FIELD OF THE INVENTION

The presented disclosure relates to computer technology, and more particularly to computerized systems and methods for detecting unauthorized or suspicious financial activity, e.g. money laundering, terrorist financing, human trafficking, stealing via an unauthorized money transfer from a possibly legitimate account, and the like.

BACKGROUND OF THE DISCLOSURE

Financial institutions—including banks, brokerage firms and insurance companies—have legal and business pressures to fight money laundering and other illegal activity. For example, financial institutions are required by law to monitor and report suspicious activities that may relate to money laundering and terrorist financing. The pertinent laws presently include the Bank Secrecy Act and the USA PATRIOT Act in the United States, the Third EU Directive in Europe, Articles on the Criminalization of Money Laundering in Japan, and others. As such, anti-money laundering (AML) compliance officers must create and maintain an effective transaction monitoring program to keep up with evolving regulations and control their AML program costs. Missteps could result in fines and reputational damage.

Fraudulent transactions, such as unauthorized withdrawals or transfers, may lead to large financial losses and lead to reputational losses.

Suspicious activities, patterns and transactions may have to be reported to authorities in accordance with corporate rules, local laws and/or national and international regulations. In some cases, these reports must be sent within specific timeframes, e.g. 48 hours.

Financial institutions use computers to store financial data on financial transactions as well as perform some transactions such as Electronic Fund Transfers (EFT), credit card transactions, and others. The computers can be used to identify unusual transactions and activity patterns, and detect the activities that are suspicious with regard to potential money laundering or terrorist financing or other illegal purposes.

In view of large amounts of data that need to be processed to detect suspicious activity, and the short deadlines dictated by law or business necessity, improved computer techniques are desired to stop financial crime.

SUMMARY

This section summarizes some features of the invention.

Some embodiments of the present disclosure use machine learning techniques based on Artificial Neural Networks (ANN) to detect suspicious activity and identify the pertinent accounts, people, companies, devices (e.g. computers, phones, Network Interface Cards, etc.), addresses, and/or other entities. Further, some embodiments calculate a risk score that a given entity is engaged in an unauthorized activity.

As is well known, machine learning (ML) techniques may or may not provide reliable results for any particular problem depending on the type of the Artificial Neural Network (ANN) and on data preparation, i.e. the kind of input data provided to the ANN. Further, machine learning techniques can be slow if the ANN algorithms are complex and the amount of data is large. In financial crime prevention, fast detection of suspicious activity can be critical to stop illegal flow of money or other valuables. Speed can also be important for retraining the machine to take account of changing legal, political, and business landscapes. But high processing speed and obtaining reliable results are conflicting goals because high reliability may require more detailed data and more complex, and hence slower, processing.

The inventors have discovered that both relatively high speed and high reliability can often be obtained using Graph Convolutional Neural Networks (GCN, sometimes also called GCNN or CGN) if the financial input data are suitably prepared. In this technique, financial data are represented as a graph. In a conventional graph representation for GCN, some information is associated with graph nodes (vertices), while other information is associated with graph edges. Selecting the kind of information to associate with a node or an edge is an important decision with regard to GCN reliability and speed. According to some embodiments of the disclosure, nodes are used to represent entities, and edges represent transactions or other relationships between the entities. Further, even related information on an entity can be represented by different nodes. For example, in some embodiments, an account entity is represented by one node; the account's owner is represented by a different node (rather than being an attribute of the account node); and the ownership relationship is represented by an edge between the two nodes. A family or business relationship between parties can also be represented by an edge. Thus, some embodiments use separate nodes to represent accounts, other nodes to represent parties, and optionally still other nodes to represent addresses, devices, etc. An address can be a complete street address, or a partial address (e.g. a country name and/or a city name and/or some other address portion). An address can also be an IP address, an email address, a layer-2 network address, or some other address recognized in computer networks. Such representation is believed to improve GCN reliability for many GCN types according to the present disclosure.

In some embodiments, information can be duplicated in different node types. For example, an account owner's name can be provided both in the owner's node and the account's node. In other embodiments, information is not duplicated: the account owner, the associated device, etc. are identified and described only in the respective nodes.

Further, in some embodiments, the financial data are aggregated before being provided to the GCN. Aggregation is performed to reduce the amount of data handled by the GCN and thus to increase the processing speed while reducing memory requirements. Generally, aggregation results in loss of information, and may therefore reduce reliability of the results. Aggregation should be performed to discard unimportant information while preserving essential information for reliable detection of suspicious entities. In some aggregation embodiments according to the present disclosure, the monetary amounts on individual transactions performed in a particular period of time are aggregated into averages and/or medians and/or maxima and/or minima and/or some other aggregated values. Further, for a given entity (e.g. account), separate aggregation is performed for transactions in which the entity is a transaction source, and separate aggregation is performed for transactions in which the entity is a destination. Also, separate aggregation may be performed for each transaction channel (e.g. online banking, ATM, etc.) and/or each transaction type (e.g. online money transfer) involving the entity. Such aggregation techniques preserve essential information to provide more reliable results.

The invention is not limited to the features or advantages described above. Also, some embodiments use one or more but not all of the techniques described above. For example, in some embodiments, the nodes and entities are defined as described above, but the aggregation is not performed per source or destination. In other embodiments, the aggregation is performed as described above, but the nodes are defined in a simpler manner, e.g. each account corresponds to a separate node, but the account owners and other account information are not associated with separate nodes but are stored as attributes of the account node. Other embodiments and variations are within the scope of the invention, as described by the present disclosure.

