Traditionally, financial institutions use rule based systems to monitor for situations which could be indicative of a financial crime or compliance breach. For example, if a payment is greater than $10,000, or if an account has been dormant for 6 months before making an initernational transfer then this could be alerted on.
These rule based systems are important and are the backbone of compliance technology. They can be used to demonstrate to regulators, banking partners and investors that good governance is in place across across any compliance operation.
Another backbone of the compliance is the stop list. This involves maintaining for instance lists of sanctioned organisations or individuals who are "politically exposed." If transactions are made to these organisations or people then the transaction should be flagged for manual investigation.
There are however limits to the effectiveness of such rules when we examine them within the context of AML and Fraud. For instance:
- Static Configuration - Rule based systems tend to be static and predefined, stating “if this happens, trigger that”. They cannot always account for a combination of data points or variance of behaviours.
- Stale Configuration - Often rule based systems are set up at the point of implementation and rarely reviewed again, partly down to personnel changes and the skills required to change existing rules, some of which require coding effort.
- Standardised Approach - Rule based systems are generally written with a single industry in mind but do not have the “out of the box” flexibility to address the unique challenges of different organisations or jurisdictions.
- Easy To Reverse Engineer - Criminals know rule based systems exist, so they carefully masquerade their true intentions by testing the thresholds of rules over long period of times.
- Threats From New Techniques - The type of attacks possible with AI are much harder to detect from using traditional rules and are weak at identifying impersonation.
We believe that these add up to the fact that simple rules based systems are no longer adequate to todays world.
From Rules Based To Behavioural Analysis
To combat this, financial crime teams are interesting in moving towards what we call "behavioural analysis" or "behavioural analytics".
Behavioural analysis allows us to look at the patterns of behaviour over time that take into account what we know about the customer.
A 360 degree view of risk is based on not just transactional thresholds being tested but a meaningful insight into the subtitles of a customers behaviour and risk profile.
So you can use that as part of your hostel of defense and detection. So if you start to see a change in Behavior, you start to see the change in the way your customer interacts with you. Then you want to be able to use that model and employ it back into your own processes as a means of detection.
Entity Resolution
Reducing False Positives
False positives continue to be a challenge with analysts sometimes spending hours trying to understand the risk a customer actually presents as opposed to an alert within a system.
Defending The Customer Experience
The challenge is in doing this without disrupting the customer experience.
We've all been in the shop and had our card stops and it may be that in the morning you transacted in Southampton and three hours later. You're in Leeds and your bank just wants to do four check.
You don't want to disrupt that customer satisfaction. You don't want to disrupt that customer experience and traditionally a lot of systems are produced High numbers and false positives. And again, this takes endless time to research before they can click release those payments. So having the system that enables them to take a holistic view of the risk and also the customer and be able to query multiple data sources to be able to drive that risk-based decision really to strengthen that customer relationship.