How Big Data and Deep Learning are Revolutionizing AML and Financial Crime Detection

BigDataandPredic.veAnaly.csforAMLandFinancialCrimeDetec.onSanjayKumarGMIndustrySolu.ons–Telecom&FS

2 ©HortonworksInc.2011–2016.AllRightsReserved

Agenda

Ã  Introduc=on

Ã  WhatisFinancialCrime,AMLandwhatweareseeingintheAMLSpace

Ã  BriefDiscussionofCustomerAc=vityinAML

Ã  Illustra=veUseCases

Ã  WhereCurrentImplementa=onsfallshort?

Ã  ReferenceArchitectureforAMLandPredic=veAnaly=cs

Ã  Q&A


FSIIndustryMarketSegments

FSI Industry"

Capital Markets"

Investment Banks" Hedge Funds" Wealth Mgmt"

Retail Lines"

Consumer lines" Corporate"

Payments"

Acquirer & Issuer Banks " Schemes"

Market Exchanges"

•  Thereare4primarymarketsegments/sectorscomprisingtheglobalFSIindustry:CapitalMarkets;RetailBanking,Payments;MarketExchanges.•  Eachgeography,countryandstatemayhavetheirownregula=onandcompliancerequirementsforproducts,distribu=onandra=ngrequirements.Bankingisthemostregulatedindustry!

•  ItiskeytounderstandthemarketsegmentoftheBankingcompanyasthebusinessprocessanddata/informa=onneedsandchallengesareverydifferentacrossthe4.Addi=onally,challengesvarybyPremium/Revenue=er.

•  TherearemanyGlobalFScompanieswhichmaydefinestandardsgloballyanddeploylocally.


ImpactofBigDatain5majorareas

Predictive Analytics And ML/DL

Digital Banking

Capital Markets

Wealth Management

Cybersecurity Helpingdefendins=tu=onsagainstcyberthreats

Improvingwealthmanagementcapabili=estherebyprovidingenhancedcustomerservice

Enhancingcapabili=esacrossinvestmentbanking,tradingetc.

EnablingDigitalbank,providingseamlesscustomerexperience

Analy=csenablingbothdefensiveandoffensiveusecases


WhyBigDataforFinancialCrimesandControls

Ã  Firms,largeandsmall,needtonavigateasetofincreasinglycomplexcompliancerulesandregula=onsasregulatorybodiesclampdownonloopholesinthefinancialregulatoryframework.With=ghterregula=oncomestheneedtoseekoutmoreadvancedandcosteffec=vecompliancesolu=ons

Ã  Itises=matedbytheFinancialAc=onTaskForcethatoveronetrilliondollarsislaunderedannually.

Ã  Regulatorsincreasinglyrequiregreateroversightfromins=tu=ons,includingclosermonitoringforan=-moneylaundering(AML)andknowyourcustomer(KYC)compliance.

Ã  Themethodsandtac=csusedtolaundermoneyareconstantlyevolving,fromloan-backschemesandfrontcompanies,totrustsandblackmarketcurrencyexchanges,thereisno“typical”moneylaunderingcase.


WhatIsAML,FinancialCrimeandWhatweareseeinginAML


WhatisAMLandFinancialCrimes

Ã  Financialcrimeiscommonlyconsideredascoveringthefollowingoffences:–  Fraud–  ElectronicCrime(CreditCard,stoleninforma=onetc)–  MoneyLaundering–  Terroristfinancing–  BriberyandCorrup=on(KYC)–  marketabuseandinsiderdealing(TradeSurveillance)–  Informa=onsecurity(CyberSecurity)

Ã  An=-moneylaundering(AML)isatermmainlyusedinthefinancialandlegalindustriestodescribethelegalcontrolsthatrequirefinancialins=tu=onsandotherregulateden==estopreventorreportmoneylaunderingac=vi=es.


FinancialCrimeIsOntheRise!

ofbusinesseswerevic=msoffraud

ofbanksfailedtocatchfraudbeforefundsweretransferredout

offraudaiacks,thebankwasunabletofullyrecoverassets

ofbusinessessaidtheyhavemovedtheirbankingac=vi=eselsewhere

Only20%ofbankswereabletoiden=fyfraudbeforemoneywastransferred.

“TheROIofinves/nginfraudpreven/onisclear.”

58%

Source:PonemonIns=tute/GuardianAnaly=csstudy,March,2010

80%

87%

40%

20%

Apollof500execu.vesandownersofsmallandmediumbusinessesshowed:


Key AML Use Cases


Case1:UnderstandCustomerProfile(KYC)•  CaseDescrip.on:MrAlexisaComplianceofficeratABCbank.Whilescru=nizingnumberofthecustomerprofileandaccount

ac=vityhenotedsomesuspiciousac=vityinoneofthecustomer'saccount.Customerprofileandaccountac=vityhasthefollowinginforma=on.

•  CustomerProfile:–  Individualcustomeraccount,RiskTypeClassifica=on–Sensi=veClient,SeniorPublicFigure.Customerscarryingoutlarge

transac=ons–  Anumberoftransac=onsintherangeof$10000to5,000,000carriedoutbythesamecustomerwithinashortspaceof=me–  Anumberofcustomerssendingpaymentstothesameindividual

•  UniquenessofUsecase:Mul=–ChannelLinkedAccountsinvolvingmul=plegeography•  Dataelementsinvolved

– CustomerData– Transac=onDataover5yearperiod

•  Challengeswithcurrenttechnology– Mul=pleLinkedAccountsandPastHistorybeyond6monthsDataretrieval– Real-=mevisualiza=on

l  Suppor.ngDatarequiredtosimulatetheusecase– CrossCurrency,CrossGeographyLoca=ons– Mul=pleChannelsTransac=ons– Mul=pleCrossCurrencytransac=onsfromUSD,SGD,GBPandEUR– NearlyxAccounts– AcrossGeographyin50countries– Between500-600CR/DBtransac=oneveryMonth

l  Results/Objec.veofUseCase:TodemonstrateMul=Channeltransac=onswithhistoricdatasetl  Visualiza.ontoshowresultsofusecase:Tobeiden=fied


Case2:Mul.ProductLinkedAccounts(KYC)•  CaseDescrip.on:AcustomerprofilewithabusinessprofilewithlinkedaccountsandTransac=onacrossproductsandinvestments.

Therearemanyfunneledtransac=onsintotheaccountandinvestmentsacrossgeographicalloca=onsofhighriskcountries.•  CustomerProfile:

–  Businesscustomeraccount,RiskTypeClassifica=on–HighRiskClient,Customerscarryingoutlargetransac=ons–  ComplexandLargecashtransac=onsintherangeof$50,000above–  Mul=pleExchangeofcashinonecurrencyforforeigncurrency–  Highcashbusinessessuchasrestaurants,pubs,casinos,taxifirms,beautysalonsandamusementarcades–  Anumberofcustomerssendingpaymentstothesameindividual

•  UniquenessofUsecase:Mul=–ProductLinkedAccounts•  Dataelementsinvolved

– CustomerMasterProfile– ProductMaster– Transac=onsoverxyeardataset

•  Challengeswithcurrenttechnology– Mul=pleLinkedAccountswithMul=products– Real-=melinkvisualiza=onandtracking

l  Suppor.ngDatarequiredtosimulatetheusecase– CrossCurrency,CrossGeographyLoca=ons– Mul=pleProductTransac=onsandwiredtransac=ons– Mul=pleCrossCurrencytransac=onsfromUSD,SGD,GBPandEUR– NearlyxLinkedAccounts– AcrossGeographyin50countries– Between2000CR/DBtransac=oneveryMonth

l  Results/Objec.veofUseCase:TodemonstrateProducttransac=onlinkswithhistoricdatasetl  Visualiza.ontoshowresultsofusecase:Tobeiden=fied


Case3:$200MillionCreditCardFraud•  CaseDescrip.on:OnFeb.5,federalauthori=esarrested13individualsallegedlyconnectedtooneofthebiggestpaymentcard

schemeseveruncoveredbytheDepartmentofJus=ce.Thedefendants'allegedcriminalenterprise-builtonsynthe=c,orfake,iden==esandfraudulentcredithistories-crossednumerousstateandinterna=onalborders,inves=gatorssay.

•  CustomerProfile:–  169BankAccounts–  25000FraudulentCreditcards–  7000falseiden==es–  WiredTransac=onacrossgeographies

l  UniquenessofUsecase:Mul=plecustomerprofilestracking•  Dataelementsinvolved

– CustomerMasterProfilel  Challengeswithcurrenttechnology

– Mul=CustomerProfiletrackingandverifica=on– Accurateprofileverifica=onbycross-verifica=onofpublicrecordswithu=litybillsandbankaccountsaroundtheworld– Createasingleen=tyview(SEV)ofsimilaren==es– Detectaliaseswhethertheyarecreatedinten=onallyorthroughhumanerror– Iden=fyirregulari=esinuserinput– Reducefalseposi=vesthroughdataenrichment

l  Suppor.ngDatarequiredtosimulatetheusecase– CrossGeographyLoca=onsProfiles– xLinkedAccountsacrossdifferentbanksandproducts

l  Results/Objec.veofUseCase:TodemonstrateDE-duplica=onofcustomerprofilesandverifica=onofiden=tyl  Visualiza.ontoshowresultsofusecase:Tobeiden=fied


Case4:SocialNetworkAnalysis•  CaseDescrip.on:AnalysisofSocialNetworkNetworksitestoestablishlinkswithfraudulentcustomersLinks•  CustomerProfile:

– CustomerProfileswithover5Millionrecords– AcrossGeographyin50countries– Search,matchandlinkwithTelephone,MobileNumber,Email,SocialNetworkIDs– Iden=fyirregulari=esinuserinput– Protectindividualprivacyconcernsthroughanonymousresolu=on,displayingeitherthefullmatchingrecords– Reducefalseposi=vesthroughDataenrichment

l  UniquenessofUsecase:SocialNetworkAnalysisofCustomerProfiles•  Dataelementsinvolved


– AbilitytolinktosocialnetworksitesandTextAnalysisl  Suppor.ngDatarequiredtosimulatetheusecase

– CustomerProfilesgleanedfromsocialnetworksiteslikeFacebook,LindedIn,Myspaceandothersocialnetworks/communi=es

l  Results/Objec.veofUseCase:TodemonstrateSocialNetworkiden=tylinkswithcustomerprofilestoestablishFraudulentcustomerprofilesandtoreducefalseiden=ty

l  Visualiza.ontoshowresultsofusecase:Tobeiden=fied


Case5:WatchListFilteringandTextMining•  CaseDescrip.on:Watchlistfilteringprimaryrequirementistorou=nelyscancurrentandprospec=veclientsagainstadatabase

(watchlist)consis=ngofnames,akaandaddressentries.•  CustomerProfile:

– Compareandscru=nize1,000,000namesontheglobalPEPlist– Nearly120sanc=onsliststhatcollec=velyhavemorethan20,000profiles.– Watchlistscreeningiscrea=nganeffec=vescreeningprocessthatminimizesfalseposi=vesandfalsenega=ves.– Search,matchandlinkwithnamesandprovidecomparisonwithactualandoriginalrecords

l  UniquenessofUsecase:TextMiningofUnstructuredData•  Dataelementsinvolved


– UnstructureddataresultsinFalsePosi=ves– NumberofMatchingRulesandEaseofincorpora=ngMatchMatrixchanges.– CustomerDataIntegrity– Foreignnames,mul=partnames,hyphenatednames,nameswhich“sound”similarbutspelleddifferently(eg.Muhammedv/sMohamad)

l  Suppor.ngDatarequiredtosimulatetheusecase– OFAC'sSDNlist,BankofEnglandList,DeniedPerson'sList

l  Results/Objec.veofUseCase:TodemonstrateReliableandscalablewatch-listfilteringl  Visualiza.ontoshowresultsofusecase:Tobeiden=fied


Ã Needforhighlyinterac=veandvisuallyappealingUI’sforinves=ga=onÃ Needforadvancedanaly=csfordeeperinsightintotrendsincustomerbehavior.

Ã HigherdegreeofdepthofanalysisinAMLprogram.Ã GuardagainstAgingtechnologyandManualapproachesÃ  AutomatedRiskClassifica=onApproachesÃ NeedtoreducethevolumeofFalseposi=vesÃ  Theneedforstructuredandunstructureddataanalysis

Data Analysis Trends in AML


l  Higherdegreeoftechnologysophis=ca=onamongcriminalsl  AMLprogramsneedtomovefromrunningdetec=onprocessesonsimilardata

sets,toopera=ngacrossdiversedataFraudpaiernsoffrauddemand360viewofRiskaswellasanabilitytoworkacrossmorecomplexandlargerdatasets

l  Mostillicitac=vi=esspanningacrossgeographies,productsandaccountsl  LackofefficiencyinInves=ga=onToolsandProcessesl  ExpertSystemsorRulesEnginebasedapproachesbecomingineffec=vel  Predic=veapproachtodetec=ngfraudisemergingasakeytrendl  Movetoincreasedautoma=onl  Theamountofdatathatisneededtofeedthepredic=veapproachesisgrowing

exponen=ally.

What we are seeing in AML..


Where current solutions fall short


Ã  FragmentedBookofRecordTransac=onsystems–  Lendingsystemsalonggeographicandbusinesslines–  Tradingsystemsalongdeskandgeographiclines

Ã  Fragmentedenterprisesystems–  Mul=plegeneralledgers–  Mul=pleEnterpriseRiskSystems–  Mul=plecompliancesystemsbybusinessline

•  AMLforRetail,AMLforCommercialLending,AMLforCapitalMarkets…•  Lackofreal=medataprocessing,transac=onmonitoringandhistoricalanaly=csÃ  Typicallyproprietaryvendorandin-housebuiltsolu=onsthathavebeenacquiredover

theyearsbuildingupasignificanttechnologicaldebt.

Ã  Unabletokeeppacewiththeprogressoftechnology

Ã  MovetocombineFraud(AML,CreditCardFraud&InfoSec)intooneplavorm

Ã  Issueswithflexibility,costandscalability

WhatWeHaveSeenatBanks


High Level Solution - Architecture Predictive Analytics


Someessen.aldataelementsforAML:StructureandUnstructured

Ã  Inflowandouvlow

Ã  Linksbetweenen==esandaccounts

Ã  Accountac=vity:speed,volume,anonymity,etc.

Ã  Reac=va=onofdormantaccounts

Ã  Signerrela=onship

Ã  Depositmix

Ã  Transac=onsinareasofconcern

Ã  Useofmul=pleaccountsandaccounttypes

Ã  SocialMediaBehavior

Ã  Etc.


BigDataforFinancialCrimesandControls-Solu.onÃ  Theuniquenatureofmoneylaunderingrequiresanewgenera=onofsolu=onsbasedon

–  VastvarietyofHistoricalData–  Businessrules–  fuzzylogic–  DataMining–  supervisedandunsupervisedlearningandothermachinelearningtechnologiestoincrease

detec=onandreducefalseposi=ves.

Ã  Toimplementanextgenera=onsolu=onforBSA/AML,firmsmustlooktowardsupdatedmachinelearningtoolsthatallowfinergrainresolu=onatthescaleneededtodetectAML.

Ã  PhasedApproach–  RuleBasedModel(CrawlPhase)–  FeaturebasedModel(WalkPhase)–  DataDrivenModel(RunPhase)


AMLSolu.on:RuleBasedSolu.on(CrawlPhase)

Ã  ManualAnalysisbyainves=gator

Ã  Subjec=veandInconsistent

Ã  TimeConsuming

Ã  HighFalsePosi=ve

Ã  Constantupdatetorules

Ã  NotabletoCatchnomodesofFrauds

KeyHighlightsandChallenges

Transac=onData

LexisNexis

AccountsDatabase

PaymentData

Carddata

DashboardtoMatchData

NOT

AlertsfromRuleBasedSystem

Suspicious

RuleBasedAMLSolu=on


AMLSolu.on:FeatureBasedSolu.on(WalkPhase)Rulebase&Supervised&UnsupervisedLearningforAML

Ã  Featuresaremetadata(Extractedfromthedata)--averagebalanceoflast7days

Ã  Featureshelpalgorithmscaptureinforma=onfromthedata.

Ã  Featureengineeringisaformoflanguagetransla=on:Betweenrawdataandthealgorithm.

Ã  UsesSupervisedand/orunsupervisedMachineLearning

Ã  Quickclassifica=on

Ã  Lowfalseposi=verate-tweakedbasedonriskappe=te.

Keyhighlights

Transac=onData

LexisNexis

AccountsDatabase

PaymentData

Carddata

DashboardtoMatchData

NOT

AlertsfromMLBasedSystem

Suspicious

MachineLearning

Algorithms

HistoricalAlerts


TypeofMachineLearningandPoten.alUsage


NextGenAMLSolu.on:DataDrivenBasedSolu.on(DeepLearning)

Ã  Thealgorithmunderstandsmaliciousbehaviorthroughdata

Ã  Algorithmissmarttoworkwithoutfeatures-metadata

Ã  Doesnotneedalertsfortraining

Ã  Helpsiniden=fyinganykindofanomalousbehavior

Ã  Deeperinsightsaboutcustomer

Keyhighlights

Transac=onData

LexisNexis

AccountsDatabase

PaymentData

Carddata

NOT

SuspiciousDeeplearningAlgorithms

DataDrivenSolu=on


HighLevelSystemArchitecture:MAXROI&FutureProofSolu.onNoteJustforAML/Fraud

SourceData

(examples)

Data.gov

Accounts

Transac=ons

lexisNexis

Social

Real-TimeEventStreamingEngine

DynamicCustomerProfile/Risk

Appe=teModel

CentralDataLake

Real-.meIntelligentAc.on•  RiskSimilarity/RiskProfiling•  RelatedEn=tyAnalysis(graphdatabase)•  Fraud/SocialNetworkAnalysis•  Mul=-line“profitable”classcode•  Geospa=aldata•  Updatedriskappe=te

RiskScoringEngine(examples)•  Creditscore(ifallowedbyregulatoryagencies)•  Ra=ngaiributes(demograhics,geographic,

social,propertyaiributes)•  Likelihoodoffraud/risk(frequency/severity)

EnrichEventswithCustomer/Riskinfoand

ScoringModels

UpdateProfilesandScoringModels

External/3rdpartyDataSources

Na=veAPI

RestAPI

ODBC/JDBC

UpdateDataLake

Visualiza.on/Analy.calViews


KeyDeliverabletobuildBigDataSolu.on

Ã  Automa=ngDueDiligencearoundKYCdata–  Simpleinforma=oncollectedduringcustomeronboarding– Morecomplexinforma=onforcertainen==es–  Applyingsophis=catedanalysistosuchen==es–  Automa=ngResearchacrossnewsfeeds(LexisNexis,DB,TR,DJ,Googleetc)

Ã  EfficientCaseManagement

Ã  CaptureallDataSetatoneplace

Ã  ApplyingAdvancedAnaly=cs(twosubUseCases)–  ExploratoryDataScience–  AdvancedTransac=onIntelligence– MachineLearning/DeepLearning


BusinessAnaly.csMustEvolveToDealWithDataTippingPoint

PROVIDEINSIGHTINTOTHEPASTviadataaggrega.on,datamining,

businessrepor.ng,OLAP,visualiza.on,dashboards,etc.

UNDERSTANDTHEFUTUREviasta.s.calmodels,forecas.ngtechniques,machinelearning,etc.

ADVISEONPOSSIBLEOUTCOMESviarules,op.miza.onandsimula.onalgorithms


TheDataTippingPoint

DriversofaConnectedDataArchitecture


Ã  Afreeopensourcelinearlyscalableplavormhasonlybecomeavailablewithinthelastfewyears

Ã  Duetotheamountofregula=onoverthelast15yearsallbankenterprisecompliance,riskandfinancesystemsnowfunc=onessen=allythesameway

Ã  Bankspartneringwithanopensourcepartnerisverydifferentfrompartneringwithavendorwhodevelopsproprietarysoyware

Ã  Proprietarysoywarevendorswilladoptthenewstandardssinceitisintheirselfinteresttodoso

Ã  Regulatorscannowstreamlinetheirregulatoryprac=cesbyadop=ngaBigDatabasedapproach

Ã  HavingastandardsbasedOpenSourceplavormmeansthatregulatorscanusethesameplavormasthebanks

WhyWillThisWorkNow?


DigitalBankingSolu.onArchitecture

DistributedFileSystemStaging,Database,Structured,Unstructured,Archival,Document

DataOpera.ngSystemMul=-purposeplavormenablement

Governance&Integra.on BusinessWorkflow

Batch Search In-Memory Real-Time PivotalHAWQSQL Predic.ve

RetailBankingApps Marke.ngApps SVC

Storage

Processing

Applica.ons&Workloads

EnterpriseSecurity

NBA

RetailBankingEnterpriseData&ComputeLake

CustomerJourney

Social

RDBMS

Mainframe

DocumentMgmtSystems

DataSilos

CoreBanking

IndustryRef.

WebLogs

BankingSources

BusinessAnaly=cs

Other…

DataScience

BI&Repor.ng

SAS

BusinessLogicLayer

CloudCompu.ngStack(PublicorPrivate)PublicCloud,PrivateCloud,HybridCloudsuppor=ngafullstackofVMsandDocker


Q&A

How Big Data and Deep Learning are Revolutionizing AML and Financial Crime Detection

Technology