How to improve your AML detection? Christopher Ghenne Principal Manager Fraud & Security Intelligence EMEA

How to improve your AML detection? Christopher Ghenne Principal Manager Fraud & Security Intelligence EMEA

Years of 14,010 SAS employees worldwide 93 of the top 100 on the 40 #1 BUSINESS ANALYTICS companies GLOBAL 500 LIST TOP World s Best Multinational Workplaces list World s LARGEST privately held software company 25% Annual reinvestment in R&D US $ 3.16 b Continuous Revenue Growth since 1976 94% Annual customer retention rate 80,000+ Customer sites in 139 countries 175+ Banking clients

What s hot Phased roll-outs Terrorism New Regulations Real-time Discovery Analytics Trade Finance Digitalization Optimization Cost reduction

False Positives Key Components for Monitoring Customer Screening Monitoring Systems Transaction Monitoring Payments Screening Customer Screening Transaction Monitoring Sanctions PEPs and SIPs 75% to 99% False Positive 99.9% False Positive 99.5% to 99.9% False Positive Al Qaeda PEP - Politically Exposed Person SIP - Special Interest Person

Compliance The AML Puzzle KYC NAME SCREENING TRANSACTION MONITORING PAYMENT FILTERING

Compliance The AML Puzzle KYC / CDD / EDD AML (Transaction Monitoring & Customer Screening) Sanctions screening Correspondent Banking FATCA / CRS AML Optimisation Trade based AML

Compliance Current and Future Value Propositions

The Vision Data Silos Poor Data Quality False Positives Time-consuming New Investigations Regulations High volumes of Unstructured Data Challenges Single Platform Targeted Risk Mitigation Data Insights Effective KRIs & Diagnostics Advanced Analytics Reporting Dashboards

SAS Hybrid Approach for AML Detection Levels Of Detection Event Predictive Modeling Entity Anomaly Detection Alert Generation Process Database Searches Network Automated Business Rules Text Mining

SAS Methodology - End to End Data Detection Investigation Reporting Structured & unstructured data sources Batch or real time processing Data cleansing Data integration Variable extraction & sentiment analysis with text mining Entity resolution Business rules Anomaly detection Advanced predictive models Watch lists Profiling Hybrid technology Social network analysis and network-level analytics (if appropriate) Automated alert generation Advanced ranking technology Custom alert queues Alert qualification and triage Powerful user interface with single and holistic views Documentation & traceability Dedicated dashboards, easy to use web-based interface Workflow analysis Creation of SARs (where appropriate) Full business intelligence reporting capability System and case management integration Pro-active dynamic data exploration Advanced query of integrated data Self-administered Detection performance analysis New modus operandi discovery Discovery Accelerated design and constant improvement of the detection logic Alert suppression & routing rules Simulation and testing of new risk assessment methodologies

Optimisation Upstream vs Downstream

Different Types of Optimisations Upstream Vs Downstream Drowning under alerts flowing from everywhere Reduce the flow upstream Reduce the flow downstream

Different Types of Optimisations Upstream Vs Downstream Legacy detection Investigation Incoming Transactions Alerts Cases

Different Types of Optimisations Upstream Vs Downstream Legacy detection Downstream: Improve Triage Investigation Incoming Transactions Alerts Cases

Different Types of Optimisations Upstream Vs Downstream Legacy detection Upstream: Improve Legacy Downstream: Improve Triage Investigation Incoming Transactions Alerts Cases

TM Optimisation Ongoing AML Program Improvement Descriptive Diagnostic Predictive Reports / Dashboards Data Exploration Predictive Analytics Business Analysts Data Stewards / CDOs Data Scientist

Trend Analysis - Correlation

Alerts by day and region

Zone Drill Down

Decision Trees

Number of Entities Number of Entities Number of Entities Number of Entities Our Methodology Statistical Approach for segmentation and optimization ILLUSTRATIVE ANALYSIS As part of the preliminary segmentation analysis and validation component, various analytical approaches are utilized to explore the data to determine the relationships between the variables and to identify key attributes that can be used to segment similar customers and accounts together. Graphical approaches used include items such as scatter plots, frequency histograms, box plots, stacked bar charts, pie charts, etc. Statistical tests on the segments means and variances are performed to verify that they are in fact from different populations. Tests to identify outliers are performed as well as tests for normality of the population. Total Monthly Transaction Amounts Total Amount Vs. Total Volume Businesses Corporations Government MSBs Distributional metrics including skewness, kurtosis, coefficient of variation, mean, and median are all produced to assist in determining the similarity of the segments. Various statistical clustering procedures are performed to assist in identifying groups of entities with similar characteristics. Distributional Metrics LOB Variable Min 25th Pct Median Mean 75th Pct Max STD CoV Skewness Kurtosis Business Amount 100 120 144 173 207 249 55.8 0.3 23.3 30.3 Volume 10 70 121 151 182 1,000 369.7 2.4 21.9 28.5 Corporations Amount 125 150 180 216 259 311 69.8 0.3 20.6 26.8 Volume 25 175 203 254 305 1,500 542.2 2.1 19.4 25.2 Government Amount 500 650 845 1,099 1,428 1,856 509.7 0.5 18.2 23.6 Volume 65 455 502 628 753 3,200 1,134.3 1.8 17.1 22.2 MSB Amount 6500 7,800 9,360 11,232 13,478 16,174 3,627.5 0.3 16.1 20.9 Volume 21 147 180 225 270 5,523 2,187.6 9.7 15.1 19.6 The distributional analysis shown here is only an example of the types of analysis performed. The analysis performed as part of this component of the segmentation is significantly more extensive.

Threshold #2 Value This illustration shows how the current threshold value and the testing region are determined within the alert distribution SINGLE VARIANT ANALYSIS EXAMPLE Current Production Recommended Threshold Value Threshold Value Productive Alert Non-productive Alert Threshold Value MULTIPLE VARIANT ANALYSIS EXAMPLE Current Production Recommended Threshold Values Threshold Values Productive Alert Non-productive Alert Threshold #1 Value This illustration depicts how the current threshold value and the testing region are determined within the alert population.

Thanks sas.com