Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework

Emmanuel Nahimana; Yaé Ulrich Gaba

cs.LGAug 15, 2026

Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework

Authors: Emmanuel Nahimana, Yaé Ulrich Gaba

Organizations: African Institute for Mathematical Sciences (AIMS) Senegal, KM 2, Route de Joal, Mbour, Senegal · AI Research and Innovation Nexus for Africa (AIRINA Labs), AI.Technipreneurs, Cotonou, Bénin · Sefako Makgatho Health Sciences University, Pretoria, South Africa

Abstract

Mobile money has widened financial access across Sub-Saharan Africa and enlarged the surface for money-laundering and terrorism-financing (ML/TF) activity in ecosystems dominated by high-volume, low-value transactions. Rwanda is a case in point: several million active mobile-money users, telecom-led wallets on the MTN and Airtel networks, and a Financial Intelligence Centre (FIC) supervising transaction streams whose scale exceeds static rule-based monitoring. This paper develops and evaluates a transaction-monitoring framework aligned to the Rwandan AML/CFT regime under (i) extreme class imbalance (~0.1% prevalence), (ii) scarce and delayed labels, and (iii) bounded investigator capacity. Using SAML-D, a synthetic dataset of 9,504,852 transactions with 17 laundering typologies, we engineer account-centric behavioural features (rolling velocity, net-flow directionality, counterparty diversity, burstiness) and benchmark supervised classifiers (Logistic Regression, Random Forest, LightGBM), unsupervised anomaly detectors (Isolation Forest, Local Outlier Factor), a dense autoencoder, and a late-fusion meta-learner. Evaluation is operational: PR-AUC, recall at a calibrated ~90%-precision point, recall at top-K%, and alerts per 10,000. On the chronologically held-out test period, LightGBM attains PR-AUC = 0.0469, capturing 64 laundering cases at precision ~0.89 with 0.51 alerts per 10,000; the fusion stacker reaches PR-AUC = 0.0477 at precision ~0.91 and 0.46 alerts per 10,000, recovering 59 true positives. We map score bands to Rwanda-relevant analyst workflows and STR/SAR escalation, and outline a staged path from synthetic prototyping to real-data validation with the National Bank of Rwanda and FIC. The contribution is operational: a governance-aware pipeline and evaluation protocol calibrated to the constraints of an African mobile-money regulator, not a new algorithm.

Figures & tables

Group	Examples (illustrative)	AML motivation
Rolling activity	cnt_1h, sum_24h, sum_7d	Structuring; bursty micro-transaction sequences.
Velocity & tempo	velocity_1h, iat, burstiness	Rapid layering; automation-like tempo.
Net flows	net_24h, in_out_ratio	Fan-in / fan-out; cycling and cash-in-cash-out loops.
Counterparty diversity	uniq_cp_24h, H_7d	Rings; mule dispersion and hub concentration.
Time context	hour, dow, is_night	Off-hours anomalies relative to account baseline.
Amount shape	log_amt, amt_zscore	Threshold gaming; unusual amount distributions.

Table 1: Feature groups used for risk scoring (causal, account-centric).

Panel of Figure 1 — Figure 1: End-to-end AML monitoring pipeline: raw transaction stream, chronological train/validation/test split, causal account-centric feature engineering, portfolio scoring across supervised and anomaly detectors, logistic late-fusion, and threshold-calibrated risk banding feeding analyst workflow and STR/SAR reporting.

Panel of Figure 2 — Figure 2: Dense autoencoder used as the reconstruction-based anomaly detector: symmetric encoder–decoder $[128,32,8,32,128]$ with a $d=8$ latent bottleneck, trained on non-laundering transactions only, thresholded on the $99.5$ th percentile of reconstruction error on validation.

Panel of Figure 3 — Figure 3: Late-fusion (stacking) architecture: base-detector scores are fed into a logistic-regression meta-learner fitted on the validation window; coefficients $\beta_{k}$ are class-weighted. In practice on SAML-D the fitted stacker is dominated by $\beta_{1}$ (LightGBM), rendering the fusion score effectively a stricter cut of the supervised score at the high-precision operating point (see § 7.5 ).

Panel of Figure 4 — Figure 4: Precision–recall performance on the held-out test set for the four ranking models. Points are the validation-calibrated $\sim 90\%$ -precision operating point (leftmost anchor per curve) and the top- $K\%$ ranking anchors for $K\in\{1,3,5\}$ . Precision axis is logarithmic to make the high-precision regime legible. The dashed grey line is the random baseline at test-set prevalence $\pi\approx 0.0012$ ; every model sits at least an order of magnitude above it across the plotted recall range.

Model	PR-AUC	ROC-AUC	Precision	Recall	Alerts/10k
Logistic Regression	$0.0118$	$0.7492$	$1.0000$	$0.0035$	$0.04$
Random Forest	$0.0399$	$0.6954$	$0.8889$	$0.0330$	$0.44$
LightGBM	$\mathbf{0.0469}$	$\mathbf{0.7897}$	$0.8889$	$\mathbf{0.0377}$	$0.51$
Fusion (stacker)	$0.0477$	$0.7856$	$0.9077$	$0.0348$	$0.46$

Table 2: Supervised and fusion performance on the test set at the validation-calibrated

\sim 90\%

-precision operating point.

Model	TN	FP	FN	TP
Rule-based baseline	$1{,}272{,}042$	$151{,}939$	$1{,}172$	$525$
LightGBM ( $\mathrm{Prec}\approx 0.89$ )	$1{,}423{,}973$	$8$	$1{,}633$	$64$
Fusion stacker ( $\mathrm{Prec}\approx 0.91$ )	$1{,}423{,}975$	$6$	$1{,}638$	$59$

Table 3: Confusion matrices at the calibrated high-precision operating point on the test window (

N=1{,}425{,}678

transactions;

\approx 1{,}697

laundering positives). Rule-based baseline uses conventional amount-and-count thresholds.

Panel of Figure 5 — Figure 5: Confusion-matrix comparison at the validation-calibrated high-precision operating point on the test window. The rule-based baseline (left) achieves higher raw recall ( $525$ true positives) but at the cost of $\sim 152{,}000$ false alerts. LightGBM (centre) suppresses false positives to $8$ while capturing $64$ true laundering transactions. The fusion stacker (right) tightens further to $6$ false positives and recovers $59$ true positives, a small trade of both alert volume and captured cases relative to LightGBM. Fusion at this operating point acts as a stricter cut of the supervised score rather than as a corroborative recall booster.

Model	PR-AUC	ROC-AUC	Precision	Recall	Alerts/10k
Isolation Forest	$0.0021$	$0.6391$	$0.0078$	$0.0006$	$0.90$
Autoencoder	$\mathbf{0.0210}$	$0.6428$	$\mathbf{0.2671}$	$\mathbf{0.0253}$	$1.13$
Local Outlier Factor	$0.0099$	$0.5685$	$0.1558$	$0.0141$	$1.08$

Table 4: Unsupervised and reconstruction detector performance at

\approx 1

alert per

10{,}000

transactions on the test set.

Model	Recall@ $1\%$	Recall@ $3\%$	Recall@ $5\%$
Logistic Regression	$0.104$	$0.203$	$0.268$
Random Forest	$0.080$	$0.141$	$0.207$
LightGBM	$\mathbf{0.139}$	$\mathbf{0.253}$	$\mathbf{0.342}$
Fusion	$0.126$	$0.246$	$0.341$
Autoencoder	$0.061$	$0.093$	$0.114$
LOF	$0.042$	$0.089$	$0.127$

Table 5: Recall at top-

K\%

highest-risk transactions on the test set. LightGBM and fusion are essentially co-ranked at

K=3\%,5\%

; fusion loses recall at

K=1\%

Panel of Figure 6 — Figure 6: Top-12 features by LightGBM gain-based importance on the training set (values reproduced from the corresponding thesis experiment). Amount, hour, and day-of-week dominate the ranking, followed by log-amount and channel indicators; per-alert SHAP explanations should be delivered to analysts to translate global importance into per-instance narratives.

Amount band	False negatives (count)
$[0,1{,}000)$	$257$
$[1{,}000,5{,}000)$	$\mathbf{534}$
$[5{,}000,10{,}000)$	$\mathbf{500}$
$[10{,}000,50{,}000)$	$291$
$\geq 50{,}000$	$51$

Table 6: False negatives by amount band on the test set at the LightGBM high-precision operating point.

Panel of Figure 7 — Figure 7: Distribution of false negatives (missed laundering transactions) by amount band at the LightGBM calibrated high-precision operating point on the test window. Failures concentrate in the mid-band ( $1{,}000$ – $10{,}000$ currency units): transactions that are neither anomalous in amount nor rare in tempo, and therefore blend into legitimate merchant and remittance activity. High-value cases ( $\geq 50{,}000$ ) and sub- $1{,}000$ structuring are captured comparatively well.

Configuration	PR-AUC	Recall @ Prec $\approx 0.9$
Full model	$0.0469$	$0.0377$
$\;-$ behavioural features	$0.0315$	$0.0234$
$\;-$ time-context features	$0.0392$	$0.0291$
$\;-$ class weighting	$0.0287$	$0.0186$

Table 7: Ablation on LightGBM: PR-AUC and recall at the calibrated

\sim 90\%

-precision operating point, test set.

Band	Score range	Alert budget / $10^{4}$	Action
A (monitor)	$s(x)<\tau_{1}=0.10$	0	Passive monitoring; no case creation.
B (triage)	$\tau_{1}\leq s(x)<\tau_{2}=0.60$	$\sim 20$	Lightweight analyst check: history, velocity flags, counterparty profile.
C (priority review)	$\tau_{2}\leq s(x)<\tau_{3}=0.95$	$\sim 3$	Case creation, enhanced due diligence, cross-account link checks.
D (critical)	$s(x)\geq\tau_{3}=0.95$	$\sim 0.5$	Fast-track escalation for STR/SAR decisioning subject to policy and legal procedures.

Table 8: Risk bands, thresholds, and analyst actions in the proposed Rwanda-aligned deployment. Thresholds are illustrative and would be recalibrated on real deployment data.

Scenario A: $1$ M transactions/day
Detector	Alerts/10k	Daily alerts	Analyst-hours/day	FTE analysts
Rule-based baseline	$\sim 1{,}066$	$106{,}600$	$35{,}533$	infeasible
LightGBM (Prec $\approx 0.89$ )	$0.51$	$51$	$17.0$	$2.8$
Fusion stacker	$0.46$	$46$	$15.3$	$2.6$
Scenario B: $5$ M transactions/day
Rule-based baseline	$\sim 1{,}066$	$533{,}000$	$177{,}666$	infeasible

Table 9: Illustrative operational load at three hypothetical daily transaction volumes for the Rwandan retail mobile-money segment. Assumptions (all clearly hypothetical):

20

minutes analyst-time per alert triage,

6

productive analyst-hours per shift, all alerts triaged same day. Actual BNR/provider values must replace these before any deployment claim.

Panel of Figure 8 — Figure 8: Rwanda-aligned operational workflow: transaction capture at mobile-money providers, ML scoring, risk banding (Bands A–D as defined in Table 8 ), analyst review with SHAP-based explanation payload, and escalation to the Financial Intelligence Centre (FIC) with supervisory coordination through the National Bank of Rwanda (BNR).

Explore similar work

Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation
Apr 3, 2026Haseeb Tariq, Marwan HassaniFinancial Fraud Detection
ING Bank, Amsterdam, The Netherlands · Eindhoven University of Technology, Eindhoven, The Netherlands
TransXion: A High-Fidelity Graph Benchmark for Realistic Anti-Money Laundering
Apr 19, 2026Keyang Chen, Mingxuan Jiang, Yongsheng Zhao +9Financial Fraud Detection Synthetic Benchmark Generation
Fudan University · Peking University
Detecting Complex Money Laundering Patterns with Incremental and Distributed Graph Modeling
Apr 1, 2026Haseeb Tariq, Alen Kaja, Marwan HassaniFinancial Fraud Detection Anomaly Detection
ING Bank Amsterdam, The Netherlands · Eindhoven University of Technology Eindhoven, The Netherlands · Identity & Risk Intelligence Adyen Amsterdam, The Netherlands +1

Apr 3, 2026J/K move · Enter open · S save

Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation

Haseeb Tariq, Marwan Hassani

ING Bank, Amsterdam, The Netherlands · Eindhoven University of Technology, Eindhoven, The Netherlands

Financial Fraud Detection

Open paper AskPDF arXiv

Money laundering presents a persistent challenge for financial institutions worldwide, while criminal organizations constantly evolve their tactics to bypass detection systems. Traditional anti-money laundering approaches mainly rely on predefined risk-based rules, leading to resource-intensive investigations and high numbers of false positive alerts. In order to restrict operational costs from exploding, while billions of transactions are being processed every day, financial institutions are investing in more sophisticated mechanisms to improve existing systems. In this paper, we present ExSTraQt (EXtract Suspicious TRAnsactions from Quasi-Temporal graph representation), an advanced supervised learning approach to detect money laundering (or suspicious) transactions in financial datasets. Our proposed framework excels in performance, when compared to the state-of-the-art AML (Anti Money Laundering) detection models. The key strengths of our framework are sheer simplicity, in terms of design and number of parameters; and scalability, in terms of the computing and memory requirements. We evaluated our framework on transaction-level detection accuracy using a real dataset; and a set of synthetic financial transaction datasets. We consistently achieve an uplift in the F1 score for most datasets, up to 1% for the real dataset; and more than 8% for one of the synthetic datasets. We also claim that our framework could seamlessly complement existing AML detection systems in banks. Our code and datasets are available at https://github.com/mhaseebtariq/exstraqt.

Abstract

Explore similar work

Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation

TransXion: A High-Fidelity Graph Benchmark for Realistic Anti-Money Laundering

Detecting Complex Money Laundering Patterns with Incremental and Distributed Graph Modeling