Network Analysis

Constructs a dynamic graph of nodes (accounts, individuals, businesses) and edges (transactions, shared identifiers) to visualize the financial ecosystem. This moves beyond isolated transaction monitoring to reveal the structural context of every interaction.

• Links accounts through shared phone numbers, email addresses, or device fingerprints
• Identifies beneficial ownership chains through multi-hop corporate structures
• Reveals nominee directors and shell corporations by clustering shared addresses

Applies graph algorithms like Louvain and Label Propagation to partition the network into densely connected subgraphs. These communities often correspond to organized criminal rings, money mule networks, or coordinated fraud cells.

• Detects tightly-knit clusters operating below individual alert thresholds
• Identifies broker nodes that bridge otherwise separate criminal communities
• Reveals layering loops where funds circulate through controlled accounts

Calculates mathematical measures of node importance to identify the key players in a criminal network. Metrics like betweenness centrality expose the facilitators who control information and money flow, while eigenvector centrality reveals those connected to other powerful nodes.

• Pinpoints ring leaders who direct operations without directly handling funds
• Identifies critical chokepoints for law enforcement intervention
• Ranks entities by structural influence, not just transaction volume

Uses machine learning on graph topology to predict undisclosed connections between entities. By analyzing structural similarities and common neighbors, the system infers relationships that have been deliberately obscured through layering or nominee structures.

• Surfaces probable beneficial owners behind opaque shell companies
• Predicts future collusion based on structural proximity patterns
• Generates high-probability leads for enhanced due diligence investigations

Examines how the network evolves over time, tracking the formation and dissolution of relationships. This temporal dimension is critical for identifying the sequencing of layering and distinguishing legitimate business networks from rapidly assembled criminal structures.

• Detects burst patterns where dormant accounts suddenly activate in coordination
• Tracks the lifecycle of shell corporations from creation to dissolution
• Identifies smurfing campaigns by analyzing synchronized micro-transaction timing

Searches for structural signatures that match known money laundering typologies, such as circular flows, fan-out/fan-in patterns, and bipartite structures indicative of trade-based money laundering. Graph neural networks learn to flag subgraphs that deviate from normal financial topology.

• Identifies circular transaction loops characteristic of layering
• Detects money mule fan-out patterns where funds disperse to multiple accounts
• Flags bipartite trade networks with inflated invoice values

A class of deep learning models designed to operate directly on graph-structured data. Unlike traditional models that require flat feature vectors, GNNs learn representations by aggregating information from a node's neighborhood. In AML, GNNs excel at link prediction to identify hidden relationships and node classification to flag high-risk entities. Key architectures include Graph Convolutional Networks (GCNs) and Graph Attention Networks (GATs), which assign varying importance to different connections during message passing.

The algorithmic partitioning of a network into clusters of densely connected nodes, revealing hidden structures within transaction graphs. Techniques like the Louvain algorithm and Label Propagation identify tightly-knit groups that often correspond to fraud rings or money laundering cells. By isolating these communities, investigators can uncover collusive behavior that is invisible when examining individual accounts in isolation. A sudden shift in community affiliation can also signal account takeover.

A set of metrics quantifying a node's importance within a network. Degree centrality counts direct connections, betweenness centrality identifies nodes acting as critical bridges between clusters, and eigenvector centrality measures influence by weighting connections to other high-importance nodes. In financial crime, a shell corporation acting as a hub for layering will exhibit high betweenness centrality, while a key organizer in a criminal ring will show high eigenvector centrality.

A machine learning task that estimates the likelihood of a future or missing connection between two nodes. In AML, link prediction is used to infer undisclosed beneficial ownership or anticipate the next transaction in a layering sequence. Models are trained on known graph structures and learn heuristics like common neighbors and Adamic-Adar index. A high-probability predicted link between a low-risk account and a known high-risk entity triggers an immediate enhanced due diligence review.

The extension of network analysis to incorporate the dimension of time, modeling how relationships evolve. A dynamic graph captures the sequence and velocity of transactions, not just their existence. This enables the detection of burst activity—a rapid formation of connections followed by dissolution, a classic hallmark of smurfing operations. Techniques like temporal random walks and time-aware graph embeddings capture these evolving patterns that static graphs miss entirely.

The process of transforming nodes, edges, or entire subgraphs into low-dimensional vector representations that preserve structural properties. Algorithms like Node2Vec and GraphSAGE generate embeddings where nodes with similar network roles are close in vector space. These embeddings serve as feature inputs for downstream machine learning models, enabling clustering, visualization, and anomaly detection. A node's embedding drift over time is a powerful signal for concept drift in behavioral profiles.