A whitepaper for AML leaders

The TTP Shift in

Financial Crime

'Is This Unusual' to 'Which Adversary Is This': A New Lens on AML

How threat-actor TTPs — not transaction patterns — become the unit of AML detection.

What the FinCEN Effectiveness Rule demands that SARs cannot answer.

Field-test evidence: 70 illicit finance actors identified using Section 2's financial crime intelligence-as-a-service, only 7 were seen by the institution's TMS without it.

What's inside

The 1% problem isn't a technology problem and the queue was never going to solve this.

01

Why alerts stopped working

Transaction monitoring asks what looks unusual. It cannot tell you who is moving the money — and the false negatives never appear in a queue.

02

TTPs as the unit of detection

Tactics, techniques, and procedures are stable where transaction patterns are not. Classify the behavior, and the actor becomes findable across institutions.

03

What examiners now expect

The FinCEN Effectiveness Rule asks for attribution and demonstrable outcomes — not SAR volume. Deterministic, sourced classification is the defensible answer.

04

Adopting the taxonomy

How Hybrid Threat Finance™ maps the five-stage criminal lifecycle onto the data you already hold — no rip-and-replace of your existing TMS.