AML Detection with Graph Neural Networks

What is Money Laundering Detection?

Anti-money laundering (AML) systems detect transactions that integrate illegally obtained funds into the legitimate financial system. Banks file 2M+ Suspicious Activity Reports (SARs) annually with FinCEN, with the average investigation costing 8 billion, driven by increasing regulatory penalties ($2.2B in fines in 2023 alone).

Traditional AML systems rely on rule-based approaches: flag transactions over $10,000 (CTR threshold), detect rapid movement between accounts, and screen against watchlists. These rules generate millions of false positives (95–99% of alerts are false) while missing sophisticated laundering schemes that operate below thresholds. The fundamental limitation is that rules examine transactions in isolation, missing network-level patterns.

Graph neural networks (GNNs) represent a paradigm shift by analyzing the transaction network as a whole. Money laundering creates characteristic graph structures: layering generates long chains of accounts, structuring creates star patterns (many small transactions to a central account), and circular flows create loops. GNNs learn to identify these structural patterns from labeled examples, achieving 30–50% fewer false positives than rule-based systems.

Mathematical Foundation

GraphSAGE Aggregation:

Where:

• — node embedding at layer
• — neighbors of node
• AGG — aggregation function (mean/max/LSTM)
• Intuition: Each node aggregates information from neighbors, learning structural context

AML Alert Score:

Where:

• — model weights (sum to 1)
• Intuition: Combine transaction, network, and rule-based signals

Model Architecture

# models/graph_aml.py
import torch
import torch.nn as nn
import torch.nn.functional as F

class GraphSAGELayer(nn.Module):
    def __init__(self, in_dim: int, out_dim: int):
        super().__init__()
        self.linear = nn.Linear(in_dim * 2, out_dim)

    def forward(self, x_self, x_neighbors):
        agg = x_neighbors.mean(dim=1)
        combined = torch.cat([x_self, agg], dim=-1)
        return F.relu(self.linear(combined))

class AMLGNN(nn.Module):
    def __init__(self, node_dim: int, hidden_dim: int = 128, num_layers: int = 3):
        super().__init__()
        self.layers = nn.ModuleList()
        self.layers.append(GraphSAGELayer(node_dim, hidden_dim))
        for _ in range(num_layers - 1):
            self.layers.append(GraphSAGELayer(hidden_dim, hidden_dim))
        self.classifier = nn.Sequential(
            nn.Linear(hidden_dim, 64),
            nn.ReLU(),
            nn.Dropout(0.3),
            nn.Linear(64, 1),
            nn.Sigmoid(),
        )

    def forward(self, x_self, neighbor_feats):
        h = x_self
        for layer in self.layers:
            h = layer(h, neighbor_feats)
        return self.classifier(h)

Training Pipeline

# training/trainer.py
import torch
import torch.nn as nn
from torch_geometric.nn import SAGEConv

class AMLTrainer:
    def __init__(self, model, lr=1e-3, pos_weight=50.0):
        self.model = model
        self.criterion = nn.BCELoss(
            weight=torch.tensor([pos_weight])
        )
        self.optimizer = torch.optim.Adam(model.parameters(), lr=lr)

    def train_epoch(self, loader):
        self.model.train()
        total_loss = 0
        for batch in loader:
            pred = self.model(batch.x, batch.edge_index)
            loss = self.criterion(pred, batch.y)
            self.optimizer.zero_grad()
            loss.backward()
            self.optimizer.step()
            total_loss += loss.item()
        return total_loss / len(loader)

Performance Results

Real-World Case Study

HSBC's AML system, rebuilt after a 2.5B+ in suspicious transactions annually, reducing false positives by 60% compared to the previous rule-based system. Key pattern: a network of 200 accounts in Mexico received $50K daily deposits from unrelated sources, then wired the funds to a single account in Hong Kong — a classic layering pattern detected through community detection in the transaction graph.

Deployment

# main.py
import torch
from models.graph_aml import AMLGNN
from data.graph_builder import TransactionGraphBuilder

model = AMLGNN(node_dim=64)
model.load_state_dict(torch.load("aml_gnn.pt"))

builder = TransactionGraphBuilder()
graph = builder.build_graph(recent_transactions)

with torch.no_grad():
    risk_scores = model(graph.node_features, graph.neighbor_features)

suspicious = torch.where(risk_scores > 0.7)[0]
print(f"Flagged {len(suspicious)} accounts for review")

Common Pitfalls

1. Class imbalance: AML cases are 0.01% of transactions — use focal loss and oversampling
2. Adversarial adaptation: Launderers change patterns after detection — retrain monthly
3. Privacy regulations: GDPR/CCPA limit what data can be used — implement federated learning
4. Alert fatigue: Investigators ignore alerts if precision is too low — optimize for precision-recall tradeoff
5. Temporal dynamics: Money laundering patterns evolve over time — use temporal graph networks

Interview Questions

Answer: Money laundering creates characteristic network structures — layering generates long chains of accounts, structuring creates star patterns, and circular flows create loops. Transaction-level models like XGBoost examine each transaction in isolation, missing these multi-hop patterns. GNNs aggregate information from neighboring nodes through message passing (GraphSAGE aggregation: h_v = σ(W · CONCAT(h_v, AGG({h_u : u ∈ N(v)}))), learning structural embeddings that capture network topology. The file shows GNN achieving 94.2% recall with 0.01% FPR versus XGBoost's 88.5% recall with 0.05% FPR — the GNN catches laundering patterns that transaction-level features simply cannot represent.

Answer: (1) Structuring (smurfing): many small transactions from unrelated sources to a central account — detected via star-pattern community detection in the transaction graph; (2) Layering: funds moved through multiple accounts to obscure origin — detected via long path analysis and temporal attention patterns in the GNN; (3) Circular flows: money returned to origin through intermediary accounts — detected via cycle detection algorithms. The HSBC case study illustrates layering: 200 accounts receiving $50K daily deposits from unrelated sources, then wiring to a single Hong Kong account. Community detection algorithms identify this cluster, while the GNN learns to score the structural risk.

Answer: AML precision is inherently low because money laundering is extremely rare (0.01% of transactions) and highly sophisticated. Even with 12.8% precision, the GNN is a massive improvement over rule-based systems (2.1% precision). The cost structure matters: each alert costs 100K (rule-based), and the GNN catches 94.2% of actual laundering versus 65%. Banks file 2M+ SARs annually — the goal is minimizing false positives while maintaining high recall to meet regulatory requirements (FinCEN mandates reporting). The 0.01% FPR means only 1 in 10,000 legitimate transactions is flagged, preventing alert fatigue.

Quiz