Managing AML Risks in Hybrid IT Infrastructure: Lessons for Payment Institutions
A Report by CYS Global Remit Legal & Compliance Office
Part 2 — Data Fragmentation, Data Quality & AML Surveillance Gaps
Introduction
An AML framework is only as strong as the data feeding it. No matter how sophisticated the monitoring rules or how experienced the investigations team, poor-quality or inconsistent data will always undermine the outcome. This is precisely where hybrid IT infrastructure introduces some of its greatest challenges. By design, hybrid environments distribute data across multiple systems — on-premises, cloud, and third-party — and unless this distribution is carefully governed, it creates blind spots that can compromise both monitoring effectiveness and investigative integrity.
This second instalment in our series examines how data fragmentation, quality issues, and traceability gaps arise within hybrid architectures, and what compliance teams can do to close them.
1. Fragmented Data Ecosystems
Hybrid environments rarely rely on a single, unified data source. Instead, they typically bring together:
Core banking or payment systems hosted on-premises
Cloud-based onboarding or KYC platforms
External, API-driven screening engines
Distributed customer and transaction data sources, often spread across regions or business lines
Each of these systems may hold a different piece of the customer or transaction picture, and none of them, on its own, tells the whole story. When these pieces aren't properly reconciled, the consequences can be significant. Screening decisions may be made on the basis of incomplete information, simply because the screening engine never received the full customer profile. Monitoring rules — often built on the assumption that certain fields will always be populated — can silently fail when those fields are missing or inconsistently structured. And investigators, rather than focusing their time on genuine analysis, end up manually reconciling records across systems just to establish a basic factual timeline.
The risk here isn't always dramatic or immediately visible. It tends to be quiet and cumulative — a screening gap here, a missed alert there — until a pattern of failure becomes apparent, often only after a regulator or an internal audit asks the right question.
2. Data Quality Issues
Fragmentation is only part of the problem; even when data does flow between systems, its quality can vary considerably. Some of the most common issues compliance teams encounter include:
Inconsistent formatting — differing currency conventions, timestamp formats, or field structures between systems
Variable enrichment quality, particularly where cloud-based tools apply their own logic to supplement raw data
Latency or outright failures in synchronisation between on-premises and cloud environments
Human error, which tends to be magnified rather than corrected when data is migrated manually between platforms
None of these issues is unique to hybrid infrastructure, but hybrid setups tend to multiply the number of handoff points where such errors can be introduced — and, just as importantly, where they can go unnoticed.
3. Data Lineage and Traceability
Beyond the immediate accuracy of the data itself, regulators increasingly expect institutions to demonstrate exactly where their data came from and how it has changed along the way. In practice, this means maintaining:
Accurate data lineage, showing the full journey of a data point from source to system of use
Clear logs of data transformations, so any modification can be traced and explained
Evidence that monitoring systems are consistently receiving complete and reliable input
This is where hybrid architectures present a particular difficulty. With logs distributed across multiple platforms and several layers of transformation occurring along the way — often managed by different teams or even different vendors — reconstructing a clean, end-to-end data trail can be genuinely difficult. And when that trail is needed most, such as during a regulatory examination or an internal investigation, gaps in lineage can be costly, both in terms of time and credibility.
4. Strengthening Data Governance
None of these risks are insurmountable, but they do require a deliberate and sustained governance response. Compliance teams should look to implement:
Centralised data governance policies that apply consistently across on-premises and cloud systems alike
Unified data dictionaries, ensuring that a given field means the same thing wherever it appears
Regular data completeness and integrity reviews, rather than one-off checks at implementation
Monitoring dashboards capable of detecting data pipeline failures in real time, rather than after the fact
The common thread running through all of these measures is visibility. Institutions cannot govern what they cannot see, and in a hybrid environment, visibility has to be actively engineered rather than assumed.
Conclusion
Data complexity is, arguably, one of the most significant — and most underestimated — AML vulnerabilities within hybrid configurations. It rarely announces itself as dramatically as a system outage or a cyber incident, yet its effects on monitoring effectiveness and investigative accuracy can be just as serious. Strong governance, consistent standardisation, and genuine end-to-end visibility are not optional extras in this context; they are foundational requirements for any institution operating a hybrid model.
The next part in this series turns to third-party and vendor-related risks — an area that brings its own distinct set of AML challenges within hybrid IT infrastructure.
