Case Study II

Problem Description

This case study was conducted to evaluate the potential of supporting the processing of an audit issue, which was raised for a dedicated business region. The goal was to gain general insights and evaluate if our approach retrieves structure of interest for AML experts.

The analyzed region consisted of approximately 81700 accounts and 513000 transactions. Trans- actions to and from external accounts were not used for the identification of the structures in TMatch, but added to the visualizations. Exclusion from the structure identification is justified by the fact that the quality of available data does not allow to identify external accounts uniquely for each external transaction.

Two base pattern matchers were applied:

• A High Value Path pattern matcher which added each connection between nodes exceeding and aggregated amount of 1 Mio CHF to the alert graph

• A Sum Chain Pattern matcher (based on the ChainFinder) which added Sum Chains ex- ceeding an aggregate value of 10000 CHF to the alert graph

Weakly and stronlgy components were identified and logged separately5_.

Results

The following number of components were identified for the different settings:

High value path components (strongly connected) with Size≥4: 10 Components were iden- tified. Table 4.2shows the number of identified components and their size. Only 0.06% of all analyzed accounts are part of a high value path component.

Figure4.9shows the biggest component of size 13. The size and density of this component is very unusual and was confirmed to be of high interest for AML and Compliance issues.The account marked red is a numbered account. The intense interconnections may indicate that the

5_{A component is strongly connected if for each pair of nodesn}

i,njin the component there is a path fromnitonj, and

a path fromnjtoniwhere the path fromnitonjmay contain different nodes and edges than the path fromnjtoni(see

[Wasserman and Faust, 1994] In contrast to [Wasserman and Faust, 1994] we denote each connected component which is notstronglyconnected asweaklyconnected for simplicity

Numer of components Size 1 13 1 7 1 6 1 5 6 4

Number of components: 10 Number of nodes within components 55

Table 4.2:Strongly connected high value path components

involved accounts have the same beneficial owner. While this is not necessarily indicating suspi- cious activity, it is of interest whether the assumptions this pattern suggests match the knowledge and KYC6_{documentation of the responsible customer advisors. If the observed behaviour cannot}

be justified with the available information in the client history, the KYC principle may be violated and a detailed investigation is necessary.

Figure 4.9:A component of high interest containing a numbered account (marked red)

Numer of components Size 1 254 1 24 1 13 2 11 1 10

Number of components: 6 Number of nodes within components: 323

Table 4.3:Weakly connected high value path components

High value path components (weakly connected) with Size ≥10: Due to the lower restric- tions of weakly connected component, the minimal size was set to 10 nodes. Table4.3shows the number of identified components and their size.

The very large size of one component proposes experimenting with more restrictive high value paths in future. Extensive expert investigation, which was out of scope in this case study, may help to find the most suitable parameter settings. Figure4.10gives an example of a weak compo- nent of size 11. The component visualization was enriched with edges below the threshold level of one million for investigation.

Figure 4.10:Example weakly connected high value path component

Sum chain components (strongly connected): The use of an account as a mere passage point may result in sum chains. These pattern may have perfectly legal reasons, for example emerge from dedicated company structures or may have illegal motivation (in particular layering [Al- tenkirch, 2006]) The idea of this analysis, combining the ChainFinder and TMatch, was to evalu-

Numer of components Size

1 16

1 6

1 5

8 3

Number of components: 11 Number of nodes within components: 51

Table 4.4:Strongly connected sum chain components

ate if complex structures consisting of Sum Chains exist, and if yes, how common they are. Table

4.4shows the number of identified components and their size.

Figure4.11visualizes the biggest component of size 16. The star structure, which is indicated in the component scoring by a high maximum centrality (1), is of limited interest. The sum chains may have randomly occurred.

Figure 4.11:A strongly connected sum chain component of limited interest

In contrast, Figure4.12shows a strongly connected component (for internal nodes) which is of high interest. The structure exhibits numerous intersecting high value sum chains (simplified numbers), which is very uncommon.

Fig.4.13shows the same structure enriched with connections not being part of sum chains.

Sum chain components (weakly connected) with size≥5 Table4.5shows the number of identi- fied components and their size. The presence of a component of size 753 is striking. A component of this size is not suitable for investigation neither for TVIS in the current release nor for a human expert. The proposed way to evaluate such a component is therefore to run a more restrictively

Figure 4.12:A strongly connected sum chain component

Figure 4.13:Enriched component visualization with all transactions

Numer of components Size

1 735 1 16 1 13 1 8 6 7 4 6 4 5

Number of components 18 Number of nodes within components: 858

configured instance of TMatch on this component and analyse the resulting subcomponents. The fact that one huge component repeatedly occurred in a number of settings (cf. Table4.3and4.7), proposes the extension of TVIS to provide optimized visualization of big components (see chap- ter5). The component of size 16 exhibits another complex structure consisting of sum chains (Figure4.14).When the minimal amount for sum chains was raised to one million, 13 components remained (Table4.6).

Numer of components Size

2 10

2 7

4 6

5 5

Number of components 13 Number of nodes within components: 83

Table 4.6:Weakly connected sum chain components II