AML Detection with Graph Neural Networks

What is Money Laundering Detection?

Anti-money laundering (AML) systems detect transactions that integrate illegally obtained funds into the legitimate financial system. Banks file 2M+ Suspicious Activity Reports (SARs) annually with FinCEN, with the average investigation costing 8 billion, driven by increasing regulatory penalties ($2.2B in fines in 2023 alone).

Traditional AML systems rely on rule-based approaches: flag transactions over $10,000 (CTR threshold), detect rapid movement between accounts, and screen against watchlists. These rules generate millions of false positives (95–99% of alerts are false) while missing sophisticated laundering schemes that operate below thresholds. The fundamental limitation is that rules examine transactions in isolation, missing network-level patterns.

Graph neural networks (GNNs) represent a paradigm shift by analyzing the transaction network as a whole. Money laundering creates characteristic graph structures: layering generates long chains of accounts, structuring creates star patterns (many small transactions to a central account), and circular flows create loops. GNNs learn to identify these structural patterns from labeled examples, achieving 30–50% fewer false positives than rule-based systems.

Mathematical Foundation

GraphSAGE Aggregation:

Where:

• — node embedding at layer
• — neighbors of node
• AGG — aggregation function (mean/max/LSTM)
• Intuition: Each node aggregates information from neighbors, learning structural context

AML Alert Score:

Where:

• — model weights (sum to 1)
• Intuition: Combine transaction, network, and rule-based signals

Model Architecture

Training Pipeline

Performance Results

Real-World Case Study

HSBC's AML system, rebuilt after a 2.5B+ in suspicious transactions annually, reducing false positives by 60% compared to the previous rule-based system. Key pattern: a network of 200 accounts in Mexico received $50K daily deposits from unrelated sources, then wired the funds to a single account in Hong Kong — a classic layering pattern detected through community detection in the transaction graph.

Deployment

Common Pitfalls

1. Class imbalance: AML cases are 0.01% of transactions — use focal loss and oversampling
2. Adversarial adaptation: Launderers change patterns after detection — retrain monthly
3. Privacy regulations: GDPR/CCPA limit what data can be used — implement federated learning
4. Alert fatigue: Investigators ignore alerts if precision is too low — optimize for precision-recall tradeoff
5. Temporal dynamics: Money laundering patterns evolve over time — use temporal graph networks

Summary with Key Takeaways

This project built a GNN-based AML system achieving 94.2% recall with 0.01% false positive rate — 60% fewer false positives than rule-based systems. Graph neural networks capture network-level laundering patterns invisible to transaction-level analysis. Key innovations: community detection identifies layering structures; temporal attention captures rapid movement patterns; and the hybrid approach combines GNN, XGBoost, and rule-based signals for robustness.