Money Laundering Bulletin

Timon Molloy

Document

Incoming tide - AI for AML

The next wave of IT development, already crashing in with artificial intelligence large language models like ChatGPT, and set for further tumult when propelled by quantum computing power, will bring sea change to the work of compliance teams. Andreia Nogueirachecks the latest technology forecast.

The next wave of IT development, already crashing in with artificial intelligence large language models like ChatGPT, and set for further tumult when propelled by quantum computing power, will bring sea change to the work of compliance teams. Andreia Nogueirachecks the latest technology forecast.

As information technology evolves, notably through the development of artificial intelligence (AI), anti-money laundering (AML) compliance officers at obliged entities are assessing a growing range of applications and platforms.

The global AML software market size is estimated to grow by US$2.7 billion from 2022 to 2027, reaching US$5.4 billion at a compound annual growth rate (CAGR) of around 15%, although "the high cost of implementation may impede" this expansion, according to the Illinois, USA-based market researcher Technavio. [1] Recognising the pace at which new AI solutions are launching, standard-setters and industry bodies, including the Financial Action Task Force (FATF) and the UK's Joint Money Laundering Steering Group, are issuing guidance [2] [3] on their use. That will, for the time being, rely on human AML expertise. A study by LexisNexis Risk Solutions, the data analytics company, showed that, in 2021, on average, financial crime compliance functions in UK banks were still spending 1.5 to 3 times more on people than on technology. [4]

Man and machine

Jason Piper, head of tax and business law at the Association of Chartered Certified Accountants (ACCA), in London, and a member of the Accountancy Europe federation's AML expert group, said that combining software with human expertise is the safest strategy. "An awful lot of accountants still think that you can judge character based on the strength of your client's handshake and the look in his eyes," a tendency strengthened, he noted, by the lack of accounting sector-focused AML software.

A 2022 survey into the state of machine learning in UK financial services by the Bank of England and the Financial Conduct Authority (FCA) concluded there was work to do in this sector too, with almost half of respondents pointing to Prudential Regulation Authority and/or Financial Conduct Authority regulations that constrain ML tech deployment. [5]

In 2021, an ACCA survey on know your customer (KYC) digitalisation raised concerns that the UK government was promoting "a tick-box culture" by failing to adopt a risk-based approach to AML reporters looking to install AML software; it was adopting "a blanket approach... irrespective of the potential risk posed". [6] Piper said AML systems should better integrate "with the rest of what the accountant does", which would encourage more effective screening and less "box-ticking".Companies should combine "automated searching processes" with "humans... piecing together the hints and tips," he said, adding that due to their "long-term relationship with clients," accountants might help them with their AML case management.

Don't trust, verify

Mason Wilder, research manager at the USA-based Association of Certified Fraud Examiners (ACFE), told MLB that anti-money laundering officers (AMLOs) should mobilise commercial customer due diligence (CDD) databases that generate red flags from OSINT, although as these draw "from all over the internet and can't verify every piece of information,... [anything] that would be critically relevant to your investigation or case, you should definitely verify it via the original source of the information, if possible". AML professionals will also benefit increasingly from machine learning-based transaction monitoring tools, Wilder believes.

The Covid-19 pandemic "led many organisations to invest in non-face-to-face KYC [know your customer] technologies", including in sectors that, traditionally, have made less use of AML IT, like real estate, Adam Feldman, a principal at Toronto, Canada-based consultancy The AML Shop, told MLB. Despite the recent "explosion" in new AML tech, he said that some organisations are hesitating over the risks in "migrating from an existing legacy system". At the same time, new methods for model training, such as 'few-shot learning', are reducing the size of dataset needed for implementation.

Lubna Shuja, president of the Law Society of England and Wales, said that the legal profession is adopting new AML technology, a trend that extends across electronic due diligence tools centred on biometrics, "which use facial matching across ID documents and photographs, as well as open banking [data sharing] and automated client screening".

Lawyers are using AI for identity verification and distributed ledger technologies and smart contracts to boost transparency, including by "establishing the provenance of an asset and a ledger for transactions," she noted.

Shuja recommended that "both government and companies have a robust risk-based regulatory and compliance structure" for AML tech, "alongside clear and practical guidance, policy and procedures".

AI advances

Nikhil Manek, MLRO at KPMG in the UK, encourages AML officers to use "workflow management and population analysis tools," to "identify trends and exposures to sectors, countries and ultimate beneficial owners" and "understand where a single case is in the process". Another argument for upgrading is increasing demands around sustainability reporting: "AML is part of an organization's approach to ESG [environmental, social, and governance]."

All professional services firms will increase their focus on machine learning and natural language processing (eg, ChatGPT) in order to identify and analyse suspicious transactions, says Manek; they can enhance adverse media tools' ability to "process wide amounts of data and categorise them into ML/financial crime risks". Machine learning, for instance, "can establish what type of adverse media an organisation is not interested in", he added.

Feldman, from The AML Shop, observed that AI and machine learning are simplifying watchlist screening: "The system automatically recommends closing or investigating the alert based on historical patterns and provides a plain language explanation to support the recommendation." AI can "more effectively analyse large datasets than humans" and suggest rules "to detect transactions that are consistent with those patterns," he said.

In a 2020 paper, ACCA's Piper and global head of public sector policy Alex Metcalfe wrote that advanced AI and forensic data analytics allow "businesses to go far beyond simply identifying single illicit payments". They stressed that "the ability to analyse unstructured data alongside structured data sources and integrate the findings using behavioural and social networking analytics allows employers" to combine basic AML checks (such as KYC, CDD and suspicious activity alerts) with other useful techniques, "such as predictive modelling, audio analytics, text mining and geospatial analysis, to build a comprehensive picture of risk indicators". [7]

Undue reliance

Needless to say, advanced AML tech brings its own risks of abuse: "If a bad faith actor can get into your systems and spoof the digital credential further down the track than where it was initially verified, unless somebody goes back and checks all the way through the chain... it can go through for a long time until people find out there is an issue," said Piper. He also cautioned that "[L]awyers who have asked ChatGPT for advice got something which looks absolutely plausible and has a legal citation" but, it then turns out, wasn't real.

Mason Wilder, from ACFE, also sees "potential accuracy issues with natural language processing and biometrics technologies", while "geolocation can be manipulated via technologies like virtual private networks".

KPMG's Manek warned that "treating AI solutions as a 'black box' isn't sustainable" - they need to be part of a broader strategy involving human experts. The organisation's approach to AML IT should reflect its "risk-based approach and risk appetite"; "pain points in the end-to-end customer onboarding journey"; the capacities of its KYC team; and "their ability to maintain appropriate governance and oversight, especially of advanced solutions using new and evolving technologies".

For Lubna Shuja, "appropriate regulation and governance frameworks, including transparency and accountability within the system design, will be very important to ensure that the technology delivers benefits and to mitigate any risks." She added: "As with any data-driven system, gaps or bias in the underlying data can create adverse consequences and harm for individuals or organisations, as can over-reliance on a system's accuracy." Ultimately, though, "[L]awyers are accountable for the advice they give, regardless of whether delegating to humans or machines."

Innovative edge

Although sources were not prepared to endorse specific products, Neil Katkov, risk practice director Boston, USA-based consulting firm Celent, told MLB that "in the banking sector, some of the most widely used incumbent AML detection systems globally are NetReveal ( https://www.netreveal.ai), NICE Actimize, Oracle ( https://www.oracle.com/financial-services/aml-financial-crime-compliance/), and SAS Institute; ( https://www.sas.com/en_us/software/anti-money-laundering.html) as well as regtech startup Quantexa ( https://www.quantexa.com/solutions/anti-money-laundering/)".

New Jersey, US-based NICE Actimize is presenting solutions, infused with AI and machine learning, for suspicious activity monitoring, sanctions screening, cryptocurrency intelligence, trade-based ML and currency transaction reporting. Examples of products include data processor X-Sight Entity Risk and Xceed, an integrated fraud and AML platform. [8]

Leading vendors are covered in specialist market reports [9]and websites, such as https://www.g2.com/categories/anti-money-laundering; https://www.saasworthy.com/list/anti-money-laundering; and https://6sense.com/tech/anti-money-laundering.Commonly featured services are LexisNexis Risk Solutions' AML Insight [10] and Refinitiv's World-Check Risk Intelligence database, which cater to KYC and third-party due diligence screening. [11]

Katkov, however, advised AML reporters to look at the "many regtech startups offering more modern solutions". These include cloud-based systems, modular microservices, which allow a large application to operate as smaller free-standing parts, and systems underpinned by AI. He highlighted (not all startups) Feedzai ( https://feedzai.com); Featurespace ( https://www.featurespace.com); HAWK:AI ( https://hawk.ai); Napier ( https://www.napier.ai); and Tookitaki ( https://www.tookitaki.com/), which is based in Singapore and offers an all-in-one solution, combining smart screening, case management, transaction monitoring, and dynamic risk scoring. [12]

Katkov also signposted "other widely used watchlist screening systems", including CGI ( https://www.cgi.com/en); Fircosoft ( https://www.evision.ws/anti-money.html); FinScan ( https://finscan.com); and ComplyAdvantage ( https://complyadvantage.com).

"Notable solutions focused on KYC workflow are provider Pegasystems [ https://www.pega.com] and regtech startups Alloy [ https://www.alloy.com] and Fenergo [ https://www.fenergo.com]," he said.

The benefits of investing in the latest AML technology, at least on paper, are significant, even if the decision on when is fraught given the pace of change. Katkov, for one, is clear that AI/machine learning and other tech innovations introduced by recent regtech startups have "enabled efficiency improvements of 50 per cent or higher through false positives reduction and process efficiency for alert investigation".