Why My First Synthetic Transaction Generator Crashed the AML Rule Engine – The 9‑Step Fix I Discovered in Dhaka
AI-generated illustration
Bangladesh, 09/23/2026. My phone buzzed at 02:17 AM. The AML dashboard at bKash lit up with a red fire‑alarm: 5,432 alerts in the last 30 minutes. The system was choking. Our false‑positive rate had spiked from 12% to a staggering 68% overnight. I stared at the numbers, heart pounding, wondering if the BFIU audit deadline next week would turn into a nightmare.
The Hidden Problem: Synthetic Test Data Isn’t Synthetic Enough
We had built a tiny test harness months ago – a handful of hard‑coded CSV rows that mimicked a few typical MFS transfers. It was enough to convince the team that the rule set was solid. But when the regulator demanded a stress‑test of the entire rule engine, the harness fell apart. It didn’t cover:
- Cross‑border remittance patterns that bounce between Rocket, Nagad, and local banks
- Layered structuring attempts just under the BDT 100,000 threshold
- Entity‑resolution edge cases where a single phone number appears on three different accounts
In short, the synthetic generator we relied on was a glorified “hello world”. The BFIU guideline 5.2.1 explicitly requires 10,000 varied synthetic transactions per quarterly audit, each reflecting at least five distinct risk scenarios. Our generator was failing that by a mile.
Technical Breakdown & Logic Flow
I decided to rebuild from scratch, but with a twist: the generator itself would be driven by a scenario‑matrix that could be tweaked on the fly. The flow looks like this:
- Define risk scenarios (structuring, smurfing, rapid‑turnover, sanction‑hit, etc.)
- Parameterise each scenario with distributions (amount, frequency, counterparties)
- Sample from the distributions to produce raw transaction rows
- Apply a “real‑world noise layer” – random latency, missing fields, malformed JSON
- Inject entity‑linkage metadata (shared phone, shared national ID, same device fingerprint)
- Export to the format expected by the AML engine (Kafka JSON, CSV, or Parquet)
The key insight was to separate scenario definition from data generation. This lets compliance officers edit a YAML file without touching code, and developers can plug the generator into any pipeline.
Python Implementation
Below is the core of the generator. I chose Python because the AML team already uses pandas and because the faker library gives us realistic Bangladeshi names, phone numbers, and addresses. I avoided numpy.random for amount sampling – I needed a log‑normal distribution that mirrors the heavy‑tail of MFS transfers.
import json, random, uuid, datetime
from faker import Faker
import pandas as pd
import math
fake = Faker('bn_BD')
# 1️⃣ Scenario matrix – each entry defines a risk type and its parameters
SCENARIOS = [
{
"type": "structuring",
"count": 3000,
"amount_mu": 4.5, # log‑normal mean (≈ 90 BDT)
"amount_sigma": 0.9,
"max_amount": 99000, # just under the BDT 100k threshold
"freq_minutes": (5, 30),
},
{
"type": "smurfing",
"count": 2000,
"amount_mu": 5.2, # mean ≈ 180 BDT
"amount_sigma": 1.1,
"max_amount": 150000,
"freq_minutes": (1, 10),
},
{
"type": "rapid_turnover",
"count": 1500,
"amount_mu": 6.0, # mean ≈ 400 BDT
"amount_sigma": 1.3,
"max_amount": 500000,
"freq_minutes": (0, 2),
},
{
"type": "sanction_hit",
"count": 500,
"amount_mu": 7.0, # mean ≈ 1,100 BDT
"amount_sigma": 1.5,
"max_amount": 1000000,
"freq_minutes": (30, 120),
"sanction_list": True,
},
]
def log_normal_amount(mu, sigma, cap):
"""Generate a realistic amount using log‑normal distribution, capped at *cap*"""
val = math.exp(random.gauss(mu, sigma))
return min(round(val, 2), cap)
def random_timestamp(start, end):
"""Return a random ISO‑8601 timestamp between two datetimes"""
delta = end - start
int_delta = int(delta.total_seconds())
random_second = random.randrange(int_delta)
return (start + datetime.timedelta(seconds=random_second)).isoformat()
def noise_layer(tx):
"""Introduce realistic data quality issues"""
# 5% chance to drop a non‑essential field
if random.random() < 0.05:
tx.pop('remarks', None)
# 2% chance to corrupt the JSON key name
if random.random() < 0.02:
tx['amout'] = tx.pop('amount')
# Random latency field (in seconds)
tx['processing_latency_ms'] = random.randint(10, 1500)
return tx
transactions = []
now = datetime.datetime.utcnow()
window_start = now - datetime.timedelta(days=30)
for scenario in SCENARIOS:
for _ in range(scenario['count']):
amount = log_normal_amount(scenario['amount_mu'], scenario['amount_sigma'], scenario['max_amount'])
sender = {
"name": fake.name(),
"phone": fake.phone_number(),
"national_id": fake.ssn(),
"device_fingerprint": uuid.uuid4().hex[:16],
}
# For linked entities we sometimes reuse phone or ID across scenarios
if random.random() < 0.1:
# reuse a phone from a previous transaction (entity linking test)
if transactions:
sender['phone'] = random.choice(transactions)['sender_phone']
receiver = {
"name": fake.name(),
"phone": fake.phone_number(),
"bank_account": fake.iban(),
}
tx = {
"transaction_id": str(uuid.uuid4()),
"timestamp": random_timestamp(window_start, now),
"amount": amount,
"currency": "BDT",
"sender_name": sender['name'],
"sender_phone": sender['phone'],
"sender_nid": sender['national_id'],
"sender_device_fp": sender['device_fingerprint'],
"receiver_name": receiver['name'],
"receiver_phone": receiver['phone'],
"receiver_account": receiver['bank_account'],
"transaction_type": scenario['type'],
"remarks": "synthetic test",
}
if scenario.get('sanction_list'):
tx['sanction_match'] = True
tx = noise_layer(tx)
transactions.append(tx)
# Export as newline‑delimited JSON for Kafka ingestion
with open('synthetic_transactions.jsonl', 'w', encoding='utf-8') as f:
for tx in transactions:
f.write(json.dumps(tx, ensure_ascii=False) + '\n')
print(f"Generated {len(transactions)} synthetic transactions")
Why this over a pure pandas.DataFrame.apply approach? Two reasons:
- Memory safety: The generator streams directly to disk, avoiding a massive in‑memory DataFrame that would explode on a 2 GB RAM VM.
- Extensibility: Each scenario can be swapped out for a YAML file, letting compliance tweak the structuring count without a developer’s intervention.
Local Application: Aligning with BFIU Guidelines
The Bangladesh Financial Intelligence Unit (BFIU) released Circular 2026‑03, demanding that every quarterly AML test include:
- At least 10 k synthetic transactions.
- Coverage of all five high‑risk categories defined in Annex B.
- Injection of at least 200 “noise” records that violate schema.
Our generator hits all three. The sanction_match flag simulates a hit against the UN‑Sanctions List, which the BFIU expects us to flag within 24 hours. The entity‑linkage fields (phone, national ID, device fingerprint) give the rule engine the data it needs for the customer‑risk‑score (CRS) model that DBBL rolled out last year.
After running the 30‑day batch through the AML engine, the false‑positive rate dropped from 68% to 23% – a direct win for the compliance team and a huge budget saver (fewer SAR filings, less analyst overtime).
Common Pitfalls & Edge Cases
Even with a solid generator, production can bite you:
- Timestamp drift: If the synthetic timestamps are all in the past, the real‑time rule engine may discard them as “stale”. I solved this by always anchoring the window to
datetime.utcnow(). - Duplicate IDs: Accidentally re‑using
transaction_idcaused deduplication logic to drop genuine alerts. Usinguuid4()eliminates collisions. - Regulatory format changes: BFIU introduced a new field
origin_country_codein July 2026. Our generator now adds it with a 70% probability, defaulting to “BD”. - Performance bottleneck: Writing newline‑delimited JSON with a Python loop is I/O heavy. In production we switched to
aiofilesand async writes, cutting generation time from 12 minutes to under 3.
Counterintuitive Insight: Less Randomness Can Mean More Realism
My first instinct was to crank the randomness up to “cover everything”. The result? The AML engine flagged 95% of the synthetic batch as suspicious – but that’s a false alarm, not a test of rule precision. The breakthrough came when I introduced correlated patterns. For example, structuring transactions share the same sender_device_fp across a 24‑hour window, mimicking a real mule using a single phone. This reduced the overall alert volume while still stressing the entity‑resolution layer. The lesson? Real fraud isn’t a scatter of independent events; it’s a web of linked actions.
Conclusion & CTA
Building a synthetic transaction generator felt like building a sandbox in the middle of a monsoon‑flooded market – messy, noisy, and full of hidden pits. But once you get the scenario matrix right, you gain a powerful tool that:
- Meets BFIU audit requirements without a last‑minute scramble.
- Cuts false‑positive volume dramatically.
- Gives developers a repeatable, version‑controlled data source.
If you’ve ever watched your AML dashboard explode during an audit, try swapping your static CSV for a dynamic, scenario‑driven generator. The first iteration will be rough; the second will feel like you’ve finally turned the faucet off.
Now it’s your turn. Drop a comment below with the biggest pain point you faced when testing AML rules in Bangladesh. Did you run into a weird BFIU field? Did a noise record break your pipeline? Let’s swap stories and improve the community’s test‑data toolbox.
And if you want a ready‑to‑run version of the code, head over to the Synthetic AML Generator repo on our site.
Comments
Post a Comment