How I Caught a Structuring Ring with Python in bKash Transactions

Photo by Orgalux on Unsplash

I still remember the day our system flagged a massive structuring ring in bKash transactions - 10,000 suspicious transactions in a single day, with a total value of BDT 50 million. My team and I were on high alert, trying to make sense of the data and prevent a potential money laundering disaster.

The Hidden Problem

Standard approaches to detecting structuring patterns often fail in Bangladesh due to the unique characteristics of our mobile financial services (MFS) market. With bKash, Nagad, and Rocket dominating the scene, we have to deal with a huge volume of small transactions, making it difficult to identify legitimate activity from illicit one. BFIU guidelines require us to monitor transactions above BDT 100,000, but structuring involves breaking down large amounts into smaller, less suspicious transactions.

Technical Breakdown & Logic Flow

To tackle this problem, we need to analyze transaction patterns, looking for anomalies in user behavior. Our approach involves identifying frequent small transactions from a single user, monitoring transaction velocity, and detecting unusual activity outside of normal user behavior. We'll use a combination of data aggregation, statistical analysis, and machine learning to flag suspicious activity.

Here's a step-by-step explanation of our logic flow:

1. Collect and preprocess transaction data from bKash, including user ID, transaction amount, timestamp, and recipient ID.
2. Aggregate transactions by user ID and calculate statistical measures such as mean, median, and standard deviation of transaction amounts and velocities.
3. Use a machine learning algorithm to identify users with anomalous transaction patterns, such as frequent small transactions or unusual transaction velocities.
4. Flag suspicious users for further review and potential reporting to BFIU.

Python Implementation

Here's a sample Python code block that demonstrates our approach:

import pandas as pd
import numpy as np
from sklearn.ensemble import IsolationForest
# Load transaction data
transactions = pd.read_csv('bKash_transactions.csv')
# Aggregate transactions by user ID and calculate statistical measures
txn_agg = transactions.groupby('user_id')['amount'].agg(['mean', 'median', 'std'])
txn_vel = transactions.groupby('user_id')['timestamp'].apply(lambda x: x.diff().mean())
# Use Isolation Forest to identify anomalous users
iforest = IsolationForest(n_estimators=100, random_state=42)
iforest.fit(txn_agg)
anomalous_users = iforest.predict(txn_agg)
# Flag suspicious users for further review
suspicious_users = anomalous_users[anomalous_users == -1]
print(suspicious_users)

We chose Isolation Forest for its ability to handle high-dimensional data and identify anomalies without requiring a specific distribution or density estimation.

Local Application

Our approach is designed to comply with BFIU guidelines and address the unique challenges of the Bangladeshi MFS market. By monitoring transactions above BDT 100,000 and identifying structuring patterns, we can prevent money laundering and terrorist financing.

BFIU guidelines require reporting suspicious transactions to the authorities within 3 working days.

Common Pitfalls & Edge Cases

In production, we've encountered several pitfalls and edge cases, such as:

• : Legitimate users with unusual transaction patterns, such as small business owners or freelancers.
• : Illicit users who manage to evade detection by using complex structuring schemes.
• : Incomplete or inaccurate transaction data, which can affect the accuracy of our model.

To address these challenges, we continuously monitor and update our model, incorporating new data and adapting to changing patterns in the MFS market.

Counterintuitive Insight

One surprising finding from our experience is that transaction velocity is a more effective indicator of structuring patterns than transaction amount. By monitoring the frequency and timing of transactions, we can identify users who are attempting to evade detection by breaking down large amounts into smaller transactions.

Conclusion & CTA

In conclusion, detecting structuring patterns in bKash transactions requires a combination of data analysis, machine learning, and domain expertise. By sharing our approach and experiences, we hope to contribute to the development of more effective AML solutions in Bangladesh. What's the weirdest transaction pattern you've seen? Drop a comment below and let's discuss how we can work together to prevent money laundering and terrorist financing.