Network Analysis for AML Investigations

From transactions to graphs

Each transfer is an edge (sender → receiver, amount, timestamp). Aggregated over time the graph exposes structure no single account review shows: mule clusters, layering chains, and common beneficiaries across unrelated account holders. The shift in perspective is the point: transaction monitoring optimised per account cannot see patterns that only exist across accounts — a layering chain is invisible inside any single customer's transaction history.

Techniques that matter

• Entity resolution — dedupe identifiers (names, addresses, devices) before graph construction.
• Community detection — label-propagation / Louvain find tightly-knit groups consistent with money mules.
• Centrality + motif counts — high betweenness accounts that fan out funds quickly are classic layering signatures.

Entity resolution quality gates everything downstream: two accounts that share a phone number are one entity for graph purposes, and failing to resolve them hides the very links the analysis is meant to find. Motif counts — directed patterns like fan-in, fan-out, and cycles — are the most interpretable features and translate directly into typology language investigators already use.

Operationalise with risk scoring

Convert graph features (community density, path lengths to flagged accounts, fan-out ratio) into numeric scores consumed by the transaction-monitoring engine, then route to investigation worklists. Re-score periodically: graphs drift as new accounts join and typologies evolve. Graph scores should augment, not replace, rule-based alerts: pair a graph anomaly with a narrative that names the accounts and links involved, or investigators will treat the alert as an unexplained curiosity.

Scale and privacy constraints

• Compute at ingestion with bounded windows — full-graph recompute does not scale; incremental updates do.
• Anchor visualisation on suspected clusters, not the whole network, to keep investigations tractable.
• Handle personal data minimisation early — graph analytics compound identifiers, and retention rules must cover derived graph artefacts.

References

• FATF — Operational Issues: Financial Investigations Guidance(regulatory)
• Weber et al., Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks(academic)
• NetworkX Documentation — Community Structure Detection(official docs)