Artificial intelligence: Reducing the AML Compliance Burden

Artificial intelligence: Reducing the AML Compliance Burden

How did we get here?

Since 9/11 financial institutions have made enormous investments in their anti-money laundering compliance programmes, but they are still faced with manual processes and complexities in complying with financial crime regulations. “One would be hard-pressed to suggest that banks are ignoring the need for better customer due diligence,” KPMG reported in March 2019. “Indeed, according to a recent Forbes article, some banks spend up to US$ 500 million each year in an effort to improve and manage their KYC and AML processes. The average bank spends around US$ 48 million per year. In the US alone, banks are spending more than US$25 billion a year on AML compliance.”

Much of the growth in costs is driven on the one hand by fear of fines for non-compliance (US$24 billion in non-compliance fines since 2008, but the cost to reputation can be higher) on the one hand and, on the other hand, by the need to address the high false-positive rates resulting in significant remediation efforts that rules-based systems generate.

Even though, financial institutions are the ones being fined they are by no means in this alone. There is an ecosystem of consultants, research companies, software vendors who also need to be held accountable to their clients.     

The reality is that few of the first generation AML systems were built to fight crime! These systems were mostly the by-product of business intelligence (BI) software products (as opposed to AML or financial crime solutions) that were originally created to provide insights into corporations’ past performance. Many of these systems are programmed using code that dates back to the eighties!  

After 9/11, many vendors seized the opportunity to position their BI software as AML compliance solutions. Consequently, financial institutions find themselves combatting sophisticated fraud, money laundering, and terrorist financing schemes with outdated BI software using code that dates back to the eighties!  

This is analogous to competing in this year’s Formula One driving Jackie Stewart’s Tyrrell or Alain Prost’s Renault.

No wonder, the expectations of many financial institutions’ compliance departments haven’t been met. With an exceptionally high rates of false positives, i.e. somewhere between 75 and 90 percent of alerts. In fact, many financial institutions’ compliance programs have continuously felt under-resourced compared to the volume of alerts and reports they must review while trying not to disrupt good business. Thus, financial institutions felt compelled at least those that could afford to do so built offshore entities taking advantage of lower labour costs to maintain their systems and manage their KYC alerts.

With all the attention on false positives, false negatives have a much better chance of slipping through the workflow. 

The risk-based approach was supposed to help financial institutions to get a grip on the high-rate of false positives by profiling customers and segmenting them based on their risk exposure. However, clustering customers into segments/categories based merely on products, channels, transactions, geographies, and industries and then building generic rules with arbitrarily selected thresholds was a simplistic approach, to say the least, and somewhat naïve from regulators.

Moreover, all this is happening at a time when legislation has made it easier for customers to swap from one financial institution to another. Rather than risk annoying good customers by constantly asking intrusive questions as a result of false alerts, banks have often further refined the number of segments … to the point that they become unmanageable.

The light at the end of the AML tunnel

Everyone in the AML ecosystem has come to realize that a better approach is needed, especially when it comes to verifying false positives. Basically, the whole industry is banking (pun intended) on big data, artificial intelligence (AI) and machine learning (ML) to help simplify complex processes and automate repetitive tasks. Therefore, the expectations for AI are overwhelmingly high according to PriceWaterhouse Coopers estimates, the contribution of AI to the gross world product by 2030 to be around 14 billion euros.

AI has the potential to remove the chains from AML compliance staff allowing them more time to deal with non-routine events and complex cases as well as having better information through a cleaner, more traceable process to make objective decisions.

Of course, machine learning models can process tremendous amounts of data, but ML systems still need to learn the difference between a false positive and a false negative and that in real-time. But there are challenges that need to be sorted out.

As with every new technology wave: CRM, business intelligence, big data, predictive analytics, or artificial intelligence, etc. technology companies can’t resist the temptation to sprinkle the latest buzzwords on every bit of their software like fairy dust. This gold-rush atmosphere also has its downsides. In March the Financial Times reported that 40 percent of European AI start-ups do not actually use AI programs in their products, according to an investigation by the investment company MMC Ventures.

First, there simply isn’t enough well-structured data at most companies that can be used for teaching these ML / AI models. IBM’s Watson, named after the company’s first CEO, has learned this the hard way. Originally developed to answer questions using natural language processing (NLP), and then as a system to assist in the diagnosis of cancer, as of June 2017, the Watson artificial intelligence platform had been trained on six types of cancers which took years and input from a thousand medical doctors. 

A second, challenge is that criminals are always adjusting and trying new schemas and a third is that the financial services landscape is itself changing continuously, leaving ML and AI platforms with a real-time knowledge gap.

So, caveat emptor: these systems require months and in many cases years of laborious training, and a lot of support by expensive compliance experts and data scientists. The experts must feed vast quantities of well-structured data into the platform for it to be able to draw meaningful conclusions, and these conclusions are only based upon the data that it has been trained on, i.e. what happened in the past. An implementation project will involve:

  • Learning the transaction behaviour of similar customers 
  • Pinpointing customers with similar transactions behaviour
  • Discovering the transaction activity of customers with similar traits (business type, geographic location, age, etc.)
  • Identifying outlier transactions and outlier customers
  • Learning money laundering, fraud, and terrorist financing typologies and identify typology-specific risks
  • Dynamically learning correlations between the alerts that produced verified suspicious activity reports and those that generated false positives
  • Continuously analysing false-positive alerts and learning common predictors

For the most part, financial crime will be driven by advances in technology and this marriage of regulation and technology is not new in itself. However, with the continual increase in regulatory expectations, the staggering levels of cyber-attacks against financial institutions and the disruption of new instant payment initiatives will not make it easier on people working in compliance. 

In brief, these innovations address many gaps in today’s financial crime programmes by improving automation in the detection of suspicious activity, which would be a significant move from monitoring to preventing financial crime while being more cost-effective and agile. Financial institutions that have already been down this path before and have been disappointed would be wise to start with small-scale pilot projects with limited scope, using agile software delivery methodologies.

And above all, they need to invest in data quality as it is a key component of any successful financial crime program. High-quality data leads to better analytics and insights that are so important not only for accurately training ML and AI models, but also to drive better decisions.

Paul Allen Hamilton

Visit us at: AML Knowledge Centre (LinkedIn) 

Panel Discussion – Blockchain & KYC Hype to Real Applications

Panel Discussion – Blockchain & KYC Hype to Real Applications

It was a pleasure for me discussing – Blockchain & KYC Hype to Real Applications – with the other panel experts: Roman Stammes, Yana Afanasieva, Robert Engmann and moderator Anne Bailey at the Blockchain Enterprise Days 2019 in Frankfurt

Millions of dollars and countless business hours are being spent on Know Your Customer (KYC) process by banks every year. These costs are increasing due to AML requirements. Blockchain technology can be utilized to ease this process by offering banks and FinTechs transmissible digital identities, saving time and money. Blockchain technology can improve data quality and result in better governance. There has been a buzz about KYC and blockchain for some time now but actual large scale implementations are still to be carried out. In this panel we will talk about the current status & furture of Blockchain for KYC & AML.

The panel discussed the following points:
– What are the benefits of blockchain implementation in KYC process if any?
– Any specific examples of successful implementation?
– We see government collaboration between middle eastern and Asian banks to fast-track the use of blockchain for KYC & AML. Have there been any similar types of collaborative work in Germany and EU?
– Is standardized KYC necessary and would banks agree on that?

It would be interesting to know how many of you feel that Blockchain will help streamline KYC processes?

Also big thanks to @KuppingerCole Analysts AG and their team for organizing this important event!

Follow the AML Knowledge Centre on LinkedIn at or connect with me at


Money Laundering in a Digital Age – The Perfect Storm

Money Laundering in a Digital Age – The Perfect Storm

The new Black

With the rapid advancement of mobile technologies, the internet is now accessible from any- and everywhere. Open banking (PSD2) in the European Union, together with mobile wallets, instance payment initiatives and cryptocurrencies offer consumers a lot of ways to engage with financial institutions 24/7. Therefore, in today’s environment, customer expectations are constantly changing and it’s imperative that financial crime and Anti-Money Laundering units keeps pace.

No doubt that the widespread use of mobile devices is accelerating the rate and impact of financial crime. Today, mobile subscriptions outnumbered the world’s population as illustrated by Statista:


Which in turn, has spurred the use of mobile banking apps and the way consumers pay for generic services, in general altering us into a cashless society.

With new regulations such as the Payment Services Directive (PSD2), the European Union has set the rules for open banking, allowing FinTechs access to traditional financial institutions’ systems and customer data. Everyone is a winner, the benefits of open banking are enhanced customer service for under-served markets, new revenue streams, and improved margins.

While this presents major opportunities for everyone it places a lot of responsibility on those tasked with keeping a financial institution from being compromised by cyberattacks or used as a vehicle to launder money.  

How will current financial crime & anti-money laundering systems work in a digital world?

It’s difficult enough for financial institutions to monitor and detect violations of transactions taking at best 24 hours to clear. With digital payments clearing in real time the impossible becomes totally impossible using conventional methods as transactions clear in a matter of milliseconds. By conventional, we mean systems focused on a rule-based approaches, where suspicious transactions are put in a queue and investigated in an overnight batch mode.

Even in a world operating in batch, AML systems generate too many false positives (typically between two and 15% of all transactions) and therefore imposes a huge workload on banks and financial investigation units (FIU).


Number of Suspicious transactions reported to UIF in the UK: +51% (’12-16), from 67K in 2012 to 101K in 2016


As digital payments continue to increase, this problem is greatly scaled because banks are under pressure from customers and consumers to clear transactions as quickly as possible and still make sure that risk and compliance systems flag all risks and suspicious activities. 


The Internet of Things


Once upon a time, cybercriminals focused their efforts on PCs. However, with the average user spending about five hours per day on a mobile device, with roughly 70 percent of those smartphone devices not having an anti-virus program installed on them, sensitive data (e.g. contacts, passwords, emails, documents, photos, etc.) are exposed to cyber threats. Therefore, we have witnessed a sharp increase in new mobile malware, because criminals will always take the path of least resistance.

The Internet of Things (IoT) is driving the interoperability of physical devices, vehicles, home appliances and other electronic equipment through sensors and software enabled apps.

The number of online-capable devices was believed to have increased to 8.4 billion by 2017 and by 2020 experts estimated that 30 billion objects would be online, with a global market value of $7.1 trillion.

The Nokia Threat Intelligence Report 2H 2016 estimated that more than 100 million devices worldwide have been infected by malware, including mobile phones, laptops, notepads and a broad range of IoT devices. 

The same report stated that smartphones were more often targeted, accounting for 85 percent of all mobile device infections and smartphone infections increased 83 percent during July through December, compared to the first half of the year. 

According to Check Point Mobile Threat Research’s 2017 report (“Mobile Cyberattacks Impact Every Business”) financial institutions, as the custodians of their customer’s money and data are a much sought-after target for cyberattacks.  Malware attacks by industry:

With the number of mobile devices already infected and the connectivity of devices rapidly expanding, cybercriminals have more routes to target than ever before.  

As crazy as it once seemed, cybercriminals attacking financial institutions via a coffee machine, smartphone or even an employee’s wearable health-check device is no longer science fiction. Also, this malware storm isn’t a regional threat but it’s path of destruction is universal.   The most impacted regions according to Check Point mobile threat researchers:


Source: Check Point Mobile Cyberattacks Impact Every Business

The Eye of the Storm


That said, financial institutions appreciate the importance of digital technology and are embracing an ecosystem that includes FinTechs. These ecosystems can help to provide more customer value and open new customer segments. At the same time, they bring new types of operational risks with them, such as:

  • Risky user behaviour. For example, 70 % of smartphone users have never installed an anti-virus program on their mobile device.
  • 24/7 connectivity of mobile devices to hotspots.
  • WI-FI networks and Bluetooth technologies making it easier for attackers to carry out a fraud campaign.
  • Rogue mobile applications, repacking of apps and ransomware are on the rise.
  • Advance malware & viruses for online as well as mobile devices continue to increase.

Currently, the data on mobile fraud isn’t as robust as with other channels. These operational risks need to be continually assessed to build reliable mobile fraud models without jeopardizing the customer experience. 60 percent of digital banking fraud originates from the mobile channel, according to figures published by RSA in 2018. This mobile banking fraud almost always involves thieves using RDC to deposit fraudulent checks, or cybercriminals using stolen identity credentials to hijack consumer bank accounts. This actually caused a dip in the growth of mobile banking as users sensed insecurity. Security and fear of fraud are the top two concerns about using mobile banking for up to 55 percent of consumers, according to Javelin Research. And with more than 25 million mobile devices infected by a single malware variant alone (Agent Smith) it is hardly surprising. The exact number of malware-infected mobile devices is hard to quantify, but in 2018 Kaspersky Labs and products detected:

  • 5,321,142 malicious installation packages
  • 151,359 new mobile banking Trojans
  • 60,176 new mobile ransomware Trojans

A point often overlooked is that your ecosystem is the weak link when trying to protect against external threats. One lesson learned is the degree of difficulty to detect a compromise until bad things start to happen, examples:

The Carbanak malware set in the banks’ computer systems for months, sending back vital information to hackers, who were then able to impersonate bank officers carrying out internal procedures at more than 100 banks around the world.

With complete control of mission-critical systems, they managed the transfer of millions of dollars from banks in Russia, Japan, Switzerland, the United States and the Netherlands into fake bank accounts set up in other countries.

If not for a video surveillance camera filming an ATM machine in Kiev, the Carbanak malware might never have been detected.

From the US$ 81 million stolen from the Bangladesh Bank in February 2016 only US$ 15 million has been recovered and there is still no word on who was responsible. Cyber attackers illegally transferred US$ 81 million from the Central Bank of Bangladesh (CBB), to several fictitious bank accounts around the world, by subverting their SWIFT accounts.

The Bangladesh Bank heist is a perfect illustration of the future complexity involved in monitoring instant payments.

The WannaCry virus, quickly infecting more than 200,000 businesses in 140 countries. locking computers until a ransom was paid.

Fighting Back with Innovation


The only credible answers are detection and transaction monitoring systems built on new technology, with machine learning and artificial intelligence at the core and not relaying only a rule-based approach.


Criminals don’t use rules


Algorithms that continue to improve, with the support from financial crime and AML professionals, these systems learn to identify suspicious activity where there is a higher probability of a financial crime committed and/or money laundering actually occurring. Therefore, bank staff can focus on the real alerts and not get swamped down in false positives.

Another technology-based approach that continues to develop, provides insights by taking large amounts of account data and generating a visual map. Suspicious relationships and payments can be tracked as they move between bank accounts, regardless of whether the payment amount is split between multiple accounts, or those accounts belong to the same or different financial institutions. The software creates a visual map of where and when money has moved, providing new insights and intelligence for fraud and compliance teams to take action.

By bringing together transactional data from multiple financial institutions and running sophisticated algorithms, such solutions can identify the so-called “mule accounts” that are used for money laundering and other illegal activity. Many of these accounts are not set up directly by the criminals themselves but via a number of scams including phishing, spam email, instant messaging etc.

It is worth pointing out that while technology is a necessary condition for successful financial crime and money laundering prevention, however, it is not the only tool. In addition, financial institutions will need to review their compliance procedures, risk assessments, and their service offerings to strike the optimum balance between competitiveness and security.

What should be the upper threshold look like?

Should priority to VIP and profitable customers be given when reviewing suspicious transactions? What about social and political issues? (For example, Muhammad is the world’s most common name, and also appears a lot on sanctions list. But that also means a significantly large number of false positives, which could lead to claims of unfair profiling.)

And finally, even with advanced technology and effective redesign of processes and procedures is meaningless without a sufficiently well-trained staff to detect suspicious customer behaviour and be reliable gatekeepers, especially at on-boarding of new customers.


Author Paul Allen Hamilton

For more articles on financial crime and Anti-Money Laundering join the AML Knowledge Centre at

Sanction Screening the Intensive Care Patient…Innovation the Cure!

Sanction Screening the Intensive Care Patient…Innovation the Cure!

However, minor the task of sanction screening or name filtering sounds it contributes to a significant amount of false positives and is a time consuming task that leaves less time for other AML patients.

And in today’s environment of tighter AML regulations, constantly evolving instant payment initiatives, open banking (i.e. API) and mobile wallets, as the complexity increases so do the false positives.

While this presents major opportunities it puts a lot of pressure on the risk and compliance systems at financial institutions, which need to detect and flag actual threats in real-time. And this new reality has arisen, let us not forget, at a time when regulators are imposing ever-increasing responsibility on those people who are tasked with keeping a financial institution from being compromised for money laundering and terrorist financing.

Therefore, screening individuals and entities is a key task as well as a legal requirement of any compliance program.

“A financial institution discovered, after employees returned from the weekend, hundreds of SWIFT payments had not gone out, because the system had falsely identified the beneficiaries as a sanctioned name or entity”   

The Challenges of Name Screening

Sanctions lists

Sanctions lists can be found in all formats and sizes. Some are country-based, often following United Nations resolutions to promote world peace and human rights; they prohibit certain if not all transactions. Other sanctions are motivated by politics and foreign policy at a national level, as is the case with the United States’ economic embargo against Cuba. A third category imposes targeted sanctions (e.g. the freezing of assets, travel bans and arms embargos) against specific persons, groups, undertakings and entities, as is the case with any terrorist group such as the ISIL (Da’esh) and Al-Qaida sanctions lists.

Many of the national sanctions lists are based on sanctions imposed under UN resolutions, so many of the names appearing on the UN lists also appear on supranational lists such as those issued by the European Union, as well as national sanctions lists such as the USA’s OFAC and the UK’s HMT lists.

Sanctions lists are fairly straightforward. The course of action regarding persons and entities on sanctions lists is clear – they are a no-go for most financial institutions and when confirmed a Suspicious Activity/ Transaction Report (SAR/STR) must be submitted to the local financial investigation unit (FIU) authority. Complication is manifested when a company is not on any official sanctions list, but a shareholder is, therefore you are required to treat it as a sanctioned entity.

Watch lists

Watch lists serve the purpose of assessing a client’s potential risk and includes (among others) PEPs. A politically exposed person (PEP) is someone who has been entrusted with a prominent public function and therefore presents a higher risk for potential involvement in bribery and corruption by virtue of their position and influence. The Financial Action Task Force on Money Laundering (FATF) issued its latest definition of PEPs in 2012:

  • Foreign PEPs: individuals who are or have been entrusted with prominent public functions by a foreign country, for example Heads of state or Heads of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, important political party officials.
  • Domestic PEPs: individuals who are or have been entrusted domestically with prominent public functions, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, important political party officials.

This distinction is important for a risk-based approach. Also it’s important to note that there are still countries who do not subscribe to the notion of domestic PEPs being a risk at all.

In addition, persons who are not politically active but who have been entrusted with a prominent function by a state-owned enterprise or an international organization, for example members of senior management, directors, deputy directors and members of the board or equivalent functions may also appear on watch lists.

Being on a PEP or other watch list obviously does not mean that a person is corrupt, but that person presents increased risks owing to the possibility that an individual holding such a position will have far greater opportunity to misuse power and influence for personal gain, or may be open to malign influence by a third party. A point that is often overlooked, but really important as bribery convictions reach all-time highs, is the risk that business partners may pose if they qualify as “public officials” based on their company’s ownership structure if fully or partially state-owned.

Law enforcement agencies, security authorities, national and regional agencies also disseminate various lists. These lists (e.g. Interpol’s Red Notices, the FBI’s Crime Alert List, Europe’s Most Wanted, Singapore Investors Alert and IOSCO consumer protection) can help financial institutions and other organizations avoid doing business with a wrong party and from being drawn into a fraudulent scheme or unwanted scandal.

Adverse media lists

Adverse media comes from a range of local, national and even global sources as well as online social platforms. Adverse media can support a financial institution or a corporate company’s decision to engage or not to engage in a business relationship based on the risk associated with the client from negative news. Adverse media can reveal potential involvement in money laundering, terrorism, various criminal activity and other potential crimes that could have a reputational backlash for a firm.

Lists in general

Although, many lists are publicly available, there are technical challenges because these sources have different ways of presenting information. Some offer well-structured information in downloadable XML files, others in CSV or delimited text files, while others can be drawn from social feeds, blogs, web posts and many are unstructured, and still other sources have online lists across multiple web pages, and some are even in PDF format only.

Not to mention the URLs are constantly being moved, without notice. Therefore, a firm’s name screening might not be including an important source, because the URL changed without notice.

Despite the apparent simplicity and straightforwardness of list screening, selecting the lists that will benefit all areas of your financial crime prevention program can therefore be a daunting task. Here are a few factors to consider:

  • The geographical jurisdiction(s) in which you operate
  • The requirements of local and foreign regulators in the area you operate
  • Your organization’s risk assessment – this must be consulted as a guideline
  • Is an appropriate data structure provided?
  • Does the list provider deploy technology that enables more cost-effective means of data deployment (e.g. through the cloud or interfacing via API)?
  • What formats are data files available in?
  • How up-to-date and “clean” is the data? The lists can hold millions of entries. How well does it manage duplications, expired records etc.?
  • An appropriate update schedule and updating by delta files are a “must have”
  • If an online search function is provided, what techniques are being used to match names?


  • In many cases and for many reasons an institution’s data will have gaps and inconsistencies following the old data processing axiom of garbage in garbage out (GIGO). On the other hand, we’re trying to match against hundreds of lists that have different ways of presenting the information.
  • Inconsistency in basic things like abbreviations (Sr./Senior, Inc./Incorporated, AG/Aktien Gesellschaft, nicknames, etc.) and translations of words that have the same meaning but are spelled different e.g. Germany (EN), Allemagne (FR), Deutschland (DE) can all impact screening results.


A majority of the relevant lists published are in a Latin character set, while many of the names on them originate from countries that do not use the Latin alphabet. Therefore, names that are Chinese, Greek, Islamic, Russian and Thai, etc. must be transliterated from their home language to a Latin one. However, the complication does not end there. For example, in the Arabian Peninsula, Jamal is pronounced Jamal, in Egypt Gamal, and in Algeria Djamal. These are all the same Arabic word, but one that is spelled (transliterated) in various regional ways when written in English.

A further example of transliteration is the voiceless uvular plosive used in Arabic and other languages. It is pronounced approximately like English [k], it’s pronunciation varies between different languages and different dialects of the same language. The consonant is sometimes transliterated into “g”, sometimes “k”, and sometimes “q” in English.

For example, the former Libyan leader’s name can be spelled in various ways:

  • Gaddafi
  • Qadhafi
  • Kaddafi
  • Gadhafi
  • Ghathafi
  • Qaddafi
  • Ghadafi

Beneficial owners

Opaque ownership structures present a real challenge for KYC as criminals, and politically exposed persons (PEPs), etc. hide behind corporate structures.

A company might not be on an official sanctions list, but according to an Office of Foreign Assets Control (OFAC) rule it can be blocked if stakeholders who are on lists have ownership equal to or above 50 percent (this is known as the 50 Percent Rule); thus there is a good chance that the company in question will itself be treated as a sanctioned entity. To put it simply, if company X is blocked and it owns 50 percent of company Y, company Y is also considered blocked, even if that entity doesn’t appear on the OFAC Specially Designated Nationals (SDN) list.

For this reason, it is imperative that corporate ownerships are verified when dealing with certain countries and corporate structures to ensure that none of the beneficial owners are prohibited persons under OFAC regulations.

Practical Actions to take Now

Given the various points raised above, here are some practical steps you should take if you wish to make efficient use of lists and increase the effectiveness of sanction and Pep filtering:

  1. Data Integrity. Get your data in order. A database built on the principles of good data, properly spelled names, sound data structure, and format will go a long way to improving the identity matching process.
  2. Automated Data Collection at every point of customer engagement
  3. Do not simply perform risk assessment, “live it”. This is critical in leveraging the understanding of how these risk exposures impact technological decisions and operational areas of the institution.
  4. Test, test, test – perform random checks to ensure that technology and operational processes are working appropriately and are being consistently applied. Review reports to understand when and why changes are necessary.
  5. Check AML data providers for company credibility, data accuracy,
    well-structure data, depth of content, customer service/support, data quality verified by third party, etc

Apply Innovative Technology

Artificial Intelligence 

True, there is a lot of hype about Artificial Intelligence (AI) and most AI examples that you hear about today – from Google Assistant, Alexa, Siri, or Bixby, to self-driving cars – rely heavily on deep learning and natural language processing. Using these technologies, computers can be trained to accomplish specific tasks by processing large amounts of data and recognizing patterns in the data

Therefore, if you are serious about sanction screening and tackling money laundering with an acceptable return on your efforts and investment, you need to acquaint yourself with artificial intelligence (AI) and machine learning (ML).

Artificial Intelligence and Machine learning uses two types of techniques: Supervised, models are trained on data with known inputs and outputs (also known as categorized data) to identify potentially suspicious transactions. while Unsupervised, models are exposed to raw data to find hidden patterns or intrinsic structures that might signal money laundering or other financial crimes.

The importance of this is demonstrated with the use of supervised learning in sanctions screening where every payment transaction must be screened to check if any beneficiaries are on a sanction or watch list.

However, screening systems produce a lot of false positives that must be dispositioned by a human reviewer, before the transaction can leave the gateway or employees which are greeted by thousands of false positives after an overnight batch screening.

Hopefully, AI can be trained, well enough, to eventually takeover much of the task of reviewing these false positives. There can’t be enough said to the urgency of experimenting with artificial intelligence (AI) now as these models and algorithms need to be constructed, systems set up and then trained, tested, trained, tested and trained until these technologies are taught to address the repeatable high-volume of false positives.

That said, AI is not in itself a “silver bullet” and the process of getting these models up and running can be laborious, therefore, banks should consider cloud-based multi-tenant solutions that share out the cost burden and a can improve time to deployment.

Blockchain Technology

Other technological advances, such as distributed ledger (e.g. blockchain) technology, will help to improve banks’ ability to monitor complex, multi-part transactions. These “smart contracts” with advance algorithms, will allow financial institutions to securely parse data through an AML engine on the blockchain,” in this way banks can store and share data, thus eliminating excessive complex bureaucracy involved in information sharing.

Paul Allen Hamilton

I can be contacted on LinkedIn @

Photon Photo – Shutterstock

Demystifying blockchain: what it means for KYC

Demystifying blockchain: what it means for KYC

Hardly a day goes by without a news item concerning the use of cryptocurrencies for money laundering. In June the Financial Action Task Force (FATF) told countries to tighten oversight of cryptocurrency exchanges amid growing concern among international law enforcement agencies that cryptocurrencies are being used to launder the proceeds of crime. Countries will now be required to register and supervise cryptocurrency-related firms such as exchanges and custodians, which will
have to carry out detailed checks on customers and report suspicious transactions. Many governments are already acting on this; for example, on 5 August the Thai government announced that it would bring cryptocurrencies under existing financial regulations, monitored by its
anti-money laundering office, AMLO. In a statement to the Thai press, Police Major General Preecha, secretary-general of the Anti-Money Laundering Office (Amlo), neatly summarized the
current lack of visibility over the issue, saying, “We may not find any clue, but that doesn’t mean the wrongdoing does not occur.” Elsewhere, there have been successes. Earlier this year, Europol broke up a Spanish drugs cartel that laundered cash using two crypto ATMs, machines that issue cryptocurrencies for cash. The concern is that cryptocurrencies can be used to transfer money across borders, break down large criminal money transfers into smaller amounts that are harder to detect, and to make payments on the dark web. And while some of this money laundering activity is still conducted using well-known cryptocurrencies, notably bitcoin, criminals are increasingly switching to more anonymized
cryptocurrencies. Yet, while cryptocurrencies are further complicating the AML landscape, it has been argued that the very technology supporting them – blockchain – may contribute massively to reducing the costs and
the challenge of know your customer and anti-money laundering (KYC/AML) through what has already been dubbed the KYC blockchain.

The cost of KYC

As is well known, Know Your Customer (KYC) is hideously expensive for banks. The cost of conducting KYC due diligence investigations of a company or individual can run into tens of thousands. KYC processes provide the backbone of financial institutions’ efforts to combat the financing of terrorism and to detect and prevent criminal behaviours around the world, such as trade-based money laundering (TBML). According to recent estimates, in excess of US$25 billion is spent each year on financial crime risk management in the banking sector, the majority of which is due to KYC. The reason for the high cost is simple: KYC at many financial institutions is extremely inefficient, involving labour-intensive manual processes, duplication of effort and a high risk of error. Up to 80
percent of the effort associated with KYC is dedicated to information gathering and processing, and only 20 percent to assessing and monitoring that information for critical insights. It can take weeks or even months to identify a beneficial owner by locating and validating the relevant physical and computer records. Moreover, the work is typically done many times over, even for the same customer. Each Line of Business (LoB) within a bank performs its own customer checks. The legal entity – be it an individual or an organization – typically provides KYC documents each time it requires services from different LoBs within the same institution. It is difficult or impossible for LoBs to share the information in a secure and easy manner while protecting confidentiality and privacy. Poor customer experience and high operational costs for the bank are not a good business model in a competitive environment. In other articles we have considered how machine learning – a subset of artificial intelligence – may help to address this challenge, but a key problem remains, which is that the trail of transactional records that is required to identify money laundering is typically spread across multiple LoBs, financial institutions and legal jurisdictions. And this is precisely where blockchain, the underlying technology for bitcoin and other cryptocurrencies, could reduce inefficiencies and duplication of effort in KYC information gathering
between legal entities within a large financial institution or even between competing banks.

The Singapore trial

But how realistic is such an approach? A prototype tested in Singapore in 2017 involving OCBC Bank, HSBC, Mitsubishi UFJ Financial Group (MUFG) and the Infocomm Media Development Authority (IMDA) was the first KYC blockchain in South-east Asia and the most public trial to date. It was
claimed that the prototype could solve the current practice of collecting and verifying personal information from customers repeatedly, reducing the costs by 25-50%, according to KPMG. Like cryptocurrencies, a KYC blockchain prototype operates on a distributed ledger technology and
enables structured information to be recorded, accessed and shared across a distributed network using advanced cryptography. With the customer’s consent, LoBs can share information accurately and efficiently with a clear audit trail generated on the blockchain. With a KYC blockchain LoBs can securely search customer information, generate requests for KYC
documents from other LoBs that have already verified customers, store validated customer documents and re-use them where required. The infrastructure can also be used for sharing customer profiles and alerts, which can trigger mitigation procedures when required in response to
alerts. The Singapore prototype reportedly remained stable even with a high volume of information, was resistant to tampering and maintained data confidentiality. Some fintech companies have now built their own blockchain technology-based distributed ledger systems.

Self-sovereign identity systems

A further development of blockchain-based technology that may reduce KYC costs is “self-sovereign identity” (SSI) systems. Through the use of distributed ledger technology, SSI enables individuals to retain control over their data while at the same time being verifiable for banks and other relying parties through the public recording of verified claims. SSI could be the next step in identity management, combining traditional means of identification with new technology-based systems (such as asymmetric key, one-time password, biometrics) in a distributed system. Its relevance to KYC is that it adds a layer of security and flexibility allowing the identity holder to reveal only the necessary data for any given transaction or interaction. Under existing practice, a bank has to access highly centralized pools of data time and again in order to verify identity. This has a high degree of dependence on data sources that are vulnerable to hacking. Data vulnerability is potentially damaging to both the bank and the bank’s customers, whose identity may be stolen and either used to carry out fraudulent transactions or to provide that identity to another person, who
can then use it for (among other things) for the purpose of money laundering. SSI could reduce the bank’s dependence on a centralized data pool and processes that were not designed for a decentralized, distributed and instantly connected world. An identity blockchain in which a bank has node status would provide a solution that resolves the conflicting demands of financial security and personal privacy. Such solutions for managing self-
sovereign digital identities are already in a fairly advanced stage of development.

How much of this is hype?

While there are similarities between the technology behind bitcoin and the proposed systems to assist with anti-money laundering, we should be careful that we are not blinded by the hype. As
Investopaedia recently reported:
Compare that open, permissionless blockchain to the “private” or “permissioned” blockchains that established tech and financial services players, along with a gaggle of start-ups, are developing on their own or through consortia. Rather than a trustless network of thousands of strangers, they propose to build small networks of known, vetted actors – or in some cases, to keep the blockchain to themselves. The result makes compliance with [AML and KYC] laws easier … but at some point, these purported blockchains have little to do with the innovation that underpins bitcoin. The truth is that technological change tends to be incremental and evolutionary, building on earlier advances. In the case of blockchain, this “revolutionary” technology is based on the successful combination of several pre-existing technological approaches: primarily, decentralized networks, cryptography, and consensus models. Blockchain makes it possible to exchange values in a decentralized system. Cryptocurrencies and the proposed KYC blockchains have this in common, but the commonality ends there. The blockchain hype cycle has peaked and is now in what Gartner terms the “trough of disillusionment”. This is inevitable. No new technology has ever solved more than a small fraction of the problems faced by humankind (well, not since the wheel). Blockchain (we will increasingly see the terms distributed ledger systems or hyperledgers) will bring benefits in many areas of human endeavour, including AML and KYC, but it will be no “silver bullet”. Doubts remain about its scalability, and the competitive nature of the market, concerns about confidentiality etc. will set limits on its application. That said, there is no question that these technological developments are highly positive. The bottom line? A realistic assessment is that KYC blockchains and SSI-supported onboarding will
not fundamentally transform due diligence processes but, especially if combined with other technologies, they could reduce the cost of KYC by something in the range 20%-30%. That will have a significant impact on banks’ ability to combat common forms of money laundering.

Any major financial institution would jump at that!

Join us @ LinkedIn to stay up- to-date on financial crime topics affecting your industry.

Trade-based Money Laundering – and How to Combat It.

Trade-based Money Laundering – and How to Combat It.

With international trade valued at approximately US$ 16 trillion per annum, it provides ample scope for money laundering. According to the International Narcotics Control Strategy Report (INCSR) hundreds of billions of dollars are laundered annually by means of trade-based money laundering (TBML). It is one of the most sophisticated methods of cleaning dirty money. TBML red flags are among the hardest to detect. For example: what is the value of a dress? Is it $3? Or $30? Or $300? This simple uncertainty creates an environment that’s rife for abuse. TBML accounts for hundreds of billions of dollars of illegal money flows annually. According to a PWC report published in January 2015, 80 percent of illicit financial flows from developing countries are accomplished through trade-based money laundering.

Commonly used TBML techniques include over or under-invoicing and multiple invoicing, all of which facilitate money laundering through the creation of artificial profits or losses. Honest exporters and importers can be unknowingly caught up in such schemes:

  • Over-invoicing. Company X ships 10 cars with a market value of $10,000 each to Company Y, but invoices Company Y $20,000 per vehicle. Company Y has an apparently legitimate reason to transfer $200,000 to Company X, half of which is “dirty money” to be laundered. Company X thereby profits from the $100,000 excess over market value, which represents the proceeds from criminal activity, but is now “clean”. Company X could even apply for tax incentives when exporting certain categories of goods, and it can evade capital controls by placing the excess funds in an offshore account
  • Under-invoicing. In this scenario Company X ships 10 cars with a market value of $10,000 each to Company Y, but invoices Company Y for just $5,000 per vehicle. Company Y transfers $50,000 to Company X, then sells the cars to a dealer for $100,000. In this way Company X can transfer $50,000 of dirty money to Company Y. If asked, both companies can plausibly argue that the transaction was legitimate. A more likely scenario, however, is for the two companies to limit the under-invoicing to a margin of 10% or less, making it even more difficult to prove that the transaction was designed to conceal money laundering.
  • Multiple invoicing. Money launderers may instead invoice the same shipment of goods more than once. In order to obscure the true nature of this scheme, organizations will employ multiple financial institutions to assist in financing. The price specified for the goods or services does not have to be manipulated and it is not uncommon to issue multiple payments in legitimate transactions due to amendments and corrections, making this hard to detect.

An alternative is to over or under-ship the goods themselves:

  • This is similar to over and under-invoicing in that value is transferred to either the buyer or the seller. In this case, however, the parties misrepresent the quantity rather than the price. Company X charges Company Y $5 million, which reflects the value of the goods on paper. Company X then proceeds to ship $10 million worth of product, so Company Y receives an additional $5 million worth of goods.
  • Over-shipment can also be used to avoid import duties.
  • In some extreme cases of under-shipment, also known as phantom shipment, the seller will ship nothing at all – just an empty container backed by documentation that appears to be fully in order.

A further common technique is the fraudulent description of exported goods:

  • Exporters can falsely describe the goods or services being transferred, either inflating or deflating their true value in order to pay off or get paid off. This TBML scheme works best with “invisible” services such as financial or legal advice, management consultancy marketing research etc.
  • Alternatively, low-grade or even scrap material can be valued at an inflated price and fraudulently sold as high-grade or premium material.
  • This form of money laundering may also be used in conjunction with other criminal activity, such as shipping proscribed goods such as ivory or endangered woods on CITES lists or claiming to ship goods that are eligible for tax incentives or subsidies.

Trade diversion is a common way of moving goods between high-cost and low-cost (or “developing”) economies, taking advantage of price differentiation between markets.

  • Company X sells expensive pharmaceutical goods at low costs from a European Union country (e.g. the UK or Ireland) to Company Y in a poor African country.
  • Company Y sells the same pharmaceuticals back to Ireland at (or close to) Irish market pricing.

Red flags

Most TBML involves more than one of the methods listed above (and possibly others) and more than one organization, in more than one jurisdiction. This makes it exceptionally difficult for financial institutions and regulatory authorities to identify red flags. The Financial Action Task Force lists the following red flags that financial institutions should look out for and investigate:

  • Discrepancies between the description of the good or service and the invoice
  • Discrepancies between the description of the good or service and the actual good or service
  • Discrepancies between the reported value and the fair market value
  • When the underlying good or service varies significantly from the exporter or importer’s typical shipment
  • When the size of the shipment varies significantly from the exporter or importer’s typical shipment
  • When the good or service is designated as “high risk”
  • When the jurisdiction is designated as “high risk”
  • When multiple jurisdictions are involved for no economic reason
  • When the transaction involves shell companies

Red flag checks also target the illicit shipment of dual-use goods – goods that can be used for both innocent purposes, as well as sinister ones. These could include chemicals for making illegal drugs, or that could be used for both civilian and military purposes. Ammonium nitrate, for instance, is used as a fertilizer but can also be used in explosives. In this case, understanding the context of the shipment, and knowing the organizations involved is key.

What should banks do?

Regulatory bodies around the world are stepping up scrutiny of TBML and banks are increasingly obliged to take more stringent action to ensure they are not unwittingly facilitating illicit transactions. The Monetary Authority of Singapore (MAS), the Hong Kong Monetary Authority (HKMA) have taken the lead in issuing guidelines and red flag checks around trade finance, based on advice from the International Chamber of Commerce (ICC), Bankers Association for Finance and Trade (BAFT) and FATF.  These red flag checks define the key attributes in trade finance transactions that indicate a high risk for TBML and are now seen as the global standard for due diligence for which financial institutions must screen and monitor.

In particular, banks have a duty of care to identify where goods are being shipped, what transportation is used and whether goods can potentially be used for dual purposes. However, this is not just a duty for banks; companies involved in exporting and importing must exercise due diligence to ensure that they are not (wittingly or unwittingly) involved in suspicious trade activity.

As is the case with other forms of money laundering, failure to comply will not only result in huge fines, but also significant reputational damage. Regulatory enforcement actions often feature specific language indicating that banks aided and abetted terrorism, drug trafficking, and human trafficking by failing to detect and report illicit activity, upon which media outlets can be quick to capitalize.

Sanctions screening

Compliance with government sanctions lists naturally forms a substantial part of the checks for trade finance that banks are required to make. Red flag guidelines require banks to keep a sharp eye out for customers conducting business in, or shipping items through, high-risk states, or customers engaging in potentially high-risk activities, including the arms trade or the export of dual-use goods.  Banks must verify all counterparties (corporations and banks) as part of Know Your Customer (KYC) regulations and ensure that all parties to a transaction undergo “sanctions screening” against official sanctions lists, including those from the Office of Foreign Assets Control (OFAC), the European Union (EU), and the United Nations (UN).

Why is compliance so difficult?

However, such compliance is no mean feat because, as we have seen, there are many TBML techniques, which can be  used in many combinations. Moreover, whereas legitimate international trade assumes that there is only an advising bank and an issuing bank, acting on behalf of both the importer and the exporter, the reality of letter of credit (LC) processing, could be far more complicated with many additional parties involved: one or more reimbursing banks, as well as the banks of intermediaries, advisors, shipping and insurance agents, vessels, forwarding agents, consignees, notifying parties … the list is virtually endless. Multiple financial institutions and agents, multiple ways to move the goods, etc., all add complexity upon complexity for the purpose of monitoring for money laundering.

Thus, even though all of the TBML techniques listed above are well known to investigators, there is no easy way to identify this form of money laundering activity, at least not using traditional methods. The data that is required to identify suspicious activity typically resides in multiple sources, over which the individual investigator at a bank or regulatory authority has limited visibility. Moreover, as is the case with all forms of anti-money laundering investigation and sanctions list monitoring, TBML throws up a large number of false positives, which reduce both the investigator’s productivity and the likelihood that he will spot a true positive.

Barriers to data integration

The principal reason for the high rate of false positives is that the source data being used has not been subjected to data normalization or data cleansing, and it resides in various legacy systems that are not integrated and not shared by the various financial institutions involved. Typically, there is no link between letter of credit data and associated data and a financial institution’s watch list. Consequently, most investigations are largely manual and carried out by individual investigators in individual banks. There is a complete lack of transparency and visibility.

With multiple document formats and data sources to monitor, banks are increasingly looking to artificial intelligence technologies such as natural language processing (NLP) to meet their TBML compliance obligations. To this end, unstructured data from the various paper-based trade documents must first be scanned and put into machine-readable text format. Once the data is in a format that can be processed and analyzed, NLP can be used in combination with a rules-based engine to interpret the text, understand the context and draw conclusions from it to identify red flag indicators as well as true beneficial owners on sanctions lists.

By harnessing the capabilities of such technologies, banks will be able to go monitor and detect money laundering activities more rapidly and efficiently than in the past, throwing up fewer false positives without the burden of having to employ large numbers of investigators to tackle difficult compliance checks manually. Human investigators will, instead, be able to focus on following up genuinely suspicious activity.

While TBML remains widespread, red flag guidelines and watch lists will continue to evolve and grow. It is only through flexible, intelligent, automated AI-powered solutions that banks can keep up with and adapt to heightened regulation required to tackle this growing international crime.

That said, AI is not in itself a “silver bullet” and the process of getting them up and running can be laborious if undertaken by individual financial institutions. Models and algorithms need to be constructed, systems set up and then trained and tested. This will involve expert investigators working with data scientists to set up suspicious activity scenarios based on all the key fields involved in a trade transaction. Banks should therefore look to cloud-based multi-tenant solutions that share out the cost burden.

When the system detects a potential red flag based on the pre-programmed scenarios, an alert will be generated, giving the investigator immediate access to the specific transaction. Investigators will then need the ability to rapidly find transactions that exhibit similar characteristics.

Other technological advances, such as distributed ledger (e.g. blockchain) technology, will help to improve banks’ ability to monitor complex, multi-part transactions.

Nonetheless, greater international cooperation is vitally important. Progress in combatting TBML will be greatly accelerated if regulators across jurisdictions can formulate agreements for better information sharing and improve the harmonization of data that is scattered across multiple systems, borders and financial institutions.

For more articles join the AML Knowledge Centre at

Paul Allen Hamilton

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.