AI in Finance & Fraud · Lesson 6 of 8
AML & Transaction Monitoring with ML
Anti-money laundering (AML) systems try to spot criminals moving illicit money through the financial system. Traditional rule-based monitoring creates huge numbers of false alerts. ML helps prioritise and find new patterns, but explainability and audit trails are mandatory.
How money laundering works (the 3 stages)
- Placement: cash enters the system (deposits split into small amounts, called "structuring").
- Layering: money moves rapidly through many accounts, entities or countries to hide its origin.
- Integration: the "clean" money returns as investments, property or business income.
The AML stack
- KYC / CDD: verify identity, assess the customer's risk (occupation, geography, PEP status).
- Sanctions and watch-list screening: fuzzy name matching against sanctions lists, plus entity resolution.
- Transaction monitoring: rules such as "cash deposits just under the reporting threshold", "rapid in-and-out", "high-risk corridors".
- Alert investigation: analysts review alerts. Suspicious cases are reported to the Financial Intelligence Unit (STR/SAR).
Where ML adds value
| Problem | ML approach |
|---|---|
| 90%+ false-positive alerts | Alert prioritisation model: score each alert by the likelihood it leads to an STR, so investigators see the riskiest first |
| Unknown patterns | Unsupervised anomaly detection per customer segment (Isolation Forest, autoencoders) |
| Networks of mules / shell companies | Graph analytics: communities, cycles, fan-in/fan-out patterns, GNNs |
| Name screening noise | Entity resolution with fuzzy matching plus ML match scores |
| Investigator time | GenAI case summaries: summarise the transaction history, links and adverse media, with citations |
Typical features
- Cash intensity, round-amount ratios, just-below-threshold counts.
- Pass-through ratio (money out / money in within N days), velocity.
- Number of counterparties, new counterparties, high-risk geographies.
- Mismatch between the stated profile (salary, business type) and observed activity.
- Graph metrics: component size, cycles, centrality, links to previously reported entities.
Explainability and governance
- Every alert decision must be traceable: why was it raised, and what did the analyst conclude?
- Prefer models whose drivers can be explained (GBM + SHAP), and keep rules for regulatory scenarios.
- Never auto-close alerts without approved policy. ML usually prioritises; humans decide.
- Monitor for drift and for coverage gaps: a model that hides a typology from analysts is a regulatory risk.
GenAI for investigators (with care)
- RAG over policies, typology guides and prior case notes.
- Case narrative drafts for STRs, which the analyst edits and approves.
- Guardrails: no data leaving the bank, a citation for every claim, full audit logs.
Check yourself
What is "structuring" in money laundering?
Splitting large amounts into many smaller deposits or transfers, often just below reporting thresholds, to avoid triggering mandatory reports.Why do banks often use ML to prioritise alerts rather than suppress them?
Regulators expect every relevant scenario to be covered and reviewed. Prioritisation reduces analyst workload while keeping humans responsible for decisions, which is safer and more defensible than auto-closing alerts.Give two graph patterns that suggest laundering.
Fan-in/fan-out (many small inflows quickly sent out to many accounts), and cycles where money returns to the origin through intermediaries. Shared devices or addresses among unrelated customers are another strong signal.Created by Ajeetkumar