Seeing the Bigger Picture: Growth as a Compliance Signal

One of the most useful lessons from major financial crime cases is also one of the easiest to overlook:

Sometimes, the signal is not in a single transaction. It is in the pattern.

Consider the frequently quoted €200 billion figure associated with the Danske Bank case.

The figure is often described as the amount of money that was laundered. However, that interpretation is not accurate.

The approximately €200 billion represented the aggregate flow of payments involving around 15,000 customers examined in connection with the bank's non-resident portfolio between 2007 and 2015. While subsequent investigations identified extensive suspicious activity, the €200 billion figure should not be interpreted as €200 billion of proven illicit funds.

The more important compliance lesson lies elsewhere.

It is about seeing the bigger picture.

The case involved a business area that had grown significantly, attracted a large concentration of non-resident customers and generated substantial transaction volumes.

None of these characteristics, by themselves, indicate financial crime.

But they create important questions.

Why is this business growing so quickly?

Why is this customer segment becoming increasingly significant?

Is the growth consistent with the organisation's stated business strategy?

Does the risk profile of the new business resemble the risk profile originally assumed when the business was approved?

And perhaps most importantly:

Are the controls, resources and management oversight growing at the same pace as the business?

This is where compliance can move beyond being primarily reactive.

From Transaction Monitoring to Business Monitoring

Traditional AML frameworks naturally focus heavily on individual customers, transactions, alerts and investigations.

Those activities remain essential.

However, they are only part of the picture.

A Chief Compliance Officer should also have visibility over how the underlying business is changing.

For example, potential indicators may include:

• Customer numbers increasing significantly faster than expected
• Deposits or transaction volumes growing disproportionately
• Rapid expansion within a particular customer segment
• Increasing concentrations of higher-risk customers
• A business unit materially outperforming its peers
• Growth coming from jurisdictions or channels that were not central to the original business model
• Revenue increasing without a corresponding increase in compliance capacity
• A significant rise in alerts, investigations or SAR/STR activity
• Repeated exceptions to onboarding, KYC or transaction-monitoring processes
• A growing gap between business activity and the assumptions used in the risk assessment

None of these indicators is proof of misconduct.

They are signals that deserve context.

What Could This Look Like in Practice?

This does not necessarily require another major compliance programme.

A practical approach could begin with a Compliance Growth Dashboard.

The objective would be simple:

A CCO could review a relatively focused set of indicators on a monthly or quarterly basis.

1. Growth

Customer numbers, deposits, transaction volumes, revenue and new products.

2. Concentration

Customer nationality, geography, industry, product, channel, introducer and risk rating.

3. Risk

High-risk customers, PEP exposure, sanctions exposure, adverse media, unusual activity and risk-rating changes.

4. Controls

KYC completion, periodic reviews, transaction-monitoring coverage, alert volumes, investigation backlogs, overdue remediation and control exceptions.

5. Capacity

Compliance headcount, investigator capacity, onboarding resources, technology coverage and management information.

The most important element is not the dashboard itself.

It is the relationship between the indicators.

For example:

This does not prove that anything is wrong.

But it creates a very reasonable management question:

Is the control environment keeping pace with the business?

The Next Step: Create a "Why?" Review

When a material growth signal appears, compliance should not immediately assume misconduct.

Instead, the business should be asked to explain the change.

What caused it?

Was it planned?

Was it part of the approved strategy?

Which customers are driving it?

Which products are driving it?

Which jurisdictions are driving it?

What assumptions have changed?

What risks have changed?

What controls were added?

And does the current risk assessment still reflect reality?

This turns growth from a purely commercial KPI into a compliance intelligence signal.

Making Growth Monitoring Part of the Compliance Operating Model

For CCOs, the opportunity is to integrate this approach into existing governance rather than create an entirely separate process.

A practical model could look like this:

Business Planning → Risk Assessment → Growth Monitoring → Compliance Review → Management Challenge → Control Adjustment

A significant change in business activity could automatically trigger a targeted compliance review.

That review could then determine whether:

• Customer due diligence needs to change
• Transaction-monitoring scenarios need recalibration
• Risk appetite needs to be reconsidered
• Compliance staffing needs to increase
• Management information needs to improve
• Particular customer segments need enhanced oversight
• The business model itself needs to be challenged

This approach is particularly relevant following acquisitions, entry into new markets, the launch of new products, changes in distribution channels or rapid growth in specialised customer segments.

The Broader Lesson

The lesson from major financial crime cases is not that growth is suspicious.

It is that growth creates context.

A transaction may appear ordinary when viewed individually.

A customer may appear ordinary when viewed individually.

A business unit may appear highly successful when viewed solely through commercial metrics.

But when these factors are viewed together, a very different picture can emerge.

That is what effective compliance should increasingly be capable of doing.

Not simply asking:

"Which transaction should we investigate?"

But also:

"What is changing across the business, and do we understand why?"

The goal is not to slow legitimate growth.

It is to ensure that growth remains understood, governed and within the organisation's risk appetite.

Because sometimes, the most valuable compliance signal is not an individual red flag.

It is the bigger picture.

Further Reading

For those interested in examining the underlying case material, the 2018 investigation report into the non-resident portfolio provides a detailed primary-source account of the findings and methodology.

The U.S. Department of Justice's 2022 resolution provides further detail on the subsequent criminal case, including the bank's guilty plea and the approximately $2.059 billion forfeiture.

These materials are worth reviewing not simply because of the scale of the case, but because of the important governance, oversight and control lessons they illustrate.