The Case for Graphs in AML

Neo4j Innovation Lab
The Case for Graphs in
Anti-Money Laundering
Alessandro Svensson
Head of Neo4j Innovation Lab
A look under the hood when
innovating with graphs
May 28, 2020

Growing
Adoption
76%
FORTUNE 100
have adopted
or are piloting
Neo4jFinance
20 of top 25
7 of top 10
Software
Retail
7 of top 10
Airlines
3 of top 5
Logistics
3 of top 5
Telco
4 of top 5
Hospitality
3 of top 5

Growing
Adoption
76%
FORTUNE 100
have adopted
or are piloting
Neo4j
Finance
20 of top 25
7 of top 10
Software
Retail
7 of top 10
Airlines
3 of top 5
Logistics
3 of top 5
Telco
4 of top 5
Hospitality
3 of top 5

Why do financial services firms care about AML?
Anti-Money Laundering with
Graphs
• Billions of dollars from illegal activity is generated on a yearly
basis – of which substantial amounts attempts to be laundered.

• Financial services firms have to deal with fines, if they’re not in
compliance with regulations.

• Firms risk of suffering severe damage to their brands in the eyes
of the public, when failing to address money laundering issues.

Graphs
Traditional technology is not designed to handle these
connected data problems of:

1. obfuscation

2. payment chains, and

3. structured transaction, in real time or to adapt to
evolving techniques
Why Graphs?
The Money Laundering Scheme
of the Cali Drug Cartel


1. obfuscation


evolving techniques
Why Graphs?
Data represented as in a
relational database
Graphs


1. obfuscation


evolving techniques
Why Graphs?
Graphs
Data represented as a graph

How to innovate successfully
in the in the age of connected
data?

1. Data Capture
2. Data Modeling & Storage
3. Processing & Analytics
4. End user-applications & Insights
Consider these 4 steps:
(Collecting the most relevant data for the use case)
(Choosing the right technology for the right job)
(Queries and Algorithms)
(Tangible, end-results)

1. Data Capture 2. Data Modeling & Storage 3. Processing & Analytics 4. End user-applications & Insights
Because of its connected
nature, money laundering is
a massive data challenge

Branch Locations: Tens of thousands

ATM Locations: Hundreds of Thousands
Locations: Hundreds of millions
Account Sessions: Multipe Billions
Total DB Size: Multi-Terabytes
Customers: Multiple Millions

Business Customers: Tens of thousands
Deposit Accounts : Multiple Millions
Transactions: Multiple Billions
Financial Institutions: Thousands
What are the essential data-
points and behaviors relevant to
your use case to capture?

Disparate Silos
DOCUMENT STORERELATIONAL DB RELATIONAL DB RELATIONAL DB
On Prem Data
Lakes
Data
Warehouse
Cloud
IT infrastructure
Cross-Silo Connections Property Graph Model

Let’s model our AML-graph

Account

Holder

Account

Holder
Phone

Number
HAS_PHONE

Account

Holder
Phone

Number
Email
HAS_PHONE
HAS_EMAIL

Account

Holder
Phone

Number
Email
Tax
Number
HAS_PHONE
HAS_EMAIL
IDENTIFIED_BY
HAS_EIN

Account

Holder
Phone

Number
Device
Email
Tax
Number
HAS_PHONE
HAS_EMAIL
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
Phonetic

Soundex
SOUNDS_LIKE

Account

Holder
Street

Address
Phone

Number
City
Device
Email
Postal

Code
State
Country
Tax
Number
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
IN_CITY
IN_CITY
IN_POSTALCODE
IN_STATE
IN_CO
UNTRY
Phonetic

Soundex
SOUNDS_LIKE

Account

Holder
Street

Address
Phone

Number
City
Device
Email
Deposit
Account
Postal

Code
State
Country
Tax
Number
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
IN_CITY
IN_CITY
IN_POSTALCODE
IN_STATE
IN_CO
UNTRY
Trans-
action
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS
Phonetic

Soundex
SOUNDS_LIKE

Account

Holder
Street

Address
Phone

Number
City
Device
Email
Deposit
Account
Postal

Code
State
Country
Tax
Number
Phonetic

Soundex
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
SOUNDS_LIKE
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
IN_CITY
IN_CITY
IN_POSTALCODE
IN_STATE
IN_CO
UNTRY
Trans-
action
Exposed

Person
WatchList
IS_LISTED_O
N
IS_PEP
HighProﬁle
Person
HAS_HIGHPROFILE
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS

Calendar

Date
Account

Holder
Street

Address
Phone

Number
City
Device
Email
Deposit
Account
Postal

Code
Tax
Number
Phonetic

Soundex
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
SOUNDS_LIKE
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
IN_CITY
IN_CITY
IN_POSTALCODE
IN_STATE
Trans-
action
Exposed

Person
WatchList
IS_LISTED_O
N
IS_PEP
HighProﬁle
Person
HAS_HIGHPROFILE
Account

Proﬁle
PROFILE_ADDRESS
HAS_PROFILE
HAS_PHONE
PRO
FILE_DO
P
PRO
FILE_DATE
SESSION_DATE
TXN_DATE
Calendar

Month
Calendar

Year
Calendar

Quarter
Calendar

Week
IS_M
ONTH_IN
IS_Q
UATER_IN
IS_IN_QUATER
IS_DATE_IN
IS_IN_WEEK
IS_IN_QUATER
PREV_W
EEK
NEXT_DATE
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS

Calendar

Date
Account

Holder
Street

Address
Phone

Number
City
Device
Email
Deposit
Account
Postal

Code
Tax
Number
Phonetic

Soundex
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
SOUNDS_LIKE
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
IN_CITY
IN_CITY
IN_POSTALCODE
IN_STATE
Trans-
action
Exposed

Person
WatchList
IS_LISTED_O
N
IS_PEP
HighProﬁle
Person
HAS_HIGHPROFILE
Account

Proﬁle
PROFILE_ADDRESS
HAS_PROFILE
HAS_PHONE
PRO
FILE_DO
P
PRO
FILE_DATE
SESSION_DATE
TXN_DATE
Calendar

Month
Calendar

Year
Calendar

Quarter
Calendar

Week
IS_M
ONTH_IN
IS_Q
UATER_IN
IS_IN_QUATER
IS_DATE_IN
IS_IN_WEEK
IS_IN_QUATER
PREV_W
EEK
NEXT_DATE
LegalEntity
LEGAL_ADDRESS
IS_LEGAL_ENTITY
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS
HQ_ADDRESS

Calendar

Date
Account

Holder
Street

Address
Phone

Number
Device
Email
Deposit
Account
Tax
Number
Phonetic

Soundex
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
SOUNDS_LIKE
Account

Session
IP

Address
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
Trans-
action
Exposed

Person
WatchList
IS_LISTED_O
N
IS_PEP
HighProﬁle
Person
HAS_HIGHPROFILE
Account

Proﬁle
PROFILE_ADDRESS
HAS_PROFILE
HAS_PHONE
PRO
FILE_DO
P
PRO
FILE_DATE
SESSION_DATE
TXN_DATE
Calendar

Month
Calendar

Year
Calendar

Quarter
Calendar

Week
IS_M
ONTH_IN
IS_Q
UATER_IN
IS_IN_QUATER
IS_DATE_INIS_IN_WEEK
IS_IN_QUATER
PREV_W
EEK
NEXT_DATE
GAL_ENTITY
Employ-

mentHisto-
ry
HAS_EMPLOYMENT_HISTORY
CURRENT_EMPLOYER
S
External

Account
Direct
Payment
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS
RECEIVES
DEBITS
CREDITS
SENDS_W
IRE
SEND_PAYMENT
RECEIVE_PAYMENT
HAS_ACCOUNT
PAYMENT_CREDIT
PAYMENT_DEBIT

Account

Holder
Phone

Number
Device
Email
Deposit
Account
Tax
Number
Phonetic

Soundex
HAS_PHONE
BUSINESS_ADDRESS
CURRENT_RESIDENCE
HAS_EMAIL
HAS_ACCOUNT
USES_DEVICE
IDENTIFIED_BY
HAS_EIN
SOUNDS_LIKE
Account

Session
SESSION_DEVICE
SESSION_IP
ACCOUNT_SESSION
Trans-
action
IS_LISTED_O
N
IS_PEP
HighProﬁle
Person
HAS_HIGHPROFILE
ount

ﬁle
PROFILE_ADDRESS
HAS_PROFILE
HAS_PHONE
ATE
DATE
HAS_EMPLOYMENT_HISTORY
CURRENT
External

Account
Direct
Payment
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS
RECEIVES
DEBITS
CREDITS
SENDS_W
IRE
SEND_PAYMENT
RECEIVE_PAYMENT
HAS_ACCOUNT
GovIssued

ID
PRESENTED
ISSUED_BY
ISSUED_BY
HAS_GOV_ID
PAYMENT_CREDIT
PAYMENT_DEBIT
Employee
ATM
Location
IBAN_Code
ABA_

Routing

Code
Financial

InstitutionBranch

Location
OCCURS_AT
OCCURS_AT
IBAN_ROUTING
ABA_ROUTING
HAS_ROUTING_CODE
HAS_IBAN_CODE
HAS_BRANCH_AT
HAS_ATM_AT
BANK_EMPLOYEE
ACCOUNT_AT
ACCOUNT_ADDRESS
OPERATES_IN

A small subset of
clusters

Query (e.g. Cypher/Python)
You know what you’re looking for and
make a decision in real-time
Local Patterns
Graph Algorithms
You’re learning the overall structure of a
network, updating data, and predicting
Global Computation
Input data

Money Query
Categories
Circular payments, payment
chains pass-thru payments
Layering & Behaviour
Multiple daily transactions
above a threshold
Concentration
Large cash deposits/low
withdrawals
Accumulation
Rapid cash deposits, rapid
movement of funds
Rapid movements
For example wired overseas
to high risk geography
Flagging
Shared personal attributes
Structure

Flagging
Structure
Money Query
Categories

//*****************************************************************
// * AML Query for Fraudulent Accounts - show customers that
// * share personal attributes (e.g. SSN, PhoneNumber, Address)
//*****************************************************************
MATCH path=(cu1:Customer:AccountHolder)
-[:HAS_EMAIL|HAS_PHONE|IDENTIFIED_BY|CURRENT_RESIDENCE|USES_DEVICE]-
>(info)
<-[:HAS_EMAIL|HAS_PHONE|IDENTIFIED_BY|CURRENT_RESIDENCE|USES_DEVICE]-
(cu2:Customer:AccountHolder)
WHERE id(cu1)<>id(cu2)
RETURN path
Structure 1:
Customers who share PII
Account

Holder
Phone

Number
Tax
Number
Email
Street

Address
CURRENT_RESIDENCE
HAS_PHONE
IDENTIFIED_BY
HAS_EMAIL
Cypher Query
Section of the
graph being
traversed
Structure
Money Query
Categories
Flagging

Structure
Money Query
Categories
Flagging
Structure 1:
Results
Graph
List

Money Query
Categories
Flagging
Structure //*****************************************************************
// * AML Query for Fraudulent Accounts - Circular Payments
//*****************************************************************
MATCH p=(ah:AccountHolder)-[:MAKES_PAYMENTS_TO*2..4]->(ah)
RETURN p LIMIT 100
MATCH p=(ah:BusinessCustomer:AccountHolder)-[:MAKES_PAYMENTS_TO*2..4]-
>(ah)
RETURN p LIMIT 100
Layering & Behaviour 1:
Circular payments
(execute one at a time)
Account

Holder
Deposit
Account
HAS_ACCOUNT
ENTITY_RESO…
Trans-
action
External

Account
DEBITS
WITHDRAWALS
DEPOSITS
CREDITS
RECEIVES_W
IRE
DEBITS
CREDITS
SENDS_W
IRE
Simpliﬁed model Model of what could have been

Money Query
Categories
Flagging
Structure
Results ﬁrst query

Results second query
Money Query
Categories
Flagging
Structure

Money Query
Categories
Flagging
Structure
//*****************************************************************
// * AML Query for Cash transactions (Deposits) to separate account,
// * Transfer of combination of Cash Transactions to central (Yth) account,
// * Followed by wire to bank outside US
//*****************************************************************
// Step 1 - Find anyone who made wire transfer to high risk geo (Country's
fraud score higher than 0.6)
WITH date('2019-06-30') as endDate
WITH endDate, endDate-duration({days:90}) as startDate
MATCH p=(ctr:DepositAccount)-[:WITHDRAWALS]-(wt:Wire:Transaction)-
[:RECEIVES_WIRE]-(ext:ExternalAccount)
-[:IBAN_ROUTING]->(iban:IBAN_Code)
<-[:HAS_IBAN_CODE]-(fi:FinancialInstitution)-[:OPERATES_IN]-
>(cty:Country)
WHERE wt.transactionDate >= startDate
AND wt.transactionDate <= endDate
AND cty.fraudScore > 0.6
Flagging 1a:
Cash deposits → central account wired overseas

//*****************************************************************
// * AML Query for Cash transactions (Deposits) to separate account,
// * Transfer of combination of Cash Transactions to central (Yth)
account,
// * Followed by wire to bank outside US
//*****************************************************************
// Step 2 - find the accounts that had cash deposits that transferred to
the account that did the wire transfer
WITH ctr, wt, ext, iban, fi, cty
MATCH g=(cu:AccountHolder)-[:HAS_ACCOUNT]->(src:DepositAccount)-
[:WITHDRAWALS]->(srcTxn:ACH:Transaction)
-[:INTERNAL_XFER]->(ctrTxn:ACH:Transaction)-[:DEPOSITS]->(ctr)<-
[:HAS_ACCOUNT]-(cu2),
(ctr)-[:WITHDRAWALS]-(wt)-[:RECEIVES_WIRE]-(ext)-[:IBAN_ROUTING]->(iban)
<-[:HAS_IBAN_CODE]-(fi)-[:OPERATES_IN]->(cty),
(extName:External:AccountHolder)-[:HAS_ACCOUNT]->(ext)
WHERE srcTxn.transactionDate <= wt.transactionDate
AND duration.inDays(srcTxn.transactionDate, wt.transactionDate).days<30
RETURN cu.accountName, src.accountNumber, srcTxn.amount,
srcTxn.transactionDate,
ctr.accountNumber, cu2.accountName, wt.amount, wt.transactionDate,
ext.accountNumber, extName.accountName, fi.bankName, cty.countryName
ORDER by ctr.accountNumber, src.accountNumber
Flagging 1b:
Cash deposits → central account wired overseas
Flagging
Structure
Money Query
Categories

Flagging 1:
Results
List of ﬂags
Flagging
Structure
Money Query
Categories

Flagging
Structure
Money Query
Categories
Keymaker

Analytics Pipeline
Keymaker

Flagging
Structure
Money Query
Categories
Keymaker

Analytics Pipeline
1. Data Capture 2. Data Model & Storage 3. Processing & Analytics 4. Applications & Insights
Keymaker

Graph Algorithms
You’re learning the overall structure of a
network, updating data, and predicting
Query (e.g. Cypher/Python)
You know what you’re looking for and
make a decision in real-time
Local Patterns Global Computation

Detecting Money Laundering Behavior
Graph Algorithms
Enable reasoning about network structure

Connected components
Identify disjointed group sharing identifiers
Graph Algorithms

PageRank
Measure influence and transaction volumes
Graph Algorithms

PageRank
Louvain
iIdentify communities that frequently interact
Graph Algorithms

PageRank
Louvain
Jaccard
Measure account similarity
Graph Algorithms

Graph Algorithms
Louvain
Jaccard
PageRank

Louvain
Jaccard
PageRank
Graph Algorithms

The Neo4j Graph
Data Science
Algorithms Library
50+ algorithms
www.neo4j.com/graph-data-science-library

Under the
hood
Applications
Executives
(Dashboard)
Analysts
(Visualization)
Data-scientist
(Patterns)
INPUT DATA
+
Analytics Pipeline
+
AI/ML-pipeline

Under the
hood
Applications
INPUT DATA
+ +
Analytics Pipeline
(AI/ML-pipelines)
It’s what happens under the hood that determine
the potential of your applications.
If you have a connected data problem
— make sure to solve it with graphs!

…the negative impact money laundering has on
financial services firms — especially when they’re not
in compliance with regulations.

…that AML is all about transaction patterns, making it
a very strong use case for graphs — and we showed
an example of how to model such a graph.

…graph computations offers a mix between querying
local patterns and understanding network behaviors
through Graph Algorithms.
Today we covered…

If you want to learn more
Applied Use Case Training

1. Data Capture 2. Data Model & Storage 3. Processing & Analytics 4. Applications & Insights
Micro
Batches
Micro
Batches
Real-Time
Transactions
Graph
Algorithm
Feedback
Cypher
Workbench
Modeling & Code Gen
Hop
ETL
Apache Kafka
Event Streams
GRAND Stack
Dashboard
Bloom &
Linkurious
Graph Visualizations
Neo4j BI
Connector
SQL BI Tools
Neo4j Browser
SQL BI Tools
DBC HDFS
ETL CSV JSON
Neo4j Graph
Database
Graph Data
Science Library
Cypher
Keymaker
Analytics Pipelines
Micro
Batches
Micro
Batches
Real-Time
Transactions
Graph
Algorithm
Feedback
Cypher
Workbench
Modeling & Code Gen
Hop
ETL
Apache Kafka
Event Streams
GRAND Stack
Dashboard
Bloom &
Linkurious
Neo4j BI
Connector
SQL BI Tools
Neo4j Browser
SQL BI Tools
DBC HDFS
ETL CSV JSON
Neo4j Graph
Database
Graph Data
Science Library
Cypher
Keymaker
Analytics Pipelines
Neo4j AML Solutions
Framework

1. Data Capture
2. Data Model & Storage
3. Processing & Analytics
4. Applications & Insights
Micro
Batches
Micro
Batches
Real-Time
Transactions
Graph
Algorithm
Feedback
Cypher
Workbench
Modeling & Code Gen
Hop
ETL
Apache Kafka
Event Streams
GRAND Stack
Dashboard
Bloom &
Linkurious
Neo4j BI
Connector
SQL BI Tools
Neo4j Browser
SQL BI Tools
DBC HDFS
ETL CSV JSON
Neo4j Graph
Database
Graph Data
Science Library
Cypher
Keymaker
Analytics Pipelines
Neo4j AML Solutions
Framework

Keymaker
Analytics Pipelines
Cypher
Workbench
Modeling & Code Gen
Hop
ETL
Apache Kafka
Event Streams
Neo4j Graph
Database
Graph Data
Science Library
Cypher
GRAND Stack
Dashboard
Bloom &
Linkurious
Neo4j BI
Connector
SQL BI Tools
Neo4j Browser
SQL BI Tools
The Property
Graph Model
The Case for
Graphs in AML
Curriculum
Module
The Case for Graphs in AML
Module
Graphs in Practice
Module
AML Solutions Framework

Curriculum
Module
The Case for Graphs in AML
Module
Graphs in Practice
Module
AML Solutions Framework
• The Case for Graphs in
AML or Fraud Detections

• Property Graph Model

• Money Queries

• Modeling
• Data Loading
Techniques

• Cypher

• Graph Algorithms
• AML Solutions
Framework

• Keymaker

• Application building
examples

Learn graphs in the context of a use case
Enterprise developer-teams at large/midsize organizations
Fast, and inexpensive, way to learn how to apply graphs from
best practice in preparation for a more robust POC.
About the program
What?
Who should participate?
Why?
Three days, remote & instructor lead curriculum
combined with self-paced assessments and exercises.
How?

Please feel free to reach out to me
for more information!
alessandro.svensson@neo4j.com
Alessandro Svensson, Neo4j

Ebook:
The Graph Technology War
Against Money Laundering
The Neo4j AML Framework
Darryl Salas, Northeast Managing Director, Neo4j

Thank you for listening! !
alessandro.svensson@neo4j.com
Alessandro Svensson, Neo4j

The Case for Graphs in AML

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to The Case for Graphs in AML

Similar to The Case for Graphs in AML (20)

More from Neo4j

More from Neo4j (20)

Recently uploaded

Recently uploaded (20)

The Case for Graphs in AML