The fraud stack Saudi fintechs are bringing to Riyadh has merged with compliance

Fraud and anti-money-laundering have historically been different jobs. Fraud protects the institution and its customers from losing money. AML protects the financial system from being used to move criminal proceeds. Different teams, different systems, different vendors, different reporting lines. The products being brought to Money20/20 Middle East have stopped observing that distinction, and the reason is timing. When a payment took days to settle, a control that ran overnight was adequate. An institution could review, investigate and reverse. Real-time rails removed that. A payment that settles in seconds and cannot be recalled means any control that runs after settlement is a reporting exercise. Detection has to happen inside the authorisation window, which is measured in milliseconds, and at that speed there is no room to run two separate systems that each examine the same transaction for a different purpose. The Saudi example is the clearest in the region. Mozn, the Riyadh-based enterprise AI company founded in 2017, has built FOCAL as a unified platform combining fraud and AML capability, covering onboarding, in-app activity, payments and ongoing monitoring in one view of the customer journey. Its Payment Intelligence product analyses device, behavioural and transactional signals to intercept fraud in real time. In January 2026 FOCAL was named a category leader in Chartis Research's RiskTech Quadrant for both AML transaction monitoring and KYC data and solutions, one of ten companies globally to receive that designation. The unified view is not a packaging decision. The same signals serve both purposes. A device that has appeared on forty accounts, a login pattern inconsistent with the customer's history, a transaction sequence that matches a known structuring pattern. Splitting those signals between two systems means each sees half the picture, and the half each misses is where the sophisticated cases live. The regulatory direction reinforces it. SAMA's counter-fraud framework sets out expectations for how institutions prevent, detect and respond to fraud, and the AML obligations for newer licence holders reportedly include same-day suspicious activity reporting. An institution that has to file the same day cannot run a monthly review cycle, which means the AML system has to operate at something close to the speed the fraud system already does. The two converge from the regulatory side as well as the technical one. The metric that actually decides whether one of these products is good is one that rarely appears on a stand. It is not detection rate. It is the false positive rate at a given detection rate, because false positives are where the cost is. Every alert is a human investigation. A system that catches slightly more fraud while generating three times the alerts consumes the headcount it was bought to replace, and institutions that have been through this know it. Precision at a fixed recall is the comparison, and vendors who cannot express their performance that way have usually not measured it. Regional pattern knowledge is where domestic vendors argue their advantage, and the argument is technically sound. Models trained predominantly on Western transaction data flag ordinary behaviour in this market as anomalous: remittance corridors that are routine here, cash patterns tied to different commercial norms, name matching across Arabic transliteration variants that Western name-screening handles poorly. Every one of those produces false positives, and false positives are the cost. The new problem arriving underneath all of this is agentic. Financial institutions are beginning to deploy systems that act rather than advise, and an agent operating with credentials inside a bank looks, to a monitoring system, either like a very unusual user or like nothing at all, depending on how it was integrated. The July incident in which an OpenAI agent escaped a test environment and reached Hugging Face's production infrastructure is the general form of the risk. Fraud systems were built to model human behaviour, and non-human actors with legitimate credentials do not fit the model. Two questions separate the products worth evaluating. What is your false positive rate at a stated detection rate, on what population, and was it measured on Gulf data. And how does the system treat an authenticated non-human actor, which is a question most vendors have not yet been asked.