Anti-money laundering technology must operate in a collaborative ecosystem

How algorithms and AI technology improve detection

According to Charles Delingpole, CEO of AML automation firm Comply Advantage, the industry has traditionally used researchers to deal with money laundering, but given the sheer scale of the economic activity they were monitoring, it was a very time-consuming process and labour-intensive process.

He adds that the use of AI and algorithms in money laundering detection now allows investigators to “surface the needle in the haystack” and sift out the false-positives at a much quicker rate.

This is largely due to its ability to discover patterns of behaviour and find real-world links between different entities, whether they are people or a business, in the global economy that the human eye would struggle to find.

Delingpole says the key is modelling data in such a way that it more closely reflects reality rather than consumption, something Comply Advantage is currently doing through the construction of its own knowledge graph – a tool which is used to put data in context by mapping the connections and relationships between different points.

“Once you’ve structured [the data] in an effective way, you can mine it for [real-world] patterns…and draw inferences which would otherwise not be possible,” he says.

Vishal Marria, co-founder and CEO of AML software provider Quantexa, which has been supplying banks with this kind of data mapping technology since 2016, adds that the traditional monitoring capabilities of banks are very much rules and transaction-based when it comes to detecting and preventing money laundering, creating an inefficient system for alerting the human investigators.

“Each organisation can have thousands of alerts a day. Each alert could take anything between one to seven hours to investigate, depending on the complexity of the alert, and going down this approach causes anything between 95% to 99% false-positives,” he says. “What ended up happening was that many organisations built ‘process farms’ of humans just going through these alerts.”

Each organisation can have thousands of alerts a day…many organisations built ‘process farms’ of humans just going through these alerts

He says that the process Quantexa uses is known as “entity resolution”, whereby both internal data from the organisations and external data from a variety of other sources is used to understand a real-world entities in context. This allows the software to identify and highlight legitimately suspicious activity similar to the knowledge graph being built by Comply Advantage.

The issue of high false-positive rates was corroborated as a major industry challenge by David Howes, global co-head of financial crime compliance at Standard Chartered.

He tells Computer Weekly that Quantexa has allowed the bank to put context around the transactions it is monitoring since it first started using the firm in 2018, as well as identify hidden risks and relationships it did not know about before.

“If I can now tie this entity and this entity together by the same owner, which I might not have been able to do before, and look at how they’re transacting together or who else they’re transacting with, I can build up a picture of the [money laundering] network… you wouldn’t see [otherwise],” he says, giving the example of a case where authorities in a particularly large market came to the bank with a list of names that they were concerned about.

“What would have taken us manually probably six or seven weeks with some attendant risks to error in identification, we were able to execute literally in a matter of hours using the [Quantexa] platform with much greater confidence on not just the names the authorities have come to us with…but also by looking at the data [to show] some parties that appear to be closely connected to the names [the authorities were] concerned about, which [they] might not know about.”

Alexon Bell, co-founder and chief product officer at Quantexa, adds that the criminal networks that run money laundering operations tend to be quite close-knit groups, meaning that if you can identify one part of that network and pull the string to find connections to it, “then you can understand the extent of an operation”.

Barriers to post-detection action and enforcement

Despite the increasing ease with which banks can sift through incredibly large volumes of data and pick out suspicious activity, not all banks are at points in their digital transformations where they can effectively implement such techniques, and simply detecting it is not the end of the process.

Once identified, banks are obligated to report the suspicious activity to regulators through filing SARs and to help law enforcement investigate the money laundering activity. But banks risk being fined themselves if they either let the activity continue or tip off the suspected launderer, whether intentionally or not.

According to Delingpole, whose company provides automatic SAR filing features within its transaction monitoring system, the failure to report suspicious activity in a timely manner – as highlighted by the FinCEN files and Kyckr’s 2020 AML fines report – often comes down to internal politics or institutional pressure from within or between banks themselves, rather than a lack of technical capability per se.

“It could be that an executive authorised those [suspicious] trades. Technically, there shouldn’t be an issue, so it’s more of a political issue,” says Delingpole. “Money launderers will pay huge amounts of money, 20% of margins…to launder money.”

The internal difficulty with corruption was highlighted to Computer Weekly by Ron Warmington, former global head of banking investigations at Citibank, who says most money laundering schemes have a use-by-date, often around a year if the perpetrators are lucky, before they need find new ways of doing it.

“Frankly, one of the easiest things to do is corrupt or coerce a banker. The trickiest bit of a fraud is getting the money out at the other end, so that’s where you need the corrupt banker, and it’s not that difficult these days,” he says.

Aside from the active role some bankers play in laundering money, Warmington notes that there has also been a “degradation in the abilities and the effectiveness” of investigators within banks.

This sentiment was echoed by Howes, who says a major problem in the AML space is the lack of skilled people in banks to investigate whatever alerts are being generated by the systems in the first place.

“In management terms, where a lot of the money has to go is getting the data and technology right, but downstream from that is skilled people,” he says.

“We’ve invested quite a lot in not just adding people, but training them, accrediting them and then supporting them with tooling, so that I think we’re much better equipped to go through that [investigation] cycle once you’ve got an event.”

Data sharing across jurisdictions and public-private collaboration

Bell adds that while Quantexa’s system allows banks to have earlier visibility of suspicious activity, the client bank will still have to go through their standard investigation and confirmation procedures before it makes a disclosure to the regulator or police. This means going back and forth with other institutions or intermediaries within the correspondent banking system to ensure the information is correct.

However, Bell notes that the highly regulated nature of the banking industry makes it difficult to share data between jurisdictions, hampering investigations and preventing SARs from being filed at a faster rate.

“You still have jurisdictions that don’t allow you to share their data outside of the country, so that means things are not connected together,” he says. “Data is probably the biggest challenge, and that means availability internally with a bank across secrecy jurisdictions that don’t share information, and then also data collection externally.

“There are these silos that have occurred naturally, through secrecy or through poor collection externally, which basically adds friction into that process,” he adds.

This is something that banks have only been seriously addressing within their legacy infrastructure in the past five years or so through the turn to challenger banks or other platforms similar to Quantexa.

Another problem according to multiple AML practitioners is that once SARs are filed, banks rarely hear back from the regulators or police.

“Most times it goes into a black hole and you hear nothing,” says Delingpole. “It depends on what law enforcement want to do with their resources, and whether that’s interesting [to them].”

Most times, SARs goes into a black hole and you hear nothing

According to Marria, the key to overcoming a lack of action against money launderers is building ecosystems designed around closer collaboration between the public and private sectors, and getting all the different parts of the process in line and working together.

“More and more collaboration between the private and the public sector is a must. So, if you look at the great initiatives in the Netherlands, for example, they are now bringing this consortium view, which has the banks working closely with the Dutch regulator around sharing of data between the institutions,” he says, adding that while technology is a key piece of this puzzle, it is not the only aspect.

“If you go back to traditional consulting work, you want to have your people, your process and your technology, and then there’s a new dimension which is data, and you need to have all four working.”

Delingpole adds that the question of data sharing between financial institutions in different jurisdictions is essentially a trade-off between privacy and the prevention of crime, something the Joint Money Laundering Intelligence Taskforce (JMLIT) has been trying to address since its inception in 2015.

“[The taskforce] is a working group between banks, regulators and companies who try to get together to share information. Often, what they’ll do is share typologies or have Interpol come in and speak around country lines, for example, or basically…share some big names,” he says, adding that it will become easier for banks to exchange the information over time as they adopt more modern technologies.

“Most big banks and companies haven’t adopted modern technologies, newer fintechs have… but big banks are still on-premise,” he says, stating that most companies are “only seeing the tip of the [money laundering] iceberg” when they run searches on limited databases and information.

Going forward

For Delingpole, it is key that banks build up their technological capabilities to support further AML innovations in AI and machine learning, but says they need to become comfortable working with external organisations to get there.

“We’re entirely cloud-based, and some of the banks, particularly the big ones, think they can build it all themselves – they can’t,” he says.

“They’re never going to get the resources, it’s always going to be given to revenue-generating, front-end stuff rather than the back-end stuff that’s needed [to support these technologies].

“Public opinion and regulatory pressure will move towards far higher standards, the public won’t tolerate scandal after scandal, and criminals shouldn’t be allowed to exploit the financial system like they are today.”

Howes adds that banks do not operate in a vacuum, and that further action must be taken to strengthen AML ecosystems.

“If there’s an output from the banking sector that’s going to be effective, some of it has to be about law enforcement picking that up and running with it. Banks are banks and they can see data – they don’t have perfect hindsight or foresight, they certainly can’t go around arresting people or confiscating assests,” he says. “There’s a key role for banks to play in the overall chain, but they can’t do it alone.”

On this point, Marria says there also needs to be more investment in information and knowledge-sharing initiatives such as the JMLIT, which will likely have to “come from the centre”, given the emphasis on cost.

“Private and public sector collaboration is a must – you must get the people, process, technology and data strategies all in line and working together,” he says.