Why Most AML Rule Engines Miss Layering in Mobile Banking

Photo by Md. Mehedi Hasan on Unsplash

I still remember the night we discovered a massive structuring ring in our mobile banking system. It was a typical Monday evening when our team detected a pattern of transactions that seemed to be designed to evade our anti-money laundering (AML) checks. The total amount was staggering - over BDT 10 million in a single day, all below the BDT 100,000 threshold for monitoring.

The Hidden Problem

As we dug deeper, we realized that our AML rule engine had missed a critical technique used by money launderers: layering. It's a simple yet effective method where criminals break up large transactions into smaller, seemingly innocuous ones, making it difficult for our systems to detect. The problem is that standard approaches to AML often focus on individual transactions rather than the overall pattern of behavior.

Our team was frustrated - we had implemented all the recommended rules and thresholds, but still, these transactions slipped through. It was then that I realized the importance of understanding the why behind our rules. Why were we monitoring transactions above BDT 100,000? Why were we flagging transactions with specific keywords?

Technical Breakdown & Logic Flow

To tackle layering, we needed a more nuanced approach. We had to analyze the transaction data in a way that would help us identify patterns, rather than just individual transactions. This involved creating a graph of all transactions, where each node represented a transaction, and the edges represented the relationships between them. By analyzing this graph, we could identify clusters of transactions that seemed to be related, even if they were below the threshold.

The logic flow was as follows:

1. Collect all transaction data for a given time period
2. Create a graph of transactions, where each node is a transaction, and edges represent relationships
3. Analyze the graph to identify clusters of related transactions
4. Flag clusters that exhibit suspicious patterns, such as a large number of transactions in a short period

Now, let's dive into the Python implementation of this logic. We'll use the NetworkX library to create and analyze the graph.

import networkx as nx
import pandas as pd

# Load transaction data
transactions = pd.read_csv('transactions.csv')

# Create a graph of transactions
g = nx.Graph()
for index, row in transactions.iterrows():
    g.add_node(row['transaction_id'])
    for other_index, other_row in transactions.iterrows():
        if row['customer_id'] == other_row['customer_id'] and row['transaction_date'] == other_row['transaction_date']:
            g.add_edge(row['transaction_id'], other_row['transaction_id'])

# Analyze the graph to identify clusters
clusters = []
for component in nx.connected_components(g):
    cluster = g.subgraph(component)
    clusters.append(cluster)

# Flag clusters that exhibit suspicious patterns
suspicious_clusters = []
for cluster in clusters:
    if len(cluster.nodes()) > 10 and len(cluster.edges()) > 20:
        suspicious_clusters.append(cluster)

As you can see, this implementation is not perfect, and there are many ways to optimize it. However, it gives you an idea of how we can use graph analysis to identify layering patterns in transaction data.

Local Application

In the context of Bangladesh, this approach is particularly useful. The Bangladesh Financial Intelligence Unit (BFIU) guidelines require us to monitor transactions above BDT 100,000, but they also emphasize the importance of identifying suspicious patterns. By using graph analysis, we can identify clusters of transactions that may be below the threshold but still exhibit suspicious behavior.

Additionally, mobile financial services (MFS) like bKash, Nagad, and Rocket have made it easier for people to conduct transactions, but they also increase the risk of money laundering. By analyzing transaction patterns, we can identify potential layering activity and flag it for further investigation.

The BFIU guidelines state that all transactions above BDT 100,000 must be reported. However, our approach goes beyond this threshold, identifying suspicious patterns that may be below the limit.

Common Pitfalls & Edge Cases

One common pitfall is overfitting our model to the training data. If we're not careful, our model may become too specialized to the specific patterns in the training data and fail to generalize to new, unseen data. To avoid this, we need to use techniques like cross-validation and regularization to ensure our model is robust and generalizable.

Another edge case is handling missing data. In many cases, transaction data may be missing or incomplete, which can affect our analysis. To handle this, we need to use imputation techniques to fill in missing values and ensure our model is robust to incomplete data.

Counterintuitive Insight

One surprising finding from our experience is that layering patterns can be incredibly complex. We've seen cases where money launderers use multiple layers of transactions, each designed to evade our detection. This means that our model needs to be able to identify not just simple patterns but also complex, nested patterns.

This insight has significant implications for our approach. We need to be able to analyze transaction data at multiple levels, from individual transactions to complex patterns. We also need to be able to adapt our model to new, emerging patterns, as money launderers continually evolve their techniques.

Conclusion & CTA

In conclusion, layering is a critical technique used by money launderers that can be difficult to detect using standard AML approaches. By using graph analysis, we can identify suspicious patterns in transaction data and flag them for further investigation. However, this approach requires careful consideration of common pitfalls and edge cases, as well as a deep understanding of the underlying data and patterns.

So, what's the weirdest transaction pattern you've seen? Drop a comment below and let's discuss. Have you tried using graph analysis to identify layering patterns? What were your results? Let's share our experiences and insights to stay one step ahead of money launderers.