Technologies for Detecting Money Laundering - MIT CSAILgroups.csail.mit.edu/mac/classes/6.805/articles/money/ota-money... · Technologies for Detecting Money Laundering t the core

Technologies forDetecting

MoneyLaundering

t the core of all wire transfer monitoring proposals areone or more computer technologies. Many of thesetechnologies rely upon techniques developed in the fieldof artificial intelligence (AI). Others involve computer

graphics and statistical computing. Wire transfer monitoring pro-posals generally involve a combination of technologies, institu-tional structures, and reporting requirements. Four of thesecombinations are presented as options in chapter 7. However, alimited set of technologies and their relative capabilities form thecore of each option.

This chapter discusses two topics central to understandingthese technical options and the policies surrounding their use.The first section introduces several basic technologies that areemployed in one or more options. The second section discusseschallenges that must be overcome by all options. These chal-lenges involve characteristics of wire transfer data and moneylaundering profiles.

BASIC TECHNOLOGIESThere are at least four categories of technologies that may be

useful in the analysis of wire transfers. These technologies can beclassified by the task they are designed to accomplish:

� wire transfer screening to determine where to target further in-vestigations,

� knowledge acquisition to construct new profiles for use duringscreening,

� knowledge sharing to disseminate profiles of money launder-ing activities quickly, reliably, and in a useful form, and

| 51

52 | Information Technologies for Control of Money Laundering

Figure 4-1: How Technologies Relate to Each Other

��

� data transformation to produce data that can beeasily screened and analyzed.

Each category of technology is used in the tech-nical options discussed in chapter 7. Screening isused in all options, knowledge acquisition insome, data transformation in most, and knowl-edge sharing in some of the options. Figure 4-1shows the relative roles of these technologies inwire transfer analysis systems.

❚ Wire Transfer ScreeningWire transfer screening is the heart of all optionsdiscussed in chapter 7. Technologies for screeningwire transfers include knowledge-based systemsand link analysis. Knowledge-based systems auto-matically make inferences about wire transfersand other data. Effective use of knowledge-basedsystems requires effective knowledge acquisi-tion—a way of constructing profiles of moneylaundering. Effective knowledge acquisition, inturn, requires either human experts who knowhow to reliably screen wire transfers or a largesample of data that are “labeled” to indicate wiretransfers of the sort that should be identified by aworking system. Link analysis helps identify rela-tionships among individual accounts, people, andorganizations. Effective use of link analysis re-quires a variety of readily available data, some of

which provide reliable indicators of money laun-dering activity.

Some technical options use a knowledge-basedsystem exclusively. Others initially screen all wiretransfers using a knowledge-based system andthen allow analysts to scrutinize some or all trans-fers using link analysis. In the latter case, theknowledge-based system can be used to filtertransfers—only passing on some transfers to thenext stage of analysis—or the knowledge-basedsystem can be used to derive additional data—passing on all transfers along with the additionalderived data. The latter use is analogous to onepart of the Financial Crimes Enforcement Net-work (FinCEN) Artificial Intelligence System(FAIS) (see box 4-1).

Banks already use a set of relatively simple sys-tems to screen transactions for illicit conduct.Some of these systems screen currency transac-tions to identify those which indicate “structur-ing”—a series of transactions designed to evadecurrent reporting requirements (e.g., five depositsof $3,000 each in a single day). Other systemsmonitor wire transfers to look for countries or in-dividuals that appear on a list compiled by Trea-sury’s Office of Foreign Assets Control (OFAC).While these systems are quite simple in compari-son with the configurations discussed in chapter 7,they are examples of how such systems can be in-

Chapter 4 Technologies for Detecting Money Laundering | 53

Box 4-1: The FinCEN Artificial Intelligence System

&0-� �16�� 9;1.1+1)4� �6;-441/-6+-� %@:;-5� ��%�� 1:� +<99-6;4@� <:-,� ;7� 897+-::� )6,� )6)4@A-� )44� 9-C

879;:� 9-+-1=-,� <6,-9� ;0-� �)63� %-+9-+@� �+;� ��%�� -)94@� )44� �579-� ;0)6� �� 8-9+-6;�� 7.� ;0-:-� 9-879;:

)9-� �<99-6+@� &9)6:)+;176� $-879;:� ��&$:�� &0-� �6;-96)4� $-=-6<-� %-9=1+-� ��$%�� -;971;� �758<;-9� �-6;-9

)6,� ;0-� '�%�� <:;75:� %-9=1+-� �);)� �-6;-9� +744-+;� )6,� :;79-� �%�� 9-879;:�� %� ),,:� =)4<-� *@� 416316/

)6,� -=)4<);16/� ;0-:-� 9-879;:�

��%� <:-:� ;09--� *):1+� ;@8-:� 7.� ,);)�� %�� 9-879;:D9-.-99-,� ;7� ):� ��)9-� <:-,� ,19-+;4@�

&9)6:)+;176:� ;0);� +)6� *-� )::7+1);-,� >1;0� ;0-� :)5-� 8-9:76� 79� *<:16-::� )9-� <:-,� ;7� +9-);-� )� 6->� ,);)

-4-5-6;� +)44-,� )� �� &9)6:)+;176:� ;0);� +)6� *-� )::7+1);-,� >1;0� ;0-� :)5-� *)63� )++7<6;� )9-� <:-,� ;7

+9-);-� )6� -4-5-6;� +)44-,� )6� �� &0-� /97<816/� 7.� ;9)6:)+;176:� 16;7� :<*2-+;:� )6,� )++7<6;:� 1:� )+C

+75841:0-,� *@� -?)51616/� 16.795);176� 16� ;0-� ;9)6:)+;176:� �-�/�� 6)5-�� ),,9-::�� :7+1)4� :-+<91;@� 6<5*-9��

�.� ;0-:-� 1;-5:� )9-� :<..1+1-6;4@� :1514)9�� ;0-6� ;>7� ;9)6:)+;176:� )9-� )::<5-,� ;7� *-476/� ;7� ;0-� :)5-� :<*2-+;�

&0-:-� ;09--� ;@8-:� 7.� ,);)� -4-5-6;:D;9)6:)+;176:�� :<*2-+;:�� )6,� )++7<6;D)9-� )6)4@A-,� *@

)67;0-9� +75876-6;� 7.� ��%�� )� 367>4-,/-C*):-,� :@:;-5�� 16�� :� 367>4-,/-C*):-,� :@:;-5� 1:

,-91=-,� .975� )� :@:;-5� 791/16)44@� ,-=-478-,� );� ;0-� '�%�� <:;75:� %-9=1+-� .79� :+9--616/� �&$:�� &0-� 367>4C

-,/-� *):-� .975� ;0-� �<:;75:� �9;1.1+1)4� �6;-441/-6+-� %@:;-5� ��%�� >):� 9-C-6/16--9-,� ;7� .<6+;176� >1;0

�16�� :� :@:;-5�� )6,� 1:� +76;16<)44@� <8,);-,� ;7� 9-.4-+;� +0)6/-:� 16� 576-@� 4)<6,-916/� 5-;07,:�� &0-

367>4-,/-C*):-,� :@:;-5� +75876-6;� 7.� ��%� 1:� <:-,� ;7� -=)4<);-� ;0-� :<:81+17<:6-::� 7.� ;9)6:)+;176:�

:<*2-+;:�� )6,� )++7<6;:�� ):-,� 76� 16,1+);79:� ;0);� )88-)9� ,19-+;4@� >1;016� ;9)6:)+;176:�� )6,� 76� ),,1;176)4

16,1+);79:� +)4+<4);-,� .975� ;07:-� ;9)6:)+;176:�� %� )::1/6:� )� 6<5-91+� :<:81+17<:6-::� :+79-� ;7� -)+0

;9)6:)+;176�� :<*2-+;�� )6,� )++7<6;�

!6� ;0-� *):1:� 7.� ;0-:-� :+79-:� )6,� :-=-9)4� 7;0-9� +91;-91)�� 16�� )6)4@:;:� :-4-+;� :<*2-+;:� )6,� )+C

+7<6;:� .79� .<9;0-9� 16=-:;1/);176�� &01:� 16=-:;1/);176� 1:� )++75841:0-,� >1;0� ;0-� 4163� )6)4@:1:�� +75876-6;� 7.

��%�� 163� )6)4@:1:� 1:� <:-,� ;7� 1,-6;1.@� 6-;>793:� 7.� .16)6+1)4� )+;1=1;1-:� ;0);� 0-48� ;7� ,1:;16/<1:0� *-;>--6

4-/1;15);-� *<:16-::� )+;1=1;1-:� )6,� 576-@� 4)<6,-916/�

��%� <:-:� )� =)91-;@� 7.� +755-9+1)4� 0)9,>)9-� )6,� :7.;>)9-�� &0-� :@:;-5� 9<6:� 76� )� �C897+-::79

%8)9+�-6;-9� �� :-9=-9� )6,� :-=-9)4� %8)9+%;);176� >793:;);176:� .975� %<6� �1+97:@:;-5:�� 6+�� &0-� ,);)C

*):-� +75876-6;� <:-:� )6� %#�� :-9=-9� .975� %@*):-�� 6+�� ;0-� 367>4-,/-C*):-,� +75876-6;� <:-:� -?C

8-9;� !*2-+;� .975� -<976� �);)�� 6+�� ;0-� 4163� )6)4@:1:� +75876-6;� <:-:� �&��"� .975� ��&�� 6)4@;1+:�� 6+�

�6� ),,1;176� ;7� :<*:;)6;1)4� :7.;>)9-� ,-=-4785-6;� ,76-� >1;016� ;0-:-� 897,<+;:�� :75-� ),,1;176)4� 8)9;:� 7.

��%� >-9-� ,-=-478-,� <:16/� ;0-� 4)6/<)/-� �� )6,� <:16/� !8-6� �6;-9.)+-� .975� -<976� �);)�� 6+�

��%� 0):� *--6� 78-9);176)4� :16+-� �)9+0� �� )6,� 897+-::-:� )8897?15);-4@� �� ;9)6:)+;176:

8-9� >--3�� :� 7.� �)6<)9@� �� 5144176� ;9)6:)+;176:� 0),� *--6� -6;-9-,�� 4163-,�� )6,� -=)4<);-,�� 9-:<4;C

16/� 16� �� 5144176� +76:741,);-,� :<*2-+;:� )6,� �� 5144176� )++7<6;:�� :� 7.� �)@� �� ;0-� :@:;-5� 0),� /-6-9C

);-,� 7=-9� � 16=-:;1/);1=-� :<8879;� 9-879;:� +799-:876,16/� ;7� 7=-9� �� *144176� 16� 87;-6;1)44@� 4)<6,-9-,

.<6,:�� 16�� 0):� 9-+-1=-,� 7=-9� 76-� 0<6,9-,� .--,*)+3� .795:� .975� 7<;:1,-� )/-6+1-:�� ):� >-44� ):� 16;-9C

6)4� .--,*)+3�� !=-9� �� 8-9+-6;� 7.� ;0-� .--,*)+3� 16,1+);-:� -1;0-9� 6->� +):-:� 78-6-,� 79� 9-4-=)6+-� ;7� 76C

/716/� 16=-:;1/);176:�

______________� �79� ),,1;176)4� ,-:+918;176� 7.� �16�� :--� +0)8;-9� �� %--� 5)16� ;-?;� .79� )6� -?84)6);176� 7.� 367>4-,/-C*):-,� :@:;-5:� )6,� 4163� )6)4@:1:�

%!'$��%�� &-,� %-6);79�� 16)6+1)4� �915-:� �6.79+-5-6;� -;>793�� 8-9:76)4� +755<61+);176:�� )9+0� �� C� �<6-� �� '�%�� &9-):<9@�

�16)6+1)4� �915-:� �6.79+-5-6;� -;>793�� B�16�� 9;1.1+1)4� �6;-441/-6+-� %@:;-5�� )+;� %0--;�� 67� ,);-�� &-,� %-6);79�� -69@� �74,*-9/�

�-99@�(77;76��);;0->��7;;161�� '5)9��0)6��091:;16)��416/-9��(16:;76��4)5):��1+0)-4��)9976-�� )6,�$)80)-4�(76/�� B&0-� �16��

�9;1.1+1)4� �6;-441/-6+-� %@:;-5�� ,-6;1.@16/� "7;-6;1)4� �76-@� �)<6,-916/� .975� $-879;:� 7.� �)9/-� �):0� &9)6:)+;176:��

�� .79;0+7516/��


BOX 4-2: Current Monitoring and Compliance Systems

20)� &%1.6� %1(� :-5)� 75%16*)5� 6<67)06� %/5)%(<� ,%9)� 6<67)06� 7,%7� );%0-1)� '855)1'<� %1(� :-5)

75%16%'7-216�� !,)6)� 6<67)06� %5)� 68&67%17-%//<� /)66� 623,-67-'%7)(� 7,%1� 620)� 352326)(� 6<67)06� *25� :-5)

75%16*)5� 021-725-1+�� 2:)9)5�� 7,)<� ,)/3� -1(-'%7)� 7,)� 67%7)� 2*� '855)17� &%1.� 6<67)06� %1(� 7,)� )19-5210)17

:-7,-1� :,-',� 1):� 6<67)06� :28/(� 23)5%7)�

Currency Transaction Reporting�6� 127)(� -1� &2;� >�� 855)1'<� !5%16%'7-21� �)32576� ��!�6�� %5)� *-/)(� :,)1� %� '86720)5� ()326-76

29)5� �� -1� '%6,�� 2:)9)5�� &%1.6� %/62� /22.� *25� )9-()1')� 2*� ��?%� 6)5-)6� 2*� 60%//)5� '%6,

75%16%'7-216� 7,%7� %5)� -17)1()(� 72� )9%()� 5)3257-1+� 5)48-5)0)176�� 9)1� 7,28+,� 7,)6)� ()326-76� %5)� 81()5

7,)� �� 7,5)6,2/(�� 7,)<� 6,28/(� &)� 5)3257)(� &)'%86)� 7,)<� 0%<� -1(-'%7)� 021)<� /%81()5-1+�

�%1.6� %1(� '200)5'-%/� 62*7:%5)� 9)1(256� ,%9)� ()9)/23)(� 6<67)06� 7,%7� %++5)+%7)� 08/7-3/)� '85>

5)1'<� ()326-76� 29)5� 63)'-*-'� 3)5-2(6� �868%//<� (%<6� 25� :)).6�� 25� );%03/)�� ,%6)� �%1,%77%1� �%1.�

�� %� /%5+)� 021)<� ')17)5� &%1.�� 86)6� %� 6<67)0� 7,%7� %++5)+%7)6� 08/7-3/)� '855)1'<� 75%16%'7-216� 7,%7� 2'>

'85� 21� 7,)� 6%0)� &86-1)66� (%<�� #,-/)� 7,)� %'7-9-7<� /-67)(� 21� 7,)� 6<67)0�6� 5)32576� -6� 9)5<� /2:�� %&287� �

3)5')17� 2*� �,%6)� �%1,%77%1�6� �5-0-1%/� �)*)55%/� �2506� ��6�� %5)� %� (-5)'7� 5)68/7� 2*� -19)67-+%7-1+� %'>

'2817� %'7-9-7<� ,-+,/-+,7)(� &<� 7,)� 6<67)0�� -0-/%5/<�� 7',/)<� <67)06�� 1'�� %� '200)5'-%/� 62*7:%5)� 9)1(25�

,%6� ()9)/23)(� %� 6<67)0� 7,%7� %//2:6� &%1.6� 72� %++5)+%7)� '855)1'<� 75%16%'7-216� 29)5� %� *-;)(� 63)'-*-)(

180&)5� 2*� (%<6� %1(� 5)3257� %//� %++5)+%7-216� 7,%7� );'))(� %� 63)'-*-'� 7,5)6,2/(�� !,)� 6<67)0� '%1� %/62� */%+

-1(-9-(8%/� %''28176� %1(� %8720%7-'%//<� +)1)5%7)� 5)32576� 21� 7,)-5� '%6,� %'7-9-7-)6� )%',� (%<�� !,)� /%77)5

'20321)17� -6� 86)(� :,)1� &%1.� 0%1%+)56� :-6,� 72� 021-725� 7,)� '%6,� %'7-9-7<� 2*� ')57%-1� %''28176�� )9)1

7,28+,� -7� 0%<� 127� );'))(� 63)'-*-'� 7,5)6,2/(6�

Foreign Assets Control�%1.6� %5)� 5)48-5)(� 72� '203/<� :-7,� 5)+8/%7-216� -668)(� &<� 7,)� !5)%685<� �)3%570)17�6� �**-')� 2*� �25>

)-+1� �66)76� �21752/� �� !,)� 5)+8/%7-216� :)5)� 35208/+%7)(� 81()5� 6-;� 67%787)6� 7,%7� 352,-&-7�� -1� 9%5->

286� :%<6�� 75%()� :-7,� 63)'-*-'� '28175-)6�� -1'/8(-1+� �8&%�� 257,� �25)%�� -&<%�� 5%4�� $8+26/%9-%�� "��!�

��1+2/%�� %1(� �5%1�� 1� %((-7-21�� ;)'87-9)� �5()5� �� 352,-&-76� 75%16%'7-216� :-7,� 7)5525-676�� !2� %66-67

&%1.6� :-7,� '203/-%1')�� 0%-17%-16� %� /-67� 2*� 63)'-%//<� ()6-+1%7)(� 1%7-21%/6� � ��6�� %1(� &/2'.)(

3)56216� 7,%7� '217%-16� 29)5� � �� )175-)6�� %',� )175<� -6� %1� -1(-9-(8%/� �)�+�� %18)/� �25-)+%�� 25� 25+%1-=%>

7-21� �)�+�� -=&%//%,�� 25� -1(-9-(8%/6�� %((5)66)6� %1(� 7-7/)6� %5)� 620)7-0)6� +-9)1�� *25� 25+%1-=%7-216�� %� /-67

2*� %/-%6)6� %1(� %((5)66� -1*250%7-21� -6� +)1)5%//<� +-9)1�� 1� 620)� '%6)6�� 6)3%5%7)� )175-)6� %5)� 0%()� *25

%/7)51%7-9)� 63)//-1+6� 25� %((5)66)6� 2*� -1(-9-(8%/6� 25� 25+%1-=%7-216�� %',� )175<� %/62� '217%-16� %� ()6-+1%>

7-21� 2*� :,%7� 3529-6-21� 5)68/7)(� -1� 7,)-5� -1'/86-21� -1� 7,)� /-67�

tegrated with bank operations and of the chal-lenges posed by such integration (see box 4-2).

Knowledge-Based systemsKnowledge-based systems, often called “expertsystems,” are computer programs that processdata in ways that emulate human experts. Theydiffer from conventional algorithms in severalways. First, the knowledge that is embedded with-in the system is largely separate from the reason-ing methods used to operate on that knowledge.

Second, they often are designed so that they candisplay the path of evidence and facts used toreach a particular conclusion—in essence, knowl-edge-based systems can “explain” the inferencesthat they have made.

The knowledge embedded in knowledge-basedsystems often is expressed in terms of rules of theform shown in figure 4-2. Rules can directly con-nect input data to final conclusions; they can beginwith intermediate conclusions of other rules; orthey can produce intermediate conclusions that


BOX 4-2: Current Monitoring and Compliance Systems (Cont’d.)

�&2/7� &6*� 6*59.6*)� '=� �� 6*,90&8.327� 83� '03(/� ;.6*� 86&27+*67� ,3.2,� 83� 36,&2.>&8.327� &2)� .2).@

:.)9&07� 32� 8-*� 0.78�� 2� 8-*� 4&78� 7*:*6&0� =*&67�� -&7� .1437*)� 1.00.327� 3+� )300&67� .2� (.:.0� 4*2&08.*7

.2:30:.2,� $�"�� '&2/7�� 378� 3+� 8-*� +.2*7� ;*6*� 0*:.*)� '*(&97*� &� '&2/� +&.0*)� 83� '03(/� &2� .00.(.8� 86&27+*6� 8-&8

;&7� 463(*77*)� 1&29&00=� �� -&7� 238� ,*2*6&00=� 4*2&0.>*)� '&2/7� +36� +&.0.2,� 83� '03(/� 86&27+*67� 8-&8

;*6*� 463(*77*)� &9831&8.(&00=�� 378� 0&6,*� $�"�� '&2/7� -&:*� (31498*6� 7=78*17� .2� 40&(*� 83� 7(6**2� ;.6*

86&27+*67�� "*:*6&0� )3>*2� '&2/7� &2)� :*2)367� -&:*� )*:*034*)� 7=78*17� 8-&8� &9831&8.(&00=� 7(6**2� .2(31@

.2,� ;.6*� 86&27+*67� +36� 03(&8.327�� 36,&2.>&8.32�� &2)� 4*67327� 32� 8-*� �� 0.78�� %-*2� 32*� 36� 136*� 3+� 8-*7*

2&1*7� .7� +392)�� 8-*� 86&27+*6� .7� 78344*)� &2)� '639,-8� 83� 8-*� &88*28.32� 3+� &� -91&2� 34*6&836�� #-*� 46*7*2(*

3+� 79(-� 73+8;&6*� .7� ?(327.)*6*)� +&:36&'0=�� ;-*2� �� .2:*78.,&8*7� &� '&2/� 8-&8� +&.0*)� 83� '03(/� &2� .00*,&0

86&27+*6�

Fedwire Scanning System#-*� �*)*6&0� !*7*6:*� �&2/� -&7� 8-*� (&4&'.0.8=� 83� *0*(8632.(&00=� 7(&2� &2)� 6*86.*:*� 6*(36)7� 3+� ;.6*

86&27+*67� 1&)*� 3:*6� .87� �*);.6*� 7=78*1�� #-*� 7=78*1� .7� 97*+90� +36� +90+.00.2,� 0&;� *2+36(*1*28� 6*59*787� +36

�*);.6*� 86&27+*6� 6*(36)7�� '98� 8-*� (&4&'.0.8=� .7� *<86*1*0=� 0.1.8*)� .2� (314&6.732� 83� 8-*� 7=78*17� (328*1@

40&8*)� .2� 8-.7� 6*4368�� 2� 8-*� 4&78� 7*:*6&0� =*&67� .8� -&7� '**2� 97*)� 320=� .2+6*59*280=�

%.8-� &2� &446346.&8*� 7*&6(-� ;&66&28�� 0&;� *2+36(*1*28� &,*2(.*7� (&2� 6*59*78� &� 7*&6(-� 3+� �*);.6*

6*(36)7�� &(-� 7*&6(-� (&2� 74*(.+=� 94� 83� 8;*28=� ).++*6*28� (-&6&(8*6� 786.2,7�� *&(-� 786.2,� (&2� 6*46*7*28� &

).78.2(8� .8*1� �*�,�� 2&1*�� &((3928� 291'*6�� 786**8� &))6*77�� ).++*6*28� 4*6198&8.327� 3+� 8-*� 7&1*� .8*1

�*�,�� 1908.40*� 74*00.2,7� 3+� &� 2&1*�� 36� &� (31'.2&8.32� 3+� 8-*� 8;3�� 20=� *<&(8� 1&8(-*7� &6*� 6*4368*)�

#-*6*� &6*� 7*:*6&0� 0.1.8&8.327� 83� 8-*� 7*&6(-*7�� .678�� 7*&6(-*7� (&2� (3:*6� 320=� 6*(36)7� +631� 8-*� 4&78

�� )&=7�� !*(36)7� 30)*6� 8-&2� �� )&=7� &6*� 86&27+*66*)� 83� 1.(63+.(-*� &2)� 1978� '*� 7*&6(-*)� 1&29&00=�

"*(32)�� *&(-� 7*&6(-� (&2� 6*:.*;� 8-*� 6*(36)7� +631� 320=� 32*� !*7*6:*� �&2/�7� �*);.6*� 86&++.(�� +� &� 0&;� *2@

+36(*1*28� &,*2(=� .7� 92(*68&.2� ;-.(-� �*)*6&0� !*7*6:*� �&2/7� 1&=� -&:*� 463(*77*)� &� )*7.6*)� 86&27+*6�� .8

1&=� -&:*� 83� 79'1.8� 1908.40*� 6*59*787�� #-.6)�� 7*&6(-.2,� &� 7.2,0*� )&=� 3+� �*);.6*� 6*(36)7� 8&/*7� &4463<.@

1&8*0=� 32*� -396� &2)� 7*&6(-*7� (&2� 320=� '*� )32*� )96.2,� -3967� ;-*2� �*);.6*� .7� (037*)� &2)� &+8*6� 8-*

*2)@3+@)&=� 463(*77.2,� -&7� '**2� (3140*8*)�� 966*280=�� 8-.7� &139287� 83� 320=� &� +*;� -3967� *&(-� 2.,-8�� &2)

8-.7� 8.1*� ;.00� '*� 6*)9(*)� *:*2� +968-*6� ;-*2� �*);.6*� *<4&2)7� .87� -3967� 3+� 34*6&8.32� .2� ��

�*74.8*� 8-*7*� 0.1.8&8.327�� 8-*6*� &6*� 6*&7327� 8-&8� 0&;� *2+36(*1*28� &,*2(.*7� 1.,-8� ;.7-� 83� 3'8&.2

6*(36)7� 8-639,-� �*);.6*� 7(&22.2,� 6&8-*6� 8-&2� 8-639,-� 6*(36)7� &8� &2� .2).:.)9&0� '&2/�� 8� 1&=� 238� '*

/23;2� ;-.(-� 3+� 8-*� � �� '&2/7� ;.8-� &((*77� 83� �*);.6*� 7*28� 36� 6*(*.:*)� 8-*� 86&27+*6�� 073�� .+� 0&;� *2@

+36(*1*28� &,*287� '*0.*:*� 8-&8� '&2/� *1403=**7� &6*� (3140.(.8� .2� 132*=� 0&92)*6.2,�� 36� 8-&8� 8-*� '&2/

;390)� .2+361� &((3928� -30)*67� 3+� 8-*� 6*(36)7� 6*59*78�� 8-*2� 8-*=� 1&=� ;.7-� 83� 3'8&.2� 8-*� 6*(36)7� 8-639,-

�*);.6*� 7(&22.2,�

"�$!��"�� 3=(*� �30*8>�� -&7*��&2-&88&2�� 4*6732&0� (31192.(&8.32�� 46.0� �� .1� �8(-0*=�� 8(-0*=� "=78*17� �2(�� 4*6732&0

(31192.(&8.32�� &=� �� $�"�� *4&681*28� 3+� #6*&796=�� 46.0� �

�� $�"�� *4&681*28� 3+� #6*&796=�� ++.(*� 3+� �36*.,2� �77*87� �328630�� 46.0� ��

�� 39.7*� !37*1&2�� 773(.&8*� �.6*(836�� .:.7.32� 3+� !*7*6:*� �&2/� �4*6&8.327� &2)� &=1*28� "=78*17�� 3&6)� 3+� �3:*62367� 3+� 8-*

�*)*6&0� !*7*6:*� "=78*1�� 4*6732&0� (31192.(&8.32�� &=� �� 3� �22� �&66.7�� 77.78&28� �88362*=� �*2*6&0�� 6.1.2&0� �.:.7.32�� $�"�

�*4&681*28� 3+� �978.(*�� *136&2)91� 83� �00� $2.8*)� "8&8*7� �88362*=7�� &29&6=� ��

will be used by other rules. Knowledge-based sys-tems often employ hundreds or thousands of suchrules to emulate expert reasoning within a narrowdomain. The collection of rules is referred to as aknowledge base.

The knowledge base is the input to an inferenceengine, an algorithm that uses the knowledge baseand input data to reach final conclusions that arethen provided to the user. The user can query the


Figure 4-2: An Example Rule

��

knowledge-based system to trace its pattern ofreasoning.

The knowledge represented in a system’sknowledge base can be acquired in one of twoways. Most commonly, knowledge bases areconstructed by interviewing one or more expertsin an area in ways that are meant to elicit the de-tails of their reasoning processes. Less frequently,knowledge bases are constructed by analyzing alarge number of cases where the correct decision isknown. Both of these approaches are covered be-low.

Knowledge-based systems were developed inthe 1970s largely as a result of efforts to constructtwo major systems: the DENDRAL system forelucidating chemical structures1 and the MYCINsystem for diagnosing and recommending treat-ment for infectious diseases.2 Knowledge-basedsystems are now widely applied in many fields,including industry, government, medicine, andscience.3 They have been applied to a wide varietyof problem types, including diagnosis, repair, andscheduling.

Link AnalysisLink analysis is a technique to explore associa-

tions among a large number of objects of differenttypes. In the case of money laundering, these ob-jects might include people, bank accounts, busi-nesses, wire transfers, and cash deposits.Exploring relationships among these different ob-jects helps indicate networks of activity, both le-gal and illegal (see figure 4-3).

Link analysis can indicate where to focus in-vestigations. For example, if a person isassociated with other persons or businesses thatare known to be engaged in criminal conduct, thenadditional investigation of that individual may bewarranted. Similarly, link analysis can help toconfirm suspicions. For example, there may beambiguous evidence of criminal activity for asingle individual, but if that person is connectedwith many other persons and businesses that alsoappear to be involved in criminal conduct, then theanalysis offers some confirmation of the initialsuspicion.4

Link analysis operates on a set of data records,where each record has several fields containing in-formation. These might be records of an individu-al (with fields of name, address, and phonenumber), bank account (account number, owner,bank), or business (name, owners’ names, boardmembers, address). Link analysis looks formatching fields in each of these records. For ex-ample, these matching fields could indicate thattwo persons live at the same address, deposit intothe same bank account, or are involved in the samebusiness.

1 B. G. Buchanan and E. A. Feigenbaum, “DENDRAL and Meta-DENDRAL: Their Applications Dimension,” Journal of Artificial Intelli-

gence, 11:5-24, 1978.

2 B. G. Buchanan and Shortliffe, E. H. (eds.), Rule-Based Expert Systems: The MYCIN Experiments of the Stanford Heuristic Programming

Project (Reading, MA: Addison-Wesley, 1984).

3 Interested readers should consult the proceedings of a conference on AI applications held annually since 1989: Innovative Applications of

Artificial Intelligence (Menlo Park, CA: AAAI Press; Cambridge, MA: MIT Press).

4 For additional information, see: Malcolm K. Sparrow, “Network Vulnerabilities and Strategic Intelligence in Law Enforcement,” Interna-

tional Journal of Intelligence and Counterintelligence, 5(3): 255-274.


Figure 4-3: Example of Link Analysis Results

�� "��#� �� !�� !�

� �� #� � ��!��

Link analysis is a relatively new technique, al-though it has quickly gained adherents in law en-forcement agencies in the United States andelsewhere.5 The field has its own journal and aprofessional society,6 although these are almostentirely oriented to the use of link analysis in so-cial science, not law enforcement. One early pro-moter and developer of link analysis in lawenforcement is Anacapa Sciences, Inc.7 Becauseof the prevalence of this company’s training,many law enforcement sources refer to link analy-sis as “Anacapa charting.” Link analyses havebeen used in many criminal investigations, in-

cluding serial murders, fraud, and conspiracycases.

Several commercial software packages can beused to conduct link analyses. One popular com-mercial package for link analysis is NETMAP fromAlta Analytics Corporation.8 NETMAP is used byboth FinCEN and the Australian Transaction andReports Center (AUSTRAC), as a part of systemsdeveloped in-house at both agencies. In addition,NETMAP is used by several state agencies investi-gating financial crimes by analyzing currencytransaction data.9

5 Clive Davidson, “What Your Database Hides Away,” New Scientist, January 9, 1993, 28-31. Roger H. Davis, “Social Network Analysis:

An Aid in Conspiracy Investigations,” FBI Law Enforcement Journal, December 1981, pp. 11-19.

6 Social Networks and the International Network of Social Network Analysts, respectively.7 Anacapa Sciences, Inc., Santa Barbara, California.8 Alta Analytics, Dublin, Ohio. NETMAP is a trademark of Alta Analytics.9 Besides NETMAP, there are at least three other software packages for link analysis: Criminal Network Analysis (Anacapa Sciences, Inc.,

Santa Barbara, California); Watson (Harlequin Group, Ltd., Boston, Massachusetts (U.S. Office)); Analyst’s Workbench (I2, England). In addi-tion, Syfact (Inter Access Consultancy B.V., Hilversum, The Netherlands) is a specialized package that uses link analysis to search financialdata for indicators of money laundering and fraud.


Link analysis is useful for money launderinginvestigations mostly because it can integratemany different sources of information. The indi-vidual records that FinCEN currently receives,and the records that might be available under wiretransfer monitoring proposals, provide few indi-cators of suspiciousness. Link analysis provides away of combining these different records so thatpatterns of illegal activities can be discovered.While other methods can supplement it, link anal-ysis may be the only method of analysis that al-lows these records to be used productively.

Link analysis is a useful way of discovering anddisplaying links between objects,10 but it does notautomatically construct meaning from thoselinks. That task is left to the analyst. In the case ofmoney laundering, analysts must make judgmentsabout whether a network of links represents a le-gitimate pattern of personal and business associa-tions, or whether the network represents acriminal organization. Links to database recordsthat show prior criminal activity or suspicious ac-tivities (e.g., criminal referrals, suspicious trans-action reports, etc.) can aid these judgments.

Link analysis is computationally intensive.Constructing links involves determining whetherobjects share common data values (e.g., whether aperson and a business both share the same ad-dress). Consequently, rather than merely examin-ing each record, the analysis must examine eachpossible pair of records, although some shortcutscan be used to reduce the necessary computation.

Even with these difficulties, however, practicallimits on analysis are not unduly restrictive. Usingavailable software and workstations, it is possibleto run analyses with tens of thousands of objects.Analyses with hundreds of thousands of objects,however, exceed the capacity of available soft-ware and hardware. This indicates that wire trans-fer data (currently generated at a rate of nearlythree million records per day) would have to be

segmented or aggregated before it is combinedwith additional data and analyzed.

Other TechniquesIn addition to the relatively sophisticated analysisprovided by knowledge-based systems and linkanalysis, several simpler techniques are useful forscreening. For example, FinCEN’s FAIS com-putes statistics based on Currency Transaction Re-ports (CTRs) and other reports received by theagency. FAIS uses the value of these statistics(e.g., number of CTRs filed in past year, numberof suspicious transaction reports filed in past year)to evaluate the suspiciousness of individual sub-jects and accounts. These statistics are a simple,but relatively powerful, way to evaluate financialrecords for evidence of money laundering.

❚ Knowledge AcquisitionAs previously noted, knowledge-based systemsrequire a knowledge base—knowledge aboutmoney laundering encoded in ways that the sys-tem can use to make inferences. Knowledge basescan be constructed in two ways: by interviewingan expert (often called knowledge engineering) orby analyzing a large number of cases (often calledknowledge discovery or data mining).

Knowledge engineering attempts to capture therelevant heuristics, or “rules of thumb,” used byexperts to reach conclusions in the relevant do-main (e.g., wire transfers and money laundering).Knowledge engineering can be difficult, becauseexperts often cannot easily articulate their deci-sionmaking processes within the narrow languageused by knowledge-based systems. In addition,experts sometimes rely on broad “common sense”knowledge in order to draw useful conclusions,making the knowledge engineering task unrea-sonably large.

10 The terminology used here (“objects” and “links”) is not universal. Some law enforcement agencies refer to “entities” and “relation-

ships”; the mathematical field of graph theory refers to “vertices” and “edges.”


Figure 4-4: Example Data Set

��

Knowledge engineering in the area of wiretransfers is only possible if there are people whoknow how to screen transfers for evidence ofmoney laundering. There are no human expertswho scan large numbers of wire transfers and reli-ably distinguish between legitimate and illegiti-mate wire transfers. Consequently, knowledgeengineering techniques are of little help in build-ing a wire transfer monitoring system. Instead,knowledge discovery techniques must beemployed.

Knowledge discovery techniques are diverseand multifaceted, including techniques from sta-tistics and the AI subfield of machine learning. Inaddition, an emerging set of data visualizationtechniques are also gaining recognition. Severalknowledge discovery techniques have been pro-posed for use at FinCEN, but none are now used.The boundary between screening and knowledgediscovery is not a clear one, and techniques cur-rently in use (e.g., link analysis) can be used toidentify new patterns. Some knowledge discovery

techniques are only useful when there are a largenumber of cases where the answer is known—thatis, whether the wire transfer (or person, account,etc.) can be labeled as involved with money laun-dering or not.11 Other knowledge discovery tech-niques can be somewhat useful even in theabsence of such clear labels.

Machine Learning and StatisticalModel BuildingResearchers have developed several techniques inthe past few decades for automatically finding pat-terns in large amounts of data. In most cases, thedata consist of a large number of observations,where each observation represents a single object(e.g., a person, account, or wire transfer) and con-sists of values for each of several numeric or sym-bolic variables. A fragment of a fictitious data setis shown in figure 4-4.

Analysis begins by designating one variable(e.g. “Money Laundering?” in figure 4-4) as the

11 Similarly, link analysis is only effective if some indicators of criminal activity are available. Without evidence that at least some of theobjects (e.g., individuals, accounts, businesses) are inherently suspicious, it will be difficult to distinguish between legitimate and illegitimatepatterns of activity. If such indicators are not present, or are not present in sufficient number, interpreting link analysis results requires an addi-tional step—determining what patterns of associations indicate money laundering.


variable of interest.12 The rest of the analysis con-sists of deriving models that attempt to accuratelypredict this variable by using the remaining vari-ables (e.g., dollar amount, foreign beneficiary,customer type, and others in the example above).Models can be in the form of algebraic equations,logical rules, weighted networks,13 or any otherway of relating the values of one or more variablesto the value of another variable.

Models are usually derived by a process ofsearching through large numbers of possible mod-els. Each possible model may use different sets ofvariables or combine the same variables in differ-ent ways. Models that accurately predict the vari-able of interest are retained, while less accuratemodels are discarded. In many cases, it is not fea-sible to search through all possible models,14 sotechniques often limit the number of modelssearched by selectively altering the most accuratemodels that have already been constructed.

Technologies for machine learning and statisti-cal model-building have existed for at least threedecades, but they continue to be an active researcharea.15 Interest in analysis of large databases hasgrown tremendously in the past five years, as ma-jor corporations have begun to “mine” large data-bases of customer information. This has spurredinterest in massively parallel computing hard-ware, new algorithms for model construction, andnew model forms.

ClusteringResearchers in both statistics and AI have devel-oped methods of looking for closely relatedgroups of objects. Cluster analysis can be used todetermine underlying groupings that are not

otherwise apparent in the data. For example, clus-ter analysis of wire transfers could be based on thefrequency and dollar amount of each transfer, aswell as the type of beneficiary. Such analysiscould reveal groups of transfers whose originatorsare highly similar (e.g., brokerage houses, indus-trial firms, or money transmitters).

Computational techniques for cluster analysispartition a set of observations into groups basedon one or more variables (e.g., frequency and dol-lar volume). The ultimate goal is to producegroups that differ greatly in terms of one or morevariables, but where the individual members ofeach group differ little in terms of those variables.Figure 4-5 is an example of a graph showing sev-eral clusters in terms of two variables.

In financial data, clusters might reveal similartypes of accounts, individuals, or organizations.For example, the currency and wire transactionsof manufacturing firms might cluster closely to-gether in comparison to other firms. Similarly, in-surance companies might resemble each otherclosely in terms of their financial transactions.These clusterings might allow investigators toidentify manufacturing firms whose financialtransactions are atypical and examine them moreclosely to determine whether the corporation ismerely a “shell” within which to conceal moneylaundering.

VisualizationVisualization techniques use color and interactivegraphics to allow users to explore the relation-ships among two or more variables. Rather thanautomating the construction of useful models likemachine learning techniques, visualization tech-

12 Some techniques do not require designation of a specific variable of interest. An example is cluster analysis, a method that searches forgroupings of observations that are all highly similar (see section below). These techniques can help an analyst understand a data set, but they donot directly help construct predictive profiles.

13 This approach is described in more detail in a later section.14 Some methods do search all possible models within a limited range, but they are relatively rare.15 Interested readers can consult the proceedings of three groups of workshops and conferences: Machine Learning (held annually since the

mid-1980s), Knowledge Discovery in Databases (held periodically since 1989), and Artificial Intelligence and Statistics (held biennially since1985). Another source is articles in the journal Machine Learning (Hingham, MA: Kluwer Academic Publishers).


Figure 4-5: Example of Clustering

��

niques give human analysts powerful tools to ex-amine data—allowing analysts to explore andapply their own knowledge to the data analysisproblem.16 In addition, visualization techniquesallow analysts to apply their own abilities to rec-ognize patterns in data, a human ability that ma-chines cannot yet duplicate.

Other TechniquesSeveral other technologies are difficult to classifyas either screening or data analysis, but they arepotentially relevant to the problem of wire transferanalysis. Case-based reasoning and neural net-work technologies can be used both to derive pro-files from data and to help apply those profiles.

Case-based reasoning techniques rely on thestorage and processing of prototypical cases (i.e.,observations), rather than deriving an abstractprofile based on the values of particular variables.For example, a case-based reasoning approach toprofiling wire transfer data might involve select-ing records (e.g., wire transfers, CTRs, criminal

referrals) that are prototypical of different classesof legitimate traffic, as well as selecting recordsthat are prototypical of different types of illegiti-mate traffic (e.g., multiple cash deposits under$10,000 in a single day). These prototypical caseswould then be compared to new records—helpingto determine what type of activity they represent.

Neural network techniques attempt to emulatethe information processing of biological networksof neurons, one of the fundamental structures ofthe brain. Neural networks are a set of intercon-nected elements called nodes. Some nodes are in-puts and take on the values of particular variables(e.g., amount of transfer); other nodes are outputsand are used to determine the answer suggested bya network (e.g., whether a wire transfer is suspi-cious). Many networks also have internal, or “hid-den,” nodes. Nodes are interconnected and eachconnection has a weight, indicating the strength ofthe influence of the value of one node on the valueof another.

By adjusting the weights on each connection,neural networks can be made to produce nearlyany output based on a given set of inputs. Given aset of data where each observation contains a set ofinputs (e.g., amount of transfer, foreign beneficia-ry, etc.) and a known output (e.g., suspiciousness),the network can be trained to implicitly recognizepatterns in the input, if such patterns are present.However, one potential disadvantage of neuralnetworks in the context of wire transfer monitor-ing is that they can make it difficult or impossibleto “explain” why a particular transfer (or person,account, etc.) was identified as suspicious. Neuralnetworks differ from many knowledge-based sys-tems in this regard, because the knowledge repre-sented within the network is not explicit orintelligible. This characteristic would cause diffi-culties if the results of the network’s analysisneeded to be explained to law enforcement agents,judges, or juries.

16 Link analysis can be thought of as a visualization technique. Chris Westphal and Bob Beckman, “Data Visualization for Financial Crimesand Money Laundering Investigations,” Proceedings of the ONDCP/CTAC International Symposium on Tactical and Wide-Area Surveillance,Chicago, IL, 1993.


❚ Knowledge SharingSeveral of the technical options for wire transfermonitoring require that knowledge-based systemsbe installed at multiple locations. Some configu-rations require installation at wire transfer sys-tems (e.g., CHIPS and Fedwire); others requireinstallation at large money center banks, and stillothers require installation at many or all banks.17

Locating knowledge-based systems at severallocations poses a unique challenge in terms of up-dating and maintaining the knowledge base ofthose systems. Because money laundering tech-niques can change rapidly, the profiles in knowl-edge-based systems intended to detect moneylaundering would have to change as well. Updat-ing multiple screening systems could be done inthree ways. First, all banks and wire transfer sys-tems could be required to use a standard softwarepackage supplied by regulatory agencies. Such anapproach would simplify updating but would alsoimpose regulatory burdens, limit flexibility, anddiscourage innovation. Second, banks and wiretransfer systems could be provided with textualdescriptions of new profiles, allowing them to al-ter their monitoring systems appropriately. Thisapproach would impose little burden on the feder-al government but would require each bank and/orwire transfer systems to recode their monitoringsystems, perhaps causing long delays in the use ofthe profiles. Finally, banks and wire transfer sys-tems could be provided with the profiles in a waythat would facilitate updating multiple, heteroge-neous knowledge-based systems.18

Some initial research on this latter option, re-ferred to as knowledge sharing, has been con-ducted in the last five years. Much of the researchhas been conducted under the Knowledge-Shar-ing Effort, a project sponsored jointly by the Air

Force Office of Scientific Research, the DefenseAdvanced Research Projects Agency, the Corpo-ration for National Research Initiatives, and theNational Science Foundation.19 Research onknowledge sharing includes techniques to trans-late between different languages for encodingknowledge bases, to remove arbitrary differencesbetween such languages, to create a standard pro-tocol for knowledge-based systems to communi-cate, and to develop generic and reusableknowledge bases.

Although the research is progressing, knowl-edge sharing techniques are not well-developedand are substantially less mature than many of theother techniques discussed in this chapter. How-ever, wire transfer monitoring poses only relative-ly small challenges to knowledge sharing. Theknowledge bases that are shared are likely to berelatively small. The complexity of the domain isrelatively low, given that wire transfers have asmall number of fields and that wire transferscreening systems (outside of FinCEN) are likelyto employ only small amounts of additional data.Finally, the use of knowledge sharing techniquescan easily be phased-in over a period of time, start-ing with communicating profiles using relativelystandard terminology, and perhaps moving to-ward electronic dissemination of specially for-matted knowledge bases.

❚ Data TransformationData transformation issues are some of the mosttroubling and time consuming aspects of analyz-ing financial records (e.g., CTRs) and experienceindicates that wire transfer data are likely to pres-ent at least as many problems. For example, deter-mining whether two different transfers originatedfrom the same individual is not easy. Financial re-

17 This latter possibility could involve an extremely large number of systems. There are approximately 11,500 commercial banks in the

United States.

18 All of these options would disseminate law enforcement profiles of money laundering and would pose a risk of these profiles falling into

the hands of money launderers. This concern is discussed briefly later in this chapter.

19 Robert Neches, Richard Fikes, Tim Finin, Tom Gruber, Ramesh Patil, Ted Senator, and William R. Swartout., “Enabling Technology for

Knowledge Sharing,” AI Magazine, Fall 1991, 12(3): 36-56.


cords do not always contain unambiguous indica-tors such as a social security number; smallvariations in format and spelling can defeat simpleword matching; addresses are not typically pro-vided and frequently change;20 money laundererscan use multiple, shifting account numbers. As aresult, FinCEN and AUSTRAC have exploredand implemented various schemes to processtextual information to allow matching of namesand addresses of institutions and individuals. Inaddition, AUSTRAC uses some approaches to un-derstanding written text, referred to as naturallanguage processing, in order to glean additionalinformation from free text fields of wire transfers.

Other sorts of data transformations involveproducing new records from existing ones. For ex-ample, FinCEN’s FAIS produces new records forindividual persons and accounts by aggregatingdata from CTRs and other reports. Fields in theserecords are then filled with data calculated usingvarious statistics (e.g., number of CTRs marked as“suspicious,” total cash deposits).

Both FinCEN and AUSTRAC use a databasethat contains both original data records (e.g.,CTRs) and records constructed by the system it-self (e.g., a record representing an account,constructed by aggregating a number of CTRs).This concept of a database containing both origi-nal and constructed records is nearly identical toan AI-based concept referred to as a blackboard.21

A blackboard is a central database where multipleproblem-solving agents can share related in-formation about a particular problem over a periodof time.22 In the case of wire transfer analysis, the“agents” may be banks that report wire transfers,conventional computer systems that create aggre-gated records, knowledge-based systems that en-

hance or create records, or human analysts whoenhance or create records.

A blackboard architecture can allow continu-ous enhancement and development of knowledgeabout potential money laundering cases overdays, weeks, or months. In theory, the knowledgeabout those cases can be updated and developedby different analysts whose only communicationis through the blackboard. In fact, many law en-forcement databases can be thought of as black-boards. Agents enter reports that are used by laterinvestigators without the need for direct commu-nication between them even though they are geo-graphically separated or separated in time.

DETECTING MONEY LAUNDERINGBefore examining the applicability of differenttechnologies, it is important to examine the taskof detecting money laundering activity in wiretransfer data. This section discusses wire transferdata, other types of data that might be combinedwith it, and characteristics of profiles that mightbe developed.

❚ Wire Transfer DataWire transfers contain three basic categories ofinformation: 1) information on the originator(name, address, account number, bank, routingnumber); 2) information on the beneficiary (name,account number, bank, routing number); and 3) in-formation about the transfer itself (dollar amount,date, payment instructions, intermediary banks,internal codes).

Analyzing the relatively small amount of datain each transfer presents a surprising array of prob-lems. These problems include the extremely large

20 Addresses and other information will be mandatory under new Treasury Department regulations, although money launderers could

evade these requirements by providing false, flawed, or misleading information.

21 Ted Senator, Henry Goldberg, Jerry Wooton, Matthew Cottini, A.F. Umar Khan, Christina Klinger, Winston Llamas, Michael Marrone,and Raphael Wong, “The FinCEN Artificial Intelligence System: Identifying Potential Money Laundering from Reports of Large Cash Transac-tions,” Proceedings of the 7th Conference on Innovative Applications in Artificial Intelligence, 1995 (forthcoming).

22 A blackboard architecture was first constructed in the HEARSAY speech understanding system. L. Erman, F. Hayes-Roth, V. Lesser, andD. Reddy, “The HEARSAY II Speech Understanding System: Integrating Knowledge To Resolve Uncertainty,” Computing Surveys, 12(2):213-253, 1980.


number of transfers, incomplete or faulty data,heterogeneous formats and recordkeeping sys-tems, and other difficulties for supplying cases fordata analysis.

Large Volume of DataU.S. wire transfer systems handle hundreds ofthousands of transactions per day. Taken together,CHIPS, SWIFT, and Fedwire handle some700,000 transactions in the United States eachbusiness day. This volume of data dwarfs the BankSecrecy Act data, some 30,000 reports per day,that are currently received, processed, and ana-lyzed at FinCEN.

Although the number of wire transfers is largewhen compared to financial reports currently filedwith FinCEN, the size of each transfer message isquite small. For example, the current format for aFedwire transfer is limited to 600 characters. Eventhe expanded Fedwire format, due to be used in1997, will use a maximum of 1,700 characters.Wire transfers rarely use all the available charac-ters; wire transfers in both Fedwire and CHIPSaverage about 300 characters in size.23 In compar-ison, CTRs currently collected and analyzed atFinCEN average around 1,000 characters.24

The volume of reporting to FinCEN is of par-ticular concern, given past experience with CTRreporting. Until mid-1993, the volume of CTRsfar outstripped any ability to analyze and monitorthem. Now the FinCEN AI System analyzes everyCTR at least once, but banking industry represen-tatives still charge that many CTRs are relativelyuseless and do little but impose reporting costs onbanks. These concerns are behind the recent revi-sion to the CTR reporting requirements designedto reduce the volume of these reports filed bybanks. A broad reporting requirement for wiretransfers could raise similar objections, but on afar greater scale.

As is the case with CTRs, many wire transferscould be excluded from required reporting by us-

ing relatively simple criteria. AUSTRAC uses ex-clusions to reduce the volume of wire transfer datadelivered to the agency, and similar exclusionscould be used in the United States.

Clearly, there is some risk to excluding broadcategories of wire transfers from reporting re-quirements. Money launderers could attempt tomake their wire transfers fall into the categoriesexcluded from reporting. Reporting exclusionswould have to take this risk into account and onlyexclude categories of transfers that could not easi-ly be used by money launderers. For example,some wire transfers by banks aggregate manysmaller transactions. These transfers carry little orno information about the original transactions andcould be excluded on the assumption that onlyregulatory scrutiny could uncover money launder-ing by banks.

Data Transmission, Processing and StorageSome of the technology configurations identifiedby OTA involve the transmission of wire transferrecords from banks to FinCEN. Electronic trans-mission of CTRs by banks to the Internal RevenueService (IRS) or Customs data centers is increas-ing, but the addition of wire transfer records couldswell the volume of these electronic records by afactor of 10 to 100. The mere transmission of thesedata would strain current networks, and storageand analysis of these records might be beyond thecapacity of current technology. A critical questionthen becomes whether the number of transferstransmitted might be reduced, either by exempt-ing classes of funds transfers or by requiring banksto commit some preliminary processing of thetransfers.

The security of funds transfer information isanother issue, both as the information is trans-mitted and as it is stored. These records, if leakedor stolen, could help competitors identify a com-pany’s suppliers and customers, detail its coststructure, or predict its future behavior. Encryp-

23 Mike Rosenberg, Senior Intelligence Research Specialist, FinCEN, personal communication, February 1995.24 Ted Senator, Chief, Systems Development Division, FinCEN, personal communication, February 1995.


tion suggests one manner of ensuring secure trans-mission, but securing the information at thefederal repository is not a simple matter.25

There is no centralized database of wire trans-fers. Depending on the origin and destination of awire transfer, messages making that transfer mayflow over one or more of the three major systems(CHIPS, SWIFT, and Fedwire). Even individualwire transfer systems do not always maintaincentralized databases of the transfers travelingthrough their system. For example, Fedwire dataare decentralized in three different locations (al-though that will shrink to two locations by the endof 1995).

In addition, not all data are kept in a form that iseasily accessed. For example, the Federal Reserve(Fedwire) keeps records online for three days, ontape for six months, and on microfiche for sevenyears. Bank records, although they originate inelectronic form, are often stored electronically foronly a short time. Some large banks keep long-term records on microfiche and some small bankskeep records on paper, although banks are increas-ingly moving toward electronic storage. In addi-tion, even electronic data are not always easilyretrievable. For example, Fedwire data are cur-rently indexed by sending and receiving bankonly. Other fields (e.g., recipient account) may belocated by using a search program to look forstrings of characters, but even a relatively smallnumber of requests (e.g., a few requests for use ofthe program per day) would be extremely de-manding on the current system. See box 4-2 fordetails on the Fedwire scanning system.

The various recordkeeping and computer sys-tems used to conduct and record wire transferswere not intended for the activities contemplatedin monitoring proposals. They were intended toquickly and reliably process a large volume ofwire transfers. This mission does not requirecentralized recordkeeping, long-term electronicstorage, or quick retrieval of the sort required forlaw enforcement purposes. It is certainly possibleto construct a system that would allow decentral-ized storage and retrieval of data.26 However, itwould substantially complicate wire transfer anal-ysis and it would impose substantial new costs onbanks and/or wire transfer systems.

Incomplete or Faulty DataSome wire transfers contain blank fields or rela-tively useless information. Accurate informationin these fields are not required for the transfer offunds, although they would be useful for law en-forcement purposes. For example, some foreignbanks refuse to reveal the name of the originatorof a wire transfer, saying only that the transferoriginates from “our good customer.” Even whereinformation is required, individuals or organiza-tions wishing to confound analysis could providefalse or misleading information.

In addition, wire transfer data sometimes con-tain errors. In some cases, these errors are mis-takes or typographic errors made at the bank level.In other cases, the errors result from operators whouse fields in ways that were not originally in-tended when the format of wire transfers was

25 For example, see U.S. Congress, Office of Technology Assessment, Information Security and Privacy in Network Environments, OTA-

TCT-606 (Washington, DC: U.S. Government Printing Office, September 1994).

26 An example of such a system is NASA’s Earth Observing System Data and Information System (EOSDIS). See Office of TechnologyAssessment, U.S. Congress, Remotely Sensed Data: Technology, Management, and Markets (Washington, DC: U.S. Government Printing Of-fice), September, 1994.


created.27 Occasionally, messages are returnedand resent in order to correct errors in the originaltransmission, and this procedure could compli-cate simple data analysis schemes that assumeeach transfer of funds is only associated with asingle wire transfer record.

An additional problem is created by variationsin individual and business names and addresses.Many of the fields in wire transfers (e.g., origina-tor name, beneficiary name) are entered as freeform text. These fields are subject to format differ-ences (e.g., ACME, Inc.; Acme, Incorporated,ACME Corporation; American ConsolidatedMining and Engineering, Ltd.) and misspellings.These can make it difficult to identify wire trans-fers that correspond to the same individual orbusiness. Additional fields, such as address andaccount number, can be used, but individuals andbusinesses can operate multiple accounts and useseveral addresses.28

Heterogeneous Data Formats and Data TypesWire transfers vary greatly in their characteris-

tics. For example, different classes of banks typi-cally make different types of transfers and thereare several different wire transfer systems, eachwith its own format. This produces wide variabili-ty in transfer records.

Money laundering analysts emphasize thatmany different types of entities (e.g., transfers, in-dividuals, accounts, companies) would need to behandled by any comprehensive analysis system.Money laundering profiles developed by law en-forcement and regulatory personnel involve rela-tionships among these different entities, ratherthan the properties or behavior of a single entity.

Fragmentary RecordsOne approach to detecting money launderingwould be to compare the behavior of individualsand companies to general profiles of behavior fortypes of individuals and companies. For example,the behavior of an individual could be comparedto the behavior of others in his or her socioeco-nomic group. Many fraud detection systems in thecredit card, cellular communications, and healthcare fields rely on this approach (see box 4-3).

However, these fraud detection systems have adistinct advantage—credit and cellular commu-nications companies have relatively complete re-cords of each individual customer, and healthinsurance companies have relatively complete re-cords of each health care provider. Merely by vir-tue of doing business with the company,customers and health care providers must supplybasic information. In addition, because transac-tion records are clearly designated as belonging toa particular customer, companies can constructdetailed profiles of the customer’s typical pat-terns.

In contrast, FinCEN has only fragmentary re-cords on the individuals and companies that it in-vestigates, and wire transfers offer littleimprovement in this regard. Social security num-bers are not provided on wire transfers, so linkingtogether multiple transactions would requiremuch more effort. Much of the FinCEN AI systemis devoted to accurately aggregating Bank SecrecyAct (BSA) data to form records of accounts andindividuals by using inexact identifiers such asname and address. Even after this aggregation isaccomplished, the resulting records form only a

27 Because of problems with anomolies and errors in wire transfer messages, specific software has been designed to correct errors in somemessage types. For example, see: Peter Johnson, Joseph Devlin, Stephen Mott, and Jean Jans, “Applying Natural Language UnderstandingTechnology to Automate Financial Message Processing,” Intelligent Information Access, Proceedings of the BANKAI Workshop, Brussels,Belgium 14-16 October, 1991. Society for Worldwide Interbank Financial Telecommunication S.C. (Editors). Amsterdam: Elsevier SciencePublishers, 1992.

28 As a result of all these problems, according to the American Bankers Association (ABA), some wire messages (such as those associatedwith bank trust and securities) are often ambiguous enough to confuse trained and experienced human readers. ABA Comments on OTA draftmaterial, received March 24, 1995.


BOX 4-3: Electronic Fraud Detection at the Travelers Insurance Company

�5$8'� ,6� $� 68%67$17,$/� 352%/(0� )25� ,1685$1&(� &203$1,(6�� "+(� �$7,21$/� �($/7+� �$5(� �17,)5$8'

�662&,$7,21� �� (67,0$7(6� 7+$7� �� 3(5&(17� 2)� $//� +($/7+&$5(� &/$,06� &217$,1� 620(� (/(0(17� 2)� )5$8'�

!8&+� )5$8'� ,6� &267/<� 72� ,1685$1&(� &203$1,(6�� $1'� 7+(<� +$9(� 7$.(1� 67(36� 72� '(7(&7� $1'� ,19(67,*$7(� 32>

7(17,$/� )5$8'� &$6(6�

"+(� �/(&7521,&� �5$8'� �(7(&7,21� �� 6<67(0� $66,676� )5$8'� ,19(67,*$7256� $7� "+(� "5$9(/(56� �1685>

$1&(� �203$1,(6� ,1� 7+(� '(7(&7,21� $1'� 35(,19(67,*$7,9(� $1$/<6,6� 2)� +($/7+� &$5(� 3529,'(5� )5$8'�� "+(� 6<6>

7(0� +$6� 0$1<� 6,0,/$5,7,(6� 72� 352326('� 6<67(06� 72� 021,725� :,5(� 75$16)(56�� $6� :(//� $6� 620(� ,03257$17

',))(5(1&(6�

�1� 7+(� 3$67�� )5$8'� '(7(&7,21� +$6� 5(/,('� 8321� 0$18$/� ,163(&7,21� 2)� &/$,0� )2506� $1'� 7,36� )520� ,17(5>

1$/� 6285&(6�� /$:� (1)25&(0(17� $*(1&,(6�� $1'� $� 7(/(3+21(� +27/,1(�� 2:(9(5�� ,1&5($6,1*� 86(� 2)� (/(&7521,&

5(&25'6� +$6� 0$'(� $8720$7('� $1$/<6,6� 3266,%/(� $1'� +$6� 5(029('� 7+(� 3266,%,/,7,(6� 2)� 620(� &219(17,21$/

)2506� 2)� )5$8'� '(7(&7,21� �(�*�� (;$0,1,1*� 3$3(5� &/$,0� )2506� )25� 6,*16� 2)� $/7(5$7,21�� (7&�� 6� $� 5(68/7�� "+(

"5$9(/(56� �1685$1&(� �203$1,(6� 81'(5722.� 7+(� '(9(/230(17� 2)� �� $� 6<67(0� 72� '(7(&7� )5$8'� 86,1*� $8>

720$7('� $1$/<6,6�

":2� 2)� 7+(� &+$//(1*(6� )$&('� ,1� '(9(/230(17� 2)� �� ',5(&7/<� 0,5525� 352%/(06� ,1� '(9(/23,1*� $� :,5(

75$16)(5� 6<67(0�� ,567�� 7+(� &203$1<� +$'� 12� (;3(576� :,7+� (;3(5,(1&(� 6&5((1,1*� /$5*(� 180%(56� 2)� &/$,0

)2506�� "+(� &203$1<� +$'� (;3(576� ,1� &/$,06� 352&(66,1*� $1'� (;3(576� ,1� ,19(67,*$7,1*� )5$8'�� %87� 12� ,1',>

9,'8$/6� :,7+� (;3(5,(1&(� ,1� 7+(� 63(&,),&� 7$6.� 72� %(� $''5(66('� %<� �� !(&21'�� &855(17� '$7$� :(5(� ,168)),>

&,(17� 72� '(9(/23� $� 6<67(0�� "+(� .12:1� &$6(6� 2)� )5$8'� :(5(� -8'*('� 72� %(� ,1$'(48$7(� )25� 67$7,67,&$/� 25

0$&+,1(� /($51,1*� $3352$&+(6�� 27+� 352%/(06� :(5(� &,7('� %<� 7+(� '(9(/23(56� $6� 0$-25� %$55,(56� 72� '(9(/>

23,1*� ��

�(63,7(� 7+(6(� ',)),&8/7,(6�� $� 6<67(0� :$6� '(9(/23('� 7+$7� 5(/,(6� 8321� $66(0%/,1*� $� '(7$,/('� 67$7,67,>

&$/� 352),/(� 2)� ($&+� +($/7+&$5(� 3529,'(5� $1'� 7+(1� &203$5,1*� 7+$7� 352),/(� 72� 27+(5� 3529,'(56� 2)� 7+(� 6$0(

7<3(�� !,1&(� ($&+� 3529,'(5� ),/(6� $� /$5*(� 180%(5� 2)� &/$,0� )2506�� 67$7,67,&6� &$1� %(� '(5,9('�� ,1',&$7,1*� 7+(

180%(5� 2)� 6(59,&(6� 2)� $� 3$57,&8/$5� 7<3(� $1'� 7+(� 180%(5� 2)� 6(59,&(6� 2)� $1� 81(;3(&7('� 7<3(� 3(5)250('

%<� $� *,9(1� 3529,'(5�� "+(6(� 67$7,67,&6� &$1� 7+(1� %(� &203$5('� :,7+� $9(5$*(6� )25� &203$5$%/(� 3529,'(56�

�25� (;$03/(�� 7+(� 67$7,67,&6� 2)� $� 3$57,&8/$5� &+,5235$&725� &$1� %(� &203$5('� 72� $//� &+,5235$&7256� ,1� 7+(� 6$0(

&,7<�

�27(17,$/� )5$8'� &$6(6� $5(� ,'(17,),('� :+(1� $� 3529,'(5� ',))(56� )520� 27+(5� 3529,'(56� ,1� :$<6� 7+$7� $5(

%27+� 67$7,67,&$//<� 6,*1,),&$17� $1'� ,1',&$7,9(� 2)� )5$8'�� "+(� 6<67(0� 86(6� +(85,67,&6� 25� =58/(6� 2)� 7+80%�� 7+$7

,1',&$7(� :+<� $� 3$57,&8/$5� 67$7,67,&� ,6� ,1',&$7,9(� 2)� )5$8'�� $1'� :+$7� 6257� 2)� '(9,$7,216� )520� $9(5$*(� $5(

,03257$17�� 25� (;$03/(�� 620(� 67$7,67,&6� 0$<� 127� %(� ,1',&$7,9(� 2)� )5$8'� ,)� 7+(<� $5(� /2:(5� 7+$1� 1250$/�� %87

21/<� ,)� 7+(<� $5(� +,*+(5� 7+$1� 1250$/�

�� '(021675$7(6� 7+$7� ,7� ,6� 620(7,0(6� 3266,%/(� 72� &216758&7� $� 6<67(0� :+(5(� 12� (;3(57� $1'� )(:

'$7$� (;,67�� 2:(9(5�� 7+(5(� $5(� ,03257$17� ',))(5(1&(6� %(7:((1� +($/7+� &$5(� )5$8'� '(7(&7,21� $1'� :,5(� 75$16>

)(5� $1$/<6,6�� ,567�� "+(� "5$9(/(56� +$6� '(7$,/('� ,1)250$7,21� $9$,/$%/(� 21� ($&+� +($/7+&$5(� 3529,'(5� %(&$86(

3529,'(56� ),/(� $� /$5*(� 180%(5� 2)� &/$,06� ($&+� <($5�� $7$� )520� :,5(� 75$16)(56� $1'� �" 6� $5(� /,.(/<� 72� %(

)(:(5� $1'� 025(� )5$*0(17$5<�

!(&21'�� %$6('� 21� 7+(� �� (67,0$7(�� 3(5&(17� 2)� $//� +($/7+� &$5(� &/$,06� ,192/9(� 620(� )5$8'�

�1� &2175$67�� 352%$%/<� $5281'� �� 3(5&(17� 2)� $//� :,5(� 75$16)(56� ,192/9(� 021(<� /$81'(5,1*�� "+,6� 326(6� $

08&+� *5($7(5� &+$//(1*(�� 6,1&(� :,7+287� +,*+� $&&85$&<�� $1� $8720$7('� 021,725,1*� 6<67(0� :28/'� 352'8&(

$1� 81$&&(37$%/<� /$5*(� 180%(5� 2)� )$/6(� 326,7,9(6�

!�# �� 2+1� �� $-25� $1'� �$1� �� ,(',1*(5�� =�� <%5,'� �12:/('*(�!7$7,67,&$/>�$6('� !<67(0� )25� 7+(� �(7(&7,21� 2)� �5$8'��

�� >��


fragmentary record of the individual or account inquestion.

Difficulties With Supplying Cases of MoneyLaundering for Data AnalysisIt is difficult to label individual transfers, persons,accounts, or businesses as definitely associatedwith money laundering within the time frame rele-vant to crime detection. Years often elapse be-tween the time that wire transfer records aregenerated and the conclusion of a law enforce-ment investigation of relevant leads or suspects.Even if criminal prosecution records were careful-ly matched with wire transfers, it is unlikely thatconcluded cases would identify all, or even most,of the records that were actually involved withmoney laundering. Law enforcement agenciesclearly do not identify or prosecute all moneylaundering activity and may catch only the incom-petent money launderers. Thus, by looking at anyset of wire transfers, it is not possible to confident-ly label each as licit or illicit.

Fraud detection systems for credit cards, tele-phones, and health care do not suffer from thisproblem to the same extent. Much fraud is “self-revealing”—clearly detectable after the fact. Forexample, some cellular telephone fraud schemesinvolve “cloning” the phone of a customer with noinvolvement in the fraud scheme, and the custom-er will usually report the fraudulent toll calls whenhe or she receives a bill.29

While this self-revealing characteristic usuallydoes not allow the fraud to be detected as it is oc-curring, it does provide investigators with a baseof positive cases from which to derive overall pat-terns of fraud. Unfortunately, money launderingalmost never is self-revealing. Investigators canonly make inferences based on the schemes that

they have caught themselves—leaving open thepossibility that many other schemes may go unde-tected.

If imperfectly labeled data about money laun-dering are used in knowledge acquisition, the re-sulting profiles may do little more than confirmknown methods. Suppose a set of data is labeledso that each known case of money laundering isused as a positive example and all the remainingcases are used as negative examples. The negativeexamples almost certainly contain undetectedcases of money laundering, perhaps representingas many (or more) cases than are being used aspositive examples. If these data are used to deriveprofiles of money laundering, the profiles will be“trained” to ignore negative examples—eventhough they may, in truth, involve money launder-ing. The resulting profiles will faithfully profileknown money laundering schemes, rather than de-tect new ones.30

This labeling problem impairs data analysistechniques that might be used to construct profilesdirectly from data using techniques of statistics,machine learning, and visualization.

❚ Additional DataWire transfer data don’t exist in a vacuum. Thereare other types of data that can be used to identifymoney laundering. In fact, FinCEN currently usesa large number of databases to identify and ana-lyze financial crimes. Table 4-1 details some ofthe types of information and the specific databasesfrom which it is gathered.

FinCEN information comes from three basicsources: 1) the U.S. Treasury’s Financial Databasethat contains CTRs, Currency and MonetaryInstruments Reports, Casino Reports, and For-eign Bank Account Reports; 2) several databases

29 Not all fraud is self-revealing. For example, some health care schemes involve creating entirely fictitious identities or involve the willingcollusion of policyholders. See: Malcolm Sparrow, “The State of the Fraud Control Game; and the Impact of Electronic Claims Processing onFraud and Fraud Control,” Unpublished paper for the 1994 International Symposium on Criminal Justice Information Systems and Technology,1994.

30 Malcolm Sparrow, “The State of the Fraud Control Game; and the Impact of Electronic Claims Processing on Fraud and Fraud Control,”

Unpublished paper for the 1994 International Symposium on Criminal Justice Information Systems and Technology, 1994.


TABLE 4-1: Data Accessible to FinCENÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁCategory

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁType

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁSelected specific databasesÁÁÁÁÁÁÁÁ

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

��&'$#'ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

��"�� &�''� �$&"�&� ��&�''�'� %�$#�

#)"��&'� '$��!� '��)&�(,� #)"��&� !��!

��!�#�'� �&�"�#�!� &��&&�!'� !�&�� '�

(&�#'��(�$#'� �$&��#� ��# � ��$)#(

�$!��#�'� (&�*�!� &��$&�'

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

�&��(� �)&��)'� #�+'� &�%$&('� �� $'(�!

�#�� $""�&��!� ��#�� $�� &�''

"�''�#�� !�&�#� ��(��'�� %�$#�

��&��($&��'� !�+� �#�$&��"�#(� �#�� (&��')&,

��(��'�'

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

�)'�#�''�' ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

��"�� &�''�'� ��#�#��!� ��(�� #�"�'� $�

$��&'�� %�&(#�&'�� #�� #('� !��!� �#�

&��)!�($&,� ��!�#�'

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

)#� �� &��'(&��(� �#�$&"�(�$#� "�&��

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ�&$%�&(,

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ��&�''�� '�!�'� �#�$&"�(�$#

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ�$)&(�$)'�� &��$&�'� �#� �� '(�(�'ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

ÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁÁ

�� #�� $�)"�#('��

of criminal reports including the Drug Enforce-ment Administrations’s Narcotics and DangerousDrugs Information System, the INTERPOL CaseTracking System, and the United States Postal In-spection Service; and 3) commercial database ser-vices from organizations such as Dun &Bradstreet, LEXIS/NEXIS, and credit bureaus.

In addition to these databases of specific in-formation, some useful data may involve generalknowledge about money laundering activities.For example, money laundering is generallythought to employ accounts in countries withstrong bank secrecy laws.31 However, informa-tion such as this is relevant only in the context ofadditional information indicating criminal intent.For example, legitimate corporations use offshorebank accounts in countries with strong bank secre-cy laws. This activity, in itself, is not a sufficientindicator of money laundering.

❚ Money Laundering ProfilesAnother set of challenges for wire transfer moni-toring systems involves basic facts about moneylaundering and the current state of knowledgeabout it. These include the extremely low inci-dence of money laundering, the lack of tested pro-

files, the existence of temporal and spatialprofiles, and the dynamic nature of criminal con-duct, the similarity of licit and illicit conduct, andthe need for multiple levels of analysis.

Extremely Low IncidenceThe dollar volume of money laundering appearslarge (one estimate is $300 billion per year world-wide), but is small compared to the total volumeof money moved over wire transfer systems in theUnited States (at least $2 trillion per business day,$500 trillion per year). Assuming that all moneylaundering moves through U.S. wire transfer sys-tems, that each transaction moves once via a wiretransfer, and that money laundering transactionsare the same size as other transactions, then laun-dered money would account for approximately0.05 percent of all wire transfers in the UnitedStates (see box 4-4).

The low incidence of money laundering wiretransfers exacerbates the problem of false positiveidentifications of money laundering by an auto-mated or semiautomated system. Because thefalse positive rate is likely to be orders of magni-tude greater than the 0.05 percent incidence ofmoney laundering, the ratio of false positives to

31 In 1989, these countries were: Antigua, Austria, Bahamas, Bahrain, Barbados, Belize, Bermuda, British Virgin Islands, Cayman Islands,Costa Rica, Channel Islands, Gibraltar, Grenada, Hong Kong, Isle of Man, Liberia, Liechtenstein, Luxembourg, Monaco, Republic of Nauru,The Netherlands, The Netherlands Antilles, Panama, Singapore, St. Kitts, St. Vincent, Switzerland, and Turks and Caicos Islands. Mike Har-rington and Marcus Glenn, “Methods for Analyzing Wire Transfer Data To Detect Financial Crimes,” MTR-91-W00057, McLean, VA: MITRECorporation.


BOX 4-4: What Percentage of Wire Transfers Involve Money Laundering?

�1� (0� .-00(!*$� 1-� -!1 (,� /-2&'� $01(+ 1$0� -%� 1'$� .$/"$,1 &$� -%� 4(/$� 1/ ,0%$/0� 1' 1� (,3-*3$� +-,$5

* 2,#$/(,&�� ! 0$#� -,�

�61'$� ),-4,� 3-*2+$� -%� +-,$5� 1/ ,0%$//$#� -3$/� 4(/$� 1/ ,0%$/� 0501$+0� (,� 1'$� �,(1$#� �1 1$0�

�6$01(+ 1$0� -%� 1'$� 1-1 *� +-2,1� -%� +-,$5� * 2,#$/(,&�� ,#

�6 002+.1(-,0� !-21� '-4� +-,$5� * 2,#$/$/0� 20$� 4(/$� 1/ ,0%$/0�

Volume of wire transfers : � �,� �� $#4(/$� 1/ ,0%$//$#� -3$/� �� 1/(**(-,� ,#� �� 1/ ,0%$//$#-3$/� �� 1/(**(-,�� '$� 3-*2+$� 1/ ,0%$//$#� (,� ,#� -21� -%� 1'$� �,(1$#� �1 1$0� 1'/-2&'� �� +$00 &$0� (0

,-1� $ 0(*5� $01(+ 1$#�� *1'-2&'� (1� (0� ./-! !*5� -%� 1'$� 0 +$� -/#$/� -%� + &,(12#$� 0� 1'-0$� -%� �$#4(/$� ,#

�� -4$3$/�� + ,5� �� +$00 &$0� /$� 21-+ 1(" **5� "-,3$/1$#� 1-� �� +$00 &$0�� +$ ,(,&

1' 1� 0(+.*5� ##(,&� 1'$� 1-1 *� #-** /� 3-*2+$0� -%� 1'$� 1'/$$� 0501$+0� 4-2*#� /$02*1� (,� ,� -3$/$01(+ 1$�� -/� 1'$

.2/.-0$0� -%� $01(+ 1(-,�� 1/(**(-,� .$/� 5$ /� 4(**� !$� 20$#� 0� 1'$� 1-1 *� #-** /0� 1/ ,0%$//$#� !5� 4(/$� 1/ ,07

%$/0� 1'/-2&'� 1'$� �,(1$#� �1 1$0�

Total amount of money laundering : � �01(+ 1$0� -%� 4-/*#4(#$� +-,$5� * 2,#$/(,&� /$� �� !(**(-,1-� �� !(**(-,� ,,2 **5�

Assumptions and estimates : �%� (1� (0� 002+$#� 1' 1� **� * 2,#$/$#� %2,#0� +-3$� 1'/-2&'� 1'$� �,(1$#�1 1$0�� 1' 1� 1'$5� /$� 1/ ,0%$//$#� -,*5� -,"$�� ,#� 1' 1� +-,$5� * 2,#$/(,&� 1/ ,0%$/0� /$� ,-� * /&$/� -/� 0+ **$/

1' ,� -1'$/� 1/ ,0%$/0�� 1'$,� 1'$� .$/"$,1 &$� -%� **� 4(/$� 1/ ,0%$/0� 1' 1� +-3$� 1'/-2&'� 1'$� �,(1$#� �1 1$0� ,#

(,3-*3$� +-,$5� * 2,#$/(,&� (0� !$14$$,� �� .$/"$,1� �� ,#� �� .$/"$,1� ��

�'$� $01(+ 1$� "-2*#� !$� 02!01 ,1( **5� *-4$/� (%� (1� (0� 002+$#� 1' 1� ,-1� **� * 2,#$/$#� %2,#0� . 00

1'/-2&'� 1'$� �,(1$#� �1 1$0�� -/� 1' 1� ,-1� **� * 2,#$/$#� %2,#0� 1' 1� . 00� 1'/-2&'� 1'$� �,(1$#� �1 1$0� /$� 0$,1

3( � 4(/$� 1/ ,0%$/0�� (+(* /*5�� (1� "-2*#� !$� 02!01 ,1( **5� '(&'$/� (%� 1'$� 0 +$� * 2,#$/$#� +-,$5� (0� 002+$#� 1-

!$� 0$,1� 3( � 4(/$� 1/ ,0%$/� +2*1(.*$� 1(+$0� �(,� -/#$/� 1-� $3 #$� 0(+.*$� #$1$"1(-,� 0"'$+$0�� )(,&� !-1'� -%

1'$0$� % "1-/0� (,1-� ""-2,1�� $01(+ 1$0� 1' 1� 1'$� 1-1 *� .$/"$,1 &$� -%� 4(/$� 1/ ,0%$/0� 1' 1� (,3-*3$� +-,$5

* 2,#$/(,&� (0� ./-! !*5� *$00� 1' ,� -,$71$,1'� -%� -,$� .$/"$,1� �� .$/"$,1�� ,#� 1' 1� � /$ 0-, !*$� +$#( ,

$01(+ 1$� (0� -,$714$,1($1'� -%� -,$� .$/"$,1� �� .$/"$,1�� (3$,� 1'$� 2,"$/1 (,15� /$& /#(,&� 1'$� 1-1 *

+-2,1� -%� +-,$5� * 2,#$/(,&�� ,#� '-4� +-,$5� * 2,#$/$/0� 20$� 4(/$� 1/ ,0%$/0�� 1'$0$� $01(+ 1$0� 0'-2*#� !$

/$& /#$#� 0� ./$*(+(, /5� ,#� '(&'*5� 2,"$/1 (,�

�� %%("$� -%� �$"',-*-&5� �00$00+$,1��

true positives (even if all the true positives are cap-tured by the monitoring system) is apt to be ex-tremely high (see box 4-5).

A high false positive rate would diminish lawenforcement’s confidence in the system’s capabil-ities. The leads produced by any wire transfermonitoring system must compete for the attentionof law enforcement agents. Most law enforcementagencies contacted by OTA noted that they had fartoo few resources to follow up every possible lead.If most leads provided by a system turn out to befalse, law enforcement agents are unlikely to usethe output of the system in preference to more reli-able information sources.

Lack of Tested ProfilesBuilding traditional knowledge-based systems in-volves interviewing an expert about a relativelynarrow problem area (e.g., diagnosing bacterialdiseases) and constructing a computer-basedmodel of the reasoning process of that expert. Lawenforcement agents or analysts do not know howto recognize a wire transfer as money laundering.If wire transfers are examined at all, they are ex-amined in the context of an ongoing investigation,due to limits on law enforcement access to wiretransfer data.


BOX 4-5: False Positives

�'%#64'� /145� 8+3'� 53#04('34� #3'� .')+5+/#5'�� #0� #651/#5'&� 8+3'� 53#04('3� /10+513+0)� 4:45'/� 816.&

(#%'� #� &#605+0)� 5#4-�� (� #� 4:45'/� /'3'.:� %.#44+(+'&� '#%*� 53#04('3� #4� ;.')+5+/#5'�� 13� ;+..')+5+/#5'�� +5� 816.&

*#7'� 51� 2+%-� 165� #� 7'3:� 4/#..� 06/$'3� 1(� 53#04('34� #4� +..')+5+/#5'�� 8*+.'� .'#7+0)� 5*'� 7#45� /#,13+5:� 1(� �.')+5+<

/#5'�� 53#04('34� 60516%*'&�� 0:� 46%*� 4:45'/� 8+..� #./145� %'35#+0.:� /#-'� /#0:� '33134�� &6'� 51� 5*'� $#4+%

.#84� 1(� 231$#$+.+5:�

�446/'� 5*#5� #� 4:45'/� '9#/+0'4� '#%*� 1(� �� 8+3'� 53#04('34� #0&� %.#44+(+'4� '#%*� #4� ;.')+5+/#5'�

13� ;+..')+5+/#5'�� 635*'3�� #446/'� 5*#5� 5*'� 4:45'/� +4� 3'#410#$.:� #%%63#5'�� %133'%5.:� %.#44+(:+0)� �� 2'3<

%'05� 1(� 5*'� 53#04('34� �+�'�� +0� 10.:� �� 2'3%'05� 1(� 5*'� %#4'4� &1'4� +5� %.#44+(:� #� 53#04('3� #4� +..')+5+/#5'� 8*'0� +5

#%56#..:� +4� 015�� 13� 7+%'� 7'34#�� (� 5*'� +0%+&'0%'� 1(� /10':� .#60&'3+0)� +0� 8+3'� 53#04('34� +4� �� 2'3%'05�� 5*'0

10.:� �� 1(� 5*'� �� 8+3'� 53#04('34� 816.&�� +0� 3'#.+5:�� $'� +..')+5+/#5'�� *'� 4:45'/� %16.&� $'� '92'%5'&� 51

%133'%5.:� %.#44+(:� 0'#3.:� #..� 1(� 5*'4'� 53#04('34� �� 165� 1(� �� 13� �� 2'3%'05�� (� 5*'� 3'/#+0+0)� ��

.')+5+/#5'� 53#04('34�� /145� 816.&� $'� %133'%5.:� %.#44+(+'&� � �� 165� 1(� �� 13� �� 2'3%'05�� 18'7'3�

0'#3.:� �� 1(� 5*'� .')+5+/#5'� 53#04('34� �� 165� 1(� �� 13� �� 2'3%'05�� 816.&� $'� /+4%.#44+(+'&�� *'

4:45'/� 816.&� +&'05+(:� 5*'/� #4� +..')+5+/#5'� '7'0� 5*16)*5� 5*':� #3'� 015�� 4� #� 3'46.5�� 5*'� )3162� 1(� 53#04('34

+&'05+(+'&� $:� 5*'� 4:45'/� #4� +..')+5+/#5'� 816.&� %104+45� #./145� '05+3'.:� �� 2'3%'05�� 1(� 53#04('34� 5*#5� #3'

#%56#..:� .')+5+/#5'�

�7'0� +(� 5*'� #%%63#%:� 1(� 5*'� 4:45'/� +4� 0'#3.:� 2'3('%5�� 5*'� 3'46.54� #3'� 45+..� &+4%163#)+0)�� (� 5*'� 4:4<

5'/� +4� �� 2'3%'05� #%%63#5'�� 5*'0� #..� �� +..')+5+/#5'� 53#04('34� 816.&� $'� %133'%5.:� %.#44+(+'&�� #0&� �� .')+5+<

/#5'� 53#04('34� 816.&� $'� /+4%.#44+(+'&� #4� +..')+5+/#5'�� *'3'(13'�� '7'0� 8+5*� #� 4:45'/� 8+5*� 3'/#3-#$.'

#%%63#%:�� 0'#3.:� #..� 1(� 5*'� 53#04('34� +&'05+(+'&� #4� +..')+5+/#5'� #%56#..:� 816.&� $'� .')+5+/#5'��

______________�� *'� 231$.'/� 1(� #� *+)*� (#.4'� 214+5+7'� 3#5'� *#4� $''0� +&'05+(+'&� +0� 15*'3� %105'954�� 0� #� �� 456&:� 1(� 5*'� 64'� 1(� 21.:)3#2*� 5'45+0)�

� �� %10%.6&'&� 5*#5� ;5*'� /#5*'/#5+%#.� %*#0%'� 1(� +0%133'%5� +&'05+(+%#5+10� 1(� +001%'05� 2'34104� #4� &'%'25+7'� �(#.4'� 214+5+7'4�� +4� *+)*'45

8*'0� 5*'� 21.:)3#2*� +4� 64'&� (13� 4%3''0+0)� 263214'4�� *+4� +4� $'%#64'� +0� 4%3''0+0)� 4+56#5+104�� 5*'3'� +4� 10.:� #� 7'3:� 4/#..� 2'3%'05#)'� 1(

5*'� )3162� $'+0)� 4%3''0'&� 5*#5� /+)*5� $'� )6+.5:�� !�� 10)3'44�� ((+%'� 1(� '%*01.1):� �44'44/'05��

�� < �<�<�� "#4*+0)510�� 17'30/'05� �3+05+0)� �((+%'�� 17'/$'3� �� 2��

��!�� ((+%'� 1(� '%*01.1):� �44'44/'05��

Analysts at FinCEN and law enforcementagencies have little expertise analyzing wire trans-fers on the scale envisioned by proposals, and un-til they do, it will be difficult or impossible toconstruct a traditional knowledge-based system toanalyze wire transfers automatically.32 Anotherproblem stems from the paucity of informationcontained in a wire transfer. At best, the wiretransfer message contains only the names, ad-dress, and account numbers of the originator andbeneficiary, information about intermediarybanks processing the transfer, the amount of thetransfer, and optional payment instructions. At

worst, the message identifies the banks involvedin the particular transfer and the account numberof the beneficiary. Such information, unless com-bined with large amounts of other data, offers fewopportunities to identify suspicious transfers.

Even wire transfer systems know surprisinglylittle about the transfers that flow over their sys-tems. For example, the Federal Reserve Banksonly collect information on the total dollar vol-ume and number of transfers processed over Fed-wire. The sole exception appears to be a 1987study of a single day’s traffic on CHIPS and Fed-

32 FinCEN has attempted to arrange a pilot study to examine Fedwire data. However, there is no indication that the legal issues surrounding

access to wire transfer data have been overcome.


wire.33 However, even this study has severe li-mitations. It sampled only certain categories ofthe day’s traffic and examined only wire transfersfrom some participating banks.

Patterns in Time and SpaceIf reliable indicators of money laundering activi-ties are present in financial data, they may neces-sarily involve multiple transfers over a period oftime between geographically dispersed individu-als, businesses, and financial institutions. For ex-ample, known scenarios of money launderinginvolve a series of cash deposits into multiple ac-counts (where each deposit is under the $10,000reporting threshold), aggregation of the funds intoa separate account, and a large wire transfer out ofthat separate account.34 Being able to screen forsuch patterns necessarily involves temporal andspatial concepts.

The need for temporal and spatial screening af-fects the necessary technical characteristics of asuccessful monitoring system. First, it empha-sizes the importance of examining data from mul-tiple locations and time periods, making localizedanalysis less likely to be effective—screening at asingle bank or for limited time periods may identi-fy relatively few money laundering schemes. Se-cond, the need for temporal and spatial screeningimplies the need for certain types of databases andanalysis tools, making them ill-suited for investi-gating money laundering. Some tools, particular-ly those developed for law enforcement (e.g.,NETMAP), do allow analysis using temporal andspatial information.

Dynamic and Diverse Forms of CriminalConductThere are many ways to launder money. Any sys-tem that attempts to identify money launderingwill need to evaluate wire transfers against multi-ple profiles. In addition, money launderers are be-lieved to change their modes of operationfrequently. If one method is discovered and usedto arrest and convict money launderers, activitywill switch to alternative methods.35

Law enforcement and intelligence communityexperts interviewed by OTA stressed that criminalorganizations engaged in money laundering arehighly adaptable and flexible. For example, in thepast two years, law enforcement agencies haveseen increased use of nonbank financial institu-tions (e.g., exchange houses and check cashingservices) and increased use of instruments likepostal money orders, cashiers checks, and certifi-cates of deposit.36 In this way, money launderersresemble individuals who engage in ordinaryfraud. They are adaptive and devise complex strat-egies to avoid detection. They often assume theirtransactions are being monitored and design theirschemes so that each transaction fits a profile oflegitimate activity.37

Similarity of Licit and Illicit ConductMany patterns of transactions associated withmoney laundering differ little from legitimatetransactions (see chapter 1). They are recogniz-able only because of their association with crimi-nal activities. Banking officials emphasize thatlegitimate wire transfer activities in the U.S. bank-

33 Federal Reserve Bank of New York, A Study of Large-Dollar Payment Flows Through CHIPS and Fedwire, December 1987.34 This scenario is also consistent with legitimate activity of some small businesses.35 One convicted money launderer insists that criminal organizations will know “instantly” when money laundering detection methods are

changed, because they have friends in banking, law enforcement, and intelligence communities. Kenneth Rijock, interview at OTA October 6,1994.

36 “Current Trends in Money Laundering,” Hearing before the Permanent Subcommittee on Investigations, Committee on Government

Affairs, U.S. Senate, 102 Congress, Second Session, February 27, 1992.

37 Malcolm Sparrow, “The State of the Fraud Control Game; and the Impact of Electronic Claims Processing on Fraud and Fraud Control,”

Unpublished paper for the 1994 International Symposium on Criminal Justice Information Systems and Technology, 1994.


ing system are diverse and wide-ranging, differingin their type, purpose, frequency, origins, destina-tions, and amounts. Because the ordinary traffic isso heterogeneous, it can be difficult to identifytransfers that are “out of the ordinary.”

Wire transfer information alone is not enoughto determine legality.38 Money laundering expertstold OTA that it is nearly impossible to identify in-dividual wire transfers as suspicious.39 Most ille-gitimate uses of wire transfers mirror standardbusiness practices. Officials at the Federal Re-serve maintain that all patterns with which theyare familiar are also consistent with normal busi-ness practices.

Instead, only patterns of transactions (both wireand nonwire) can indicate money laundering. In-deed, even these patterns of transactions can bemade to resemble legitimate businesses. Howev-er, these data can be combined with other data inorder to evaluate the suspiciousness of a pattern offinancial transactions. This is one reason why ev-ery major effort to search for money laundering infinancial data (e.g., those of FinCEN and AUS-TRAC) employs link analysis. When data fromlaw enforcement databases are included with fi-nancial data, it becomes more feasible to separatelicit and illicit activities.

Multiple Levels of AnalysisIt is useful to think of wire transfer analysis as con-sisting of multiple levels. 40 First is the transactionlevel. Money laundering necessarily involves a

set of individual transactions such as currency de-posits and withdrawals, wire transfers, andchecks.41 Second is the individual or account lev-el. Multiple transactions are associated with spe-cific individuals and bank accounts.42 Third is thebusiness or organizational level. An individualbusiness may be a front for money laundering andmay involve multiple accounts and multiple indi-viduals. Fourth is the “ring” level which involvesmultiple businesses, accounts, and individuals ina money laundering scheme of broad scope.

The multiple levels of possible analysis indi-cate a flaw in analytic approaches that only ex-amine transaction-level data. Schemes thatoperate at a “ring” or a business level may not bedetectable through transaction analysis. Instead,the indicia of these schemes may become apparentonly after aggregating data to the individual/ac-count, business, or ring level. Analysis at anysingle level may miss indicators of activity at oth-er levels. Different levels of analysis may be bestdone in different places. For example, banks areuniquely equipped to detect money laundering atthe transaction and individual/account levels.They have access to customer information and ac-count history which can be brought to bear on eva-luating suspiciousness. In contrast, FinCEN isuniquely equipped to detect money laundering atthe business and ring level. They have aggregateddata and additional information from law enforce-ment and commercial sources that can be broughtto bear.

38 Mike Harrington and Marcus Glenn, “Methods for Analyzing Wire Transfer Data To Detect Financial Crimes,” MTR-91-W00057,

McLean, VA: MITRE Corporation.

39 Many people compare the problem of looking for illicit wire transfers to “looking for a needle in a haystack.” Ted Senator, Chief of Fin-CEN’s Systems Development Division, notes that the problem is more analogous to “looking for a needle in a stack of other needles.” Even ifyou examine each transfer, it is not obvious which ones are illicit.

40 This idea is adapted from: Malcolm Sparrow, “The State of the Fraud Control Game; and the Impact of Electronic Claims Processing onFraud and Fraud Control,” Unpublished paper for the 1994 International Symposium on Criminal Justice Information Systems and Technology,1994.

41 However, some forms of money laundering involving bulk shipments of currency out of the United States would not involve any transac-

tions that could be captured by monitoring U.S. institutions.

42 FinCEN’s AI System (FAIS) consolidates transactions into precisely these categories: subjects and accounts.


FINDINGS� Many of the major challenges in constructing

an effective wire transfer analysis system arerelated to data and not technology. In severalcases, technologies are available that would beappropriate for wire transfer analysis, but dataand expertise do not exist to make thosetechnologies effective.

� There are two basic types of screening technol-ogies: knowledge-based systems and link anal-ysis. Effective use of knowledge-basedsystems requires either human experts who canaccurately screen wire transfers or substantialamounts of data for which the correct analysis

is already known. Effective use of link analysisrequires a variety of readily available data,some of which provide indicators of moneylaundering activity.

� In general, there are no experts or data to makethe use of knowledge-based systems feasiblefor detecting money laundering through wiretransfer monitoring alone. However, data areavailable that would make it possible to con-duct link analyses on wire transfers.

� The data and expertise necessary to apply linkanalysis already are assembled at FinCEN (theFinancial Crimes Enforcement Network).

Documents

Technologies for Detecting Money Laundering - MIT CSAILgroups.csail.mit.edu/mac/classes/6.805/articles/money/ota-money... · Technologies for Detecting Money Laundering t the core