AML Detection
“Which accounts show money laundering patterns?”
Book a demo and get a free trial of the full platform: research agent, fine-tune capabilities, and forward-deployed engineer support.
By submitting, you accept the Terms and Privacy Policy.
Loved by data scientists, ML engineers & CXOs at
A real-world example
Which accounts show money laundering patterns?
Banks spend $30B+ annually on AML compliance (LexisNexis Risk Solutions). Legacy rule-based transaction monitoring generates 95-98% false-positive rates on Suspicious Activity Report (SAR) alerts, burying investigators in noise. Meanwhile, sophisticated laundering networks exploit the gap between siloed monitoring systems, structuring deposits just below reporting thresholds, layering funds through shell-company networks, and using trade-based schemes that span multiple institutions. A top-10 bank processes 500K+ alerts annually with only 2-5% resulting in actual SARs.
Quick answer
The most effective AML detection models map the full relational graph of accounts, transactions, counterparties, and corporate structures. Graph-based ML detects multi-hop laundering patterns (structuring, layering, shell-company networks) that rule-based transaction monitoring misses. This approach reduces false-positive alert rates by 60% while surfacing 35% more true suspicious activity.
Approaches compared
4 ways to solve this problem
1. Rules-based transaction monitoring
Flag transactions above reporting thresholds ($10K), detect structuring patterns (multiple deposits just below $10K), and apply velocity rules.
Best for
Regulatory baseline. Required for BSA compliance. Catches textbook structuring patterns that match known typologies.
Watch out for
95-98% false-positive rates. Investigators spend 95% of their time clearing false alerts. Sophisticated launderers structure transactions to stay below every threshold and use multi-hop layering that single-transaction rules cannot detect.
2. XGBoost on account-level features
Aggregate transaction features per account (cash deposit frequency, wire transfer volume, counterparty count) and train a classifier to predict SAR-worthy accounts.
Best for
Reduces false positives vs pure rules. Captures account-level anomalies like unusually high cash deposits for a business type.
Watch out for
Each account is scored in isolation. The model cannot see that deposits from 12 'unrelated' individuals flow through 3 intermediary accounts to an offshore entity. Multi-hop laundering networks are invisible to single-table features.
3. Network analysis (link analysis, community detection)
Build a transaction network graph, identify clusters of connected accounts, and flag communities with suspicious flow patterns.
Best for
Visualizes money-flow networks for investigators. Good for case-building once suspicious activity is identified.
Watch out for
Typically a manual investigation tool, not a predictive model. Requires analysts to know where to look. Does not scale to 500K+ alerts per year.
4. KumoRFM (relational graph ML)
Connect accounts, transactions, counterparties, beneficial owners, and corporate structures into a relational graph. The GNN automatically learns multi-hop laundering patterns without hand-coded rules.
Best for
Detects that 12 depositors share an address, their structured deposits flow through 3 intermediary accounts, and the receiving offshore entity shares a beneficial owner with the original shell company. These multi-hop patterns are learned from data, not coded as rules.
Watch out for
Corporate structure and beneficial ownership data is often incomplete. The model works best when KYC and entity-resolution data feeds are clean.
Key metric: Graph-based AML models reduce false-positive alert rates by 60% while surfacing 35% more true suspicious activity vs rules-based monitoring.
Why relational data changes the answer
Money laundering is, by definition, a network crime. The whole point of laundering is to move money through enough entities that the connection between source and destination is obscured. A single transaction from Person A to Account B looks normal. But when you see that Person A shares an address with Persons C, D, and E, who all deposited just below $10K into Account B, which then wired funds through Account C to an offshore entity whose beneficial owner is linked back to Person A, the laundering pattern is obvious.
This is precisely the kind of multi-hop, multi-table pattern that relational models are built to detect. Rules-based systems see individual transactions. Flat-table models see individual accounts. Relational models see the entire flow network. That is why graph-based AML models reduce false positives by 60% (investigators stop wasting time on noise) while catching 35% more true suspicious activity (the sophisticated networks that slip through rule-based monitoring).
Rules-based AML monitoring is like a bank teller who checks each customer's ID but never notices that the same 12 people visit the same teller window every Tuesday, each depositing $9,800. The teller sees individual transactions. The security camera (the relational graph) sees the coordinated pattern.
How KumoRFM solves this
Relational intelligence built for banking and financial data
Kumo maps the full relational graph of accounts, transactions, counterparties, beneficial owners, and corporate structures. The model identifies patterns invisible to threshold-based rules: Account A-7012 receives structured deposits from 12 unrelated individuals, each below $10K, then wires funds through three intermediary accounts to an offshore entity whose beneficial owner shares an address with the original depositors. These multi-hop laundering patterns emerge naturally from the graph structure without hand-coded rules.
From data to predictions
See the full pipeline in action
Connect your tables, write a PQL query, and get predictions with built-in explainability — all in minutes, not months.
Your data
The relational tables Kumo learns from
ACCOUNTS
| account_id | owner_name | type | opened_date | jurisdiction |
|---|---|---|---|---|
| A-7012 | Apex Trading LLC | Business Checking | 2024-08-15 | US |
| A-7013 | Global Imports Inc | Business Checking | 2024-09-02 | US |
| A-7050 | Margaret Wilson | Personal Savings | 2019-03-10 | US |
TRANSACTIONS
| txn_id | from_account | to_account | amount | type | timestamp |
|---|---|---|---|---|---|
| T-001 | EXT-4421 | A-7012 | $9,800 | Cash Deposit | 2025-09-01 |
| T-002 | EXT-4422 | A-7012 | $9,700 | Cash Deposit | 2025-09-01 |
| T-003 | A-7012 | A-7013 | $48,500 | Wire | 2025-09-03 |
COUNTERPARTIES
| entity_id | name | type | risk_country | shared_address |
|---|---|---|---|---|
| EXT-4421 | John Doe | Individual | US | 142 Oak St |
| EXT-4422 | Jane Smith | Individual | US | 142 Oak St |
| EXT-9901 | Cayman Holdings | Corporation | KY | N/A |
CORPORATE_STRUCTURE
| entity_id | parent_entity | beneficial_owner | jurisdiction |
|---|---|---|---|
| A-7012 | Shell Corp A | Unknown | US |
| A-7013 | Shell Corp B | Unknown | US |
| EXT-9901 | Shell Corp A | Unknown | KY |
Write your PQL query
Describe what to predict in 2–3 lines — Kumo handles the rest
PREDICT BOOL(ACCOUNTS.SAR_FILED = 'True', 0, 30, days) FOR EACH ACCOUNTS.ACCOUNT_ID WHERE ACCOUNTS.TYPE = 'Business Checking'
Prediction output
Every entity gets a score, updated continuously
| ACCOUNT_ID | OWNER | AML_RISK_SCORE | ALERT_PRIORITY | PATTERN_TYPE |
|---|---|---|---|---|
| A-7012 | Apex Trading LLC | 0.92 | Critical | Structuring + Layering |
| A-7013 | Global Imports Inc | 0.78 | High | Layering |
| A-7050 | Margaret Wilson | 0.04 | Low | None |
Understand why
Every prediction includes feature attributions — no black boxes
Account A-7012 (Apex Trading LLC)
Predicted: 92% AML risk score
Top contributing features
Structured deposits below $10K threshold
12 in 7 days
30% attribution
Counterparties sharing same address
4 of 12
25% attribution
Rapid layering to intermediary accounts
3 hops
20% attribution
Corporate structure opacity
Unknown UBO
15% attribution
Account age vs. transaction volume mismatch
13mo old, $2.1M flow
10% attribution
Feature attributions are computed automatically for every prediction. No separate tooling required. Learn more about Kumo explainability
PQL Documentation
Learn the Predictive Query Language — SQL-like syntax for defining any prediction task in 2–3 lines.
Python SDK
Integrate Kumo predictions into your pipelines. Train, evaluate, and deploy models programmatically.
Explainability Docs
Understand feature attributions, model evaluation metrics, and how to build trust with stakeholders.
Frequently asked questions
Common questions about aml detection
What is the best ML approach for AML detection?
Graph-based ML models that map the full transaction-counterparty-entity network outperform both rules-based monitoring and flat-table classifiers. The key advantage is detecting multi-hop laundering patterns: structuring, layering through intermediary accounts, and shell-company networks. These models reduce false-positive alert rates by 60% while surfacing 35% more true suspicious activity.
How do you reduce AML false positives?
Most AML false positives come from threshold-based rules that lack context. A $9,800 cash deposit is suspicious only if 11 other people deposited similar amounts to the same account from the same address. Relational models provide this network context, scoring accounts based on their full transaction-counterparty graph rather than individual transaction features.
Can ML replace rule-based transaction monitoring?
Not entirely. Regulatory requirements mandate certain rule-based checks (CTR filing above $10K, for example). But ML can dramatically improve the prioritization of alerts. Instead of investigators reviewing 500K alerts with a 2-5% hit rate, ML models rank alerts by true-risk probability, so investigators focus on the 20% of alerts most likely to result in SARs.
What data do you need for an AML detection model?
Transaction records and account data are the baseline. For best results, add counterparty information, beneficial ownership data, corporate structure hierarchies, and KYC records. Each additional data source adds a layer of network visibility that helps the model detect layering and shell-company schemes.
How much do banks spend on AML compliance?
Banks spend $30B+ annually on AML compliance globally (LexisNexis Risk Solutions). The bulk of this cost is investigator time spent reviewing false-positive alerts. A top-10 bank processes 500K+ alerts per year with only 2-5% resulting in actual SARs. Reducing false positives by 60% translates to $50-80M in annual savings for a single large institution.
Bottom line: Reduce AML false positives by 60% and surface 35% more true suspicious activity, saving $50-80M in annual compliance costs while strengthening regulatory standing.
Related use cases
Explore more financial services use cases
Topics covered
One Platform. One Model. Infinite Predictions.
KumoRFM
Relational Foundation Model
Turn structured relational data into predictions in seconds. KumoRFM delivers zero-shot predictions that rival months of traditional data science. No training, feature engineering, or infrastructure required. Just connect your data and start predicting.
For critical use cases, fine-tune KumoRFM on your data using the Kumo platform and Research Agent for 30%+ higher accuracy than traditional models.
Book a demo and get a free trial of the full platform: research agent, fine-tune capabilities, and forward-deployed engineer support.
