The financial services industry will spend an estimated $200 billion on financial crime detection operations in 2026. It will recover less than one percent of the illicit funds moving through the global financial system.
That is not a technology problem. The platforms are sophisticated. The data is rich. The analysts are experienced. And yet criminal networks — drug trafficking organizations, human trafficking operations, sanctions evaders, terrorist financiers — continue to move money through the financial system with a success rate that would be the envy of any legitimate business.
The problem is structural. And understanding it requires being honest about what the current generation of AML programs was actually designed to do.
Modern AML programs were built in response to regulation. The Bank Secrecy Act, its amendments, and the compliance infrastructure that grew around it created a framework oriented around a single core question: did we file the right reports?
That is a compliance question. It produces compliance outputs — Suspicious Activity Reports, Currency Transaction Reports, documented processes, defensible audit trails. It does not produce what law enforcement needs: a clear picture of who is moving illicit funds, how they are doing it, and where in the criminal network they sit.
The transaction monitoring systems at the heart of most AML programs operate on anomaly detection logic. They compare current behavior against historical baselines and flag deviations. When a transaction looks unusual relative to an account's history, an alert is generated. An analyst reviews it. Most of the time — in some institutions, 95% of the time — the alert turns out to be noise.
This is not a failure of the technology alone. It is a limitation of the methodology. Anomaly detection identifies what is different. It cannot tell you whether what is different is criminal. Those are different questions, and answering the second one requires something the first approach was never designed to provide: intelligence.
The traditional three-stage model of money laundering — placement, layering, integration — was developed decades ago and remains the conceptual foundation of most AML training and detection logic today. It is incomplete.
Criminal organizations do not begin their financial activity at placement. They begin at revenue generation — the mechanism by which illicit proceeds are created in the first place. A drug trafficking organization generating cash from street-level sales, a human trafficking network collecting fees from exploitation, a ransomware group extracting payments from victims — each represents a distinct revenue generation typology with its own behavioral signatures in the financial system.
And criminal networks do not end at integration. They end at usage (or sustainment) — the deployment of laundered funds to sustain and expand criminal operations. Operational expenditures, recruitment, bribery, reinvestment into criminal infrastructure. These transactions flow back through the financial system with patterns as distinctive as the revenue generation phase that preceded them.
A detection methodology that ignores revenue generation and usage is blind to two of the five stages at which criminal financial activity is detectable. Most AML programs are operating with a model that accounts for only three of them.
Hybrid Threat Finance™ was built to close that gap — not by improving anomaly detection, but by replacing the methodology underneath it.
The foundation of HTF is criminal tradecraft: the systematic study of how criminal organizations actually structure their financial operations. How a fentanyl distribution network moves cash through a regional bank differs from how a human trafficking operation collects and disperses fees. Both differ from how a sanctioned entity layers value through correspondent banking relationships. Each has distinct behavioral signatures. Each requires different detection logic.
That knowledge does not exist in academic literature. It exists in law enforcement case files, intelligence community analysis, and the operational experience of investigators who have spent careers dismantling these networks. Section 2's Special Investigations Unit synthesizes that knowledge continuously — translating criminal tactics, techniques, and procedures into detection logic organized by threat category, operational echelon, and financial crime stage.
This is where detection logic begins in the HTF methodology. Not with transaction data alone, but with criminal behavior.
Putting Hybrid Threat Finance™ into practice requires three interconnected components, each building on the one before it.
Hybrid Threat Central™ is the intelligence backbone. It is Section 2's proprietary central repository of criminal risk signals — a continuously updated database of threat entities (individuals, organizations, and networks), jurisdictional risk profiles, geographic risk indicators, and known criminal typologies drawn from credible global sources. Hybrid Threat Central is what makes the rest of the system possible: it is the intelligence layer that tells TENet what to look for and informs TRACC's contextual assessments. Core typologies, threat actor and network data and geographic risk indicators are recalibrated and updated regularly. The intelligence does not go stale.
TENet™ — Threat Entity Network — is the detection layer. It is a proprietary library of financial crime targeting packages built directly on HTF methodology, accessible to financial institutions via API or SFTP and integrated with their existing transaction monitoring workflows. TENet does not require ripping and replacing existing infrastructure. It delivers daily detection reports — case candidates identified by threat classification, operational echelon, and financial crime stage — directly into the institution's case management environment. The integration is non-disruptive. The output is not an alert queue for analysts to triage. It is a set of high-confidence, actionable findings with full explainability for practitioners and regulators alike.
TRACC™ — the Threat Risk Assessment Framework — connects the institution's specific risk profile to the intelligence. It overlays Section 2's Global Threat Landscape against the institution's inherent risk factors: geography, customer segments, product mix, and transaction volumes. The output is a living risk registry that maps exactly which financial crime threats the institution is exposed to, and which TENet targeting packages it should deploy to address them. Risk assessment stops being a once-a-year compliance exercise and becomes a continuously updated operational input.
Together, these three components do something no legacy AML platform was designed to do: they build detection logic around how criminals actually operate, tailored to the specific threat environment each institution faces.
The output of intelligence-led detection is fundamentally different from the output of anomaly-based detection.
A traditional AML alert tells you that something looks unusual. It produces a transaction amount, a flag reason, and an account number. A human analyst then determines whether the unusual activity is actually suspicious — a process that, at scale, consumes enormous analyst capacity while producing a fraction of actionable findings.
A TENet™ targeting package tells you something different. It tells you the threat classification — which financial crime category the behavioral pattern maps to. It tells you the operational echelon — whether you are looking at a strategic network leader, an operational coordinator, or a tactical participant. It tells you the financial crime stage — where in the revenue generation, placement, layering, integration, or usage cycle the activity sits. And it provides the evidence trail: the specific behavioral signals, account relationships, and transaction patterns that support the finding and make it fully auditable to an examiner.
The difference is not incremental. It is the difference between a compliance output and an intelligence output. Between a report filed and a network identified.
In one engagement, applying the Hybrid Threat Finance methodology reduced an institution's false positive rate from 94% to 18% — while simultaneously surfacing financial crime activity that had generated zero alerts in the existing TMS. The signal was in the data. The intelligence layer was missing.
Section 2's product architecture is designed with the future of financial crime detection in mind. Near-term developments include delivering TENet Intelligence as a Service (IaaS) to machine learning-driven threat detection and real-time alert workflows. The roadmap extends to an AI-powered HTF Assistant — giving analysts and investigators direct access to Hybrid Threat Central's intelligence for research and case analysis — and to Intelligence Insights: regular briefings and reporting on emerging criminal patterns, threat actor developments, and typology shifts in the context of the HTF methodology.
The goal is not a point-in-time compliance tool. It is a continuously evolving intelligence platform that redefines how financial institutions understand, monitor, and respond to the financial crime threats in their specific environment.
Financial crime detection is at an inflection point. The regulatory environment is moving toward outcome-based evaluation — examiners increasingly asking not just whether an institution filed the right reports, but whether its program is designed to find the financial crime threats it is actually exposed to. The technology environment is enabling intelligence-led detection at scale for the first time. And the criminal networks that have operated largely undisturbed by current detection methods are not standing still.
The institutions that move first on Hybrid Threat Finance™ will not simply perform better on existing metrics. They will help define the next generation of metrics — the benchmarks that peer institutions will be measured against in three, five, and ten years.
If your institution is ready to move beyond compliance-first AML and build a detection program designed to actually find financial crime, we’d like to talk.
