In Operation Fort, an organised crime network trafficked more than 400 vulnerable people into forced labour. The traffickers forced victims to open bank accounts, then took control of their debit cards and digital credentials (Independent Anti-Slavery Commissioner, 2020).This raises a difficult question for payment providers: what can transaction monitoring actually reveal, and how can systems avoid treating an exploited account holder as the criminal?
Monitoring can produce leads to trafficking networks, this much has been established. But the accuracy of the label needs improvement.
Firstly, an important distinction to be made is between suspicious activity and the account holder’s responsibility. Precisely in situations of human trafficking, this can result in a legal and de facto grey zone. This article argues that providers should distinguish the detection of suspicious financial activity from the attribution of control and responsibility. Their assessment procedures should record indicators of third-party control and thus avoid labelling the mere use of an account as evidence.
In this article, “fintech” shall refer to payment and electronic-money providers using automated monitoring. It must be highlighted that these providers are not the only institutions facing this problem: banks also automate monitoring (Oztas et al., 2024).
What financial monitoring can reveal
The FATF and Asia/Pacific Group report gives concrete reasons to examine financial activity. Its forced-labour indicators include wages withdrawn soon after receipt and several customers using the same ATM at the same time, suggesting third-party control of their cards (Financial Action Task Force & Asia/Pacific Group on Money Laundering [FATF & APG], 2018, p. 68). These clues can justify inquiry. No single indicator confirms trafficking-related laundering, and some also point to other crimes (FATF & APG, 2018, p. 19).
There are two kinds of error here: detection errors and attribution errors. Detection errors include false positives, where lawful activity is incorrectly flagged as suspicious, and false negatives, where trafficking or exploitation goes unflagged, potentially delaying victim identification and access to protection. An attribution error occurs when trafficking-linked activity is correctly detected but responsibility is wrongly assigned to the account holder. Attribution remains a problem even if detection is accurate. Criminal proceeds may genuinely pass through an account held by someone being exploited. Improving a model’s accuracy at recognising those proceeds would not, by itself, establish who controls the account or bears responsibility for the activity.
Automation helps institutions process large volumes of transactions. Its limits are less easily measured. Interviews with eight AML specialists describe false positives and incomplete customer information, while stressing the need to examine transactions in context (Oztas et al., 2024). This is evidence about AML practice, not a test of trafficking detection. It supports caution about relying on alerts without supplying a detection rate for payment providers.
The limits of the EU framework
Regulation (EU) 2024/1624 provides the next EU framework to examine. Its monitoring and reporting requirements apply from 10 July 2027. Article 26 requires ongoing monitoring; Article 69 requires prompt reporting of qualifying suspicions to financial intelligence units (FIUs). A report supplies intelligence for assessment. It does not establish guilt or automatically begin a prosecution (Regulation (EU) 2024/1624, 2024, arts. 26, 69, 90).
Nor does an alert require automatic account closure. Article 21 requires termination where customer due diligence cannot be completed. Article 76(5) requires meaningful human intervention in specified automated customer decisions, including decisions about maintaining a business relationship. It also allows explanations and challenges, except in relation to suspicious reports. These safeguards matter. Still, human review can repeat an attribution error unless the reviewer knows how exploitation may appear in an account (Regulation (EU) 2024/1624, 2024).
Confidentiality creates another difficulty. Article 73 prohibits disclosing specified suspicion assessments or reporting to customers and third parties. It does not prohibit every customer interaction (Regulation (EU) 2024/1624, 2024, art. 73). My concern is practical: contacting an account holder through a device controlled by a trafficker could expose the inquiry. That is a risk inferred from account control, not an empirical finding about provider communications. Safe contact needs more thought than simply adding a message to an automated process.
From suspicion to victim identification
Protection need not wait for a conviction. The Council of Europe Convention requires trained victim identification (Council of Europe, 2005, art. 10). Amended Article 8 of the EU Directive requires authorities to be empowered not to prosecute or penalise unlawful activities compelled by trafficking. It does not grant blanket immunity, or automatically make private account closure a prohibited penalty (Directive (EU) 2024/1712, 2024). In V.C.L. and A.N. v. the United Kingdom (2021), the Court required prompt qualified assessment where credible trafficking suspicion arises; prosecution decisions should, insofar as possible, follow it (paras. 160–162). This is a framework for state action, not a direct requirement that fintech providers formally determine victim status.
The remaining question is not whether EU law provides for referral mechanisms. Article 11, as amended strengthens national referral mechanisms, which are intended to support early detection, identification, assistance and support. Rather, the question is whether national arrangements establish a clear and safe route for information arising from financial monitoring to reach the authorities responsible for identifying and supporting potential victims. Article 69(2) requires providers to assess relevant information, but the texts discussed here do not expressly prescribe a specific interface between an AML provider’s trafficking alert and a national referral mechanism. This textual omission does not prove that national rules or supervisory guidance lack such a connection (Regulation (EU) 2024/1624, 2024; Directive (EU) 2024/1712, 2024).
With regards to reporting practice, FATF and APG already advise institutions to identify suspected victims clearly when reporting their activity (2018, p. 65). Providers should train reviewers to recognise indicators of third-party control and record them in their assessment, without delaying mandatory reports. Authorities should clarify safe referral routes and the responsibilities of the institutions involved. Any contact or referral should account for the risk that a trafficker controls the victim’s device, and assistance should remain informed and consensual (Directive (EU) 2024/1712, 2024, art. 1(9)). These proposals should be evaluated against actual provider practices and national referral arrangements; the available evidence does not yet show how well monitoring detects trafficking or whether these changes would improve outcomes.
The point is not to make payment providers decide who is a victim or who is guilty. It is to ensure that a suspicious account is treated as a lead for further assessment, not as proof of the account holder’s responsibility. Monitoring may reveal patterns of control, but the next steps must preserve that distinction. When it works, whose conduct have we actually detected?
References
Council of Europe. (2005). Council of Europe Convention on Action against Trafficking in Human Beings (CETS No. 197). https://rm.coe.int/168008371d
Directive 2011/36/EU of the European Parliament and of the Council of 5 April 2011 on preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA. (2011). Official Journal of the European Union, L 101, 1–11. https://eur-lex.europa.eu/eli/dir/2011/36/oj
Directive (EU) 2024/1712 of the European Parliament and of the Council of 13 June 2024 amending Directive 2011/36/EU on preventing and combating trafficking in human beings and protecting its victims. (2024). Official Journal of the European Union, L, 2024/1712. https://eur-lex.europa.eu/eli/dir/2024/1712/oj
Financial Action Task Force, & Asia/Pacific Group on Money Laundering. (2018). Financial flows from human trafficking. https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Human-Trafficking-2018.pdf
Independent Anti-Slavery Commissioner. (2020). Operation Fort: What businesses should learn from the UK’s largest anti-slavery prosecution. https://www.antislaverycommissioner.co.uk/media/z35hayca/iasc-operation-fort-review-june-2020.pdf
Oztas, B., Cetinkaya, D., Adedoyin, F., Budka, M., Aksu, G., & Dogan, H. (2024). Transaction monitoring in anti-money laundering: A qualitative analysis and points of view from industry. Future Generation Computer Systems, 159, 161–171. https://doi.org/10.1016/j.future.2024.05.027
Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. (2024). Official Journal of the European Union, L, 2024/1624. https://eur-lex.europa.eu/eli/reg/2024/1624/oj
V.C.L. and A.N. v. the United Kingdom, Applications Nos. 77587/12 and 74603/12 (European Court of Human Rights, February 16, 2021). https://hudoc.echr.coe.int/eng?i=001-207927
