Artificial Intelligence in financial security: Legal challenges in Japan's AML/CFT regime and comparative insights from selected EU countries
Artificial Intelligence in financial security: Legal challenges in Japan's AML/CFT regime and comparative insights from selected EU countries

Summary/Abstract: This study examines the legal and regulatory challenges in deploying artificial intelligence (AI) within anti-money-laundering and counter-terrorist-financing (AML/CFT) systems in Japan (focal case) and in Germany, France, and Poland (purposive comparators). It identifies intra- and cross-jurisdictional gaps; assesses alignment with FATF Recommendations 1 and 15, the GDPR, and the EU AI Act; and distils transferable best practices. Doctrinal legal analysis and normative comparative methodology were employed, with limited functional observations where supervisory practice is documented. Sources include statutes and regulations, supervisory guidance, and case law issued from May 2015-May 2025, notably the EU AML package (Reg. (EU) 2024/1624; Dir. (EU) 2024/1640; Reg. (EU) 2024/1620) and the AI Act (Reg. (EU) 2024/1689), as well as FATF materials and national guidance (BaFin, CNIL/Tracfin, JFSA). All jurisdictions permit AI in AML/CFT, yet frameworks remain fragmented and under-specified for algorithmic decision-making. Key gaps concern liability for algorithmic outcomes; tensions between transparency/explainability and tipping-off; and safeguards for automated decisions (GDPR Art. 22). Germany/France show higher supervisory maturity (explainability, auditability, DPIA, human-in-the-loop), whereas Japan/Poland rely chiefly on general data-protection duties with limited AML/AI-specific guidance, indicating the need for governance-heavy, auditable, human-in-the-loop designs. Better coordination of the AML, AI, and data-protection regimes is required to ensure both effectiveness and fundamental-rights protection. Japan could benefit from EU practices by formalising human-in-the-loop requirements for high-impact AML decisions, mandating DPIAs, enhancing auditability/reporting for high-risk models, and expanding regulatory sandboxing. The EU should continue aligning the AI Act with the AML Regulation (via AMLA guidance), clarifying oversight, documentation, and explainability expectations for AML use cases.

• Details
• Contents