How to improve your AML detection? Christopher Ghenne Principal Manager Fraud & Security Intelligence EMEA

Transcription

1 How to improve your AML detection? Christopher Ghenne Principal Manager Fraud & Security Intelligence EMEA

2 Years of 14,010 SAS employees worldwide 93 of the top 100 on the 40 #1 BUSINESS ANALYTICS companies GLOBAL 500 LIST TOP World s Best Multinational Workplaces list World s LARGEST privately held software company 25% Annual reinvestment in R&D US $ 3.16 b Continuous Revenue Growth since % Annual customer retention rate 80,000+ Customer sites in 139 countries 175+ Banking clients

3 What s hot Phased roll-outs Terrorism New Regulations Real-time Discovery Analytics Trade Finance Digitalization Optimization Cost reduction

4 False Positives Key Components for Monitoring Customer Screening Monitoring Systems Transaction Monitoring Payments Screening Customer Screening Transaction Monitoring Sanctions PEPs and SIPs 75% to 99% False Positive 99.9% False Positive 99.5% to 99.9% False Positive Al Qaeda PEP - Politically Exposed Person SIP - Special Interest Person

5 Compliance The AML Puzzle KYC NAME SCREENING TRANSACTION MONITORING PAYMENT FILTERING

6 Compliance The AML Puzzle KYC / CDD / EDD AML (Transaction Monitoring & Customer Screening) Sanctions screening Correspondent Banking FATCA / CRS AML Optimisation Trade based AML

7 Compliance Current and Future Value Propositions

8 The Vision Data Silos Poor Data Quality False Positives Time-consuming New Investigations Regulations High volumes of Unstructured Data Challenges Single Platform Targeted Risk Mitigation Data Insights Effective KRIs & Diagnostics Advanced Analytics Reporting Dashboards

9 SAS Hybrid Approach for AML Detection Levels Of Detection Event Predictive Modeling Entity Anomaly Detection Alert Generation Process Database Searches Network Automated Business Rules Text Mining

10 SAS Methodology - End to End Data Detection Investigation Reporting Structured & unstructured data sources Batch or real time processing Data cleansing Data integration Variable extraction & sentiment analysis with text mining Entity resolution Business rules Anomaly detection Advanced predictive models Watch lists Profiling Hybrid technology Social network analysis and network-level analytics (if appropriate) Automated alert generation Advanced ranking technology Custom alert queues Alert qualification and triage Powerful user interface with single and holistic views Documentation & traceability Dedicated dashboards, easy to use web-based interface Workflow analysis Creation of SARs (where appropriate) Full business intelligence reporting capability System and case management integration Pro-active dynamic data exploration Advanced query of integrated data Self-administered Detection performance analysis New modus operandi discovery Discovery Accelerated design and constant improvement of the detection logic Alert suppression & routing rules Simulation and testing of new risk assessment methodologies

11 Optimisation Upstream vs Downstream

12 Different Types of Optimisations Upstream Vs Downstream Drowning under alerts flowing from everywhere Reduce the flow upstream Reduce the flow downstream

13 Different Types of Optimisations Upstream Vs Downstream Legacy detection Investigation Incoming Transactions Alerts Cases

14 Different Types of Optimisations Upstream Vs Downstream Legacy detection Downstream: Improve Triage Investigation Incoming Transactions Alerts Cases

15 Different Types of Optimisations Upstream Vs Downstream Legacy detection Upstream: Improve Legacy Downstream: Improve Triage Investigation Incoming Transactions Alerts Cases

16 TM Optimisation Ongoing AML Program Improvement Descriptive Diagnostic Predictive Reports / Dashboards Data Exploration Predictive Analytics Business Analysts Data Stewards / CDOs Data Scientist

17 Trend Analysis - Correlation

18 Alerts by day and region

19 Zone Drill Down

20 Decision Trees

21 Number of Entities Number of Entities Number of Entities Number of Entities Our Methodology Statistical Approach for segmentation and optimization ILLUSTRATIVE ANALYSIS As part of the preliminary segmentation analysis and validation component, various analytical approaches are utilized to explore the data to determine the relationships between the variables and to identify key attributes that can be used to segment similar customers and accounts together. Graphical approaches used include items such as scatter plots, frequency histograms, box plots, stacked bar charts, pie charts, etc. Statistical tests on the segments means and variances are performed to verify that they are in fact from different populations. Tests to identify outliers are performed as well as tests for normality of the population. Total Monthly Transaction Amounts Total Amount Vs. Total Volume Businesses Corporations Government MSBs Distributional metrics including skewness, kurtosis, coefficient of variation, mean, and median are all produced to assist in determining the similarity of the segments. Various statistical clustering procedures are performed to assist in identifying groups of entities with similar characteristics. Distributional Metrics LOB Variable Min 25th Pct Median Mean 75th Pct Max STD CoV Skewness Kurtosis Business Amount Volume , Corporations Amount Volume , Government Amount ,099 1,428 1, Volume ,200 1, MSB Amount ,800 9,360 11,232 13,478 16,174 3, Volume ,523 2, The distributional analysis shown here is only an example of the types of analysis performed. The analysis performed as part of this component of the segmentation is significantly more extensive.

22 Threshold #2 Value This illustration shows how the current threshold value and the testing region are determined within the alert distribution SINGLE VARIANT ANALYSIS EXAMPLE Current Production Recommended Threshold Value Threshold Value Productive Alert Non-productive Alert Threshold Value MULTIPLE VARIANT ANALYSIS EXAMPLE Current Production Recommended Threshold Values Threshold Values Productive Alert Non-productive Alert Threshold #1 Value This illustration depicts how the current threshold value and the testing region are determined within the alert population.

23 Thanks sas.com