The Purity Machine

I. The Right to Exist in the Modern World

Hannah Arendt, writing in the shadow of one of the many great catastrophes the twentieth century produced, identified what she called the right to have rights. Her subject was the stateless person: the refugee, the expelled, the person whose citizenship had been revoked and who therefore found themselves outside the protection of any legal order. What she observed, with her characteristic precision, was that the abstract proclamation of universal human rights was entirely worthless without a political community to enforce and guarantee them. Without belonging and the status that made one legible to power, a person had no rights in any practical sense.

One does not need to have been driven from one’s home by fascism to grasp the contemporary relevance of this insight. In the early twenty-first century, in the prosperous democracies of Western Europe, a new form of rightlessness has emerged. It is quieter, administered rather than violent, clothed in the language of regulation rather than ideology, but functionally devastating to those it touches. It is the rightlessness of those who cannot access financial services.

A business that cannot open a bank account cannot pay its staff, cannot receive payment from customers, cannot settle its tax obligations, cannot obtain professional indemnity insurance, cannot, in any meaningful sense, operate. An individual without a bank account cannot receive a salary by electronic transfer, cannot pay rent by standing order, cannot participate in the digital economy that has, over the past two decades, quietly absorbed most of the transactions of ordinary life. The bank account, the insurance policy, the payment account are not luxuries. They are, in Arendt’s sense, the infrastructure of belonging. They are the instruments through which one is recognised as a participant in economic and social life. To be denied them is not a commercial inconvenience. It is a form of civic exclusion.

And yet, in the United Kingdom and across the European Union, hundreds of thousands of individuals and businesses are denied these services every year. Not because they have done anything wrong. Not because they have been charged, let alone convicted, of any offence. But because a compliance function, operating under frameworks of almost Byzantine complexity, has decided — in ways it is often legally prohibited from explaining — that they represent an unacceptable risk. The right to have rights, in the financial domain, is not a right at all. It is a privilege allocated by private institutions according to criteria they are not obliged to disclose, under pressure from a regulatory apparatus that has, over the course of a generation, transformed itself from a safeguard into a machine of exclusion.

II. On the Legitimacy of Constraint

The libertarian would object to all of this at the root. The state, in this telling, has no business compelling private institutions to verify the identities of their customers, monitor their transactions, or report their activities to a financial intelligence unit. The bank is a private actor, the customer is a private actor, and their relationship is their own affair. The government’s interposition — however dressed up in the language of crime prevention — is, at bottom, a form of surveillance that a free society should refuse.

There is something to this argument, and intellectual honesty requires acknowledging it before proceeding. The anti-money laundering and counter-terrorism financing apparatus that has metastasised across Western financial regulation since the turn of the century represents an extraordinary extension of state power into private commercial relationships, achieved largely without democratic deliberation, justified by emergency, and rendered effectively permanent by the institutional interests it has created. The compliance industry now employs more people in the United Kingdom than the coal industry ever did at its peak. It has a material interest in the perpetuation and expansion of the system that employs it. This is not a conspiracy theory. It is how bureaucracies work.

And yet. The libertarian position, however internally coherent, fails on the facts of the world as it actually exists. Financial systems are the circulatory infrastructure of organised criminal enterprise. Money laundering, terrorist financing, sanctions evasion and kleptocratic looting are not hypothetical concerns. They represent genuine threats to the institutions and societies that a liberal order depends upon. The question is therefore not whether any constraint is legitimate, but whether the constraints we have are proportionate to the harms they address, efficient in their operation, and applied without producing injustices more serious than those they prevent.

The framework of cost and benefit is the appropriate one, and it is one that the current compliance regime has almost entirely abandoned. A useful thought experiment: imagine a programme designed to reduce deaths from road accidents. The programme succeeds in preventing, let us say, fifty fatalities per year. It achieves this by requiring that every vehicle, before it may be driven on any public road, undergo a two-year inspection process, during which it must be submitted no fewer than eleven times to a panel of inspectors who may, at any point and without explanation, request additional documentation, change the standards against which the vehicle is being assessed, and decline to confirm whether the previous submissions were adequate. The inspection process costs, on average, one hundred thousand pounds per vehicle. It is not possible to know whether an inspection will result in approval, because the criteria are partially classified. And if it results in rejection, the inspector is prohibited by law from telling you why.

No serious person would accept this. The harm being prevented is real and serious, but the mechanism of prevention is grotesque. The ratio of cost to benefit has become absurd, and the procedural injustice of the process compounds the economic irrationality. This is not a reductio ad absurdum. It is a reasonably accurate description of what the United Kingdom’s anti-money laundering compliance framework actually delivers.

III. What We Were Trying to Do

It is worth pausing to recall exactly what the problem was that this apparatus was designed to solve. The international AML/CFT framework (the constellation of FATF recommendations, EU Anti-Money Laundering Directives, the UK’s Money Laundering Regulations) exists, in its stated rationale, to prevent three categories of harm: money laundering, which allows the proceeds of crime to re-enter the legitimate economy; the financing of terrorism, which provides the operational resources for political violence; and sanctions evasion, which allows individuals and states subject to international sanctions to access resources and markets they are supposed to be excluded from.

These are genuine concerns. The figures involved in serious organised crime and terrorist financing are not imaginary. The ability of criminal and terrorist networks to use the financial system to layer transactions, exploit correspondent banking relationships and move money through jurisdictions with weak oversight is a genuine vulnerability in the architecture of open societies. Nobody who has looked at the matter honestly proposes doing nothing.

But the National Crime Agency received over nine hundred thousand Suspicious Activity Reports in a single year. The overwhelming majority resulted in no action of any kind. The money that was actually detected and seized as proceeds of crime in the UK represents a fraction of one percent of the estimated total of laundered funds flowing through the British financial system annually. The apparatus costs billions of pounds to operate, generates mountains of documents that nobody reads, and has not demonstrably reduced the volume of serious financial crime. What it has done, with great efficiency, is make the lives of hundreds of thousands of legitimate individuals and businesses significantly worse.

The insurance broker who cannot open a business account. The Muslim charity unable to transfer funds to pay doctors in a Syrian hospital. The British Nigerian entrepreneur whose application has been declined for reasons that are legally prohibited from being disclosed. The Iranian couple in Ireland whose bank imposed restrictions on their account and, when challenged for discriminating on the basis of nationality, defended itself by invoking its AML obligations (an argument that, to its credit, the relevant tribunal did not accept). These are not acceptable collateral casualties of an effective counter-crime programme. They are the primary outputs of a system that has ceased to function as designed.

IV. The Permanent Emergency: A Short History

The architecture of modern financial compliance was not built. It grew, as so many intrusions of the state into private life grow, under cover of emergency. The Financial Action Task Force was established in 1989, at the height of international concern about narco-trafficking, and its initial remit was relatively modest: recommendations to member states on measures to combat money laundering. For a decade it remained, broadly, what it claimed to be: a standard-setting body with limited reach and limited ambition.

Then came 9/11. In the weeks and months that followed, the political and regulatory response to the attacks was comprehensive, global, and entirely unreflective. The PATRIOT Act in the United States expanded the definition of financial crimes, increased penalties, extended surveillance powers, and required banks to implement Know Your Customer procedures of considerably greater depth and intrusiveness than had previously been standard. The EU, which had been developing its own AML framework through successive Directives since 1991, significantly accelerated the process. The FATF expanded its mandate to include counter-terrorist financing explicitly. And in the space of approximately three years, what had been a moderately intrusive framework became a comprehensive surveillance architecture, embedded in the operations of every financial institution in the developed world.

The emergency framing was explicit. These measures were responses to an extraordinary attack. They were, in the political language of the time, temporary, or at least calibrated to the specific threat. Nobody said so very loudly, but there was a common understanding that the intelligence and law enforcement apparatus thus expanded would, in calmer times, be subject to review, proportionality assessment, and perhaps reduction.

This did not happen. It never does. The bureaucracy that was created to administer the new requirements had, by the time the immediate emergency had passed, acquired its own institutional logic, its own professional culture, its own career structures, and its own political constituency. Each successive financial scandal (banks that had facilitated money laundering for a drug cartel, terrorist financing that had passed undetected through the system) was used not to question whether the framework was working, but to demand more of it. The EU has now published six Anti-Money Laundering Directives, each more extensive than the last, and is in the process of establishing a new EU-wide Anti-Money Laundering Authority with direct supervisory powers. The UK, following Brexit, is developing its own parallel framework. The direction of travel has not once been reconsidered. It has only accelerated.

The temporary emergency became the permanent condition. The exceptional measure became the baseline. The apparatus that was justified by a specific, catastrophic event in 2001 has, twenty-five years later, continued to expand without any serious assessment of whether it has achieved its stated objectives, at what cost to those it affects, or whether the institutional interests now invested in its continuation are compatible with its original purpose. This is not a uniquely British or European phenomenon. It is how bureaucratic power operates. But it is the context without which the specific outrages of the current system cannot be understood.

V. The Grammar of Damnation

What strikes the attentive observer of modern financial compliance, perhaps most forcibly, is its tone. It is not the tone of risk management, or of proportionate regulation, or of the careful balancing of competing interests that one might expect from a system that affects millions of people and costs billions of pounds to administer. It is, unmistakably, the tone of eschatology — of a discourse organised around final judgments, ultimate stakes, and the terror of contamination.

The language gives it away. One does not merely conduct financial transactions in this world. One is clean or dirty. Money is laundered, i.e. subjected to ritual purification. Transactions are tainted. Relationships are contaminated. The compliance officer does not manage risk; they defend the system against those who would defile it. Mary Douglas, in her great anthropological study Purity and Danger, demonstrated that all pollution beliefs share a common structure: the dangerous thing is the thing that crosses a boundary, that cannot be classified, that occupies an ambiguous position relative to an established order. The AML framework has rebuilt this ancient anxiety in bureaucratic form. The customer from a high-risk jurisdiction, whose name appears on a screening database, whose business model is unfamiliar, whose source of funds is difficult to verify — this person is not merely a compliance challenge. They are, in the deeper grammar of the system, impure.

The Financial Action Task Force operates as a kind of global theological authority, its greylist and blacklist functioning precisely as the gradations of spiritual condition: purgatory and damnation. A jurisdiction on the FATF blacklist is excommunicated from the financial system. Banks in good standing cannot maintain correspondent relationships with it. Individuals from it inherit, without individual assessment, the institutional judgment of unworthiness. This is original sin in legal form: the guilt of the jurisdiction attaches to each of its nationals, regardless of personal conduct, regardless of evidence, by the mere fact of birth or residence.

The compliance officer, meanwhile, has been placed by the sixth Anti-Money Laundering Directive in a position of genuine existential exposure. The extension of personal criminal liability to compliance professionals means that these individuals make decisions under a threat that is potentially catastrophic for them personally. The result is entirely predictable. What they produce is not careful risk assessment. It is defensive theology: the construction of increasingly elaborate doctrinal structures whose primary purpose is not to prevent financial crime, but to demonstrate, in the event of subsequent scrutiny, that the correct prayers were said. The compliance manual is a sacred text. Deviation from its procedures is heresy. The external audit is the Inquisition. And the customer who fails to produce the precisely specified document, in the precisely specified format, by the precisely specified deadline, is not merely non-compliant. They are suspect. And in this system, suspicion, once recorded, cannot be expunged. It is permanent.

The periodic KYC update — that peculiar ritual in which long-standing customers are required to re-prove their identities and re-submit their documents, often to find that the documents previously accepted are no longer sufficient — maps with almost painful precision onto the purgatorial logic of the tradition it unconsciously echoes. You are not condemned. Your account has not been closed. But you are in a state of suspension, your existence as a financial actor dependent on the continuing mercy of a process whose criteria you do not know and whose outcome you cannot predict. The soul in purgatory at least knows the terms of its eventual release. The business owner on their fourth KYC review in five years has no such comfort.

VI. The Colonial Cartography of Risk

There is a geography to financial exclusion, and it is not the geography of actual crime. It is the geography of power: of which countries, which communities, which names, which accents have historically been legible to Western financial institutions as normal and trustworthy, and which have not.

The correspondent banking data tells the story with statistical clarity. The Caribbean has lost more than half its correspondent banking relationships since 2011. Melanesia and Polynesia have experienced comparable withdrawals. The countries that have been most completely cut off from the global financial system (e.g. Syria, Afghanistan, Yemen, Somalia, Sudan) are precisely the countries that have suffered the most catastrophic political and humanitarian crises of the post-Cold War period. The effect of de-risking in these cases is not neutral. It does not merely inconvenience the populations of these countries. It prevents humanitarian organisations from transferring funds to pay medical staff. It prevents diaspora communities from sending remittances to their families. It prevents whatever legitimate commercial life survives in these territories from participating in the global economy. The compliance apparatus, in these cases, is not adjacent to the humanitarian catastrophe. It is a contributing cause of it.

Closer to home, the pattern is equally clear. Sixty-eight per cent of Muslim charities in the United Kingdom have reported difficulties opening bank accounts. Forty-two per cent have experienced a complete withdrawal of banking services. The British Nigerian community, British Muslims more broadly, individuals with Russian or Iranian or Middle Eastern names — these communities appear, with striking regularity, in the accounts of those affected by unexplained account closures and access denials. One does not need to allege deliberate malice to observe that the risk classification systems embedded in the compliance apparatus encode assumptions that are, in their effect if not always in their design, racially and nationally discriminatory.

The IMF has noted, with its characteristic institutional understatement, that risk classifications used in correspondent banking assessments may reflect historical perceptions — that a Colombian client, for example, may be considered riskier than a Chilean one not on the basis of any evidence about the individual, but because of the country’s association with drug trafficking. This is what the sociologist would call stereotype threat, applied through financial regulation. It is what the historian would call the continuation of colonial attitudes through administrative form. The bank does not need to employ anyone who harbours conscious racial prejudice. The prejudice is already present in the database, encoded in the risk ratings, reproduced in the automated screening system, and applied to every customer whose name, nationality, or jurisdiction of origin matches the categories that the Western-dominated international standard-setting apparatus has decided are inherently suspicious.

VII. The Castle and the Silence

Franz Kafka, in the last decade of his short life, produced two unfinished novels that remain the most precise literary map of the modern bureaucratic condition ever drawn. In The Trial, Josef K. is arrested, tried, and eventually executed for an offence that is never named, by a court whose location is never established, in proceedings he is permitted to observe but never to understand. In The Castle, K. can see the authority that governs his life, can even approach it, but can never gain access, never receive a definitive answer, never achieve the resolution that would allow him to know where he stands.

The correspondence to the current compliance regime is not approximate. It is almost exact, and the mechanism that produces it is not Kafkaesque at all. It is entirely explicit, written into statute, and defended in court by lawyers charging enormous fees.

Under the Proceeds of Crime Act 2002, once a bank has filed (or is merely considering filing) a Suspicious Activity Report, it becomes a criminal offence to disclose to the customer that a SAR exists, or that it is the reason for any action the bank is taking with respect to their account. The customer whose account has been frozen, restricted, or closed therefore receives: no explanation, no indication that a SAR has been filed, no ability to challenge a suspicion they are not permitted to know exists, and no way of knowing whether the action against them reflects a genuine concern, an error in a third-party database, or the automated output of a screening algorithm that nobody at the bank has actually reviewed. They receive, in short, precisely the treatment that Josef K. received: the consequences of a judgment, without the charge, the evidence, or the judge.

But Kafka’s Castle is more applicable than his Trial, because the characteristic experience of the modern compliance victim is not the drama of arrest and proceeding. It is the grinding, indefinite suspension of K.’s situation, the inability to get a final answer, the repeated referral to another office, the sense that the authority one is trying to reach is not hostile but simply indifferent, organised around processes and concerns that have nothing to do with you personally, and that you cannot penetrate because you were never part of the world that the system was designed to serve. The compliance officer who refuses to say why a document has been rejected is not being malicious. They may genuinely not know. The automated screening system that flagged the account may have done so for a reason that exists only in the logic of the algorithm. The World-Check entry that propagated across multiple institutions, ensuring that every bank the customer approaches has received the same pre-judgment, was compiled from open-source data by a commercial operator with no obligation to verify its accuracy and no mechanism for notifying the subject that they have been entered.

This is K. trying to get an audience with the Castle. The database is the Castle. It is not malevolent. It does not know you exist as a person. It knows you exist as a data point that has been associated, at some point by some process, with a category it has been instructed to treat as dangerous. The castle does not answer K.’s letters because the Castle was not built to receive letters from K. It was built to serve the village, and K. is not from the village.

VIII. The Consumer Duty and Its Insoluble Contradiction

In 2023, the Financial Conduct Authority introduced its Consumer Duty. This is arguably the most ambitious statement of regulatory purpose the UK financial system had ever produced. The Duty imposes on all authorised firms a positive obligation to deliver good outcomes for customers: not merely to refrain from harm, but to actively ensure that customers can access and use products and services effectively, that communications support informed decision-making, that products offer fair value, and that the firm takes particular care with customers in vulnerable circumstances.

It is an admirable document in many ways. It reflects a genuine understanding, apparently arrived at through painful experience of what the absence of such an obligation produces, that firms can comply with every specific rule and simultaneously systematically mistreat their customers. It introduces, for the first time, a standard that asks not just whether the letter of the rule was observed, but whether the outcome for the customer was actually good.

The problem — and it is a problem of such fundamental proportions that one is surprised it has not attracted more comment — is that the Consumer Duty and the AML/KYC compliance apparatus are irreconcilably in conflict. The Duty requires clear communication. The tipping-off provisions make clear communication a criminal offence. The Duty requires that customers receive the support they need. The compliance apparatus denies access to the most vulnerable customers without explanation. The Duty requires good outcomes. The compliance machine routinely produces devastating outcomes: businesses unable to operate, charities unable to function, individuals unable to participate in economic life through no fault of their own.

The FCA’s own regulatory architecture contains a formal resolution to this conflict. AML obligations are, in the hierarchy of requirements, superior to Consumer Duty obligations. Where the two conflict, the compliance apparatus wins. This is not an interpretation. It is explicit. The Duty, for all its ambition, contains carve-outs that render it inoperative precisely in the cases where it would most need to apply.

But the conflict runs deeper than the formal hierarchy suggests. The Consumer Duty has been colonised. Compliance functions across the industry have learned to speak its language and frame their processes in terms of customer outcomes, to produce Customer Vulnerability Assessments and Outcome Monitoring reports, to describe the KYC update as an exercise in understanding customer needs. The regulated insurance broker who has banked with the same institution for eight years, and is now asked on their fourth periodic review to produce document types they have never previously been asked for and that do not exist in the form specified, is the recipient of a process that the compliance team will describe, in its Consumer Duty documentation, as the bank ensuring it has a complete understanding of the customer’s circumstances. The language of protection provides cover for the practice of exclusion. This is not merely ironic. It is a structural feature of systems in which the performance of compliance substitutes for its substance — where what matters is not whether the outcome was good, but whether the file demonstrates that the approved methodology was followed.

IX. The Fundamental Rethink

Let us be entirely clear about what we are dealing with. A regulated insurance broker (a firm that has itself been vetted, licensed, and subjected to ongoing supervision by the Financial Conduct Authority) is finding that it cannot open a business bank account with mainstream UK banks. It is not suspected of any crime. It has not been charged with any offence. It exists in a sector that the regulator considers sufficiently trustworthy to authorise. And yet the banking system, operating under a compliance framework that the same regulator has created, treats it as an unacceptable risk.

When this broker, having finally located an institution willing to accept its business, undergoes a periodic KYC refresh, it may find that the document types it originally provided are no longer accepted. No explanation is available as to why the standard has changed. No list of currently acceptable documents is provided in advance. The process is iterative and opaque: submit, wait, receive a rejection or a request for additional information, resubmit, wait again. If the broker asks why a particular document has been rejected, the answer is a form letter referencing the bank’s obligations under the Money Laundering Regulations.

If the account is ultimately closed, the broker will receive notice — now, under the new regulations passed in 2025, at least ninety days’ notice — but will receive no substantive explanation. The bank, if it has filed a SAR, cannot provide one. If it has not filed a SAR but is simply exercising its commercial discretion to exit a relationship it considers insufficiently profitable relative to the compliance costs, it has no obligation to provide one beyond vague references to risk appetite. The broker cannot appeal to any external forum that can review the bank’s decision on its merits. The Financial Ombudsman Service does not have jurisdiction over commercial relationship decisions of this kind. The courts will not intervene absent a breach of contract or discrimination that can be proved, and the opaqueness of the process is specifically designed to make such proof impossible.

This is the system we have. It was built, piece by piece, by regulators responding to genuine concerns, under pressure from genuine emergencies, with genuine intentions. It has become something that none of its architects would recognise as an appropriate instrument of those intentions. It treats legitimate businesses as presumptively suspect. It applies the heaviest burdens to the communities and jurisdictions that are already most marginalised. It operates through processes that are structurally designed to resist challenge. It speaks the language of customer protection while systematically denying access to the services without which participation in economic life is impossible. And when asked to explain itself, it hides behind a statute and says: we cannot tell you why.

The rethink that is required is not a matter of adjusting this parameter or refining that guidance. It is a matter of beginning again from the correct question — which is not how do we ensure that financial institutions comply with our anti-crime framework, but how do we design a system that actually reduces financial crime, at proportionate cost, without producing exclusions and injustices more serious than the harms it prevents. The current system has inverted these priorities entirely. It produces excellent compliance documentation and poor outcomes. It generates hundreds of thousands of SARs and arrests a tiny fraction of actual criminals. It excludes hundreds of thousands of legitimate customers and barely inconveniences the sophisticated criminal networks that are its nominal targets.

Hannah Arendt understood that the rightless person is not merely someone whose rights have been violated. They are someone who has been expelled from the political community altogether. What has happened, quietly and without public deliberation, in the financial compliance architecture of the UK and EU over the past two decades, is the creation of a class of economically rightless persons: people and businesses for whom the infrastructure of belonging — the bank account, the insurance policy, the payment account — has been made inaccessible through processes they cannot see, on grounds they cannot know, by decisions they cannot challenge.

The institution that closes your account and cannot tell you why has not merely failed a consumer protection standard. It has, in the Arendtian sense, expelled you. It has placed you outside the system within which economic participation is possible, without charge, without evidence, without trial, without appeal. That this expulsion is conducted by private actors, under regulatory compulsion, through administrative processes rather than coercive ones, does not make it less of an expulsion. It makes it more insidious, precisely because there is no one to hold responsible, no decision that can be appealed, no authority that will acknowledge what has been done.

The compliance officer cannot tell you. The regulator created the framework. The Parliament passed the statute. The FATF made the recommendation. The system functions as designed. And you — the regulated broker, the Muslim charity, the British Nigerian entrepreneur, the family with an Iranian surname who has banked in this country for twenty years — you are the output. You are what the machine produces when it runs correctly.

This is not acceptable. It has never been acceptable. And the fact that it has been allowed to become the settled condition of an advanced liberal democracy, in the name of fighting terrorism and financial crime, while producing not one serious piece of evidence that it has materially reduced either, is a scandal of such dimensions that only the extraordinary dullness of its administrative machinery has prevented it from being recognised as such.

The Castle does not answer K.’s letters. But at some point, K. is entitled to stop writing letters and start demanding that someone burn the Castle down and build something fit for purpose in its place.