Financial crime · Transaction monitoring
AML Investigation Console
Six months of payments on a platform with 4,600 customers. Rules raise the alerts; a triage model decides which to work first; network analysis follows the money from confirmed cases to the money mules that never tripped a rule.
How far down the queue to find the suspicious alerts (Aug–Sep test period)
Triage model orderRules order (most rules fired, then largest amount)
Top of the worked queue: highest-risk customers, Aug–Sep
The outcome column is the investigation result, known here because the data is synthetic.
Mule ring
Confirmed by investigatorsAlerted by rulesFound by network analysisNot found
Network analysis: accounts that forward money to confirmed cases
A forwarding event is money in, followed within two days by a payment to a confirmed account of at least 80% of it. Accounts with three or more are flagged. None of these accounts raised a rule alert.
Coverage by typology
Rules flag at least one member of every case. But mules each move a few thousand dollars and look like ordinary customers, so they are the members rules miss.
How it works
- Rules: seven standard scenarios evaluated per customer per week: structuring under the $10,000 reporting threshold, rapid movement, fan-in, fan-out to new recipients, wires to high-risk jurisdictions, money cycles (graph search for 3–4 account loops), and volume above the customer's declared profile.
- Triage model: gradient boosting on behaviour, rule and network features, such as the share of money forwarded within two days and the share of flows to or from other alerted accounts. Trained on April–July alert outcomes and tested on August–September, so it only sees the past.
- Network analysis: starting from customers confirmed in the worked part of the queue, it finds accounts that repeatedly pass money on to them within two days.
- Legitimate look-alikes are built in: wholesalers and staffing firms (pass-through and fan-out), landlords depositing cash, family remittances, savings clubs that rotate money, fundraisers and resellers. That is why rule precision is about 10%, typical of real monitoring.
All data is synthetic: 541,000 transactions and 64 planted cases across five typologies. Built with AI-assisted coding (Claude); the scenario design, model and review are my own.