Source-linked AI summary
Becoming Suspicious Across Borders: Algorithmic Extraterritoriality and AI-Driven Financial Surveillance
Georgios Pavlidis, Savvas Chatzichristofis, Eleni Gavriil
TL;DR
In AML/CFT, suspicion traditionally rests on situated human judgment, but AI-driven surveillance increasingly produces it through data-driven processes. The article develops algorithmic extraterritoriality to explain how regulatory reach operates through cross-border data infrastructures. These dispersed, opaque processes make suspicion harder to locate, explain, and contest.
Problem
The article asks how AI-driven financial surveillance changes the relationship between suspicion, jurisdiction, and the human subject as suspicion becomes data-driven and cross-border.
Source: §1 · p. 1, §3 · p. 6, §7 · p. 11Method
The article develops algorithmic extraterritoriality as a socio-technical account of regulatory reach mediated by cross-border data infrastructures.
Source: §3 · p. 2, §7 · p. 11Results
AI-driven surveillance increasingly produces suspicion through cross-border data infrastructures, making individuals visible and governable across borders.
Source: §3 · p. 2, §7 · p. 11Takeaways & Limitations
Because suspicion can be generated through dispersed and continuous data processing, it becomes more difficult to locate, explain, or contest.
Source: §3 · p. 5Complex AI outputs may be difficult to interpret or explain, and explainability tools provide approximations rather than full accounts of particular inferences.
Source: §3 · p. 5
Abstract
from arXiv · showhide
Suspicion is an important, yet elusive concept in anti-money laundering and counter-terrorist financing (AML/CFT), which allows for intervention below the threshold of proof. In its traditional form, suspicion can be understood as a situated legal judgement by human actors within identifiable jurisdictions. It is argued that this understanding is no longer adequate. As artificial intelligence (AI) becomes an integral part of financial surveillance, suspicion is increasingly produced through data-driven processes. This transformation is epistemic, but also spatial. Since AI-driven financial surveillance operates through transnational data infrastructures, regulatory reach is less a matter of where conduct occurs than a question of whether such conduct becomes visible within data systems. This article develops the concept of algorithmic extraterritoriality, understood as a form of regulatory power mediated by data infrastructures rather than formal assertions of jurisdiction. Moreover, since individuals are increasingly constituted as datafied subjects of suspicion, they are rendered governable through dispersed and opaque processes of evaluation. This constitutes a challenge for accountability and contestability because suspicion becomes more difficult to locate, explain or contest.
1. Introduction: Becoming Suspicious Across Borders
The article argues that AI-driven financial surveillance changes suspicion from a situated human legal judgment into something increasingly produced by data-driven processes. This challenges the traditional understanding of suspicion in AML/CFT.
1. Introduction: Becoming Suspicious Across Borders
- Suspicion traditionally operates below proof but above intuition, justifying AML/CFT monitoring, reporting, and even exclusion from financial services.It has been understood as a human judgment about transactions within identifiable jurisdictions.Source: §1 · p. 1
- AI increasingly produces suspicion through data-driven processes rather than merely detecting pre-existing irregularities.The article argues that this shift warrants reconsidering suspicion’s traditional legal framing.Source: §1 · p. 1
- Lord Devlin described suspicion as conjecture or surmise where proof is lacking [1].The cited formulation allows suspicion to take account of matters that could not themselves be put in evidence.Source: §1 · p. 1
3 Soviany, “AI-Powered Surveillance.”
AI-driven financial surveillance produces suspicion through data patterns and cross-border infrastructures, loosening its connection to specific acts and jurisdictions. The article develops algorithmic extraterritoriality to describe regulatory reach mediated by data infrastructures.
3 Soviany, “AI-Powered Surveillance.”
- Suspicion increasingly emerges from patterns, correlations, and probabilistic inferences, rather than specific legal or factual triggers.It can become a continuous condition rather than an episodic assessment.Source: §3 · p. 2
- Cross-jurisdictional data aggregation and information-sharing let institutions and regulators exercise reach through access to, processing of, and action on data.This reach is not limited to formally asserted jurisdiction.Source: §3 · p. 2
- Algorithmic extraterritoriality describes regulatory reach mediated by data infrastructures and cross-border monitoring, alongside—not instead of—traditional extraterritoriality.What becomes visible through data becomes governable regardless of location.Source: §3 · p. 2
- Individuals may become subjects of suspicion across borders through dispersed data points and ongoing algorithmic classification, rather than a specific act or location.This shifts regulatory experience from particular encounters with legal authority to continuous exposure to classification.Source: §3 · p. 2
- The article uses a socio-legal and critical approach to examine how data-driven infrastructures reshape suspicion and the constitution of legal subjects.It treats AML/CFT as revealing because routine private-sector compliance combines continuous surveillance with cross-border information flows.Source: §3 · p. 2
- The article frames AI-driven surveillance as a transformation of legal space and knowledge, treating extraterritoriality as a socio-technical condition dependent on data and computation.Its section plan also identifies accountability challenges and tensions with territorially bounded legal frameworks.Source: §3 · p. 2
2. Suspicion in Law: From Situated Judgement to Infrastructural Condition
The article contrasts suspicion’s traditional role as a contextual, episodic human judgment with AI-mediated evaluation across large, evolving datasets. This shift makes suspicion more continuous, opaque, diffuse, and difficult to contest.
2. Suspicion in Law: From Situated Judgement to Infrastructural Condition
- In AML/CFT, suspicion triggers monitoring and reporting and has traditionally depended on human interpretation within legal and institutional contexts.It is neither wholly subjective nor objective, but situated between legal standards and contextual judgment.Source: §2 · p. 3
- Traditional suspicion is episodic and situated, arising at specific moments in response to triggers and depending on contextual knowledge.These features also apply when AML/CFT obligations extend across borders.Source: §2 · p. 3
- AI systems detect correlations across large datasets, potentially spanning institutions, jurisdictions, and timeframes, without clear prior definitions of suspicious behaviour.Adaptable models make suspicion continuous in both regulatory effect and computational maintenance.Source: §2 · p. 3
- Dynamic updates shift suspicion toward continuous probabilistic inference, while complex models can make its basis less transparent.Risk scores and classifications change as new data become available.Source: §2 · p. 3
- Although human oversight formally remains, alert volumes and model opacity can constrain review as algorithmic outputs shape and predetermine decisions [16].The locus of judgment becomes more difficult to identify.Source: §2 · p. 4
- Suspicion is reconfigured from situated legal judgment into an infrastructural condition embedded in systems that continuously process and evaluate data.Those systems shape the conditions under which suspicion is generated and acted upon.Source: §2 · p. 4
- Unlike suspicion traceable to a particular decision and context, dispersed continuous data processing makes AI-generated suspicion harder to locate and challenge.It may attach to patterns inferred across multiple data points and contexts.Source: §2 · p. 4
3. AI, Financial Surveillance and Suspicion
AI-driven surveillance shifts suspicion from identifying known transactional irregularities toward generating suspicion from evolving data patterns, relationships, and probabilistic inferences. This makes suspicion continuous and potentially forward-looking, while opacity and bias complicate accountability and contestation.
3. AI, Financial Surveillance and Suspicion
- AI-driven suspicion arises from correlations and data patterns, expanding scrutiny from individual transactions to relationships and networks.A transaction unremarkable in isolation may appear suspicious within a broader constellation of data points.Source: §3 · pp. 4–5
- Models continuously recalibrate risk assessments as new data arrive, making the boundary between normal and suspicious fluid over time.This supports efforts to identify emerging laundering patterns amid class imbalance, partial visibility, and changing behavioural signatures.Source: §3 · p. 5
- Complex AI systems can be difficult to interpret, and explainability tools often approximate rather than fully account for an inference.Opacity may hinder institutional decision-making and external accountability, while affected individuals may be unable to contest decisions effectively.Source: §3 · p. 5
- Confidentiality rules, especially prohibitions on tipping off, can restrict disclosure of the basis for suspicion to affected individuals.This creates asymmetric visibility: institutions can see individuals through data while the processes producing suspicion remain opaque.Source: §3 · p. 5
- AI outputs reflect training data, architectural choices, and regulatory priorities, and may reproduce or amplify bias in financial surveillance.Individuals, groups, or regions may be disproportionately rendered suspicious, including through culture-linked or jurisdiction-linked profiling variables.Source: §3 · p. 5
- AI-enabled suspicion may be forward-looking, prompting intervention based on probabilistic risk before unlawful activity occurs.This can enhance AML/CFT prevention while raising questions about intervention thresholds and measures based on risk rather than concrete acts.Source: §3 · p. 5
4. Regulatory Reach and the Concept of Algorithmic Extraterritoriality
The article distinguishes jurisdiction-based extraterritoriality from regulatory reach mediated by transnational data infrastructures. It develops algorithmic extraterritoriality to describe how data visibility, shared compliance systems, and circulating assessments can extend governance across borders, while dispersing accountability.
4. Regulatory Reach and the Concept of Algorithmic Extraterritoriality
- Algorithmic extraterritoriality describes regulatory reach mediated by the ability to access and process cross-border data, rather than grounded primarily in legal doctrine.It operates alongside traditional extraterritoriality and makes activities governable when they become visible in data-driven systems.Source: §4 · p. 6
- Financial institutions, technology providers, and public authorities jointly shape this distributed form of regulatory power.Institutions deploy monitoring systems, providers may shape the infrastructures, and authorities establish legal obligations and supervisory expectations.Source: §4 · p. 6
- Group-wide compliance policies and platforms can carry regulatory expectations into less regulated environments through global financial networks.The EU AML/CFT regime requires group-wide policies, while recent reforms strengthen integrated supervision and cross-border coordination.Source: §4 · p. 7
- Risk scores and alerts can circulate across institutions and jurisdictions, allowing assessments made in one context to shape decisions in another.A customer’s lawful transaction in one jurisdiction may be classified using cross-border data and contribute to enhanced monitoring, delays, or de-risking elsewhere.Source: §4 · p. 7
- Data visibility and access to infrastructure can determine regulatory reach alongside territorial jurisdiction, while activities outside those systems may escape scrutiny.The resulting power is diffuse and relies on infrastructural integration and exposure to transnational surveillance and classification.Source: §4 · p. 7
- Because suspicion may span jurisdictions and institutions, decision-making and responsibility can be difficult to locate, challenging conventional legal tools.Algorithmic extraterritoriality supplements and sometimes displaces the traditional relationship between law and territory, without replacing traditional extraterritoriality.Source: §4 · p. 7
- The infrastructures carrying suspicion also operationalise law through model architectures, risk indicators, thresholds, and validation criteria.The analysis contrasts traditional AML/CFT suspicion with emerging AI-driven forms across several dimensions.Source: §4 · p. 8, Table 1 · p. 8
5. The Datafied Subject: Becoming Suspicious Across Borders
AI-driven AML/CFT increasingly constitutes people as datafied subjects: profiles assembled from dispersed data and correlations can generate suspicion beyond specific acts or locations. Opaque classifications and confidentiality constraints make the grounds for suspicion difficult to locate and contest.
5. The Datafied Subject: Becoming Suspicious Across Borders
- Unlike traditional assessments tied to specific conduct and a defined legal context, data-driven suspicion can be difficult to locate and engage through legal mechanisms.Traditional suspicion can, in principle, be challenged through an identifiable relationship between the individual, alleged behaviour, and authority.Source: §5 · p. 9
- AI-driven systems assemble fragments such as transaction histories and network connections into continuously updated profiles that may only partially reflect a person’s lived reality.A profile can structure institutional responses before it is framed as a formal legal decision.Source: §5 · p. 9
- Suspicion becomes relational: people may be treated as suspicious because their data correlate with patterns elsewhere, not because of their own actions.This is association, not direct attribution; resulting measures can include enhanced monitoring, transaction delays, account restrictions, or de-risking without clear justification.Source: §5 · p. 9
- Confidentiality limits disclosure of suspicious activity reports, and people are rarely told they have been classified or given meaningful reasons, constraining contestation.There may be no identifiable decision to challenge and no clear evidence to dispute; automated scores that shape decisions may also be legally significant before a formal refusal or restriction.Source: §5 · p. 9
- Datafied subjects face asymmetric visibility: institutions see more of their financial activity while evaluation remains opaque, potentially amplifying existing inequalities and limiting agency.Individuals may be unable to anticipate how their actions will be interpreted or affect the data used for those interpretations.Source: §5 · p. 9
6. Accountability Without Borders? Legal and Normative Tensions
Cross-border AI surveillance disperses the production of suspicion and regulatory power across institutions, providers, regulators, models, and jurisdictions. Existing accountability and legal mechanisms face difficulties assigning responsibility, explaining classifications, and enabling effective contestation.
6. Accountability Without Borders? Legal and Normative Tensions
- AI-driven decisions can draw on data processed across locations, third-party models, and expectations from different legal systems, dispersing responsibility among institutions, providers, and regulators.Institutions remain formally responsible but may struggle to explain decisions; providers lack a direct legal relationship with affected people, while regulators may lack operational visibility.Source: §6 · p. 10
- AML/CFT confidentiality and prevention obligations support extensive data collection and cross-border sharing, while data-protection safeguards may not align with financial-surveillance specifics or exemptions.The GDPR, the CJEU’s SCHUFA Holding judgment, and the EU AI Act each address aspects of automated decisions, scoring, or oversight, but the AI Act does not itself resolve diffuse responsibility in cross-border infrastructures.Source: §6 · p. 10
- Probabilistic, relational suspicion makes explanations difficult, and even permitted explanations may be partial, technical, or hard to interpret.Legal requirements such as fairness and meaningful human oversight must be translated into proxies, thresholds, metrics, and validation procedures, so accountability also concerns model design.Source: §6 · p. 10
- The article calls for accountability to extend beyond individual decisions to the infrastructures that produce them, including their design and data governance.It also calls for oversight suited to transnational configurations and reconsideration of individuals’ access to information and ability to contest classifications.Source: §6 · pp. 10–11
- The central question is when and under what conditions machine-generated associations and inferences should produce legal or regulatory consequences across borders.This is especially salient where a decision’s locus cannot readily be identified and responsibility is fragmented.Source: §6 · pp. 10–11
7. Concluding Remarks: Governing Suspicion Without Borders
The conclusion reframes suspicion as an infrastructural and transnational phenomenon, with regulatory reach exercised through access to cross-border data and individuals constituted as datafied subjects. These transformations strain accountability, prompting adaptation of legal principles and meaningful ways to understand and contest classifications.
7. Concluding Remarks: Governing Suspicion Without Borders
- Suspicion is increasingly produced through cross-border data infrastructures, making individuals visible and governable in a continuous space of financial surveillance.The article argues that suspicion is no longer adequately understood merely as a legal judgement tied to identifiable acts within defined jurisdictions.Source: §7 · p. 11
- Algorithmic extraterritoriality describes regulatory power exercised through access to and processing of cross-border data rather than formal assertions of jurisdiction.What becomes visible within data infrastructures becomes subject to governance regardless of territorial location.Source: §7 · p. 11
- Data profiles and algorithmic inferences attach suspicion to patterns and associations rather than specific acts, recalibrating it as new data become available.Individuals are exposed to opaque processes of classification and risk assessment.Source: §7 · p. 11
- Distributed surveillance complicates identifying decision-makers, providing meaningful explanations, and ensuring effective remedies, so accountability must extend to system design, operation, and governance.The conclusion calls for meaningful avenues to understand and contest classifications without abandoning established legal principles.Source: §7 · p. 11