MAY/JUNE 2004 1094-7167/04/$20.00 © 2004 IEEE 87Published by the IEEE Computer Society

A p p l i c a t i o n s : B a n k i n g

group were representatives from the FBI, Interpol, the Finan-cial Action Task Force, and a host of other international andnational financial regulators and investigators. 9/11 repre-sented a massive failure of international controls, and clearlyonly radical change would prevent something similar fromhappening in the future.

What troubled the committee and international agencieswas that the whole terrorist operation could have beenfunded for less than US$0.5 million—pocket change, inthe context of routine banking. Up to this point, interna-tional money laundering had been about the Mafia, drugsmuggling, and arms deals, involving sums in excess of$500 billion a year.1 How could banks transacting hun-dreds of millions of dollars a day spot suspicious activityin transaction amounts as small as $2,000 to $5,000? Howcould they have detected the terrorist financing behind9/11?

Two years later, almost half of the world’s top 20 banksare using AI systems,2 and AI has emerged as the leadingmethod in the fight against money laundering (see the “AIand Money Laundering Detection” sidebar).3 At Search-space, we monitor customer activity to identify unusualbehavior and detect potential money-laundering situations.

The problem from an AI perspective In 1998, I met with the head of risk for a mid-sized UK

bank. Even at that time, the UK had stringent money-laun-dering regulations owing to the ongoing terrorist threat.Banks would occasionally fall foul of the regulator andneed to demonstrate whole-hearted commitment to find-ing ways of trapping suspicious activity. This particularbank was concerned with its staff’s ability to successfullymonitor such activity, given modern banking’s increas-ingly faceless and electronic nature. Could AI help moni-tor transaction behavior to detect money laundering?

The bank had approached Searchspace, formed by re-searchers from the Intelligent Systems Lab at UniversityCollege London in 1993. It applies adaptive and learning-systems approaches to a range of business and financetasks. However, until then, we had principally developedsystems for US and UK stock exchanges to automate mar-ket-abuse detection—monitoring insider trading, frontrunning, market manipulation, and other forms of marketcheating.

The problem the bank posed was far more challenging—five million transactions per day, five million individual ac-counts, over three million customers, hundreds of producttypes, and no clear signature or pattern associated withmoney laundering. Unlike many types of financial fraud,money laundering could range from a single transaction tothe culmination of months of complex transactional activ-ity. A sequence of transactions might be interesting only inthe context of activity that has taken some time to emerge.In engineering terms, this represents one of the worst formsof dimensionality disorder, with massive scaling variancesand feature overload.

Additionally, the bank wouldn’t share past cases that ithad detected or reported. It judged this information toosensitive and insisted we find what we could on a year’sworth of historical data unguided.

Unsupervised beginningsTo an extent, we had been here before. Most financial

organizations don’t keep good records of infractions—certainly not sufficient to use as training sets. They’realso reluctant to share historic cases because of the legalcomplexity of active and prosecuted cases.

So, for the stock exchanges, we developed an approachto unsupervised learning based on probabilistic data analy-sis. The approach used adaptive heuristics mixed with con-ventional search and pattern recognition techniques. Weused these to build what we called special investigatormodules, now known as Sentinels. These are autonomousinvestigator agents designed to police a specific businessissue and alert people when there’s a problem. To aid thisprocess, we developed a conceptual framework for housing

The Wolfsberg Group, formed by a group of interna-

tional banks to share ideas on combating global

money laundering, met in early 2002 to discuss the after-

math of the September 11 terrorist attacks. Joining the

AI Fights Money Laundering

Jason Kingdon, Searchspace

the autonomous agents so that they couldcooperate and draw on a range of similarservices such as data access, security, report-ing, and workflow. (We’re still developingthese ideas—the notion of an integratednetwork of autonomous agents is promising.It offers flexibility in problem solving andforms the basis of an AI operating system.)

Our Sentinels used heterogeneous hy-brid technology so that each could draw ondifferent techniques depending on whatseemed appropriate—or what worked. Oneprinciple we enshrined was the results’transparency. A Sentinel had to be able toexplain why it sent an alert, what it found,and what it wanted you to do. For this rea-son, and because of the lack of trainingexamples, we didn’t use nonlinear para-metric techniques such as neural nets.

One method we developed to help de-tect insider trading was akin to a proba-bilistic support vector. It leveraged thehuge dimensionality of the insider-tradingproblem by assessing the probability ofan individual trading on insider informa-tion across a likelihood matrix. This wasa support vector machine but with proba-bilistic thresholds. The tests we ran repli-cated and improved on human investiga-tions. Moreover, unlike many automatedapproaches, the exchange’s regulatoryteam considered all results worthy ofinvestigation. And with no training set,the Sentinel couldn’t be accused of over-fitting the data.

This approach looked like a good start for

trying to break down the money-launderingissue.

The cure of dimensionalityComputers excel when dealing with large

volumes of data. For money laundering, thescales are so large that machines are the onlyway to tackle the problem. The question washow to start and whether this issue was toocomplex for the current state of automatedanalytic techniques.

As we’d done with other Sentinels, welooked closely at the underlying objectives.For regulatory Sentinels, this often meantreading the relevant statute. The basic legalrequirement for money-laundering report-ing in the UK is for banks to assess cus-tomers’ banking activity and report suspi-cious behavior.

However, there are no clues as to whatconstitutes “suspicious” behavior—whatmakes a transaction suspicious? An amount,an action, or a series of actions? Anecdotally,the bankers talked about tellers filing SARs(suspicious activity reports) based on obser-vations—“the customer looked suspiciousand the money smelled of fish.” Not the bestbasis for building an algorithm. Furthermore,the regulator insists that the bank use itsunderstanding of banking and its customersto determine what suspicious should mean.Moreover, the bank must be able to demon-strate that it’s doing this systematically. Thisinterpretive approach allows great freedomfor the regulator to assess a bank’s approachin the absence of easy-to-prescribe rules.

From an AI perspective, it also ruled out fil-tering transactions for a series of scenarios.

We made our first breakthrough by look-ing for “unusual” rather than suspicious be-havior. This let us establish behavioral normsfor each customer and look for “weirdness”—which is nonprescriptive but statistically de-fined over some dimensionality.

The question now became one of di-mensionality—what activity should bejudged and over what scales? We exagger-ated the basic concepts of support vectorsby introducing massive dimensionality—customers × accounts × products × geogra-phy × time. This generated an enormousmultidimensional adaptive probabilisticmatrix for each of the bank’s customers. Wecould now assess the likelihood of individu-als’ actions based on simple weighted ag-gregations of activity using the underlyingprobabilities.

The matrix is adaptive in that it updatesstatistics on the basis of customer behavior—as a customer makes transactions, the under-lying probabilities change. So, customers settheir own behavioral pattern—frequent cashpayments or international payments could benormal for some people but unusual for oth-ers. One customer’s $100,000 withdrawalcould be as normal as another’s $50 with-drawal. Using a probabilistic view of theworld solved the first major problem of scaleinvariance with an ability to compare unlikeactivity. It also provides a pseudo informa-tion-theoretic means for identifying informa-tion, or, in this context, unusualness.

88 www.computer.org/intelligent IEEE INTELLIGENT SYSTEMS

Owing to the complexity of money-laundering detection,most commercial systems have concentrated on simple rules formonitoring certain payments, such as those from sanctionedlists of individuals, organizations, or high-risk geographies. Oneexample is the OFAC List, published by the Office of ForeignAssets Control.

More sophisticated analysis has used intelligent systems toenhance manual investigations. For example, neural net-works and fuzzy logic have aided tasks such as link analy-sis—where associations between account or individuals areanalyzed for common features, including name and address,zip code, phone numbers, or other account details. However,these data mining techniques are more useful when aninvestigation is already underway, because they’re suited toagencies that pursue criminal investigations. They’re lessuseful for industries attempting to prevent the abuse in thefirst place.

In 1995, the US Congress Office of Technology Assessmentpublished a report investigating the use of AI for automatedmoney-laundering detection. The report’s conclusion wasdaunting—“automated computer screening of transactionsfor money laundering is virtually impossible.”1 The gloomyconclusion was largely based on an assumed false-positiverate applied against the number of transactions a systemwould need to screen. Fortunately, we can improve this mathby looking at customers and accounts as well as individualtransactions. Transactions inform account analysis, but systemalerts are account- or customer-based and thus avoid duplica-tion and redundancy.

Reference

1. Information Technologies for the Control of Money Laundering,OTA-ITC-630, US Congress Office of Technology, Sept. 1995.

AI and Money-Laundering Detection

Identifying money launderingThe probability matrix was a good start,

but it didn’t actually detect anything—weneeded a way to focus on interesting activity.So, we introduced a probabilistic retina inwhich an event occurs if a certain probabilitythreshold is breached. Akin to trapping aphoton, each retina cell fires only if a certainlow probability, or quantity of information, isachieved. For example, customer X deposit-ing an enormous amount of money wouldcause a cell to fire, where we define enor-mous as relative to who deposits the money.The method also evaluates more subtle activ-ity; for example, say customer X over thecourse of many months and across multipleproduct types (cash, checks, debit and creditcards, and so forth) withdraws an unusuallyhigh amount based on previously establishednorms. This too will fire an event. The Sen-tinel then aggregates weighted events for acustomer across the matrix’s multiple dimen-sions to get a ranking of universal unusual-ness across the bank at that point in time.

We designed the dimensions to be loose inform so that the system could score the sameactivity from many angles. This naturally am-plifies unusual activity in a noisy environ-ment. It also allows for a more robust designprocess because no single “signature” is thekey to the recognition task.

We also use peer groups in the matrix toestablish unusualness outside a person’sbehavioral norm. For example, it might benormal for a commercial account that’s ajeweler to transact large cash sums—say,$10,000,000 a week. However, this mightbe odd compared to other jewelers. We canjudge this in a peer context in aggregateamounts and across product types to givebalanced insight into the behavior. As wefine-tuned the matrix of events, the money-laundering Sentinel took shape.

We then worked with the bank to refine theresults and installed our first operational sys-tem in 1999. It assessed every transaction forthe risk of money laundering in its own con-text, against its own behavior and its peers’behavior, and against the sequence of activity.Unusualness turned out to be a good surro-gate for suspiciousness, providing insight into suspicious behavior in the context of themasses of information the bank processeseach day. The system didn’t use fixed rulesbut rather relied on statistically based qualita-tive judgments and comparisons of activity.

We’ve since refined our methods and improved the techniques. The system cur-

rently has approximately a 1-in-14 false-positive rate—one alert is prosecuted throughan SAR filing (meaning the banking staffjudged it worthy of action) for every 14raised. The system generates alerts on aver-age at a rate of 0.00001.

As part of the refining process, we’ve alsolooked at styles of laundering—could, forexample, our methods have detected the ter-rorist financing behind 9/11? According toresults presented to the Wolfsberg Group andothers, although the amounts transacted weresmall, the patterns were unusual. More prob-lematic today is how the investigator bureauscan respond to the improved intelligencefrom the banks.

Exploring other applicationsLong ago, banks knew you by name

and knew what you did with your money.Although we’ve gained the benefits offully automated global electronic bank-ing, a fully automated system is blind—and not just blind to money launderers,fraudsters, and general abuse but also tothe provision of service. If you nevermeet your customer, how can you respondto his or her needs?

In this context, technology puts consid-erable distance between the supplier andconsumer, which is bad for business. Whatwas once a close relationship is now re-mote and potentially undervalued.

Ironically, it’s in this sense that AI tech-niques can excel. If it’s possible to replicatethe contextual interaction of a teller andcustomer within the transaction infrastruc-ture, then we can replenish some of the inti-macy and immediacy of human contact, abasic component of which is to “know yourcustomer.”

For banking, this traditionally refers to therequirement that banks check a customer’sID when opening a new account. However,we argue (as do many in the industry) thatfaking an ID is so easy that identity theft isone of the fastest-growing banking issues.The AI approach is based on understandingan individual’s behavior—that is, “knowyour customer” by knowing his or herbehavior. Knowing how people behave is the best way to identify risk.

However, knowing someone through hisor her behavior is inherently bespoke, andinteractions between a corporation (bank)and customer on this mass scale is new. Itmoves us from an era dominated by seg-mentation and broadcast marketing toward

an era of individual interaction based onbehavior. Once an infrastructure is capableof this style of interaction, the possibilitiestouch almost all areas of banking. It meansthat event-based services can be trigged bybehavioral contexts rather than static seg-mentation and isolated campaigns. It alsobecomes possible to learn a customer’spreferred manner of interaction, whetherthat be through direct mail, a call center, oremail. Obtaining this information based ona person’s response is far more representa-tive than using answers from a series ofpreference questionnaires.

AI makes these decisions dynamic,adaptive, informed, and timely. Peoplechange, and the ability to stay current isas vital to making good risk decisions asit is to making good marketing decisions.It allows more dynamic decision-making;for example, what should trigger a denialof service—insufficient funds in an ac-count or an over-limit credit card? Thisrequires good judgment on a case-by-casebasis and within the context of bank pol-icy. A machine with the intelligence tojudge context can operate at this scale,resolving problems with transparency andjustification. In some sense, it’s akin toassigning a service guardian to each cus-tomer to negotiate the range of the bank’sbusiness objectives.

A t Searchspace, we believe this newgeneration of adaptive operational analyticsoffers new possibilities from risk manage-ment to service provision, and we’re work-ing with others in the industry to bring thispotential to life.

References

1. J. Robinson, The Laundrymen, Arcade Pub-lishing, 1996.

2. B. McGuire, “What a Difference a YearMakes: Winnowing Out AML Vendors to theLargest US Banks,” TowerGroup, 2003.

3. N. Katkov, “Ranking the Vendors of AntiMoney Laundering Solutions,” Celent, 2003.

MAY/JUNE 2004 www.computer.org/intelligent 89

Jason Kingdon is CEO of Searchspace.Contact him at j.kingdon@searchspace.com.