Ibm financial crime management solution 3

© 2009 IBM Corporation

Smarter Banking Solutions

IBM Financial Crime Management Solution

Overview and Solution Demo



Financial Crime Is On the Rise!

of businesses were victims of fraud

of banks failed to catch fraud before funds were transferred out

of fraud attacks, the bank was unable to fully recover assets

of businesses said they have moved their banking activities elsewhere

Only 20% of banks were able to identify fraud before money was transferred.

“The ROI of investing in fraud prevention is clear.”

58%58%

Source: Ponemon Institute/Guardian Analytics study, March, 2010Source: Ponemon Institute/Guardian Analytics study, March, 2010

80%80%

87%87%

40%40%

20%20%

A poll of 500 executives and owners of small and medium businesses showed:A poll of 500 executives and owners of small and medium businesses showed:



Fraud activities continue to rise

48% of fraud cases involve insiders

5% fraud activities cause 5% of pre-tax income for U.S. financial institutions

$1,000,000 Average loss when a high-level executive is involved

400% When an insider is involved, loss increases by an average 400%

A study in U.S. found:



Example: Common Types of Credit Card Fraud

Fraudulent possession of

card details (CNP Fraud)

Counterfeit Lost or StolenMail non-receipt fraud

Identity theft

Detect at application, activation and

account maintenance

Detect at Activation Detect at trax authorization

14% 7% 30% 26% 23%

Often organized crime

WesternCountriesWestern

Countries

Detect at trax authorization

Detect at trax authorization



Off-line Analysis and Investigation

Asynchronous Monitoring and Confirmation

Real-Time Automatic Decisioning and Approval

Precise Rules and High Performance

System

Challenge #1 – Follow up instead of intercept



Challenge 2 – Traditional Technology Can’t Process Large Transaction Volume

For example, a large international or regional bank’s credit card center

will have to detect over 10M transactions a day

= 623/second (99% confidence level) or 644/second (99.9%confidence level) or

663/second (99.99% confidence level)



Multiple activities usually involve in a fraud event

Many fraud patterns involve diverse systems and seemingly unrelated activities, e.g. multiple login attempts, followed by a combination of changes in PIN and contact information followed by an unusually large withdraw or transfer.

Challenge 3 – Traditional Technology Only Monitor Single Transactions



Event

!

What is Happening?What is Happening? When to Act?When to Act?

What Action?What Action?

Event Rules

Business Rules

Precise Event Rules and Business Rules Reduce False

Positive Rate

Challenge #4 – False Positive Rate Too High



Solution from Package Vendors

Transaction Score

Action

Model

Mode Description Disadvantage

Real-TimeTransaction scores in real time & recommendation send to authorization decisioning

High HW requirement

Online PlusScore is based on last transaction, send to authorization server for decision making

1st fraud transaction is lost

OnlineEnables analyst response, but no feedback to authorization

•No feedback to authorization decision•Detection response depend on analyst action

Near Online / Frequent Batch

Score batch send to analyst workstations at pre-determined time intervals

Time lag from transaction execution to analyst action may reduce effectiveness

Blackbox?Need vendor to change？

Other events (Change of Address, PIN error, replacement card, call center query, etc.)

1000’s Trax/Sec

Is environment developing too fast to train the models?

？？？？？？？？？？？？？？？？？？？？？

？？？

？？？？？？？？？？？？

？？？？？？？？？？？？

Performance?



Banks Require a Flexible and Expandable PlatformFlexible and Expandable Platform

Leverage strengths of existing systems that are cost effective, adopt best-of-breed alternatives to address deficiencies

An integrated crimes platform:1. Consolidates alerts across channels2. Conducts 2nd tier analytics3. Automates certain user activities

A consolidated and integrated operational organization (to the extent possible) addresses customer-based alerts

Integrated environment generates improved Business Intelligence which benefits tactical functions and enables strategic thinking

The Financial Crimes Steering Committee:1. Implements top-down policy based

on organization risk tolerance2. Prioritizes and manages initiatives3. Collaborates with stakeholders to

drive a smarter, safer business



IBM’s Smarter Way of Fighting Financial Crime

+ +

Instrumented Interconnected Intelligent



IBM’s Smarter Way of Fighting Financial Crime

Attitudinal DataInteraction DataBehavioral DataDemographic Data

Event Rules Profile Rules

Management Console

Transactional

& ChannelSystems

Historical Data

IBM Financial Crime Real-Time Detection & Prevention Solution

Event Detector

IBM Financial Crime Case Mgmt Solution

IBM Financial Crime

Analytics Solution



Effectively Prevent and Manage Financial Crime

Case Analysts use IBM Financial

Crime Analytics Solution to

discover patternsInvestigators use IBM Financial Crime Case Management Solution for investigation and

collaboration with bank’s auditing

department and law enforcement

Financial CrimeCases

Business Rules Analysts use IBM

Financial Crime Real-Time Detection &

Prevention Solution to turn patterns into rules that can be deployed

for real-time detection and prevention



IBM’s Smarter Way for Real-Time Financial Crime Detection

Events

Score

Actions1000’s trax/sec

Other Financial Crime-Related Activities

------------------

------------------

------------------

------------------

Watch List

Filtered financial crime Event

Event Rules

Profile Rules

Rules that can be customized and continually optimized by banks

Pre-filtering allows 100% potential events to pass through decisioning real-time without hurting performance

Automatically generated watch lists are used to monitoring selected fraud activities

Monitor any events relevant to financial crime activities

Change Password

Password Error

Report of Lost Card

Online Activation

Change of Addr


Smart Banking Solution

IBM Financial Crime Management Solution Architecture

Change Password

Report of Lost Card

Online Activation

Change of Addr

Payment

Banking Existing IT System

Business event

XML/JMS

WBE Event

association judgment

Filtered event and type

XML/JMS

ILOG anti fraud rule

Event rule

Customer history

behaviors

Event

score

Anti fraud

database

Case management



IBM Financial Crime Management Online Monitor Architecture

Exist system interface Recommend use JMS ， for asynchronous event process. Other supported interface:

SOAP 、 RDBMS 、 HTTP 、 SMTP 、 FTP 、 File Event server

Receive business event, execute event rule judgment, filter questionable transaction to rule engine for further process

Rule engine Score transaction based on event type, customer behavior model

Data mart Store customer, account, channel, merchant, tansaction log and etc.

Case management Push monitor result to case management platform for Investigator to process



Credit card online monitor process

Base event and

behavior rule

Event rule filter

Auth request

Process?

1. Create potential fraud case

2. Adjust customer base score

Cardholder :1.name2.job3.credit4.Expiry date5.other

Contact card holder1.MP2.SMS3.E-Mail

Customer info

Account info

Merchant info

Profiles:1.time2.merchant3.channel4.country5.Card holder6.History transaction score7.Behavior score

meet

Y

N

N

Y

R

R

R

R

Pass

Case management

process

UI

Triggered rule

Card info

Transaction log

investigate

Update fraud data1.increase2.decrease3.keep

Submit to higher level to process

>500

Y : YesB : NoR : Read

Channel info

Transaction log

W

W

<500

Pass



WBE event process server overview

Event cloud

Event cloud

Protocol exchange

Format exchange

Events

connector

ActionsWBE Runtime

connector

Database

JMS Push

History module

Topics

Dashboard

SOAPRDBMSHTTPSMTPFTPFileXSLJMS

JDBC

JDBC & SOAP

SOAPRDBMSHTTPSMTPFTPFileXSLJMS

Topics

WBE development

WBE object store lab

Relativity cache

Information based time sequence

Event cloud

Event cloud



Pre-Built Rules & Design Interface - WBE



Rule engine component view

Design

Maintain

Share

Deploy

Line Of Business

Production

Development

Rule Solutionsfor Office

Rule Studio

Rule TeamServer

Decision ValidationServices

Rule Repository

TransparentDecision Services

Rule ExecutionServer

Rules for COBOL

CustomWeb

Applications



Event rule sample case

Condition A:Transaction occurs between 0:00am to 6:00am

Condition B:Transaction ammount is lager then 2000

Condition C:3+ times transactions in passed 1 hour

and Potential transaction

TM01Condition A:Password was modified within today

Condition B:3+ times transactions in passed 1 hour

Condition C:Accumulative total amount is larger than 8000

and Potential transaction

TM02



Pre-Built Rules & Design Interface - iLog



Event rule implement sample



ILOG base score based on event type

get customer info, do fraud type check

based on fraud type, call related score table to score transaction

base on fraud score, generate fraud case and write in database

规则流

base score table based on event type

Event type AEvent type A

Event type AEvent type A

Score table AScore table A

Score table BScore table B

Event type CEvent type C

Event type and score table relationship （ N:1)



ILOG score base on customer behavior

when input event type meet this table, do condition match and adjust base score

Score table base on customer behavior model



Data Model



Generate potential fraud case

Input column：First column ： potential fraud typeSecond column ： transaction score

Output column：First column ： final fraud typeSecond column ： description of fraud

Generate potential fraud case based on event type and score



Management UI



Credit Card System (IBM Z)

Card Fraud Reference Deployment Model

ATM &Debit Card

InternetBanking

ACH etc

Credit Card Authorization

Module

Other SystemsOther Systems

Event EngineEvent Engine

------------------

------------------

------------------

------------------

Watchlist Generation Rules

Fraud Decisioning Rules

Event engine detects and maintains dynamic watchlists using pre-defined event rules

Event engine detects and maintains dynamic watchlists using pre-defined event rules11

Rules engine as a stage of the authorization process

Rules engine as a stage of the authorization process

22

Rules engine calls the dynamic watchlists and relevant CIF and historical data to make fraud scoring decision

Rules engine calls the dynamic watchlists and relevant CIF and historical data to make fraud scoring decision

33

Historical & Customer

Data

RuleEngineRule

Engine

Essentis / TriadEssentis / Triad

Event Engine supports high-performing detection on CICS

Contact Center / CRMContact Center / CRM

CIFCIF

DynamicWatchlistDynamicWatchlist

Event Detectors supports all major platforms

Transaction SystemsTransaction Systems

CreditCard



Retail Banking Fraud Reference Deployment

Source 1

Router

Source 2 … … …

TransactionProcessing

System

11 Transactions come from all sources

Transactions come from all sources

22 Router makes a duplicateRouter makes a duplicate

33 Main copy flows via existing route

Main copy flows via existing route

Duplicate copy is sent to IBM Financial Crime Mgmt SolutionDuplicate copy is sent to IBM Financial Crime Mgmt Solution

Router Process:-Wait if result from IBM Financial Crime Mgmt Solution arrives first-Wait only X msec if result from IBM Financial Crime Mgmt Solution hasn’t arrived

Router Process:-Wait if result from IBM Financial Crime Mgmt Solution arrives first-Wait only X msec if result from IBM Financial Crime Mgmt Solution hasn’t arrived

55

Need to reverse transaction is blocked by Router based on decision from IBM Financial Crime Mgmt Solution

Need to reverse transaction is blocked by Router based on decision from IBM Financial Crime Mgmt Solution

77

Router combines decision from existing system and IBM Financial Crime Management Solution and returns result to source system

Router combines decision from existing system and IBM Financial Crime Management Solution and returns result to source system

66

44



Deliver project team sample

Recommend project team: Business consultant: analysis customer business and develop requirement System architecture ： analysis requirement, design data mart and rules for event

server/rule engine WBE developer ： develop WBE rule and integrate with front system iLog developer: develop iLog rules Database admin ： create/maintain database and customer/account /etc data UI developer ： customize case management

SWG resource SWG Industry Solution Team Industry Solution Service CDL/LBS



System Configuration Option

Starter Configuration Extreme Configuration

Event Engine WebSphere Business Events WebSphere Business Events for Z/OS

Rules Engine ILOG JRules ILOG JRules for Z/OS (Rules Engine on Z)-- or -

ILOG Rules for COBOL (Rules Hosted on Z)

Event Detector

CICS Events for WebSphere Business Events SupportPac (enable CICS TS v3 as an emitter of events in a format directly consumable by WebSphere Business Events)

Rules Development

ILOG Rule Studio

ILOG Rule Team Server

ILOG Rules Solution for Office

WebSphere Business Events Design Tool

Monitoring

(Optional)

WebSphere Business Monitor

Integration

(option)

WebSphere Message Broker, WebSphere DataPower, WebSphere MQ

Full rule life cycle benefits of JRules BRMS on zOS using all JRules products.

- Rule execution close proximity to the data on zOS- Rule versioning and controlRules administration- Testing and SimulationContains Hot Deployment option

Core business rule mgmt benefits of JRules while retaining your existing COBOL architecture- Rule execution as COBOL code - Performance is not a concern- Close proximity to the data on the mainframe- Rule versioning and control- Fits into their application development standards- New technology but with a familiar face



Demo 1: Card Fraud Detection



Demo 2: Online Banking Fraud Detection



Summary



IBM Solution is Uniquely Positioned

IBM Financial Crime Management Solution Legacy Solutions from ISVs

Performance Fully supporting IBM Z/OS and providing decisioning capability at high performance.

“It depends”?

Rules and Model Mgmt

Rules and models are owned and managed by bank “Black box”

Capability to monitor multiple systems

IBM complex event engine uses event detector to monitor different systems to increase accuracy of decisioning

Mostly only for transaction decisioning with high false positive rates.

Capability of Real-Time Detection

IBM event engine produces real-time, dynamic watchlists for rules engine to make precide decisions.

Trade off between performance and effectiveness?

Expandability Banks can utilize this platform for future AML, customer churn management and real-time cross-selling projects.

Single-purpose, point solution reduces ROI.

Implementaiton

Powerful technical support from IBM. ???



Prospecting Questions

1. Is there a dedicated organization for financial crime management or AML?

2. Is there a roadmap for AML or Anti-Fraud?

3. How much does the bank suffer from fraud activities in credit card and other payment transactions?

4. Has the bank been fined by regulators for money laundering related activities?

5. If the bank uses foreign packages for AML and Fraud management, does the bank feel having control and ownership to adapt to the fast-changing environment and fraud patterns?

6. Show the demo.

7. Will you be interested in:

- Financial Crime Assessment & Planning Workshop?

- Financial Crime Rules Discovery Workshop?

- Financial Crime Proof of Concept / Technology / Value Workshop?