p>\n\n\n\n

    Where AI is really creating value today<\/strong>\u00a0<\/strong><\/h2>\n\n\n\n

    If final compliance decisions are not yet ready for full automation, where is AI creating the most value today? Two areas clearly stand out. <\/p>\n\n\n\n

    OSINT and open-source intelligence.<\/strong> For institutional onboarding, AI-powered OSINT is a game changer. Instead of an analyst spending two hours manually searching Twitter, public registries, and specialist databases, AI can aggregate and structure that research into a formatted report before the analyst even opens the case. The time savings are substantial, and the output includes source links for audit trail purposes.<\/p>\n\n\n\n

    For high-volume onboarding teams, the equation is different: automating screening alerts may save only a few seconds per case, but the effect compounds across thousands of reviews. For institutional teams, automating OSINT saves hours per file and fundamentally changes how analysts allocate their time.<\/p>\n\n\n\n

    Regulatory monitoring.<\/strong> Staying up to date across multiple regulatory frameworks is an ongoing challenge. AI tools that scan new directives, contextualize them based on your institution\u2019s specific situation, and identify which internal procedures need to be updated are shifting from \u201cnice to have\u201d to essential infrastructure. The goal is a pipeline that goes from new regulation to updated workflow, with complete documentation of what changed and why.<\/p>\n\n\n\n

    The data architecture problem underneath all of this<\/strong><\/strong><\/h2>\n\n\n\n

    Fragmented data remains the root cause of most operational compliance pain.<\/p>\n\n\n\n

    Three years ago, having multiple tools in separate silos with incompatible databases was simply the norm. Getting them to communicate was \u201ca nightmare.\u201d Progress in API quality and data field standardization has made unified data architectures achievable, but it remains a significant engineering effort.<\/p>\n\n\n\n

    Why does this matter so much? Because regulators now expect dynamic risk scoring, the ability to adjust a client\u2019s risk profile in real time based on transaction monitoring alerts, screening hits, on-chain activity, or changes in corporate structure. That is impossible if your KYB data, transaction monitoring tools, and screening systems are all operating independently.<\/p>\n\n\n\n

    The shift from periodic reviews (checking files every 12 months) to event-driven continuous monitoring<\/a> is real, and it is only possible with a unified data layer. A change in UBO structure, a new sanctions listing, unusual transaction volume, all of these should trigger reassessment automatically, not wait until the next scheduled review.<\/p>\n\n\n\n

    What a best-in-class KYB program looks like today<\/strong>\u00a0<\/strong><\/h2>\n\n\n\n

    If you are building or rebuilding your KYB framework in 2026<\/a>, here are the non-negotiables:<\/p>\n\n\n\n