By PAUL O’DONOGHUE, Senior Correspondent
A top EU official has urged banks to report suspected scams on social media platforms using the EU’s Digital Services Act (DSA).
Reka Horvath, a top official at the European Commission, revealed some of the legislation’s key details at the latest AML Intelligence Compliance Council meeting in Brussels.
We have plenty of exclusive insights from the event, including:
- When the EU will decide whether to press ahead with a voluntary code of conduct for online platforms to curb scams
- What forced the closure of TMNL, a successful public-private partnership in the Netherlands devoted to fighting financial crime
- Whether AI CEOs should be responsible for their tools being used for scams
We will go into more detail below. But first, back to the DSA.
November 2026 Compliance Council meeting
Horvath, head of the unit responsible for online fraud and scams at the Commission’s DG Connect, banking representatives are often “not fully aware” of how the Act works.
“The DSA says that [social media] platforms enjoy an exemption from liability for content which is hosted, which is put by third parties on their platforms,” she told the AML Intelligence Compliance Council meeting in the European Parliament.
“But they lose exemption if they are aware that there is illegal fraudulent content, and they don’t [take action]. Anyone can use this notice mechanism and notify platforms.”
She said the DSA measure is particularly relevant as financial institutions such as Revolut have reported that the vast majority of online scams originate on social media platforms.
Code of conduct
Horvath also revealed that the European Commission will decide this month whether to press ahead with a voluntary code of conduct for online platforms to curb scams.
She said the next step would be a meeting with the European Board for Digital Services (EBDS) on November 19. Horvath added that she was cautiously optimistic that the code will be implemented, saying she had heard no opposition to the measure.
Her department held three workshops with payment services, financial institutions, market participants and online platforms to discuss the code. Horvath said the code’s success would be measured by how many companies sign up.
The initiative follows the Commission’s announcement that it had opened a probe into Booking.com for failing to act against fraudulent listings.
Demise of TMNL in the Netherlands
Hendrik Frank, head of policy Europe/UK at payment firm Adyen, raised the unfortunate case of TMNL (Transaction Monitoring Netherlands), a public-private partnership devoted to fighting financial crime.
A joint initiative established by five of the biggest Dutch banks, the PPP pooled and analysed transaction data to identify suspicious payment patterns that individual banks might otherwise miss.
Although widely touted as a major compliance success story, it was shut down in 2024.
“The privacy regulator ultimately stepped in and said, “You are not allowed to do this. You are sharing data beyond what the legal basis allows,” Frank told the Compliance Council meeting.
“Since there was no clear legal basis to continue doing this data sharing, they shut it down. And that, of course, is a huge problem.
“Where companies are trying to mitigate this problem [fraud], they are being told that what they’re doing is effectively illegal.”
Autonomous fraud
Filip Verbeke, the co-founder at Reform, gave some insight on the latest developments in how AI is being used for scams.
He warned that scammers are utilising “increasingly autonomous” AI.
“That is a very, very dangerous thing,” he said. He said that previously, scammers used AI as a tool to aid their work. However, as the technology becomes increasingly autonomous, it will become easier and easier for criminals to direct high-level fraud.
“Sophisticated attacks no longer require sophisticated attackers,” Verbeke said.
“A malintentioned person can basically prompt an attack, and the attack will be executed in a very efficient way.”
Corporate liability
Finally, Regina Doherty, an Irish MEP, raised a crucial topic during the meeting – to what extent CEOs at AI companies should be responsible for their tools being used in online scams.
She said it is similar to the debate around the extent to which social media firms should be liable for fraudulent content on their platforms.
“75% of scams come through social media platforms,” she told the meeting. “One [company] makes 10% of their advertising revenue off scam ads. That’s not small. It’s absolutely whopper. They have to change their practice.
“[But] until everybody is responsible and it actually hits their bottom line, no [company] is changing its practices.”
She said that officials should make companies “financially responsible” for scam ads. Or, she proposed implementing a code of conduct “which is not voluntary”.
It points to how EU officials may revisit the issue of the voluntary code of conduct on scams, regardless of what happens later this month.
We hope you enjoyed reading this article
If you would like unlimited access to AML Intelligence premium articles, newsletter delivered twice a week, access to our Global Bank Fines and Penalties database, free access to Boardroom Series events and much more, select one of our subscription options and become a subscriber!
