cs.CRAug 23, 2026

KONTOGRAPH: Verified Point-in-Time Feature Consistency and Amortised Explanation for Real-Time Anti-Money Laundering under a 200 ms Decision Budget

Authors: Ahmed Abolfadl

Organizations: Faculty of Media Engineering and Technology German University in Cairo Cairo, Egypt

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Regulation (EU) 2024/886 obliges European payment service providers to settle euro credit transfers in under ten seconds, around the clock. This removes both the overnight batch window in which anti-money-laundering (AML) analytics traditionally ran and the settlement delay that made recovery possible, forcing detection, explanation and decision inside a single-digit-second envelope. We present KONTOGRAPH, an end-to-end AML pipeline for the SEPA Instant rail built under a self-imposed 200 ms 99th-percentile budget, and report an empirical study on 1,562,860 simulated payments with injected typologies and deliberately incomplete labels. Three findings are of interest beyond the system itself. First, a temporal graph network with per-node memory improves PR-AUC over a gradient-boosted tabular baseline from 0.0053 to 0.1717, a paired day-blocked bootstrap difference of +0.166 with 95% CI [0.105, 0.241]; per-node memory alone more than doubles the score. Second, expressing each feature once and compiling it to three execution backends, with equivalence enforced by property-based tests that perturb the future, surfaced three point-in-time violations that code review had passed--each of which would have inflated reported performance. Third, and most consequential for practice, exporting the deployed tree ensemble to ONNX changed only 7.4×10−87.4 \times 10^{-8} in mean score yet altered 0.26% of decisions and inflated the alert volume by 12%, because 32-bit accumulation perturbs scores across a cost-optimal threshold of 3.98×10−43.98 \times 10^{-4}. We argue that a serving-format conversion must be treated as a model change until measured, and that fidelity metrics for subgraph explainers can be vacuous when candidate neighbourhoods are small--a null result we report in full.

Figures & tables

Payments1,562,860
Accounts6,576
Simulated days270
Criminal payments (ground truth)2,995
Criminal rate0.19%
Confirmed labels3,495
Criminal label coverage14.5%
TABLE I: Generated dataset (profile full )
#ModelPR-AUC [95% CI]RecallCost/10k
0Constant0.0001 [0.0001, 0.0002]0.045473,280
1LightGBM0.0053 [0.0030, 0.0079]0.90920,459
2+ static graph0.0144 [0.0064, 0.0319]0.79553,529
3+ TGN, no mem.0.0734 [0.0348, 0.1353]0.77321,627
4+ memory0.1717 [0.1011, 0.2445]0.90919,997
TABLE II: Ablation ladder on the held-out test fold (303,129 payments, 44 confirmed positives). Recall is at 200 alerts/day.
Stagep50 (ms)p99 (ms)
Feature fetch1.844.67
Graph assembly0.000.01
Inference0.421.78
Explanation0.001.87
Counterfactual search0.003.59
Unaccounted0.170.46
TABLE III: Per-stage decision latency (2,000 payments, single-threaded CPU)
Teacher (perturbation search), median575.6 ms
Student (single forward pass), median2.38 ms
Speed-up241×241\times
Top-5 Jaccard vs. teacher0.904
Spearman rank correlation vs. teacher−0.038-0.038
Median candidate edges per instance1.0
TABLE IV: Teacher–student explanation, 57 instances
Mean absolute score difference7.4×10−87.4\times 10^{-8}
Maximum absolute score difference1.7×10−41.7\times 10^{-4}
Decisions changed774 (0.26%)
Alerts, original6,458
Alerts, ONNX7,232
Alert volume inflation+12.0%
TABLE V: ONNX export parity against the trained booster
More in this topic

Anti-Money Laundering Detection

See all 20 papers

Explore similar work

CardsList
Mar 22, 2026

Explainable AML Triage with LLMs: Evidence Retrieval and Counterfactual Checks

Anti-money laundering (AML) transaction monitoring generates large volumes of alerts that must be rapidly triaged by investigators under strict audit and governance constraints. While large language models (LLMs) can summarize heterogeneous evidence and draft rationales, unconstrained generation is risky in regulated workflows due to hallucinations, weak provenance, and explanations that are not faithful to the underlying decision. We propose an explainable AML triage framework that treats triage as an evidence-constrained decision process. Our method combines (i) retrieval-augmented evidence bundling from policy/typology guidance, customer context, alert triggers, and transaction subgraphs, (ii) a structured LLM output contract that requires explicit citations and separates supporting from contradicting or missing evidence, and (iii) counterfactual checks that validate whether minimal, plausible perturbations lead to coherent changes in both the triage recommendation and its rationale. We evaluate on public synthetic AML benchmarks and simulators and compare against rules, tabular and graph machine-learning baselines, and LLM-only/RAG-only variants. Results show that evidence grounding substantially improves auditability and reduces numerical and policy hallucination errors, while counterfactual validation further increases decision-linked explainability and robustness, yielding the best overall triage performance (PR-AUC 0.75; Escalate F1 0.62) and strong provenance and faithfulness metrics (citation validity 0.98; evidence support 0.88; counterfactual faithfulness 0.76). These findings indicate that governed, verifiable LLM systems can provide practical decision support for AML triage without sacrificing compliance requirements for traceability and defensibility.

Dorothy Torres, Wei Cheng, Ke Hu

School of Science, Technology, Engineering and Mathematics 263 Academy Street, Room S204 Jersey City, NJ 07306 · School of Electrical Engineering and Computer Science, The Pennsylvania State University, 207 Electrical Engineering West, University Park, PA 16802, USA

Anti-Money LaunderingAnti-Money Laundering DetectionFaithfulness of Language Model ExplanationsFinancial Fraud DetectionRetrieval-Augmented Generation
AskPDF
Apr 3, 2026

Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation

Money laundering presents a persistent challenge for financial institutions worldwide, while criminal organizations constantly evolve their tactics to bypass detection systems. Traditional anti-money laundering approaches mainly rely on predefined risk-based rules, leading to resource-intensive investigations and high numbers of false positive alerts. In order to restrict operational costs from exploding, while billions of transactions are being processed every day, financial institutions are investing in more sophisticated mechanisms to improve existing systems. In this paper, we present ExSTraQt (EXtract Suspicious TRAnsactions from Quasi-Temporal graph representation), an advanced supervised learning approach to detect money laundering (or suspicious) transactions in financial datasets. Our proposed framework excels in performance, when compared to the state-of-the-art AML (Anti Money Laundering) detection models. The key strengths of our framework are sheer simplicity, in terms of design and number of parameters; and scalability, in terms of the computing and memory requirements. We evaluated our framework on transaction-level detection accuracy using a real dataset; and a set of synthetic financial transaction datasets. We consistently achieve an uplift in the F1 score for most datasets, up to 1% for the real dataset; and more than 8% for one of the synthetic datasets. We also claim that our framework could seamlessly complement existing AML detection systems in banks. Our code and datasets are available at https://github.com/mhaseebtariq/exstraqt.

Haseeb Tariq, Marwan Hassani

ING Bank, Amsterdam, The Netherlands · Eindhoven University of Technology, Eindhoven, The Netherlands

Anti-Money Laundering DetectionAnti-Money LaunderingFinancial Fraud Detection
AskPDF
Oct 13, 2026

Privacy-Preserving GNN Inference on Financial Transaction Graphs via Homomorphic Encryption

Anti-money laundering (AML) in financial networks requires modeling transaction patterns that span multiple institutions. In practice, however, banks cannot share account and transaction features due to strict privacy regulations. We propose a privacy-preserving graph neural network (GNN) inference framework tailored to this multi-bank setting. A central server holds the graph connectivity and pretrained model weights in plaintext, while each bank keeps its transaction features encrypted. Inference is then carried out entirely on encrypted features under the CKKS homomorphic encryption scheme, so that no plaintext transaction features or predictions are exposed to the server. The key to making this practical is an edge-centric GNN architecture, wherein message passing is expressed through operations on node--edge incidence matrices. This formulation not only preserves the edge-attributed multigraph structure of transaction networks but also reduces every aggregation step to plaintext--ciphertext matrix products. Since CKKS can evaluate only polynomial circuits, we also approximate each nonlinearity with a composite polynomial of the sign function, which we calibrate per activation site. On the IBM AML benchmark, our model achieves performance competitive with plaintext baselines, and with a consumer-grade GPU, classifies each queried transaction end-to-end in as little as 5.31 seconds, while per-transaction latency can be amortized to 1.65 seconds when optimized for throughput.

H. Çağrı Bilgi, Kemal Mutluergil, Ceren Yıldırım +2

Sabancı University, Istanbul, Türkiye

Anti-Money Laundering DetectionPrivacy-Preserving MLGraph Neural NetworksFinancial Fraud Detection
AskPDF