Analysis and modelling in the world of transaction monitoring

Guest Lecture: Zanders

Zanders & Their Risk Advisory Group

Zanders provides expertise in several key risk areas, including:

  • Credit Risk

  • Trading Book Risk

  • Asset & Liability Management (ALM)

  • ESG Risk

  • Non-Financial Risk

  • Financial Crime Prevention

Financial Crime & Banks

Banks play a crucial role in monitoring accounts and transactions to stop financial crime.

The Scale of Financial Crime

  • Financial crime represents 2–5% of global GDP.

  • With the 2024 global GDP at around $110 trillion, this means:
    $2.2 to $5.5 trillion is laundered each year.

Impact of Financial Crime on Society

  • Funding illegal activities

  • Financial losses for victims of fraud, identity theft, and scams

  • Loss of government revenue because illicit income is not taxed

  • High compliance costs as banks must invest in expensive prevention measures

  • Destabilization of local economies due to illegal cash flows

  • Loss of trust as public confidence in the financial system decreases

Banks as Gatekeepers

Banks facilitate the flow of capital.

The bank facilitates the flow of capital. They act as intermediaries between savers and borrowers. Therefore, this makes the bank a centralized place were all these transaction data can be overseen and monitored .

Why do banks act as gatekeepers?

They have the responsibility to protect consumers and businesses from financial crimes ▪ By enforcing regulations by the regulator, banks need to maintain the integrity of the financial system or risking a fine

Have banks been good gatekeepers?

No — not consistently.
Many banks have faced fines and scandals for failing to detect or prevent financial crime effectively.

Types of Financial Crime

Financial crime takes many different forms. Some are targeted at individuals, while others affect companies, governments, or the broader financial system.

Legislation and Related Types of Financial Crime

Governments and regulators have created laws to detect, prevent, and prosecute financial crime. These cover a wide range of illegal activities, including:

1. Global level

This is the highest, international layer.

  • FATF recommendations
    International guidelines on preventing money laundering and terrorist financing. Countries must translate these into their own laws.

  • UN resolutions
    Decisions from the United Nations, mainly related to sanctions (against countries, organizations, or individuals).

🔎 2. European level (EU)

The global rules are then translated into European frameworks:

  • European guidelines
    EU-level guidance that builds on the FATF recommendations.

  • EU regulations
    Binding EU laws, including sanctions regulations. These apply directly to all EU member states.

🔎 3. Dutch national law (NL)

The international and EU rules are implemented in the Netherlands through:

  • Wwft (2008)
    Law on the prevention of money laundering and terrorist financing.
    Banks and financial institutions must monitor transactions and report unusual activities.

  • Sanctiewet (1977)
    The Dutch law that ensures compliance with international and EU sanctions.

  • Wft (2007)
    Financial Supervision Act.
    A broad law regulating financial institutions and market conduct.

🔎 4. Financial crime typologies (green boxes)

The legislation aims to combat these main types of financial crime:

  • Money laundering & terrorist financing

  • Sanctions violations

  • Fraud

Fraud (Most Impactful on Individuals)

Common types of fraud include:

  • Investment Scams

  • Romance Scams

  • Purchase Scams

  • Advance-Fee Scams

  • CEO Fraud

  • Invoice Fraud

These schemes often exploit trust, urgency, or convincing stories to trick victims into sending money or sharing personal information.

Fighting Fraud Using Models

Banks and financial institutions use advanced data models to detect unusual or suspicious behavior, including:

  • Credit Card Monitoring
    Model used to detect and block fraudulent credit card transactions. Uses as input a risk score from Visa/Mastercard

  • General Transaction Monitoring
    Model that covers the non-credit card transactions, by identifying and blocking potential fraudulent transactions.

  • Online Channel Monitoring
    Model used to identify unusual logins, for example in the online banking environment or in the mobile app

Sanctions

Sanctions are government-imposed restrictions designed to limit or block financial activity with specific individuals, companies, or countries.

Obligations according to Sanctiewet (1977) • Sanctions are political instruments in the foreign and security policies of the United Nations, the European Union and national governments, for example: ▪ A bank must freeze an organisation’s bank balance so that no money can be withdrawn from the account. ▪ A pension fund may not invest in a firm. ▪ An insurer is not allowed to provide insurance to an individual. An institution must at all times be able to detect whether any of its customers are named in, or its services and transactions relate to the sanctions regulations. An institution must also notify, or be able to notify, DNB of such cases without delay.

Examples of Sanctions

  • Full transaction bans on major companies

  • Freezing assets, where a bank must block an organization’s entire account balance

These measures are meant to prevent sanctioned entities from accessing the financial system.

Sanctions screening with models

Transaction filtering : Screening of all incoming and outgoing transactions, based on matching of transaction information with sanction lists.

Name screening : Daily screening of all employees, clients and companies (suppliers, vendors) against sanction violation, bad press, etc.

Money Laundering

Money laundering refers to any financial process that aims to clean money obtained through illegal activities by hiding or disguising its criminal origins.

The Stages of Money Laundering

0) Predicate Offence

An illegal activity generates the criminal proceeds that need to be laundered.

1) Placement (Injection)

Criminal proceeds make a first movement into the financial system; for instance, through deposits into bank accounts, or disguised as revenues from a legitimate business.
Examples include:

  • Depositing cash into bank accounts

  • Disguising the funds as revenue from a legitimate business

2) Layering

Money passes through additional financial transactions designed to appear legitimate and muddle the origin and movement of the funds; for instance, through multiple international transfers via shell companies.:

  • Multiple international transfers

  • Shell companies

  • Complex payment chains
    The goal is to make the funds appear legitimate and difficult to trace.

3) Integration

Laundered money becomes available for use with the appearance of non-illicit funds; for instance, for the purchase of real estate or other assets.


Examples:

  • Purchasing real estate

  • Buying luxury goods

  • Investing in legitimate businesses

Terrorist Financing

Wwft (2008)

Wet ter voorkoming van witwassen en financieren van terrorisme
This Dutch law focuses on preventing money laundering and terrorist financing.

Goal of Terrorist Financing

The goal is to convert money—whether obtained legally or illegally—into liquidity that can be used to support terrorist activities.

Models for Money Laundering & Terrorist Financing

Financial institutions use various models to detect suspicious patterns related to money laundering and terrorism:

  • Client Risk Classification
    The risk indicators are established through statistical analyses that focus on identifying client characteristics that carry high predictive power for fraudulent behaviour.

  • Transaction Monitoring
    Fraudulent individuals are identified through behaviour monitoring. Fraudulent networks are uncovered using community detection algorithms.

Why AML Is an Interesting Modelling Challenge

Anti-Money Laundering (AML) modelling is complex because of several factors:

  • Modelling Human Behavior
    Criminals constantly adapt to avoid detection.

  • Low Signal-to-Noise Ratio
    Suspicious activities are rare compared to millions of normal transactions.

  • Imbalanced Data
    Very few truly illegal cases exist compared to the huge volume of legitimate activity.

  • Limited Visibility
    Banks often see only a small piece of the full transaction chain.

  • Transactions Represent Behavior
    Every transaction reflects a customer’s actions, making patterns subtle and hard to identify.

Fraud Detection vs. AML

  • Fraud Detection:
    “Is this single transaction fraudulent?”

  • AML (Anti-Money Laundering):
    “Do these transactions show a pattern of money laundering?”

Fraud focuses on individual events, while AML focuses on long-term patterns and behaviors.

Models in AML 

Rules based systems (alerts aere enerated on one dimensional triggers 

Advantages 

  • Explainable 

  • clear link to specific risks 

  • easy to implement 

Disadvantages 

  • inefficeint 

  • unble to capture more compolex patterns 

  • susceptible to threshold gaming 

Supervised Machine Learning (ML)

In supervised ML, the algorithm is trained to recognize multidimensional patterns based on historical labeled data (for example: past confirmed money laundering cases).

Advantages

•Captures more complex patterns

•Trained to capture proven risks

•More efficient

Disadvantages

  • •Less explainable

  • •Requires more effort to link to specific risks

  • •More difficult to implement

  • •Only able to detect known and historic patterns

Anomaly Detection

Unsupervised algorithm is trained to detect anomalous behaviour based on features

Advantages

•Can detect new or unknown patterns and behaviours

•Captures more complex patterns and behaviours

Disadvantages

•Also detects harmless anomalous behaviour

•Less explainable

•Less efficient

Landscape of Models in the Financial Crime (FC) Space

Different types of models are used to detect financial crime, such as rules-based systems, supervised ML, and anomaly detection. Each has strengths, weaknesses, and implications for fairness.

TMNL – Transaction Monitoring Netherlands

What was TMNL? Transaction Monitoring Netherlands (TMNL) was a joint initiative by 5 major Dutch banks – ABN AMRO, ING, Rabobank, Triodos Bank, and de Volksbank, who have joined forces to detect and prevent criminal activities in the financial sector.

Why was TMNL created? Money laundering networks often operate across multiple financial institutions, making it challenging for individual banks to detect suspicious activities, as each institution is limited to what it can observe independently.

What did TMNL do? 1. The participating banks sent encrypted transaction data exceeding €100 to TMNL 2. Advanced algorithms and machine learning technologies detected patterns and anomalies. 3. If TMNL identified a suspicious transaction, it was flagged and sent back to the relevant bank, allowing them to take prompt action to prevent potential financial crimes. 4. The bank was then responsible for reporting suspicious activity to the Financial Intelligence 1 Unit (FIU) for further investigation.

Why was TMNL stopped? There were concerns about privacy violations of bank account holders and TMNL has been labelled as a form of “mass surveillance” and a “dragnet”. Under the latest regulations, AMLR, data sharing concerning money laundering and terrorist financing is now restricted to higher-risk customer behaviour or transaction activities

AML Models: Fighting Crime — But Are They Playing Fair?

It’s not only about detecting suspicious vs. legitimate clients.
It’s also about ensuring the models themselves do not behave unfairly or reinforce harmful biases.

But that’s not the only way we identify customers. Models often use many other characteristics—some of which are sensitive (protected attributes).

Banks have a dual responsibility: This brings us to the domain of Bias and Fairness Banks don’t just have a responsibility to detect financial crime. They also have a duty to treat customers fairly.

What’s at stake? • Legal restrictions: Under European law (GDPR), using such data is generally prohibited. • Risk of bias: Models can learn discriminatory patterns from historical data.

What Is Bias?

Bias is a systematic deviation from truth or fairness in judgment, decision-making, or data.

Key Characteristics of Bias

  • Systematic
    Not random — it consistently pushes outcomes in a particular direction.

  • Distorts Reality
    Leads to incorrect conclusions or unfair decisions.

  • Can Occur Anywhere

    • Human thinking → cognitive bias

    • Research → sampling bias

    • Technology → algorithmic bias

The Problem: Real-World Examples

Bias can negatively influence:

  • Hiring

  • Lending

  • Law enforcement

These areas show how unfair patterns can harm individuals or groups.

Protected Attributes

What Are Protected Attributes?

These are personal characteristics that are sensitive and legally protected.
Examples include:

  • Gender

  • Ethnicity

  • Sexual orientation

  • Religion

  • Etc.

What’s at Stake?

  • Legal restrictions
    Especially under European law (GDPR), using protected attributes incorrectly can violate privacy and anti-discrimination rules.

  • What’s at stake? • Legal restrictions: Under European law (GDPR), using such data is generally prohibited. • Risk of bias: Models can learn discriminatory patterns from historical data.

  • Example If a model predicts expected salary based on job function, it might learn that: • Historically, men earn more than women. • The model could then unfairly predict lower salaries for women, perpetuating bias.

  • Fairness through Unawareness • Removing all protected attributes from the dataset is also known as Fairness through Unawareness (FTU). • However, the model can still learn biased patterns from proxies

“The Solution Is Easy—Just Remove It From the Model, Right?”

This approach is known as:

Fairness Through Unawareness (FTU)

Removing protected attributes sounds logical, but it does not fix the problem, because models can still learn bias from proxies.

Examples of Common Proxies

  • Postcode → often reveals ethnicity

  • Home ownership → reflects socioeconomic status

  • Medical expenses → may indicate disability

Even if gender or ethnicity is removed, the model may infer them indirectly through these variables.

Example: Expected salary model You work at a company that uses a model to determine your salary after a promotion The model uses the following data: • Job function • Years of experience • Salary expectations (correlated with gender) Historical data shows: • Men typically earn more than women Consequence: • The model may learn that lower salary expectations → lower salaries. • Since salary expectations are often lower for women, the model could systematically assign lower salaries to women, even without using gender explicitly.

Types of Fairness

Three major fairness definitions in machine learning:

  • Independence

  • Separation

  • Sufficiency

These relate to relationships between:

  • Input features (X)

  • Predicted label (Ŷ)

  • Ground truth (Y)

Type 1: Independence

“A model satisfies independence if the prediction is independent of the sensitive attribute.” 𝑃 𝑌 ෠ = 1 𝐴 = 1 = 𝑃 𝑌 ෠ = 1 𝐴 = 0 or 𝑌 ෠ ⊥ 𝐴 →Decisions should be independent of any protected attribute

When is this a good idea? →When you are actually trying to enforce some form of equality between groups following e.g. historical bias in job application acceptance When is this a bad idea? →It ignores actual outcomes. So even if one group has a higher base rate of the outcome, the model still has to predict equally, which can lead to unfairness in practice (Ajax example)

Type 2: Separation “A model satisfies separation if the prediction is conditionally independent of the sensitive attribute given the actual outcome.” 𝑃 𝑌 ෠ = 1 𝑌 = 𝑦, 𝐴 = 0 = 𝑃 𝑌 ෠ = 1 𝑌 = 𝑦, 𝐴 = 1 or 𝑌 ෠ ⊥ 𝐴 | 𝑌 →Model mis-classifies with the same ratio across groups identified via A

When is this a good idea? →Often used in criminal justice or lending, where fairness in error rates is critical. When is this a bad idea? →When you suspect the original label Y you are training on is itself biased. E.g., suppose loan approvals in historical data were biased against a certain group. If you enforce separation, you’ll try to match error rates based on those biased approvals, then optimizing for separation will bake that bias into the model.

Type 3: Sufficiency “A model satisfies sufficiency if the actual outcome is conditionally independent of the sensitive attribute given the prediction.” 𝑃 𝑌 = 1 𝑌 ෠ = 𝑦, 𝐴 = 0 = 𝑃 𝑌 = 1 𝑌 ෠ = 𝑦, 𝐴 = 1 or 𝑌 ⊥ 𝐴 | ෡ 𝑌 → Regardless of the group, the signal has an equal chance of being correct

When is this a good idea? →When the predicted probability should be equally informative across groups (e.g., credit scoring, insurance pricing) When is this a bad idea? →When incorrect predictions lead to severe consequences (e.g., criminal justice system, healthcare) Optimizing sufficiency does not control error rates like false positives or false negatives.

Fairness impossibility theorem The three criteria often cannot all be satisfied simultaneously when base rates differ across groups. Choosing which criterion to prioritize depends on the context and values of the stakeholders.

How would you employ this at a bank

  1. Choose appropriate fairness type to optimize Based on the type of model, how the model will be deployed, and the risk appetite of stakeholders

  2. Pick a bias metric that corresponds to this fairness type

  3. Compute the chosen metric 𝑩 for different protected groups

  4. If the difference between groups is significant, report and mitigate For any two groups 𝑖 and 𝑗, if 𝐵𝑖 − 𝐵𝑗 > 𝑡, where 𝑡 is a chosen threshold, report and mitigate

  5. Apply mitigation techniques For example: • Incorporate bias metric loss function • Resample underrepresented groups • Incentivize getting more data from certain groups • Apply group-specific thresholds