Network analytics for anti-money laundering

A bank normally holds identity, ownership, account and payment information in different operational systems. Network analytics combines selected records into a relationship model where each edge states what joins two nodes, when the relationship existed and which source supplied the evidence. The INFORMS systematic review of ninety-seven studies groups AML network work around customer classification, transaction classification, community detection and movement-of-funds chains.

The relationship model should preserve direction, time, amount and provenance instead of drawing undifferentiated lines between names. A payment from account A to account B is different from common ownership, a shared address or a probabilistic identity match. Those distinctions let an investigator test a typology and later explain which evidence supported the path under review.

Entity resolution decides whether records from separate systems describe the same person, company, account or device. Exact identifiers can support deterministic matches, while names, addresses and telephone numbers require normalization, conflict rules and confidence thresholds. Perpetual KYC shows how governed identity and risk updates can keep customer records current before network analysis begins.

Every inferred edge should carry its source, matching rule, confidence and review status. A shared postal address may describe a household, serviced office or outdated record, so that edge cannot carry the same weight as verified common ownership. Investigators need the underlying fields beside every visual connection because an attractive network diagram can conceal weak identity assumptions.

The graph schema should begin with the investigation question and the institution's available evidence. Useful node types often include customers, legal entities, accounts, beneficial owners and external counterparties, while edges describe payments, ownership, authority or shared identifiers. Each institution should document which node and edge types are authoritative, derived or provisional before analysts use them.

Temporal modeling matters because ownership, addresses and account status change during a relationship. A current company director cannot automatically explain a payment made before that appointment, and a closed account should remain visible within its historical period. Versioned edges prevent present-day data from rewriting the facts that an earlier alert or decision actually used.

Graph queries can find circular flows, many-to-one collections, rapid dispersal, repeated pass-through chains and clusters sharing identifiers. Community detection can identify groups with denser internal relationships, while pathfinding can trace movement between an initial subject and a known high-risk entity. A pattern begins an inquiry and never establishes unlawful conduct by itself.

Network analytics is an evidence and investigation layer, while transaction monitoring in AML covers scenarios, thresholds, alert triage and reporting decisions. The network layer can enrich a monitoring alert with connected parties or expose a broader case spanning several alerts, but the institution still applies its established escalation and reporting responsibilities.

An investigator starts from a defined seed, such as a customer, account, payment or verified external identifier. The investigator expands only across allowed relationship types and depth limits, reviews the strongest paths first and checks source records before treating inferred connections as case evidence. Search parameters, excluded edges and analyst decisions belong in the case record.

The Hong Kong Monetary Authority adoption report describes banks using small seed networks, shared attributes and external information during investigations. Those examples support a controlled workflow, although their reported outcomes are institution-specific observations and do not predict results for another bank, dataset or jurisdiction.

Validation must test the complete decision process, including entity resolution, graph construction, pattern detection and analyst interpretation. Historical labels are sparse because confirmed laundering cases are rare and reporting decisions reflect earlier controls. Randomly splitting one transaction network can also leak related entities across training and test samples, which makes performance appear stronger than deployment performance.

Precision and recall describe different operational costs, while area under the precision-recall curve is usually more informative than accuracy for rare positive cases. The INFORMS review also warns that synthetic data can make graph methods look unrealistically successful. Model validation in banking covers independent challenge, benchmark models and ongoing monitoring after production release.

Graph projects need named owners for source data, matching logic, graph features and case outcomes. Access controls should follow investigative duties because a relationship view can combine information that separate systems previously exposed to different teams. Retention rules, correction procedures and lineage records must cover derived edges as well as original customer and payment records.

The FATF work on digital AML transformation recognizes the potential of collaborative analytics while requiring compliance with privacy and data-protection law. Under Article 90 of Regulation (EU) 2024/1624, the regulation generally applies from 10 July 2027, while current national requirements remain relevant until then.

A useful pilot selects one typology, a limited population and a dataset whose ownership is already understood. The team records a baseline for investigative time, confirmed relationship yield and unresolved data defects before introducing graph analysis. Acceptance criteria should include evidence quality, reproducibility, analyst usability and the number of important cases found only after network expansion.

The HKMA report recommends a small initial scope, tangible success measures and cooperation among financial-crime specialists and technology staff. A pilot should also sample apparently quiet networks, because measuring only generated leads cannot reveal missed risk. Production approval needs a rollback plan, defined monitoring thresholds and a route for analysts to dispute incorrect links.

Network analytics cannot recover relationships that source systems never captured, and incomplete counterparty data creates artificial network boundaries. False identity matches can spread risk across unrelated customers, while missed matches can divide one network into harmless-looking fragments. Criminal behavior also changes after controls become predictable, so stable historical results do not guarantee continuing detection.

Graph neural networks add another layer of dependency because outputs reflect topology, feature engineering and the available labels. AI for anti-money laundering covers model scoring and human oversight in greater detail. Many institutions can begin with explainable queries and graph features before considering a learned model that requires broader validation.

Network analytics normally adds relationship context to existing customer and transaction controls without replacing their legal or operational functions. Monitoring can supply the initial alert, while network analysis extends the review across relevant entities and records the evidence supporting that expansion.

A graph database is useful for repeated multi-hop queries, but an institution can test a limited case with governed relational extracts and visualization tools. The decision depends on query complexity, update frequency, data volume, integration requirements and the audit trail required for investigations.

A pilot should track evidence quality, confirmed relationship yield, analyst review time, reproducibility and missed-case sampling alongside model metrics. No single alert reduction or accuracy figure proves effectiveness because the institution must also understand false negatives and downstream investigative decisions.