Scalable and Imbalance-Resistant Machine Learning Models for Anti-money Laundering: A Two-Layered Approach

Abstract

In this paper, we address the problem of detecting potentially illicit behavior in the context of Anti-Money Laundering (AML). We specifically address two requirements that arise when training machine learning models for AML: scalability and imbalance-resistance. By scalability we mean the ability to train the models to very large transaction datasets. By imbalance-resistance we mean the ability for the model to achieve suitable accuracy despite high class imbalance, i.e. the low number of instances of potentially illicit behavior relative to a large number of features that may characterize potentially illicit behavior. We propose a two-layered modelling concept. The first layer consists of a Logistic Regression model with simple features, which can be computed with low overhead. These features capture customer profiles as well as global aggregates of transaction histories. This layer filters out a proportion of customers whose activity patterns can be deemed non-illicit with high confidence. In the second layer, a gradient boosting model with complex features is used so as to classify the remaining customers. We anticipate that this two-layered approach achieves the stated requirements. Firstly, feature extraction is more scalable as the more computationally demanding features of the second layer do not need to be extracted for every customer. Secondly, the first layer acts as an undersampling method for the second layer, thus partially addressing the class imbalance. We validate the approach using a real dataset of customer profiles and transaction histories, together with labels provided by AML experts.

A Appendix

Sequence-based Features Calculation. We have an assumption that sequences of customers’ transactions are not random and follow some hidden structure. Therefore we used a way to encode this information to the model by so-called generative log-odds features [17], where we estimate transaction probabilities between each transaction state separately for potentially illicit and non-illicit customers and then compare them. This approach allows us to capture the dynamics of the transaction history for our classification task while introducing less overhead than methods based on neural networks (e.g. Boltzman machines) or deep learning auto-encoders. In the log-odd feature extraction method, we want to generate features based on sequential probabilities. We are interested in the following probability:

$$\begin{aligned} P(X)= P(x_1,x_2,\ldots ,x_n ) \end{aligned}$$

(1)

where $x_1,x_2,\ldots ,x_n$ are some discrete properties of transactions (i.e. direction). One particular way to estimate this probability is to use the chain rule:

$$\begin{aligned} P(X)=P(x_1,\ldots ,x_n)=p(x_1)p(x_2 \mid x_1)\ldots p(x_n \mid x_1,\ldots ,x_{n-1}) \end{aligned}$$

(2)

In some cases, it is practically impossible, so we can simplify the assumptions using Markov property:

$$\begin{aligned} P(X_n=x_n \mid X_{n-1}=x_{n-1},\ldots ,X_0=x_0)=P(X_n=x_n \mid X_{n-1}=x_{n-1}) \end{aligned}$$

(3)

But for our task, we are more interested in finding that a particular set of transactions is more illicit than just a set of regular non-illicit transactions. Mathematically, we want to estimate:

$$\begin{aligned} \mathop {{{\,\mathrm{argmax}\,}}}\nolimits _{y\,\in \, (potentially\,illicit, non-illicit)} P(Y=y|X) \end{aligned}$$

(4)

One way to calculate this probability is to use Bayes theorem:

$$\begin{aligned} \mathop {{{\,\mathrm{argmax}\,}}}\limits _y P(Y=y \mid X) = \mathop {{{\,\mathrm{argmax}\,}}}\limits _y P(X \mid Y=y)P(Y=y) \end{aligned}$$

(5)

The only thing left is to calculate $P(X \mid Y=y)$ and $P(Y=y)$. $P(X \mid Y=y)$ can be calculated using train set and then calculating transition probabilities separately for potentially illicit class and non-illicit class. For example, if there are only two states in a transaction sequence, namely in, out. All we need to estimate transition probabilities is to calculate

$$\begin{aligned} P(in \mid out) = \frac{(count(out \rightarrow in))}{(count(out))} \end{aligned}$$

(6)

Similarly, for other combination of in, out we should do the same. $P(Y=y)$ is the prior probability of being potentially illicit, which is simply a proportion of potentially illicit customers in a full customer set for train data. Finally, instead of outputting a binary label 1/0 (potentially illicit sequence or not), we can plug in this as a feature into a classifier along with other features. We can use so-called log-odds ratio instead of a binary feature, defining as:

$$\begin{aligned} \log \frac{P(Y=potentially\,illicit \mid X)}{P(Y=non-illicit \mid X)} \end{aligned}$$

(7)