FlowSeries: Anomaly Detection in Financial Transaction Flows

TL;DR

FlowSeries introduces WeirdFlows, a top-down, pattern-agnostic pipeline for anomaly detection in financial transaction flows using temporal, weighted transaction graphs. It defines transaction flows as $Flow^n(x, y)$ by aggregating all paths up to length $n$ and summing the minimum edge weights along those paths, enabling interpretable anomaly signals via time-series analysis of $w(Flow^n)$. The method requires no labeled data or predefined fraud patterns and emphasizes explainability to support formal AFC investigations. Evaluation on 80 million cross-border ISP transactions demonstrates scalability to large networks and effectiveness in uncovering sanction-evasion patterns, validated by AFC experts. Overall, the framework provides a practical, interpretable approach to uncover complex money flows and anomalous actors in large financial graphs, with direct applicability to real-world AFC workflows.

Abstract

In recent years, the digitization and automation of anti-financial crime (AFC) investigative processes have faced significant challenges, particularly the need for interpretability of AI model results and the lack of labeled data for training. Network analysis has emerged as a valuable approach in this context. In this paper, we present WeirdFlows, a top-down search pipeline for detecting potentially fraudulent transactions and non-compliant agents. In a transaction network, fraud attempts are often based on complex transaction patterns that change over time to avoid detection. The WeirdFlows pipeline requires neither an a priori set of patterns nor a training set. In addition, by providing elements to explain the anomalies found, it facilitates and supports the work of an AFC analyst. We evaluate WeirdFlows on a dataset from Intesa Sanpaolo (ISP) bank, comprising 80 million cross-country transactions over 15 months, benchmarking our implementation of the algorithm. The results, corroborated by ISP AFC experts, highlight its effectiveness in identifying suspicious transactions and actors, particularly in the context of the economic sanctions imposed in the EU after February 2022. This demonstrates \textit{WeirdFlows}' capability to handle large datasets, detect complex transaction patterns, and provide the necessary interpretability for formal AFC investigations.

Figures (6)

• Figure 1: In the transaction network in Figure \ref{['subfig:net_example_2']}, node $x$ has an edge of weight $250$ towards node $y$. The paths between nodes $x$ and $y$ through nodes $h$, $k$ and $z$ could be an attempt to hide a direct edge of higher weight. Table \ref{['subtbl:table_net_example_1']} lists all paths of maximum distance $3$ from $x$ to $y$ and their respective minimum weights.
• Figure 2: Direct transactions from C2 BICs to C1 BICs. The vertical grey dotted line represents the begin of the war in Ukraine (24 February 2022).
• Figure 3: Weight of the transaction flow $Flow^3(C2, C1)$, i.e., the hypothetical maximum amount of money sent from C2 to C1 through several payment lines, each with a maximum of one intermediary.
• Figure 4: Transaction flow from C2 to C1 through C4.
• Figure 5: Transaction flow from C2 to C1 through C5.