Adaptive AML Risk Intelligence
Anti-money-laundering rules encode known indicators, obligations and investigation priorities. However, a transaction can remain below every threshold while its timing, counterparties and relationship with other accounts create a material concern. Lowering thresholds may capture more activity, but it can also flood investigators with repetitive alerts.
Marketways combines declared rules with transaction sequences, entity relationships and controlled exploration. The aim is to help authorised investigators find consequential patterns sooner, not to allow a model to declare that a customer or transaction is unlawful.
Define the risk event and the permitted response
An AML monitoring system can flag activity, prioritise an alert, request evidence or refer a case for authorised investigation. Each action requires different evidence and carries different consequences.
Marketways defines the risk indicator, decision point and authority before assessing the detection method. We separate unusual activity from suspicious activity and both from a confirmed legal or regulatory finding.
This boundary prevents a model score from becoming an unsupported allegation or restriction. It also establishes what the system must detect and what only a qualified investigator may decide.
Reconstruct the entity and transaction chronology
One transfer may appear ordinary when reviewed alone. The same transfer may require attention when it completes a sequence across connected accounts, devices, counterparties or jurisdictions.
Marketways resolves the relevant entities and reconstructs the chronology behind the alert. We preserve transaction time, channel, product, relationship, rule version and subsequent investigation outcome.
The chronology gives investigators the evidence behind the pattern. It also distinguishes a missing relationship from a genuinely unusual one, which a single aggregate risk score cannot do.
Combine known indicators with pattern discovery
Rules remain useful because they express known typologies and institutional obligations. Nevertheless, criminals can alter transaction size, timing, channel or account structure after a control becomes predictable.
Supervised models can learn from labelled cases, while anomaly, sequence and graph methods can surface behaviour that differs from relevant peers or connects otherwise ordinary events. Marketways uses these methods to supplement declared rules rather than erase them.
The combined design preserves explainable known indicators and creates a controlled route for discovering new patterns. Investigators can see which transactions and relationships produced the alert instead of receiving an unexplained score.
Recognise the selection built into historical outcomes
Confirmed cases and closed alerts provide useful evidence. However, they reflect the rules, thresholds and priorities that determined which activity investigators examined in the past.
Activity that never triggered review cannot later appear as a confirmed case. A model trained only on historical investigation outcomes may therefore reproduce the old detection boundary while appearing statistically accurate.
Marketways examines outcome maturity, investigation policy and missing labels before model development. Controlled sampling outside the current alert population can reveal blind spots and provide evidence about activity that existing rules rarely select.
Monitor behavioural change without forgetting established risk
Payment products, customer behaviour and criminal methods change over time. A model that performed well on last year's activity may lose useful separation even when its software continues to run normally.
Marketways monitors shifts in input data, alert composition, investigator decisions and downstream outcomes. We test whether new patterns require a revised rule, feature, peer group or model rather than allowing automatic retraining to change the detection policy silently.
Adaptation must also retain established typologies. A system that learns only recent behaviour can forget rare but consequential patterns that remain relevant.
Set thresholds through consequence and review capacity
A lower threshold usually creates more alerts. The increase does not establish that the institution detected more material risk.
Marketways compares thresholds through useful alert yield, missed-risk evidence, investigation time, customer consequences and the expected harm of delayed review. We include specialist capacity because an unmanageable queue can postpone the cases that require prompt attention.
The resulting policy can apply different responses to different levels of evidence. It directs uncertainty towards proportionate review instead of forcing every unusual event into clearance or escalation.
Use Agentic AI to prepare evidence within authority
Investigators may need records from several systems, the applicable rule and the history of connected entities before they can assess a case. Manual retrieval can consume much of the investigation time.
An Agentic AI workflow can retrieve authorised records, assemble a traceable chronology and identify missing evidence. It may route the file, monitor deadlines and record the investigator's decision when policy defines those actions.
The workflow must not label a customer as criminal, impose a restriction or submit a consequential report outside the authorised process. Source records, model versions, tool calls and escalation decisions must remain available for review.
Test cases that the monitoring system would not select
Testing only the alerts produced by a new model can measure precision within its chosen queue. It cannot show which material cases the model missed.
Marketways combines mature historical cases, investigator-designed scenarios, controlled synthetic patterns and sampled activity outside the selected population. We also test missing data, broken entity links, unavailable systems and adversarial changes in timing or transaction structure.
Evaluation then measures useful yield, missed-risk indicators, time to decision, overrides, reopened cases and downstream outcomes. These measures show whether the system improves investigation rather than merely rearranging the queue.
A connected-account example shows the difference
Suppose several related accounts begin sending modest transfers through new counterparties and jurisdictions. Each transaction remains below the institution's principal value threshold.
A graph and sequence analysis may reveal coordinated timing and a shared device. However, the same pattern could reflect legitimate business expansion, account compromise or a structured attempt to avoid controls.
Marketways would preserve these competing explanations, identify the evidence that distinguishes them and test the alert against relevant peers. An agent could prepare the authorised evidence package, while an investigator retains responsibility for the assessment and response.
How Marketways develops adaptive AML risk intelligence
Marketways defines the risk event, evidence boundary, available intervention and investigation authority. We combine rules with anomaly, sequence and relationship analysis, then calibrate thresholds against consequence, outcome quality and specialist capacity.
The engagement can combine Risk Detection, AI Governance and Model Risk and Anomaly and Novelty Detection. We also design workflow evaluations that test retrieval, permissions, escalation and reproducibility before the institution increases operational reliance.
Related guides and evidence
References
- FATF: Opportunities and challenges of new technologies for AML/CFT
- FATF: National money-laundering and terrorist-financing risk assessment
- BIS Innovation Hub: Project Aurora
- Advances in continual graph learning for anti-money-laundering systems
- Adapting to concept drift in credit-card transaction streams