Money-Mule Detection as a Relational Learning Problem: A Study on the RBIH NFPC Dataset

Owais Ahmad; Anirudh Deodhar

cs.AIOct 15, 2026

Money-Mule Detection as a Relational Learning Problem: A Study on the RBIH NFPC Dataset

Authors: Owais Ahmad, Anirudh Deodhar

Organizations: Applied Research, Quantiphi, Marlborough, MA 01752, USA

Abstract

Money-mule networks move criminal funds through many small transfers, each of which looks ordinary on its own. What marks an account as a mule lies outside any single transfer: in the counterparties and addresses its network shares, and in the shape of its activity over time. Production systems remain largely rule-based and see neither, while most research classifies transactions rather than accounts, recovering account-level risk only by aggregating afterwards. We instead score the account directly, reading the bank's relational schema as a heterogeneous graph in which rows are nodes and foreign keys are edges. Each account is scored from a multi-hop neighbourhood using per-column encoders, a relative-time encoding and HeteroGraphSAGE message passing, with that neighbourhood restricted to rows predating the account's own pre-flag cutoff so that no model sees evidence recorded only after the account was flagged. On a five-year Reserve Bank Innovation Hub (RBIH) retail-banking dataset of 400 million transactions and 94{,}063 labelled accounts, 2.6% of them confirmed mules, we compare against RelGNN, XGBoost, LightGBM and CatBoost trained on identical labels, splits and cutoffs. Our detector recovers nine in ten held-out mules at 83% precision and a 0.5% false-alarm rate, finding 115 more mules than the strongest tree ensemble given the same evidence. At the tuned thresholds the gap is mostly in recall: XGBoost and LightGBM lead across the first hundred alerts, but only the graph models hold their precision deep into the queue. Since the graph is the schema itself and every score is dated per account, the approach deploys on a bank's existing database without a custom feature graph build.

Figures & tables

Figure 1: Overview of the pipeline, left to right. The released relational tables, linked by primary–foreign keys, are converted into a heterogeneous graph in which each row becomes a node typed by its table and each key reference becomes an edge. The seven node types are account, transaction, customer, counterparty, branch, address and pin. For each account to be scored (the seed), a subgraph is sampled around it that keeps only nodes timestamped at or before the seed time; later nodes are excluded. Column encoders embed each node’s categorical, numerical and time attributes, combined with a relative time encoding

\Delta t

. A HeteroGraphSAGE network then propagates messages through three layers, each applying one SAGEConv per edge type (12 in total) and summing the results. The resulting 128-dimensional seed embedding is passed to an MLP head with softmax, which outputs the account’s mule probability; a tuned threshold

\tau

then flags or clears the account.

Table	Node type	Rows	Feature columns
transaction	transaction	237,785,028	5 categorical, 2 numerical, timestamp
counterparty	counterparty	105,107	— (hub)
account	account	96,091	9 categorical, opening date
customer	customer	95,820	12 categorical, 2 dates
address	address	69,616	— (hub)
branch	branch	9,000	3 categorical, 3 numerical

Table 1: The seven tables of the assembled RBIH database, the node type each becomes, and the columns each contributes as features. Hub tables are deliberately featureless: they carry connectivity only. Row counts are after restriction to labelled accounts and their transactions.

Figure 2: Weekly behavioural state of one flagged mule and one genuine account over the 24 weeks before their cutoffs. States come from each account’s own pre-cutoff transactions via population deciles of weekly relative velocity and credit share; none is derived from labels. The mule alternates high-velocity and directional-flow weeks, with brief dormant spells, and ends in a sustained high-velocity run; the genuine account returns to normal between occasional excursions.

Figure 3: The heterogeneous graph that the schema of Table 1 yields under the rule above—read off the database rather than designed. Every row is a node typed by its table and every primary–foreign key reference is an edge materialised in both directions, giving twelve directed edge types over seven node types. A

\tau

badge marks a table carrying a time column; the unbadged types are untimed,

\tau(v)=\bot

, and so are always admissible under Equation 2 . Counterparty , address and pin hold no features of their own: they exist as shared endpoints, which places accounts that share one of them within a short path of each other without a clique between them.

Figure 4: Leakage-safe temporal neighbour sampling. (a) One seed account’s transactions on a time axis, credits above the line and debits below. Rows at or before that account’s own cutoff

t_{\mathrm{seed}}(i)

make up the admissible evidence

V_{i}

of Equation 2 ; the hatched region, running through the flag date

f_{i}

and beyond, is withheld from every model we report;

f_{i}=t_{\mathrm{seed}}(i)+\Delta

unless

f_{i}-\Delta

exceeds

T_{\mathrm{end}}

. The arrow beneath the axis is the quantity the relative-time encoder of Section 5.3 consumes: a row’s age measured against that account’s own cutoff rather than against any absolute date. (b) The three-hop sample drawn at that date. Hollow dashed nodes are candidates whose timestamp fails the cutoff; they never enter the subgraph, so nothing reachable only through them enters either. Untimed rows have no timestamp to test and are admitted unconditionally.

Model	Family	ROC-AUC	PR-AUC
HeteroGraphSAGE (ours)	GNN	0.9592	0.8154
RelGNN	GNN	0.9848	0.8598
XGBoost	GBM	0.9541	0.7324
LightGBM	GBM	0.9479	0.7325
CatBoost	GBM	0.9538	0.7213

Table 2: Threshold-free quality on the held-out split (

373

mules /

14{,}110

accounts, base rate

0.0264

). Both graph models are single-seed; the gradient-boosted rows are the seed selected on validation PR-AUC out of three. Best per column in bold .

Figure 5: Precision-recall on the held-out split, PR-AUC in the legend; the dashed line is the prevalence-random baseline (

0.026

) and the dot our

F_{1}

-optimal operating point. Graph-model scores come from a re-inference pass, exact to within

0.003

Model	Thr.	$F_{1}$	P	R	FA	TP	FP	FN	TN
HeteroGraphSAGE (ours)	0.640	0.8663	0.832	0.903	0.50%	337	68	36	13,669
RelGNN	0.980	0.7930	0.795	0.791	0.55%	295	76	78	13,661
XGBoost	0.905	0.6772	0.728	0.633	0.64%	236	88	137	13,649
LightGBM	0.810	0.6799	0.793	0.595	0.42%	222	58	151	13,679
CatBoost	0.905	0.6543	0.700	0.614	0.71%	229	98	144	13,639

Table 3: The

F_{1}

-optimal operating point on the held-out split. Each model’s threshold is selected on validation and applied unchanged; FA is the false-alarm rate on the

13{,}737

non-mules. Best per column in bold .

	Precision@ $k$		Recall@ $k$
Model	100	500	100	500
HeteroGraphSAGE (ours)	0.920	0.680	0.247	0.912
RelGNN	0.960	0.676	0.257	0.906
XGBoost	0.990	0.562	0.265	0.753
LightGBM	0.980	0.564	0.263	0.756
CatBoost	0.960	0.562	0.257	0.753

Table 4: Queue behaviour on the held-out split: precision and recall among the top

k

scored accounts. Best per column in bold .

Financial Fraud Detection

Financial fraud detection identifies suspicious transactions, accounts, claims, and behavior to prevent losses and guide investigation.

See all 129 papers

Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification
Jul 20, 2026Yuge Zhang, Yuanxing Zhang, Yichao Jin +7Natural Language Explanation Generation Financial Services
OCBC, Singapore
Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework
Aug 15, 2026Emmanuel Nahimana, Yaé Ulrich GabaAnti-Money Laundering Detection Anti-Money Laundering
African Institute for Mathematical Sciences (AIMS) Senegal, KM 2, Route de Joal, Mbour, Senegal · AI Research and Innovation Nexus for Africa (AIRINA Labs), AI.Technipreneurs, Cotonou, Bénin · Sefako Makgatho Health Sciences University, Pretoria, South Africa
Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation
Apr 3, 2026Haseeb Tariq, Marwan HassaniAnti-Money Laundering Detection Anti-Money Laundering
ING Bank, Amsterdam, The Netherlands · Eindhoven University of Technology, Eindhoven, The Netherlands

Jul 20, 2026J/K move · Enter open · S save

Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification

Yuge Zhang, Yuanxing Zhang, Yichao Jin, Khairul Amsyar Mohd Razis+6

OCBC, Singapore

Natural Language Explanation Generation Financial Services Financial Fraud Detection Finance Anti-Money Laundering Detection

Open paper AskPDF arXiv

Money mule accounts are critical facilitators of financial fraud, yet detecting them at scale remains challenging due to the heterogeneous nature of transactional and behavioural data. We present an end-to-end pipeline for customer-level mule detection comprising three stages: (1) a LightGBM classifier trained on 280 engineered features spanning transaction patterns, account demographics, network topology, and temporal behaviour; (2) a TreeSHAP attribution layer that decomposes each prediction into feature contributions; and (3) a large language model (LLM) module that converts SHAP attributions into analyst-facing natural-language narratives. We evaluate across three open-weight LLM families and assess explanation quality through analyst feedback. In a live production deployment, the system achieves a yield rate of 89%, up from 61% under the incumbent rule-based system, with monthly alert volume expanding from 211 to 302, reflecting broader true-positive coverage rather than increased noise. This corresponds to a 60% incremental adverse detection beyond existing review workflows, substantially outperforming the rule-based approach. Qualitative feedback from analysts indicates that LLM-generated narratives reduce cognitive load during alert triage. We further discuss implications of deploying LLM-augmented explainability in regulated financial environments.

Abstract

Financial Fraud Detection

Explore similar work

Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification

Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework

Extracting Money Laundering Transactions from Quasi-Temporal Graph Representation