Beyond Compliance: Patricia Torres Serpel on Risk, Trust, and the Human Side of Financial Crime Prevention
Head of Risk and Fraud Officer for the MSB in Mexico, Grupo Salinas
Financial crime prevention is often discussed in the language of regulations, controls, policies, and procedures. Yet behind every transaction, risk assessment, and compliance decision are people: customers whose identities and savings need protection, employees responsible for making sound decisions, businesses trying to grow responsibly, and communities affected by the consequences of financial crime.
For Patricia Torres Serpel, that human dimension has remained central throughout nearly 25 years of work across financial crime, fraud, corruption, anti-money laundering, and terrorist financing. Her career, shaped by experience in both the public and private sectors, has reinforced a conviction that compliance cannot exist separately from business. It must understand how organizations actually operate, how risks evolve, and how controls can protect people without creating unnecessary barriers to legitimate activity.
Her philosophy is clear: “Business and compliance are two sides of the same coin; neither can thrive effectively without the other.”
Where Business Meets Responsibility
Patricia’s professional journey began with a degree in Economics and an early interest in the forces that shape businesses, employment, economic growth, and broader social development. Over time, that interest developed into a deeper understanding of the relationship between commercial success and responsible business practices. One of the most important lessons from her early career was that financial success cannot be separated from ethics. Sustainable growth, in her view, depends on aligning commercial objectives with compliance rather than treating them as competing priorities.
That perspective has become a foundation for the way she approaches risk today. Compliance is not simply about meeting a regulatory requirement. It is about creating an environment in which organizations can pursue growth while maintaining the trust of customers, employees, shareholders, regulators, and society. Her experience across both government and private-sector environments strengthened that understanding. Working on both sides gave her the ability to recognize inconsistencies, operational limitations, and opportunities for improvement from different perspectives. Government requirements may establish an important framework, but they do not always capture the operational intelligence that exists inside businesses. Conversely, private-sector experience can reveal process weaknesses and practical realities that may not be visible through traditional regulatory reviews.
For Patricia, neither perspective is sufficient on its own. The two need to work together.
Understanding How Criminal Networks Adapt
Nearly 25 years of experience combating organized crime from public- and private-sector perspectives have given Patricia a close view of how financial crime changes when pressure is applied to it. She describes organized crime in a particularly memorable way: “Organized crime behaves much like water, flowing through the paths of least resistance.”
The analogy captures an important reality. Criminal organizations do not remain fixed when a particular control becomes more effective. They look for another route, exploit another weakness, move across jurisdictions, or adapt their methods to new technologies and circumstances. That means financial crime prevention cannot rely on static controls. Systems need to evolve as threats evolve.
Patricia believes this is also why experienced financial crime, compliance, and risk professionals need to be recognized as strategic contributors at the senior leadership and Board level. Criminal groups can exploit regulatory gaps, operational weaknesses, differences between jurisdictions, and limitations in coordination. Addressing those vulnerabilities requires more than procedural compliance. It calls for continuous innovation, collaboration, and the ability to anticipate where risk may move next.
This changes the fundamental question from Are we compliant? to something more meaningful: Are our controls actually working against the risks we face?
Compliance as a Force for Good
For Patricia, compliance is ultimately connected to a much larger question: how organizations conduct themselves when pursuing growth and opportunity. Regulations provide an essential framework, but she believes businesses must also recognize the ethical responsibility behind those requirements. Economic development, innovation, and commercial success can be pursued while maintaining integrity, transparency, and accountability.
That is why she resists reducing compliance to a checklist.
“Compliance should not be reduced to a checklist exercise,” she explains, emphasizing that effective financial crime prevention requires organizations to understand the risks they are actually facing and develop practical responses to those risks. Her experience has shown her that regulations alone cannot prevent crime. Organizations need professionals who can interpret risk, understand behavior, assess threats, and determine whether a particular control genuinely addresses the problem.
Her approach is therefore firmly risk-based. A control should be examined not only for whether it exists, but for whether it is proportionate and effective. Excessively restrictive controls can create unnecessary friction, potentially affecting financial inclusion and legitimate business activity. As Patricia puts it, “Regulations provide the framework, but risk analysis provides the context.”
That distinction is important. Effective compliance is not about building the largest possible number of controls. It is about building the right controls for the risks that matter.
Protecting People Without Losing Sight of Business
The connection between financial crime prevention and protecting people is particularly important to Patricia. Fraud can affect savings, identities, and confidence. Money laundering can provide the financial infrastructure for organized crime, trafficking, corruption, and narcotics. Strong financial crime controls therefore protect more than an organization’s regulatory standing. They also help protect individuals and the wider financial system.
Patricia does not see protection and commercial performance as opposing objectives. Effective risk management should allow organizations to understand customers and transactions more intelligently, identify genuine threats, and intervene where necessary without unnecessarily restricting legitimate activity. That requires collaboration across functions. Compliance professionals need to work with business teams, operations, technology specialists, investigators, regulators, and law enforcement. Public- and private-sector perspectives are complementary, and Patricia sees part of her role as helping bridge those perspectives.
The same principle applies across industries and jurisdictions. Financial crime does not respect organizational boundaries, so prevention cannot remain confined within them.
Technology Can Strengthen Judgment, Not Replace It
Technology is changing how organizations identify and respond to financial crime. Advanced analytics, artificial intelligence, machine learning, network analysis, and real-time monitoring can help identify patterns and emerging threats more quickly while supporting better-informed decisions. But Patricia is careful about the role technology should play.
“The most effective programs combine technological innovation with experienced professionals,” she says.
Technology can identify patterns, generate alerts, and process enormous amounts of information. It cannot independently understand every business context or distinguish every meaningful signal from a false positive. That is where professional judgment remains essential. Her perspective also extends to organizational culture. Policies and procedures matter, but culture ultimately influences how people behave when a situation falls outside the neat boundaries of a policy manual. Leadership commitment, communication, training, and accountability all contribute to creating a culture of integrity.
For Patricia, compliance should therefore enter strategic conversations early rather than being brought in after important business decisions have already been made. Financial crime risks can develop gradually, and criminal actors often take advantage of gaps between jurisdictions, departments, sectors, and systems.
Leadership Begins With People
Patricia’s approach to leadership reflects the same principle that shapes her view of compliance: systems matter, but people make them work.
“Sustainable results are achieved through people, not processes alone.”
For her, effective leadership involves building trust around a common purpose, empowering people to contribute, welcoming different perspectives, and maintaining accountability for outcomes. Listening is particularly important. People closest to a process often see risks and opportunities before they become visible to senior leadership. Creating an environment where those people feel comfortable speaking up can therefore become an important part of risk management itself. Patricia also believes strong performance needs to be balanced with empathy. People need to feel valued, understood, and connected to the purpose of their work. That connection ultimately comes back to trust.
“Trust is the most valuable currency a leader can build,” she says, emphasizing that credibility is established through example rather than simply through words.
Moving From Compliance to Effectiveness
Patricia sees an important opportunity for the financial crime profession: moving from a compliance-driven mindset toward an effectiveness-driven one.
“I would like to see a greater shift from a compliance-driven approach to an effectiveness-driven approach.”
The distinction is significant. A compliance-driven organization may focus primarily on whether controls exist and whether requirements have been met. An effectiveness-driven organization asks whether those controls are actually preventing crime, protecting customers, and disrupting criminal networks. Achieving that shift will require stronger cooperation between public and private organizations and across international jurisdictions. It will also require the responsible use of AI, machine learning, and data analytics.
Patricia’s position on technology remains consistent: “Technology should enhance human judgment, not replace it.” She also sees a need for greater representation of financial crime, compliance, and risk expertise at Board and executive levels. Financial crime risk is not simply a regulatory issue. It can affect reputation, growth, sustainability, and the long-term resilience of an organization.
Thinking Beyond the Procedure
For professionals entering or developing a career in financial crime prevention, Patricia’s advice is straightforward but demanding. Remain intellectually curious. Financial crime evolves continuously, which means professionals cannot rely exclusively on established procedures or yesterday’s solutions. Be analytical rather than purely procedural. Question assumptions. Understand both regulation and business operations. Develop the ability to communicate complex risks clearly to executives, regulators, investigators, and business leaders.
Most importantly, understand why the work matters.
The purpose of financial crime prevention extends beyond policies, controls, reports, and regulatory examinations. At its core, it is about protecting people and the systems on which they depend from organized crime, corruption, fraud, trafficking, and other forms of illicit activity. That sense of purpose gives Patricia’s perspective its strongest thread. Her career has not simply been about identifying risk. It has been about understanding what risk means for people, businesses, and society, and finding practical ways to respond without losing sight of either commercial reality or ethical responsibility. As the financial crime landscape continues to change, that balance will remain essential. Technology will advance, criminal methodologies will adapt, and regulations will evolve. The underlying responsibility, however, will remain.
Patricia captures it simply: “Never lose sight of the purpose behind the work.”
For her, that purpose is where compliance becomes more than a requirement. It becomes a way of protecting trust, strengthening institutions, and helping responsible businesses grow with integrity.