Key insights:

• • • AI is supercharging old fraud schemes��— By making synthetic identities, deepfake scams, and customer fraud faster, more credible, and harder to detect, AI is amplifying fraud and crime.

    • The real vulnerability may be internal silos��— Institutions need to be on the lookout, because what looks like a credit loss, an HR issue, or a payment request may actually be part of a wider multi-vector AI-enabled attack.

    • Institutions already have the tools to respond��— Through KYC and internal and behavioral data, financial institutions have the ability to respond to fraud threats — but only if teams connect and act together.

Fraud and crime existed long before AI, of course, but today’s technology delivers an acceleration in speed, scale, and success rate for fraudsters, resulting in billions of dollars in losses for victims. AI-enabled frauds on financial institutions by 2027 in the United States alone, and of detected fraud attempts on financial institutions use AI – and of these, 29% are successful.

To respond effectively to these threats, institutions need to implement a unified response that brings together departments that may not traditionally be partners. This cross-functional coordination should include not only the institution’s fraud and financial crime risk teams but also its credit risk, cybersecurity, and human resources functions.

And this response is critical, because today, financial institutions are being targeted by multiple types of AI-enabled attacks, including tactics such as:

• • • use of synthetic identities to circumvent know your customer/customer due diligence (KYC/CDD) controls and perpetrate fraud or launder money;
    • use of deepfake identities to gain employment, particularly by North Korean IT workers;
    • AI-enhanced “CEO frauds” to deceive staff into taking unauthorized actions; and
    • Bank customers may be targeted by fraud too, presenting further risk to financial institutions.

Let’s look at these threat vectors individually:

Vector 1: Synthetic identities and KYC/CDD

Synthetic identities can be entirely fabricated or may use combinations of real and fabricated personal information to create a new identity. For example, a fraudster may construct a synthetic identity using a Social Security number exposed during a data breach combined with an AI-generated passport.

This threat is real and happening now: identifies that criminals have already used AI to successfully open accounts using falsified documents, photographs, and videos. And according to , synthetic identities were used to open as many as 3% of US bank accounts, representing millions of identities. Not surprisingly, these illicit accounts are used to commit fraud and launder the proceeds of money laundering.

Vector 2: North Korean IT workers

North Korean individuals have successfully gained employment as remote IT workers at American companies, often passing themselves off as US nationals using AI-generated face-swapping technology combined with proxy computers and false identity documents. North Korean IT workers are almost $800 million annually for the regime.

Institutions deceived into employing these workers are not only against North Korea, but they are also exposing commercially sensitive data and systems to an adversary state, increasing the possibility of theft, cyber-attacks, and extortion.

Vector 3: CEO Fraud

A “CEO fraud” is a cybercrime in which an attacker impersonates an executive to deceive an employee into taking actions such as sending unauthorized wire transfers or disclosing sensitive information. AI accelerates these frauds by making them more personalized and credible.

In one of the more well-known examples, in an AI-enhanced CEO fraud in 2024 after the fraudster impersonated Arup Engineering’s CFO and requested a staff member to make several financial transfers. The criminals added credibility to the fraud by using a in which the target recognized many of their colleagues – unfortunately, all of them were deepfakes.

Vector 4: Frauds targeting customers

Where customers are targets, AI provides the scale, speed, and personalization to allow illicit actors to deliver individualized fraud. For example, whereas romance scams previously used repetitive scripts and re-used the same images of the romantic “partner,” fraudsters can now use AI-generated messages, images, or videos, continuously adapting the execution of the scam to the target’s responses and behaviors.

Creating a cross-functional and unified response

The examples above demonstrate the diverse and highly sophisticated uses of AI by illicit actors, both adversary states and criminal networks. Detecting and responding to these illicit activities requires joint action between teams that may not traditionally work closely together.

For example, if an account holder fails to repay a loan, the credit team may consider it to be a default by a legitimate customer and write it off as a credit loss. However, if the account was opened using a synthetic identity, investigation may reveal other accounts that share similar customer data points or transactional patterns. This could reveal a network of accounts that are perpetrating a fraud or money-laundering scheme. To detect and respond effectively, joint action is needed between KYC/CDD on-boarding teams, financial crime investigators, and fraud and credit risk professionals.

Alternatively, for HR teams to effectively identify use of face-swapping videos during a hiring process, knowledge from the organization’s cybersecurity team, especially of deepfake indicators, would be valuable. If a North Korea IT worker is hired and only later identified, cybersecurity and sanctions teams must be involved in the response to mitigate data, network, and compliance exposures.

Detecting and responding to all illicit activities requires joint action between teams that may not traditionally work closely together.

Finally, all staff may be targeted by deepfake fraud, but those in senior positions or departments with financial authority are the most vulnerable. This means it is essential for institutions to deliver employee training using real-life case studies, “near misses,” and scenarios drawn from across the institution and industry. This type of training will increase vigilance and minimize the likelihood of a successful attack.

For customers, financial institutions are well-positioned to identify indicators of fraud due to their extensive datasets of KYC/CDD records, transactional, and behavioral information. Institutions should enhance their customer relationships (as well as meet applicable regulatory requirements) by taking proactive measures to inform and protect their customers.

While AI has accelerated fraud and crime, financial institutions also hold valuable and relevant assets: the knowledge distributed across their cybersecurity, HR, credit risk, financial crime compliance, fraud, and KYC/CDD teams. By connecting these teams together, even in contexts in which these departments have not traditionally been partners, institutions will be well-positioned to protect both themselves and their customers from illicit actors’ sophisticated AI-enabled threats.

You can learn more about the fraud-fighting challenges faced by financial institutions and other organizations here

Key highlights:

• • • AI governance is hard to prove in practice — While our research shows that 44% of companies publish an AI strategy, 76% of those same companies show no evidence of having policies to evaluate the quality of data used to train AI systems.

    • Workers are being left under-prepared and under-protected — Only 14% of companies have policies to mitigate the negative impacts of AI on workers, and only 31% offer any reskilling or training programs around adapting to an AI-integrated workplace.

    • Human rights and ethics appear an afterthought in AI governance — Almost three-quarters (72%) of companies conduct no AI impact assessments, and less than 1 in 10 companies conduct ethical or human rights assessments.

There is a widening chasm at the heart of corporate AI governance, according to a new report, , published by the �������� Foundation and the United Nations Educational, Scientific and Cultural Organization (UNESCO).

The Foundation’s analyzed publicly available information from nearly 3,000 companies across 11 industry sectors, creating the most comprehensive picture yet of how organizations are managing AI.

Beneath the surface of corporate AI governance mechanisms, divergence between the speed of AI adoption and meaningful human oversight is growing. The report’s findings make clear that this is no longer a gap that organizations can afford to ignore, especially when backlash against is growing and are solidifying among consumers in the United States.

Data highlights the illusion of AI governance

Businesses of different sizes and across multiple sectors are adopting AI technology at a rapid pace. When governance exists only in the wording of a strategy or company vision, however, the people most affected by AI systems — workers, consumers, and communities — are left vulnerable. According to the report:

• • • 44% of companies publicly communicate having an AI strategy. However, a gap in AI governance is evident as more than three-quarters of those companies (76%) do not seem to have policies to evaluate the quality of data used to train AI systems.
    • 40% of companies report board- or committee-level oversight of AI. At the same time, strategic signals do not necessarily indicate operational capacity or day-to-day governance. In fact, less than one-third of all sampled companies claim to have an additional team or resource dedicated to AI governance. Moreover, limited information is publicly disclosed on the teams, processes, and accountability mechanisms that translate intent into action.

Workers are being left behind

Research by the International Monetary Fund finds almost , highlighting the acute nature of concerns about job displacement and declining opportunities for some groups. Without sufficient oversight, AI can threaten workers’ rights, amplify bias, and increase surveillance and work intensity, which can enable inhumane decision-making at scale.

The TR Foundation/UNESCO report notes that many companies are adopting AI without the safeguards needed to support workers and help them to adapt to the changes this technology brings. Less than one-third of companies were shown to offer training and reskilling programs for employees who may be adapting to an AI-integrated workplace. Even within the 31% of organizations in which these training programs exist, there is a vast variation in the scope and depth of the training offered.

In fact, many company training programs are not enterprise-wide or structured. Instead, they are ad-hoc or limited to leadership roles. This lack of investment in talent risks undermining the significant investment that companies are making in AI.

Despite growing pressure from regulators, policymakers and social justice campaigners, the ethical impact of AI appears poorly governed, with companies sharing limited information publicly.

The picture on worker protections is equally concerning. Only 14% of companies have public policies in place to mitigate the negative impacts of AI systems on workers, the report shows. This means the majority of companies either have no policies in place or do not publicly communicate them.

What is more troubling is that when workers experience harm, there is almost nowhere for them to turn. Only 2% of companies indicated they had a complaints mechanism — a critical early warning system for potential concerns. The findings suggest many organizations lack a mechanism for AI-related internal complaints beyond the broad generic complaint channel, and this is compounded by low awareness of the areas in which AI systems may infringe employees’ rights and protections.

Ethics and human dignity as an afterthought

Despite growing pressure from regulators, policymakers and social justice campaigners, the ethical impact of AI appears poorly governed, with companies sharing limited information publicly.

Human rights and ethical use of AI are treated as secondary considerations to compliance, according to our research. The majority of companies (72%) do not conduct any impact assessment with regard to AI. Only 7% publicly communicate conducting a fundamental or human rights impact assessment, and just 5% report conducting an ethical impact assessment.

Among those companies conducting some form of impact assessment, the focus skews sharply toward compliance rather than people. The most prevalent assessments are privacy or compliance-focused, with 18% of those companies that conduct some form of impact assessment reporting that they conducted a data protection impact assessment, and 14% reporting they conducted a privacy impact assessment.

How to center people in AI governance

Closing this governance gap is essential for companies in order to adopt AI responsibly and avoid costly legal, ethical operational, talent-related risks.

To support companies in navigating this challenge, offers a free survey to help companies map the areas in which AI is used across products, operations and services, and then benchmark those against peers their sector.

The report also contains case studies from companies that voluntarily shared their responsible practices with us. For example, German software company SAP intentionally designs and deploys its internal AI systems with a human-in-the-loop in which AI automates repetitive tasks and supports decision-making while final judgment and complex problem-solving remain firmly in the hands of employees.

As AI becomes part of core business infrastructure, companies must move beyond statements of intent and toward measurable AI governance.

In another example, BASF, a German chemical conglomerate, has jointly agreed with its workers’ councils on a general reskilling program that covers technical, hard, and soft skills. Finally, Canadian telecom company TELUS’ Indigenous Advisory Council provides guidance on AI ethics issues that directly affect indigenous communities.

Next steps for companies

The TR Foundation/UNESCO report highlights the most impactful concrete commitments that companies can take now to future proof against AI-related risk, including:

• • • investing in structured, enterprise-wide worker-reskilling programs that measure outcomes, not just participation;
    • establishing enforceable human rights impact assessments as a standard part of AI deployment, not as an optional addition; and
    • creating accessible, AI-specific internal grievance mechanisms so that workers and users have a genuine pathway to raise concerns and seek remedy.

As AI becomes part of core business infrastructure, companies must move beyond statements of intent and toward measurable AI governance. While this data demonstrates clear governance gaps, it also presents an opportunity for companies to take the lead on implementing responsible AI that operates openly in the public interest.

You can learn more about

Key insights:

• • • Define your risk appetite — A clearly defined fraud risk appetite aligns prevention efforts with strategic objectives and ensures accountability by establishing acceptable levels of fraud risk across the organization.

    • Create a fraud-specialized team — Dedicated ownership of the vendors that supply fraud solutions by a fraud-specialized team — rather than by the procurement function — is critical to maximizing technology performance and adapting to emerging threats.

    • Establish a specialized prevention division — The rise of sophisticated scams demands the creation of a separate, specialized prevention division to avoid overburdening core fraud teams and ensure targeted, effective responses.

Corporate fraud represents one of the most significant risks facing organizations today. Yet many companies lack the structured governance and technology infrastructure needed to combat fraud effectively.

The solution requires that comprehensive fraud prevention frameworks be built on clear governance, proper technology deployment, and data-driven insights, according to Aaron Frye, Founder & CEO of Lucid Point Consulting. Organizations that implement these five pillars create resilient fraud prevention functions capable of identifying and preventing fraud before it impacts results. These five pillars include:

1. Develop a fraud risk appetite

Effective fraud prevention begins with a well-defined fraud risk appetite that tells the right story to the right stakeholders. Your framework must communicate to your board, executive leadership, and operational teams the level of fraud losses your organization should tolerate, and in which areas you should prioritize fraud prevention investments.

The fraud risk appetite framework must address several key considerations; for example, it should define the level of fraud risk that aligns with the organization’s growth objectives, identify the areas of greatest vulnerability, and evaluate which investments will yield the strongest return. Equally important is the ongoing monitoring and communication of progress through regular reporting on fraud risk metrics, vendor assessments, and investigation outcomes. These actions demonstrate to stakeholders that fraud prevention remains an active priority for the organization and ensures that fraud risk continues to inform organizational decision-making.

2. Establish clear ownership of risk-solution vendors

Many organizations invest significantly in fraud detection tools only to see disappointing returns. The problem often lies not in the tools themselves, but in unclear ownership and accountability for their performance.

Organizations that implement these five pillars create resilient fraud prevention functions capable of identifying and preventing fraud before it impacts results.

If your organization lacks a designated person or team within your fraud strategy function whose job it is to ensure the risk-solution tools you’re getting from vendors are the best for your enterprise, you likely aren’t getting the most out of your vendors. This dedicated fraud service ownership role must act as your internal champion, evaluating vendor performance, staying current with product enhancements, and ensuring integration with other fraud prevention initiatives.

Critically, procurement, sourcing, and vendor management functions should never own this role. These teams, by the nature of their titles and responsibilities, don’t prioritize fraud. They lack the specialized knowledge required to assess whether your fraud detection technology is performing optimally or adapting to emerging threat landscapes. Without dedicated fraud expertise overseeing your technological investments, advanced tools sit underutilized and critical fraud signals go undetected.

3. Develop a fraud governance function

Every organization should have a dedicated fraud risk governance team within its fraud risk management organization. This governance function serves as your second line of defense, working proactively to reduce operational chaos within your fraud strategy, operations, and investigation groups.

If a non-fraud governance function owns fraud governance, you are guaranteed not to be getting the best form of governance. Fraud is a specialized discipline requiring dedicated expertise and focus; and your governance team must develop policies, establish standards, monitor control effectiveness, and ensure consistent application of fraud prevention practices across the enterprise.

4. Document existing risks and resource gaps

One of the most important responsibilities of your fraud governance function is identifying and documenting the areas related to fraud risk that your current fraud risk teams don’t have time to review. Due to capacity constraints, it is impossible for many fraud risk teams to cover all open gaps. Your organization must understand those open gaps and not be ashamed to address them.

Create an action plan that documents open risk and self-identified issues that your current team cannot adequately address. This transparency demonstrates clear-eyed realism about your organization’s limitations and creates the business case for requesting additional resources or engaging external consultants to help close these risk gaps.

5. Address the growing scam-prevention challenge

needs its own prevention strategy division within your fraud risk function. Compromised business email, investment scams, and vendor fraud schemes represent an entirely new category of fraud risk that demands specialized attention.

Every organization should have a dedicated fraud risk governance team that serves as its second line of defense, working proactively to reduce operational chaos within corporate strategy, operations, and investigation groups.

There has never been a full manageable grip on fraud prior to the spike in scams. Therefore, you cannot expect your existing fraud risk teams to tackle a new wave of scams as a priority as well as to manage traditional fraud prevention responsibilities. Your core fraud function manages internal control systems, transaction monitoring, and investigation protocols. Adding comprehensive scam prevention to this workload without dedicated resources guarantees that identifying and preventing scams will receive insufficient attention.

Establish a dedicated scam-prevention division focused specifically on emerging scam threats, employee education, scam-specific prevention technology, and response protocols. This specialized approach ensures sophisticated scam schemes receive the expertise and resources necessary while your core fraud function continues addressing traditional fraud prevention requirements.

Going forward into the fight against fraud

In an era of escalating fraud threats, reactive detection is no longer sufficient. Organizations must adopt a proactive stance grounded in strong governance, clear accountability, and strategic resource allocation.

By defining a fraud risk appetite, assigning ownership of fraud prevention tools, strengthening governance, documenting unaddressed risks, and establishing a dedicated scam prevention function, companies can build resilient, forward-looking fraud prevention frameworks. These five pillars enable organizations to anticipate threats, allocate resources effectively, and protect both financial performance and reputational integrity.

Today, the path to fraud resilience begins not with technology alone, but with deliberate, enterprise-wide commitment to proactive risk management.

You can find out more about ways to

Key insights:

• • • Prediction markets sit in a regulatory gray zone — Prediction markets’ economic function often looks much closer to gambling than traditional finance.

    • That ambiguity creates an AML blind spot — This blind spot allows potentially weaker controls around KYC, source of funds, sanctions screening, and suspicious activity reporting.

    • Banks and payment processors should focus on actual risk, not labels — Reputational, legal, and financial crime risk exposure can arise long before regulators clarify the rules.

Prediction markets have grown into a multi-billion-dollar ecosystem, offering the ability to enter into a contract to predict the outcomes on everything from elections and sports games to economic data and weather events. Yet as these platforms expand, they operate in a regulatory gray zone that raises serious questions for banks, payment processors, and compliance professionals.

Yet, the classification question that regulators and financial institutions continue to debate is not merely academic. It determines whether prediction market platforms will face the same anti-money laundering (AML) and know-your-customer (KYC) obligations as casinos and sportsbook venues, or whether prediction markets can continue to operate with minimal compliance oversight. This distinction has real consequences for the financial system.

“Prediction markets are not just a classification problem, they represent a structural gap in how financial crime risk is currently understood and managed,” says James Lephew, Founder & CEO of , a Charlotte-based consulting firm that serves major gambling operators and financial institutions globally.

Clarification is required in classifying this sector

Prediction markets occupy an ambiguous middle ground. Market operators position their platforms as financial derivatives or forecasting tools rather than gambling venues, emphasizing price discovery and statistical analysis over chance-based wagering. A contract on the outcome of a presidential election or a sports event, they argue, reflects crowd-sourced probability estimates grounded in information aggregation, not gambling luck.

Yet the fundamental mechanics raise legitimate questions. A user who buys a contract predicting that a candidate will lose an election is, in economic terms, wagering money on an uncertain outcome. The distinction between betting on a football game and trading a contract on the outcome of that same game becomes difficult to defend from a regulatory standpoint — and this classification matters enormously.

The distinction between betting on a football game and trading a contract on the outcome of that same game becomes difficult to defend from a regulatory standpoint — and this classification matters enormously.

If prediction markets are treated as gaming operations, they trigger Title 31 obligations under the Bank Secrecy Act, including currency transaction reporting, suspicious activity reporting (SAR) requirements, and comprehensive KYC procedures. If on the other hand, prediction markets are classified more akin to financial markets, these requirements may not apply. Currently, many prediction market platforms claim financial market status, allowing them to operate outside gaming regulations and with potentially weaker AML controls.

There is a compliance gap

Without clear regulatory classification, prediction markets create a significant AML blind spot. Casinos must report cash transactions exceeding $10,000, conduct source-of-funds reviews, and maintain detailed customer profiles. Sportsbooks face licensing requirements, geolocation checks, and responsible-gaming safeguards. Prediction market platforms, by contrast, often operate with minimal reporting obligations.

This gap introduces concrete risks. Digital wallets and cryptocurrency channels can obscure the source of funds. Structuring and layering of sources become easier without robust verification, further clouding who exactly playing in these markets. Collusive trading through multiple accounts allows value transfer that may go undetected. And VPN use and foreign payment channels can enable sanctions evasion.

Further, without mandatory SAR reporting, suspicious patterns tied to money laundering, terrorist financing, or market manipulation may never reach law enforcement.

“What we’re seeing is an AML blind spot,” says Lephew. “Platforms enabling financial flows with characteristics of gambling, but without the controls that regulators would normally expect.” Until classification catches up with the technology, he adds, this blind spot remains open — and exploitable.

Why this matters for banks and processors

Banks and payment processors that support prediction market platforms may carry significant reputational and legal risk if they haven’t conducted thorough due diligence — and they cannot rely on a platform’s self-classification as a financial market or forecasting tool. Nevada and other jurisdictions are actively examining whether these platforms constitute gambling, echoing concerns from the American Gaming Association that products carrying similar economic risks deserve similar regulatory treatment.

If a product allows participants to wager on uncertain outcomes and creates risk that is substantially similar to gambling, it should face AML and customer identification requirements proportionate to that risk.

“Risk must be assessed based on how the product actually behaves, not how it is marketed,” Lephew explains. And that means evaluating whether a platform applies robust KYC procedures, verifies the source of deposits and beneficial ownership, screens against sanctions lists, reports SARs to the government, prohibits contracts on high-risk events such as assassinations or terrorism, and uses geolocation controls to block users in restrictive jurisdictions. Those answers matter far more than whatever label the platform chooses, Lephew says.

The path forward

Regulators have several options. One approach applies gaming regulations uniformly, treating all prediction markets with economic characteristics similar to gambling as gaming operations subject to Title 31. A second approach creates explicit financial market classification with statutory AML obligations and enhanced scrutiny of high-risk contracts. A third option adopts a tiered or risk-based framework, classifying contracts on lower-risk events such as economic data or weather under financial market rules, while sports and election markets could face enhanced scrutiny. Violent outcome markets would be prohibited entirely.

Regardless of which path regulators choose, the principle should be the same: Classification should follow economic function. If a product allows participants to wager on uncertain outcomes and creates risk that is substantially similar to gambling, it should face AML and customer identification requirements proportionate to that risk.

Financial institutions should not wait for regulatory clarity. They should apply rigorous due diligence now, treating prediction markets with a heightened level of scrutiny appropriate to their actual risk profile rather than their claimed legal status.

The goal is not to eliminate prediction markets, but to ensure they operate within a framework that prevents money laundering, terrorist financing, and market abuse. “If it looks like gambling, behaves like gambling, and carries the same financial crime risk, it should be regulated accordingly,” Lephew notes. “Anything less creates systemic exposure.”

You can find out more about the challenges financial institutions face in their anti-money laundering efforts here

Key insights:

• • • Human rights and environmental sustainability in sports are inseparable — Environmental harms from major sporting events — such as pollution, extreme heat, and flooding — directly undermine fundamental human rights including health, housing, and safe working conditions.

    • Mega sporting events require an integrated, lifecycle-wide approach — From supply chains and stadium construction to urban planning and event delivery, the sports industry’s environmental footprint and human rights impacts span the full lifecycle of these events, demanding a single, integrated playbook.

    • Accountability extends to sponsors and partners, not just hosts and organizers — As scrutiny from regulators, media, and civil society grows, sponsors and corporate partners are increasingly seen as responsible for the combined human rights and environmental impacts of the events they support.

This blog post was co-written with Sreeratna Kancherla and Anna J. Christians of the Henekom Group.

Sports are entering a defining decade. The convergence of climate and nature risk, growing environmental accountability, and increasing scrutiny of how mega sporting events affect the communities that build and host them has brought a long-overdue challenge to the center of sports governance.

Due to their scale, frequency, and global reach, the upcoming FIFA World Cup 2026 and the 2028 Olympics to be held in Los Angeles, alongside competitions such as the 2027 Rugby World Cup and the ICC Men’s T20 World Cup, form part of an ambitious pipeline of major events in a generation. How the sports sector responds to that challenge will shape how the next era of global sport is planned, delivered, and remembered.

Human rights due diligence during mega sporting events and environmental sustainability are often thought of as neighboring agendas, related but managed separately. In practice, however, they are inseparable. When air quality deteriorates, the right to health is at stake. When flooding displaces communities, the right to housing and livelihood is at stake. When extreme heat makes outdoor labor dangerous, the right to safe working conditions is at stake.

The environment is the condition in which human rights are either protected or violated, and sustainability, properly understood, is the commitment to preserving those conditions for current and future generations.

The need for an integrated playbook

The case for an across the lifecycle of sport reflects the scale and complexity of the sporting industry’s impact, with emissions comparable to those of a midsize country, according to . The industry’s heavy reliance on plastics across stadiums, equipment, and apparel contributes to pollution that worsens the global environmental crisis. And those environmental choices carry human consequences at every stage, for the workers who build the facilities, the residents who live alongside them, and the fans who attend the events.

The environmental footprint of the sports industry touches people across the entire lifecycle of a major event. The supply chains necessary to deliver a mega-sports event span facility development, apparel, technology, and food & beverage. These industries are among the highest risk for labor exploitation, migrant worker abuse, and unsafe working conditions. When a host city builds a stadium and hosts events there, the environmental impact is measurable and so is the human rights impact on the workers building the stadium. Indeed, this impact extends to the neighborhoods that may be displaced to make room for it, and to the residents left to live alongside its infrastructure once the event has ended.

You can find more about the resources, tools, and information that cities and organizations need to address��human trafficking around large-scale sporting events at the Thomson Reuters Institute’s Large-Scale Public Events Toolkit here

In addition, major events that rely on street circuits or temporary urban infrastructure can significantly reshape public space and surrounding neighborhoods. Air pollution, construction zones, and rising short-term rental demand also may displace residents and the unhoused population, restrict access to services, or place pressure on already fragile housing markets. In these cases, mega-sports event planning intersects directly with citizens’ rights to housing, mobility, and access to public space.

Expanding accountability

, rooted in the , is the structured process that makes those consequences visible and gives sustainability strategy its human accountability. Because environmental and human rights impacts are inseparable in practice, that accountability extends beyond organizers and host governments to the sponsors and corporate partners of the event. Many operate in sectors which already face scrutiny over their global supply chains; and therefore, alignment with a contentious event can amplify these vulnerabilities while inviting additional public and regulatory attention.

As the regulatory landscape, advocacy groups, and the media intensify their focus on the impact of these mega-sport events, sponsors are increasingly seen not only as influential stakeholders, but as actors with a degree of responsibility for the combined environmental and human rights impacts of the events they fund and support.

Moving from principle to practice

For example, Mercedes-Benz Stadium in Atlanta — home of the NFL’s Atlanta Falcons along with a venue for soccer and concerts — demonstrates that environmental performance and community impact are the same priority and can be pursued through a single design brief. Indeed, it was the first stadium worldwide to receive for zero waste, and its 2.1-million-gallon system helps prevent flooding in neighboring communities. Additionally, the stadium created targeted employment through the and delivered staff training to more than 700 people.

The same integrated logic is now being applied at the event level. Ahead of the FIFA World Cup 2026, host city organizing committees in Houston and Dallas introduced��that address labor exploitation, including human trafficking risks, alongside targeted environmental measures. These measures are treated as a single procurement workstream to be addressed through an integrated response.

Leadership, legacy & the decade ahead

The organizations that will define the next decade of global sports are those that treat human rights and environmental sustainability not as parallel strategies but as two expressions of the same obligation to the people and communities on which sports depend.

This means designing facilities with both environment and humanity in mind from the outset, managing worker rights and environmental standards together across supply chains, and placing extreme heat measures, labor protections, community access, and sustainability targets within a single accountable governance framework.

Governing bodies, organizing committees, sponsors, and host cities that act on this integrated approach have the opportunity to build systems that are more responsible, more durable, and more trusted to define what credible and future-ready sports event management looks like.

You can find more about the impact of mega-sporting events on communities here

Key insights:

• • • SAR volume is significantly underreported — Continuing and amended filings add approximately 20% to the official count yet remain invisible in trend analyses.

    • Filing activity is highly concentrated — A few large financial institutions dominate SARs volume, meaning trends reflect their practices more than systemic changes.

    • Agentic AI will drive a surge in SARs — Agentic AI risks increased noise over actionable intelligence, without addressing the unresolved question of whether current filings yield meaningful law enforcement outcomes.

The Suspicious Activity Reports (SAR) that financial institutions file with the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) provide valuable insight, although they may not offer a comprehensive picture.

Prior to meaningful discussions regarding the future of SARs, it is essential for the financial crime community to clarify what is being measured. In 2025, for example, SAR filings of more than 4.1 million, representing an almost 8% increase compared to the total number of SARs filed in 2024.

Every figure FinCEN has published reflects original SARs only. Continuing activity SARs, which represent roughly 15% of all filings, are submitted under the original Bank Secrecy Act (BSA) identification number and never appear as new filings. Corrected and amended SARs add another 5% on top of that. This makes the real volume of SARs activity approximately 20% higher than what is reported.

The average community bank files fewer than one SAR a week, while the largest institutions file more than 500 a day.

Recent FinCEN guidance giving financial institutions more flexibility around continuing activity SARs sounds significant on paper, but as former Wells Fargo BSA/AML chief Jim Richards points out: “It won’t change the reported numbers — because those filings were never counted to begin with.” Financial crime professionals need to keep that gap in mind every time a trend line gets cited.

2025 was steady, not spectacular

There were roughly 300,000 SARs filed every single month of 2025, and the most notable thing is that nothing notable happened. That is likely a first on the volume side and worth acknowledging, but beyond that milestone the year did not hand financial crime professionals anything noteworthy. In a space that has dealt with pandemic distortions, crypto chaos, and fraud spikes that seemed to come out of nowhere, steady volume and predictable patterns are a little surprising. A quiet data set, however, is not the same as a quiet landscape, and financial crime professionals who are reading stability as stagnation may find themselves flat-footed when the numbers start moving again.

For example, one of the most underleveraged insights in the SARs space is just how concentrated filing activity really is. The numbers are stark: The top four banks file more SARs in a single day than 80% of the rest of the banks file in 10 years, according to 2019 data from a .

The average community bank files fewer than one SAR a week, while the largest institutions file more than 500 a day. “50 a year versus 500 a day,” notes Wells Fargo’s Richards, adding that such asymmetry has real implications for how the financial industry interprets trends. Meaningful movement in SARs data, up or down, is almost entirely dependent on what a handful of mega-institutions decide to do.

Not surprisingly, money services businesses (MSBs) are the second largest filing category, and virtual currency exchanges are almost certainly driving recent growth there, even if outdated category definitions make that difficult to confirm directly. Credit unions round out the top three.

The filing philosophy hasn’t changed and shouldn’t

Regulatory noise occasionally suggests that institutions should be more selective about what they file. However, compliance and legal reality have not shifted. No institution has ever faced serious consequences for filing too many SARs, and the cases that result in enforcement actions, reputational damage, and regulatory scrutiny are consistently about missed filings or late ones.

“You’re not going to get in trouble from filing too much,” Richards says. “Nobody ever has, and I doubt if anyone ever will.” For financial crime professionals, the calculus remains exactly what it has always been — when in doubt, file. That posture isn’t going to change, and frankly it shouldn’t.

Yet, here is where the SARs space gets genuinely interesting. Agentic AI use in SARs filings — systems in which multiple AI agents work through a case from screening to decision to documentation — is beginning to move from concept to deployment. The impact on filing volume likely will be significant.

The risk is a system flooded with AI-generated SARs of variable quality, creating more noise for law enforcement to sort through rather than sharper intelligence to act upon.

Whereas a small team today might work through a handful of cases a week, AI-assisted workflows could push that into the dozens. Multiply that across institutions already inclined to file rather than miss something, and the result is a coming surge in SARs volume that could play out over the next two to four years.

“Agentic AI has the potential to be a game changer on how we do our work,” Richards explains. “But I believe it’ll guarantee that there will be more SARs filed and not necessarily better and fewer SARs filed.” Indeed, the critical point for the financial crime community to internalize is exactly that.

The risk is a system flooded with AI-generated SARs of variable quality, creating more noise for law enforcement to sort through rather than sharper intelligence to act upon. Once the largest institutions adopt agentic AI as a best practice, others will follow quickly, and regulators will likely be several steps behind.

The value question can’t wait

The has been in place since 2014. Yet after 12 years of filings, the financial crime community still lacks a clear public accounting of whether that data has produced actionable law enforcement outcomes.

So, the question Richards is asking is one the entire industry should be asking: “Has anybody asked law enforcement?”

This question reflects a larger challenge that the industry needs to confront more aggressively, especially as AI technology is set to dramatically increase filing volume across the board. Increasing the volume without improving how the information is used does not represent progress. If SARs are not generating real investigative value, the solution is not to file more of them faster — instead, the pipeline should be fixed before it grows any bigger.

You can find more about the challenges that financial institutions face in managing SARs here

• • • The ceasefire is between the US and Iran and is not a regional peace —��Israel launched its heaviest strikes yet on Lebanon within hours of the announced deal. Iran hit oil infrastructure in Kuwait, the UAE, Bahrain, and Saudi Arabia — including the East-West Pipeline, the primary route for bypassing the Strait of Hormuz. Companies planning around a return to normal should instead plan around the idea that the war has narrowed, not ended.

    • If the disruption stays within one quarter, the economic damage is painful but reversible — The Dallas Fed projects WTI oil at roughly $98 per barrel with a modest GDP hit in a short-closure scenario. The catastrophic scenario — WTI above $132 with sustained negative growth — requires the closure of the war to drag past Q2. Every week the ceasefire holds improves the odds, but Iran’s strike on the Saudi bypass pipeline complicates even the optimistic timeline.

    • Iran may have stumbled into the most lucrative chokepoint tax in modern history — At conservative estimates, transit fees charged for traversing the Strait of Hormuz could generate $40 billion to $50 billion for Iran annually, or roughly 10% to 15% of Iran’s pre-war GDP — all at near-zero operating cost. That revenue stream inverts Tehran’s incentives. Indeed, keeping the toll system in place may now be worth more than restoring free transit.

On April 7, less than two hours before a self-imposed deadline that threatened the destruction of Iran’s civilian infrastructure, President Donald J. Trump announced a two-week ceasefire in the war in Iran that began on the last day of February and continued over 38 days of sustained air strikes by the Unites States and Israel. In turn, Iran carried out retaliatory attacks across over a dozen countries and forced the effective closure of the Strait of Hormuz.

With the ceasefire, all that has paused. Yet, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: How can I plan around this?

The honest answer is, not yet — and the first 24 hours have already shown why.

A fragile, but functional peace

The ceasefire is remarkably thin, and it’s based on three operative clauses: i) the US and Israel halt strikes on Iran; ii) Iran halts retaliatory attacks on the US and Israel; and iii) Iran allows “safe passage” through the Strait of Hormuz. Everything else — from nuclear terms, sanctions, reconstruction, and the legal status of Hormuz transit — has been punted to negotiations in Islamabad beginning April 10, with Pakistan mediating.

With the ceasefire, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: “How can I plan around this?”

However, what the ceasefire covers matters less than what it doesn’t. Within hours of the announcement, Israel launched its heaviest strikes yet on Lebanon, and Iran warned it would withdraw from the ceasefire if attacks on Lebanon continue. Meanwhile, Kuwait, the UAE, and Bahrain all reported fresh Iranian missile and drone strikes targeting oil, power, and desalination infrastructure after the ceasefire was in place. Most critically, Iran struck Saudi Arabia’s East-West Pipeline, the main route by which Gulf producers have been rerouting oil to bypass the blockaded strait.

That pipeline strike should command attention in every supply chain and energy risk briefing this week because it signals how shaky the agreement is, and that Iran remains a long-term threat to vital infrastructure across the region.

For companies operating in or sourcing from the Gulf, the practical implications are immediate. This is not a ceasefire that restores pre-war operating conditions; rather it is a bilateral pause between two belligerents while the regional war continues around them. Insurance premiums, shipping risk assessments, and supply chain contingency plans should reflect that distinction until there is a meaningful shift.

What does this mean for the next two weeks?

Both sides are claiming victory — and increasingly, claiming different deals. Trump called Iran’s 10-point proposal “a workable basis on which to negotiate”; and Iran’s Supreme National Security Council called the ceasefire a “crushing defeat” for Washington. The White House now says the 10-point plan Iran is publicly circulating differs from the terms that were actually negotiated for the ceasefire. Tehran, meanwhile, says there is no deal at all if Lebanon isn’t included — a condition the US has not acknowledged. And of course, the Strait of Hormuz remains closed.

These are not the hallmarks of a stable agreement; but they may be the hallmarks of a durable one. The deal is thin enough so that each side can brief its domestic audience on a different story, and as long as neither is forced to reconcile those stories publicly, the pause holds.

And the incentives to keep talking are asymmetric but real. The US has watched gas prices surge past $4 nationally as domestic support for the war — which started at levels best described as in a hole — continued to drop even further. Goldman Sachs raised its recession probability to 30% and JPMorgan to 35%, and every day the strait stays closed pushes those numbers higher. The administration needs the global economy to exhale and needs distance itself from a war so it can focus on other priorities, including an already difficult midterm election cycle.

With the ceasefire, all that has paused. Yet, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: How can I plan around this?

Iran, for its part, wants the bombing to stop. Its conventional navy has been functionally destroyed, its air defenses are highly degraded, its nuclear facilities have sustained severe damage, and its cities, bridges, and transportation networks have been hit repeatedly. The regime survived and arguably emerged with greater domestic legitimacy than it had before the war, but the physical toll is mounting. Tehran wants the strikes to stop so it can claim victory by survival without incurring any more costs.

This mutual exhaustion is the load-bearing structure of the ceasefire. If the ceasefire holds for 72 hours (as I think it might), and if the strait begins opening to escorted traffic by Friday as Iranian officials have signaled, and if neither side finds a reason to walk away before the Islamabad talks convene, then the ceasefire will likely be extended. Not because the underlying disputes get resolved, but because the cost of resuming hostilities exceeds the cost of continuing to talk. Expect a rolling series of extensions, probably 30 to 45 days at a time, that resolve nothing while letting global markets gradually stabilize.

As we wrote earlier this month, if the disruption remains limited to roughly one quarter, the oil price shock is painful but reversible, ugly, but manageable. And every week the ceasefire holds pushes the trajectory toward the manageable scenario.

What happens after the ceasefire?

Again, if the ceasefire holds, we then have to start thinking about how this conflict resolves. Not surprisingly, this is where it gets uncomfortable.

The conventional assumption in Washington and in global markets is that the Strait of Hormuz will return to normal once the fighting stops. That assumption underestimates what Iran has built.

Iran’s parliament is working to pass a Strait of Hormuz Management Plan, codifying its claimed sovereignty over strait transit and establishing a legal framework for collecting toll fees. Media reports indicate Iran has been charging vessels between $1 million and $2 million per transit and is planning to keep charging those tolls for all ships as the strait reopens. So, at $1 million per ship, and with up to 135 transits per day, 365 days a year, that’s about $40 billion to $50 billion in annual revenue for Iran, or up to 15% of Iran’s pre-war GDP. All at an operating cost that approaches zero.

Iran didn’t enter this war planning to build the most lucrative chokepoint tax in modern history, but it may have stumbled into exactly that.

Compare that to Iran’s oil sector, which generated approximately $53 billion annually in 2022 and 2023, required massive capital investment and maintenance, and was subject to constant disruption. The toll revenue is comparable in scale, dramatically cheaper to operate, and immune to sanctions. If the final number is even a fraction of this, it’s still a massive financial shot in the arm for Iran that could become a far greater advantage than the damage to capital that the war has inflicted upon the state.

Iran didn’t enter this war planning to build the most lucrative chokepoint tax in modern history, but it may have stumbled into exactly that.

Of course, this changes the structural incentives around the Strait of Hormuz in ways most analysts haven’t fully absorbed. A permanent toll system gives Iran a revenue base to rebuild the military assets it lost, reduce its dependence on oil exports, and fund domestic investment that could blunt future protest movements. The regime’s cost-benefit calculus has inverted: Keeping the toll operational in place may now be worth more than restoring the pre-war status quo.

For the US and Israel, the only way to dismantle this arrangement is by force and the last 38 days demonstrated the limits of that approach. The US achieved air and naval superiority, destroyed Iran’s conventional military, and killed the supreme leader. None of it was enough to compel capitulation, and in fact, may not have even come close. A second campaign faces the same likely result, against a population now unified by the experience of surviving the first one.

The war didn’t just disrupt global trade. It may have permanently repriced the most important shipping lane on Earth — and left every piece of energy infrastructure in the Gulf more vulnerable than it was before the first air strike landed.

You can find more about the global impact of the war in Iran here

Key insights:

• • • Non-compliance is significantly more expensive than compliance — Data consistently shows the cost of non-compliance can be greater than proactive compliance investments.

    • Reputational damage and hidden costs often outweigh direct fines — Beyond financial penalties, the damage from legal fees, loss of customer trust, and operational disruptions from non-compliance can inflict long-term harm.

    • Strategic investment in compliance yields a competitive advantage — A robust compliance program builds trust, attracts investors, and demonstrates greater operational resilience in a complex regulatory landscape.

There’s a persistent myth in the business world that compliance programs are a necessary burden, a line item to be minimized and managed rather than invested in strategically. The data tells a very different story, however, and it has for quite some time. For organizations still treating compliance as an overhead expense, it’s time to reconsider the math and view the broader strategic picture.

The numbers don’t lie: Non-compliance costs more

Non-compliance costs are 2.65-times the cost of compliance itself, a finding that dates back to the of multinational organizations. While the average cost of compliance for the organizations in that study was $3.5 million, the cost of non-compliance was much greater. That means simply by investing in compliance activities, organizations can help avoid problems such as business disruption, reduced productivity, fees, penalties, and other legal and non-legal settlement costs.

According to a later report from from 2017 (the most recent set of analytical data on the subject), the numbers have only grown more striking. The study showed that average cost of compliance increased 43% from 2011 to 2017, totaling $5.47 million annually. However, the average cost of non-compliance increased 45% during the same time frame, adding up to $14.82 million annually. The costs associated with business disruption, productivity losses, lost revenue, fines, penalties, and settlement costs add up to 2.71-times the cost of compliance.

And these non-compliance costs from business disruption, productivity losses, fines, penalties, and settlement costs, among others aren’t simply abstract risks. They’re real, recurring, and measurable, and they don’t stop with the fine itself.

Beyond the fines themselves, legal costs are a significant and often underestimated component of non-compliance.

This gap between compliance and non-compliance provides evidence that organizations do not spend enough of their resources on core compliance activities. If companies spent more on compliance in areas such as audits, enabling technologies, training, expert staffing, and more, they would recoup those expenditures and possibly more through a reduction in non-compliance cost.

While the math here is straightforward, the strategic case is even clearer. Compliance isn’t overhead; rather, it’s an investment with a measurable, proven return.

The hidden costs: Legal fees, fines & reputational fallout

Regulatory fines get the headlines, but they represent only part of what non-compliance actually costs an organization — a cost that has only risen over time. As of February, a total of 2,394 fines of around €5.65 billion have been recorded in the database, which lists the fines and penalties levied by European Union authorities in connection with its General Data Protection Regulation (GDPR).

Beyond the fines themselves, legal costs are a significant and often underestimated component of non-compliance. Regulatory norms are shifting constantly and navigating them requires specialized expertise. As quickly as the rules change, outside counsel and compliance specialists must keep pace, and that knowledge comes at a price. Every alleged compliance violation triggers an immediate need to engage qualified counsel, adding to a cost burden that compounds quickly and unpredictably.

Then there is reputational damage, perhaps the most enduring consequence of all. The cost of business disruption, including lost productivity, lost revenue, lost customer trust, and operational expenses related to cleanup efforts, can far exceed regulatory fines and penalties. Consider , whose compliance failures around its anti-money laundering (AML) efforts became a cautionary tale for the industry. TD Bank’s massive $3 billion in fines from US authorities wasn’t just the result of a few missteps; rather, it was caused by years of deep-rooted failures in its AML program, pointing to a culture that prioritized profit over compliance.

The findings from both the 2011 and 2017 studies provide strong evidence that it pays to invest in compliance.

TD Bank’s failure to make compliance a priority not only led to a huge fine but also seriously damaged its reputation, with revising TD’s outlook to negative in May 2024, where it remains. This is the kind of a reputational stigma that can take years to repair.

Leveraging compliance as a competitive advantage

There is also a positive side of the ledger that often goes unacknowledged. A robust compliance program signals to investors, partners, and clients that an organization is well-governed and trustworthy. That reputation doesn’t just retain market value; it actively attracts it.

Organizations that cut corners in compliance risk engaging in a short-sighted, high-risk strategy that will ultimately result in a negative outcome for the organization. Businesses that take compliance seriously tend to operate with greater predictability, fewer surprises, and stronger stakeholder confidence.

The 2017 Ponemon and Globalscape and study found that, on average, only 14.3% of total IT budgets were spent on compliance then, not much of an increase from the 11.8% reported in 2011. This clearly indicates that organizations are underspending on core compliance activities in the short term and aren’t prepared to allot further resources as the years go on. That gap represents not just risk, but a clear missed opportunity.

“The findings from both the 2011 and 2017 studies provide strong evidence that it pays to invest in compliance,” explains Dr. Larry Ponemon, Chairman and Founder of the Ponemon Institute. “With the passage of more data protection regulations that can result in costly penalties and fines, it makes good business sense to allocate resources to such activities as audits and assessments, enabling technologies, training, and in-house expertise.”

The organizations that recognize compliance as a strategic function, not a reactive one, are the ones that will earn the trust of clients, the confidence of investors, and the operational resilience to weather an increasingly complex regulatory environment. The data is clear, and the choice is a critical one.

You can find out more about the challenges faced by corporate compliance professionals here

Key takeaways:

• • • Human trafficking is a financial crime — Without the financial system, human trafficking networks cannot operate at scale. Banks, compliance officers, money transmitters, and casinos are uniquely positioned to detect suspicious patterns.

    • The 2026 World Cup amplifies existing risks — With 5.5 million additional visitors expected in Mexico City alone, criminal networks will exploit the surge in cash flows, new customers, and cross-border movement.

    • Red flags are observable in financial behavior — Human trafficking networks often leave detectable financial footprints, which is why financial institutions must update monitoring systems and stay alert to unusual transaction spikes during the tournament.

MEXICO CITY — As the 2026 FIFA World Cup get ready to hold its tournament in June and July across three North American countries, anti-human trafficking experts are meeting as well and attempting to address the challenges facing the three host countries of the largest World Cup in history.

To that end, the Association of Certified Anti-Money Laundering Specialists (ACAMS), in partnership with ��������, organized one such event, focused on the scourge of human trafficking that often surrounds large sporting events like the World Cup.

One speaker at the event noted an important clarification in the difference between human trafficking and human smuggling — two terms that are frequently confused yet carry vastly different legal and humanitarian implications. The key distinction lies in consent and the nature of the crime. In human smuggling, the individual being transported across borders consents to the movement, typically driven by socioeconomic necessity, and the offense is considered a crime against the state. Human trafficking, by contrast, is a crime committed directly against the victim, often involving exploitation through force, coercion, threats, or deception, and does not require the crossing of any international border.

The ACAMS event challenged the common belief is that human trafficking is exclusively sexual in nature. In fact, there are 10 additional forms of exploitation beyond sexual abuse, including slavery, forced labor or services, use of minors in criminal activities, forced marriage, servitude, labor exploitation, forced begging, illegal adoption of minors, organ trafficking, and illicit biomedical experimentation on human beings.

As the World Cup approaches, financial institutions’ compliance teams must recognize that the same operational conditions that make major sporting events exciting are precisely the conditions that money launderers and traffickers seek to exploit.

Still, sexual exploitation remains the dominant form of human trafficking. Indeed, it is the second most lucrative illicit business in the world after drug trafficking, with every 15 minutes of sexual abuse of a trafficking victim generating approximately $30.

Of course, without clients, there is no demand, said one speaker from the ÁGAPE Foundation, an organization that works to raise awareness against gender-based violence and human trafficking.

Financial sector as a key line of defense

When identifying human trafficking, it’s wisest to examine it from a financial perspective to find important indicators, according to several speakers. Indeed, the financial sector plays a critical role given its capacity to detect suspicious accounts and payments, shell companies, cash movements, digital platforms, and commercial operations.

For example, when a customer opens an account or conducts a transaction, certain red flags can be visible, including whether the customer needs to consult notes to answer basic questions such as their address or occupation, or that their responses are not spontaneous or natural. Also, another indicator is if the customer’s profile is inconsistent with the type or volume of transactions being conducted.

For financial institutions, there are other patterns that have triggered alerts in illicit activity in the past, including near-immediate deposits and withdrawals with no clear justification for the cash flow, or multiple individuals registered at the same address or linked to the same account.

Similarly, another red flag would be if there’s a high number of accounts opened from the same state or municipality with similar patterns, particularly in areas identified as origin points for trafficking networks; or, payment of multiple short-term rentals or payments abroad to unverifiable recruiters or employment agencies.

Financial institutions should be on the lookout for companies that file no tax returns or invoice simulated transactions, or that use of front men to open accounts or conduct operations.

Also, new businesses whose declared activity does not correspond to their financial operations should be flagged, as well as any frequent, large-volume purchases of condoms, lingerie, or women’s clothing inconsistent with the declared business activity.

Indicators at the 2026 World Cup

In the context of major sporting events such as the World Cup, existing risks are significantly amplified, several speakers pointed out. Sexual tourism, including the commercial sexual exploitation of children and adolescents, is a known and serious threat. Indicators that are relevant not only for the financial and banking sectors, but also for the real estate, tourism, transportation, hospitality, and restaurant industries including unusual accommodation requests, such as deactivating security cameras, delivering keys through third parties, or inquiring about the presence of neighboring guests.

When identifying human trafficking, it’s wisest to examine it from a financial perspective to find important indicators, and the financial sector plays a critical role given its capacity to detect suspicious accounts.

These industries should also be on the lookout for any adult or group of adults traveling with an unusually large number of minors, or individuals who travel in silence and are accompanied by someone who appears to exercise visible control over them.

As the World Cup approaches, financial institutions’ compliance teams must recognize that the same operational conditions that make major sporting events exciting — high transaction volumes, new customers, cross-border flows, and institutional attention diverted toward the event itself — are precisely the conditions that money launderers and traffickers seek to exploit.

For these compliance teams, monitoring systems must be updated, know-your-customer processes must go beyond documentation and reflect a genuine understanding of the client’s activity and context, and on-site verification visits must be conducted by personnel who know exactly what they are looking for.

The financial sector does not need to become an investigative body; however, it does need to remain alert, informed, and willing to report. Indeed, this is exactly what the compliance function exists for, and in the context of human trafficking, the cost of silence is measured not in fines or reputational damage, but in human lives.

You can find out more about the��challenges of hosting the 2026 FIFA World Cup here

Key takeaways:

• • • Q2 is a wound that heals if the war stops — Oil spikes, inflation revisions, and supply disruptions are painful but mostly reversible in a short-war scenario. The exception is insurance and risk premiums for Gulf maritime transit, which are permanently repriced.

    • Q3 is a wound that scars — Sustained oil at $130 per barrel changes household and business behavior in ways that don’t snap back. Recession probability crosses the coin-flip threshold and supply chain disruptions cascade into industries far from the Gulf.

    • Q4 is a different body — Even if the war ends, the global economy has rebuilt itself around the disruption. Trade routes, supplier relationships, and risk models have been permanently rewired, especially if there is nothing structural to prevent the Strait from closing again.

This is the second of a two-part series on the impact of the war with Iran as the conflict continues. In this part, we’ll walk through what a quarter-by-quarter economic scenario would look like if the war continues.

Previously, we made the case that the US-Iran war is unlikely to end quickly. The regime hasn’t collapsed, the asymmetric force controlling the Strait of Hormuz is nowhere near neutralized, and diplomacy seems dead on arrival. Most significantly, the United States military is escalating, not winding down.

While the first part of this series was about the military and diplomatic picture, this piece is about your balance sheet.

What follows is a quarter-by-quarter map of what a prolonged conflict means for the global economy, charted from now through Christmas 2026. We’ll cover how oil, supply chains, GDP forecasts will be revised in real time, and how disruptions that look temporary in Q2 could trigger a permanent rewiring of how the global economy moves goods, prices risk, and sources critical inputs.

Even if your company doesn’t import a single barrel of Gulf crude, you could still get hit by this. Indeed, if you’re plugged into the global economy like the rest of us, you’re going on this ride.

Q2 2026 (April–June): The wound that heals

If the war ends by the close of the second quarter on June 30, most of the damage is reversible — painful, but reversible.

Brent crude is up about 60% since before the start of the war when it was roughly $70 per barrel; and Capital Economics , prices could fall back toward $65 by year-end. The interim outlook from the Organisation for Economic Co-operation and Development (OECD) now to be 4.2% for 2026, up sharply from 2.8%, assuming energy disruptions ease by mid-year. If that assumption holds true, it’s likely we’ll be able to muddle through the pain.

Even in the most optimistic scenario, however, Q2 introduces disruptions beyond oil that most people aren’t tracking. The Gulf supplies roughly 45% of global sulfur, and Qatar produces around one-third of the world’s helium, which is essential for semiconductor manufacturing. Further, Qatar’s liquified natural gas (LNG) production was significantly damaged by Iranian strikes.

Even in the most optimistic scenario, however, Q2 introduces disruptions beyond oil that most people aren’t tracking.

Further disruptions in fertilizer supply chains could delay spring planting, which could ripple into agricultural yields well into 2027. These effects don’t snap back the moment oil flow normalizes; they have their own timelines.

And here’s the one thing that doesn’t reverse even in the best case — risk premiums. The Strait of Hormuz was priced as a chokepoint that would never actually close. So when it did, that repricing is permanent and will be felt across the world as risk around other too important to fail chokepoints is itself reevaluated and priced higher.

Q3 2026 (July–September): The wound that scars

If a Q2 end to the war represents a recoverable spike, a Q3 end is where the word structural starts showing up in the discussion.

Capital Economics models Brent at roughly $130 per barrel — or roughly 14% higher than where it is now — in a prolonged scenario. At those prices, the damage stops being abstract. And Moody’s Analytics chief economist Mark Zandi estimates that every sustained $10-per-barrel increase . At $130 (nearly double pre-war levels) that’s approaching $2,700 per family. That is the kind of money that changes behavior.

In this case, Zandi says, especially if the cost of oil stays elevated for months — and by Q3, it would have. Moody’s recession probability model was pushing 50% in late-March when oil was $108 per barrel. At $130, the math speaks for itself.

Again, in this scenario, the damage fans out beyond energy. Fertilizer shortages hit crop yields, and helium disruptions cascade into semiconductors, automotive, and medical devices. The potential impact on AI-related manufacturing alone could spook investors already primed to see AI as a bubble. Capital Economics projects Eurozone growth at 0.5% and Chinese growth below 3%. Emerging markets could face forced rate hikes that deepen their own recessions.

This is the quarter in which contingency plans become operating assumptions. The question is no longer When does this go back to normal? —��rather the question is whether normal is coming back at all.

Q4 2026 and beyond: The different body

Here’s what most forecasts don’t capture about a war that continues passed Q4: It almost doesn’t matter whether the war is still active or not. The damage has changed shape, and it’s no longer about what the conflict is doing to the global economy. Instead, it’s about what the global economy has done to itself in response.

Companies that spent Q2 and Q3 diversifying away from Gulf suppliers have now spent real money building alternatives. They are not going back to their previous pathways even if there is a ceasefire. The sunk costs make the reversal unthinkable, and the memory of this conflict makes it irrational. No supply chain director is walking into a boardroom to recommend re-concentrating risk in a chokepoint that closed once and might close again.

The prudent approach for companies remains clear. They should plan for the war to last into at least Q2, probably Q3, with structural effects persisting beyond.

Because, of course, it could close again. If Iran emerges weakened but intact, which is the most likely outcome per multiple intelligence assessments, the result is a hostile state with every incentive to reconstitute its asymmetric capabilities the moment the pressure lifts.

Companies are thus going to reroute their future supplies around the Strait rather than through it. High oil prices and the potential for global shortage will also further accelerate green energy initiatives or alternate fuel sources across the globe as oil security reenters geopolitical calculations. Most importantly, every organization’s supply chain will need a reevaluation in light of an increasingly dangerous world, with expensive secondary supply chains becoming more a necessity than a luxury.

That’s the real legacy of a war continuing past the end of this year. Not oil prices on any given day or even insurance premiums, but the permanent repricing of an assumption. The war didn’t just disrupt the flow of goods through the Strait of Hormuz, it broke the premise that some geographies were too big to fail and would be protected and kept open. Once that premise is now broken so thoroughly companies will need to reevaluate whether the concentration of risk in individual areas is a luxury they can afford. Many will find the answer to be no, resulting in an increased push to diversify risk away from single points of failure.

The planning imperative

Fortunately, the best-case scenario remains possible. However, it requires Iran accepting terms it has publicly rejected as existential, its navy being neutralized despite retaining significant asymmetric combat capability, a coalition materializing from countries that have refused to send warships, and mine-clearance operations succeeding with the deck stacked against them. Only then, we’ll see if civilian traffic is willing to risk billions of dollars that the clean-up job was done right. Each is possible, but the odds remain slim.

The prudent approach for companies remains clear. They should plan for the war to last into at least Q2, probably Q3, with structural effects persisting beyond. They should model energy prices at between $120 and $150 per barrel, not $70. The smart companies are the ones building optionality now because the cost of flexibility is far lower than the cost of being caught flat-footed in September.

Four weeks ago, the assumption was that the Strait of Hormuz was too important to close. However, it did, and the assumption that it will reopen quickly deserves the same scrutiny.

You can find out more about the��geopolitical and economic situation in 2026��here