Detecting the Undetectable: Advanced Techniques in Suspicious Transaction Monitoring

In the ever-evolving financial services landscape, the importance of robust security measures cannot be overstated. Among these, suspicious transaction monitoring (STM) is one of the most critical tools for banks to detect and prevent fraudulent activities. Rooted in the Bank Secrecy Act (BSA) and reinforced by the Anti-Money Laundering Act of 2020, STM is essential for identifying and mitigating risks associated with money laundering and the financing of terrorism.  

The BSA is a series of laws and regulations enacted in the United States to combat money laundering and the financing of terrorism. It provides a foundation to detect those who seek to misuse the U.S. financial system to launder criminal proceeds, finance terrorist acts, or move funds for other illicit purposes. The Anti-Money Laundering Act of 2020 requires financial institutions to have reasonably designed risk-based programs to prevent money laundering and the financing of terrorism. In the recent past, several banks have been fined by their primary regulator for the failure to effectively deploy the required risk identification and prevention programs. These fines from regulators can run into the billions of dollars.¹ 

Every banking transaction has two counterparties, and it’s imperative for banks to determine the ultimate “beneficial ownership” of the customer account receiving or authorizing the disbursement of funds. Banks need to identify the risk that a customer may be authorizing the movement of funds for illicit purposes and monitor any changes in customer status, including beneficial ownership information. 

The role of machine learning in modern STM

A core analytical capability for banks is to determine whether any given banking transaction is suspicious, which often relies on identifying transaction behavior that is “out of pattern” for a customer. Dimensions of the transaction that require evaluation to identify anomalous behavior include timing (such as day of the week and calendar date), dollar amount, and, most importantly, the counterparty to the transaction, especially regarding the location of the payee and nature of its business. 

A closely related risk mitigation activity is the identification of suspicious transactions that are fraudulent, where the transfer of funds was not authorized by the customer. Payment fraud can come in many flavors but the most common is account takeover, where the account credentials have been appropriated by a malefactor. 

The ability of banks to detect suspicious transactions relies on sophisticated models that identify when a transaction is inconsistent with the transaction behavior of a customer. The models deployed are usually “decision tree based” models such as Random Forests or support vector machines, both of which are available in ClearScape Analytics™. 

Next-generation models: From decision trees to recurrent neural networks 

Traditional machine learning models rely on supervised learning, in which the system learns from labeled data. The success of large self-supervised generative models, such as ChatGPT, have proven effective in language processing, and this approach can now be applied to complex financial transactions. A next-generation, self-supervised learning model that leverages a recurrent neural network to identify suspicious transactions was developed by a subsidiary of Mastercard and is called “next event prediction past reconstruction”, or NPPR. The NPPR model has two components: 

1. Next event prediction: The system takes each customer’s network of transactions, converts them into machine-readable embeddings (the encoder), and uses the embeddings to predict the next transaction in the sequence (the decoder)
2. Past reconstruction: The encoder is extended to incorporate long-term behavioral sequences for the customer and thereby enhance the ability of the model to predict future transactions 

There is compelling evidence that applications of recurrent neural networks, such as the NPPR methodology, can be more effective than traditional methods of multiple classification and regression tasks in identifying suspicious transactions that are fraudulent.² 
 
The ability to identify suspicious transactions at scale with low latency is imperative for the regulatory and fraud risk practices of banks worldwide. A critical capability for banks is to harvest all the relevant transaction data available from customers to develop and deploy next-generation predictive models—a capability facilitated by ClearScape Analytics and exposure to open-source large language models via Bring Your Own LLM.  

1. Reuters, “US regulators impose penalties to resolve money laundering probes”, 2024, https://www.reuters.com/business/finance/us-regulators-impose-penalties-resolve-money-laundering-probes-2024-10-10/.  
2. Piotr Solski, et al. “Towards a Foundation Purchasing Model: Pretrained Generative Autoregression on Transaction Sequences,” FeatureSpace, 2023.