Peer Group Analysis

The foundation of accurate analysis lies in dynamic segmentation rather than static categories. Entities are grouped based on multi-dimensional behavioral attributes—such as transaction volume, geographic location, industry vertical, and account age—that are recalculated periodically.

• Behavioral Clustering: Uses unsupervised algorithms like k-means on normalized feature vectors
• Temporal Relevance: Groups update as entity behavior evolves, preventing stale comparisons
• Granularity Control: Balances homogeneity within groups against statistical significance of the cohort size

A business that grows 300% year-over-year should eventually migrate to a higher-activity peer group rather than permanently flagging as anomalous.

Outlier detection within a peer group requires robust statistical methods that resist distortion from the outliers themselves. Median Absolute Deviation (MAD) and interquartile range are preferred over standard deviation when distributions are heavy-tailed.

• Z-Score Calculation: Measures how many standard deviations an entity's activity is from the peer mean
• Percentile Ranking: Flags entities exceeding the 95th or 99th percentile of the cohort distribution
• Multivariate Distance: Mahalanobis distance accounts for correlations between features like velocity and amount

A single $50,000 wire may be normal for a corporate treasury peer group but represents a 99.9th percentile event for a small retail business cohort.

Not all deviations carry equal risk. Effective systems apply weighted risk factors to different attributes based on their correlation with known suspicious activity. Transaction velocity and cross-border activity typically receive higher weights than transaction count alone.

• Risk Factor Calibration: Weights derived from historical SAR conversion rates per attribute
• Composite Risk Scoring: Aggregates weighted deviations into a single interpretable score
• Explainability Preservation: Each attribute's contribution to the final score remains traceable

A 200% deviation in wire transfer frequency to high-risk jurisdictions triggers a higher composite score than an equivalent deviation in domestic ACH volume.

Peer behavior is not static; it exhibits seasonality, cyclical trends, and regime shifts. Effective analysis establishes rolling baselines over configurable lookback windows to distinguish genuine anomalies from predictable variance.

• Rolling Windows: 30, 90, or 365-day windows capture different seasonality patterns
• Trend Decomposition: Separates baseline signal into trend, seasonal, and residual components
• Change Point Detection: Identifies when the underlying peer group distribution has fundamentally shifted

Retail peer groups exhibit predictable 40% transaction volume spikes in November-December; a similar spike in March would be a true anomaly warranting investigation.

The primary operational challenge is alert fatigue from excessive false positives. Advanced systems incorporate suppression rules and secondary validation checks before generating alerts.

• Threshold Hysteresis: Requires sustained deviation across multiple periods before alerting
• Corroborating Signal Requirement: Demands deviation in at least two independent attributes
• Whitelist Integration: Suppresses alerts for pre-vetted legitimate outlier scenarios

A one-time large transaction from a known payroll funding event is suppressed, while the same transaction from a dormant account with a new beneficiary triggers an alert.

Accurate peer grouping depends on resolving fragmented entity records before analysis. A single criminal enterprise operating across multiple shell companies will appear as several normal entities unless unified.

• Graph-Based Resolution: Links entities sharing addresses, phone numbers, or beneficial owners
• Fuzzy Name Matching: Accounts for typos, transliterations, and alias variations
• Consolidated Profiling: Merges transaction history of linked entities into a single behavioral profile

Five shell corporations each transacting just below the CTR threshold appear innocuous individually but collectively reveal a clear structuring pattern when resolved to a single controlling party.