Abstract

Anti–money-laundering (AML) analysis asks whether the provenance and path of funds are consistent with legitimate economic activity—distinct from transaction-level fraud detection, which asks whether an act is theft or misuse. We document a graph-construction and analysis pipeline that builds a directed money-flow network from banking master data (customers, accounts, transfers, beneficiaries, watchlist/blacklist), then applies:

1. Greedy modularity community detection
2. PageRank and approximate betweenness centrality
3. A mule/hub heuristic combining transfer degree, PageRank, and blacklist boosts

Suspected rings are communities of size ≥ 4. Outputs feed executive KPIs, suspicious-entity queues, and an interactive ego-network scene for AML and compliance analysts.

1. Introduction

Typologies of interest include layering (funds moved across many accounts before exiting to crypto, remittance, or large cash-out) and structuring (splitting amounts below reporting thresholds). Graph representations make multi-hop counterparts, shared communities, and high-centrality “mule-like” accounts inspectable—supporting case triage rather than replacing formal STR/CTR judgment.

2. Graph Construction

• Nodes: Typed as customer, account, or external (counterparty outside the bank).
• Directed edges: Encode
  • Owns (customer ↔ account)
  • Transfer (weighted money flow)
  • Beneficiary (payee book)
• Flags: Watchlist and blacklist flags attached as node attributes for visual emphasis and scoring boosts.
• Artifacts:
  • Builds a NetworkX DiGraph
  • Persists GraphML for full-graph queries
  • Exports a display-capped payload for the browser scene

3. Algorithms

• Communities: greedy_modularity_communities on the undirected projection.
• PageRank: Weighted by transfer edge weight (max_iter=100).
• Betweenness: Approximate sampling (k scaled to graph size) for speed.
• Hub / Mule Heuristic:
  For account/external nodes:
  score = 1.5 × |out transfers| + |in transfers| + 100 × PageRank (+20 if blacklisted)
  Retain if score ≥ 8.
• Rings suspected: Communities with size ≥ 4.

4. Limitations

• Hub scores are heuristics, not calibrated probabilities.
• Community “rings” are structural suspects only.
• Temporal ordering, amount structuring detectors, and formal SAR workflow integration are out of scope for this note and remain future work.