Leveraging Time-Series Foundation Models for Financial Crime Detection

Danae Natalie Savvidi; H. Çağrı Bilgi; Kubilay Atasu; Arie van Deursen

cs.LGOct 21, 2026

Leveraging Time-Series Foundation Models for Financial Crime Detection

Authors: Danae Natalie Savvidi, H. Çağrı Bilgi, Kubilay Atasu, Arie van Deursen

Organizations: Delft University of Technology, Delft, The Netherlands

Abstract

Financial crime detection requires identifying illicit activity within large transaction networks, where suspicious behaviour is rare and unfolds over time. Existing graph-based methods capture relationships among accounts but typically underuse the temporal behaviour encoded in account transaction histories. We introduce Temporal-Context Edge Enrichment (TCEE), a framework that addresses this gap by summarising each account's transaction history with a frozen time-series foundation model (TSFM), and enriching each transaction's representation with the relevant temporal context from these summaries. These enriched representations can be scored directly for edge classification, or fed into a graph neural network (GNN) as edge features to capture broader structural information. Across six AMLWorld datasets, TCEE improves PR-AUC over the strongest evaluated baseline on five by a relative 10.8% on average, while training 6.0x faster end-to-end. Feeding TCEE's representations into a GNN raises PR-AUC a further 4.8% on the four smaller datasets. On an Ethereum phishing dataset, we show that TSFM-generated account representations fed into a GNN are also effective for node classification, improving PR-AUC by 14.5% over the strongest baseline. As TSFMs continue to advance, our results suggest they can strengthen financial crime detection by capturing temporal signals that complement graph-based approaches.

Figures & tables

Figure 1. Node-level fusion (left) provides the same pooled vector to every transaction of the same account; TCEE (right) enables each transaction to query the context independently. Two panels of the same account. Node-level fusion pools the frozen TSFM embeddings into one vector shared by all three transactions, while TCEE lets each transaction query the embedding set and retrieve its own context.

Figure 2. Chronos-2, frozen, reads each account’s history in patches of

16

transactions and emits one

768

-d embedding per feature and patch. An account's transaction history, split into six feature streams and patches of sixteen transactions, passes through the frozen Chronos-2 encoder and emerges as the embedding tensor

\mathbf{E}_a

of shape

F

P_a

by 768.

Panel of Figure 3 — Figure 3. (a) TCEE architecture. The transaction edge $e=(u,v)$ takes each account’s frozen Chronos-2 embedding (green) as keys and values, forms a query from the two transaction views through a shared MLP $\phi$ , and cross-attends for $\mathbf{ctx}_{u},\mathbf{ctx}_{v}$ . Residual enrichment fuses the queries, contexts and optional extensions into $\mathbf{e}^{\text{rich}}_{uv}$ , scored directly or after a GNN backbone. The temporal signal enters at the edge, not the node. (b) The extensions. Pair pooling aggregates the parallel transactions with PNA, and neighbourhood attention reads each account’s window, giving $\mathbf{b}_{uv}$ . Left, a block diagram of TCEE. The frozen embeddings of both endpoints supply keys and values, the two transaction views form queries through a shared MLP, and cross-attention returns the contexts that residual enrichment fuses into an enriched edge, scored either directly or after a GNN backbone. Right, the two local-context extensions. PNA pools all parallel transactions between the accounts while attention over each account's window gives the neighbourhood outputs, and the three concatenate into the extension feature.

Dataset	# Nodes	# Edges	Emb. (GB)	Illicit	Days	Split [%]
HI-Small	515,088	5,078,345	4.7	0.102%	10	64/19/17
LI-Small	705,907	6,924,049	6.5	0.051%	10	64/19/17
HI-Medium	2,077,023	31,898,238	19.1	0.110%	16	61/17/22
LI-Medium	2,032,095	31,251,483	18.7	0.051%	16	61/17/22
HI-Large	2,116,168	179,702,229	19.5	0.124%	97	60/20/20
LI-Large	2,070,980	176,066,557	19.1	0.057%	97	60/20/20

Table 1. Dataset statistics. Node, edge, embedding size, illicit rate, time span and split proportions for the six AMLWorld graphs and the Ethereum phishing graph.

	HI-Small		LI-Small		HI-Medium		LI-Medium		HI-Large		LI-Large
Model	PR-AUC	F1	PR-AUC	F1	PR-AUC	F1	PR-AUC	F1	PR-AUC	F1	PR-AUC	F1
GINe	$49.94_{\pm 4.02}$	$53.77_{\pm 3.39}$	$16.77_{\pm 4.27}$	$21.25_{\pm 4.86}$	$44.55_{\pm 4.53}$	$34.20_{\pm 9.98}$	$14.95_{\pm 3.42}$	$14.93_{\pm 3.45}$	$38.34_{\pm 7.04}$	$41.19_{\pm 5.65}$	$6.50_{\pm 1.77}$	$5.10_{\pm 5.30}$
PNAe	$59.40_{\pm 3.18}$	$60.93_{\pm 3.35}$	$22.29_{\pm 1.40}$	$31.26_{\pm 2.80}$	$58.44_{\pm 3.96}$	$58.12_{\pm 4.65}$	$21.04_{\pm 2.33}$	$26.99_{\pm 3.73}$	$59.90_{\pm 0.49}$	$61.37_{\pm 0.98}$	$20.81_{\pm 1.68}$	$25.48_{\pm 3.45}$
Multi-GNN ( Egressy et al., 2024 )	$69.05_{\pm 1.22}$	$49.28_{\pm 4.11}$	$30.30_{\pm 2.39}$	$34.56_{\pm 1.41}$	$74.97_{\pm 0.60}$	$73.26_{\pm 1.31}$	$35.86_{\pm 0.10}$	$43.78_{\pm 0.59}$	$73.57_{\pm 0.46}$	$72.36_{\pm 1.29}$	$27.44_{\pm 1.48}$	$33.54_{\pm 2.29}$
MEGA-GNN ( Bilgi et al., 2024 )	$74.28_{\pm 2.56}$	$73.63_{\pm 2.45}$	$38.41_{\pm 1.08}$	$45.49_{\pm 2.49}$	$78.32_{\pm 0.82}$	$78.00_{\pm 0.23}$	$39.60_{\pm 3.38}$	$48.75_{\pm 1.65}$	$77.40_{\pm 0.21}$	$76.68_{\pm 0.57}$	$29.36_{\pm 1.01}$	$34.62_{\pm 1.77}$
Multi-FraudGT ( Lin et al., 2024 )	$75.46_{\pm 0.39}$	$75.68_{\pm 0.78}$	$37.72_{\pm 0.75}$	$45.20_{\pm 1.56}$	$74.88_{\pm 0.36}$	$75.97_{\pm 0.20}$	$36.15_{\pm 0.57}$	$44.66_{\pm 0.66}$	$72.62_{\pm 0.37}$	$73.48_{\pm 0.68}$	$29.16_{\pm 0.10}$	$35.52_{\pm 0.17}$

Table 2. Test PR-AUC and minority-class F1 (%) on the six AMLWorld datasets, mean

\pm

std over 5 seeds. Test PR-AUC and minority-class F1 for every model on the six AMLWorld datasets.

	Model	HI-S	LI-S	HI-M	LI-M	HI-L	LI-L
	Extraction	39	58	177	181	523	509
End-to-end	Chronos-MLP	$43_{\pm 2}$	$67_{\pm 4}$	$206_{\pm 8}$	$202_{\pm 3}$	$837_{\pm 69}$	$780_{\pm 67}$
	Chronos-PNA	$89_{\pm 11}$	$141_{\pm 20}$	$783_{\pm 47}$	$766_{\pm 80}$	$4592_{\pm 472}$	$4414_{\pm 220}$
	TCEE-MLP	$44_{\pm 1}$	$65_{\pm 2}$	$224_{\pm 7}$	$223_{\pm 11}$	$843_{\pm 49}$	$810_{\pm 62}$
	$+$ Pair-PNA	$47_{\pm 2}$	$68_{\pm 3}$	$259_{\pm 14}$	$269_{\pm 16}$	$1344_{\pm 135}$	$1453_{\pm 118}$
	$+$ Pair-PNA $+$ Nbr-Attn	$50_{\pm 3}$	$70_{\pm 3}$	$257_{\pm 4}$	$261_{\pm 12}$	$1420_{\pm 184}$	$1488_{\pm 168}$

Table 3. Extraction and end-to-end wall-clock cost in minutes. End-to-end includes extraction. One-time extraction cost and end-to-end wall-clock training time in minutes for each model on each dataset.

Ablation	Setting	HI-Small	LI-Small
Counterparty	Chronos-MLP, $-$ CP	$54.69_{\pm 4.15}$	$18.80_{\pm 3.16}$
	Chronos-MLP, $+$ CP	$58.92_{\pm 3.39}$	$20.16_{\pm 3.53}$
	TCEE-MLP, $-$ CP	$63.20_{\pm 2.84}$	$27.64_{\pm 0.83}$
	TCEE-MLP, $+$ CP (default)	$69.24_{\pm 0.61}$	$31.45_{\pm 0.93}$
$\mathbf{h}_{a}$ pool	Chronos-MLP, mean over $F$	$58.74_{\pm 4.32}$	$19.98_{\pm 2.29}$
$\mathbf{h}_{a}$ pool	Chronos-MLP, attn. over $F$ (default)	$58.92_{\pm 3.39}$	$20.16_{\pm 3.53}$

Table 4. Ablations (PR-AUC %).

F

feature series,

P

patches. PR-AUC on HI-Small and LI-Small when the counterparty index, the account pooling, the attention inputs and the Chronos context are each removed or varied.

Model	PR-AUC	F1
Multi-GNN ( Egressy et al., 2024 )	$61.2_{\pm 0.6}$	$65.0_{\pm 1.1}$
MEGA-GNN ( Bilgi et al., 2024 )	$60.5_{\pm 4.5}$	$62.7_{\pm 5.8}$
DIAM ( Ding et al., 2024 )	$55.3_{\pm 1.8}$	$64.6_{\pm 1.4}$
Chronos-MLP	$31.4_{\pm 0.7}$	$26.0_{\pm 2.0}$
Chronos-PNA	$70.1_{\pm 0.9}$	$75.5_{\pm 1.3}$
TCEE-PNA	$70.9_{\pm 1.1}$	$75.4_{\pm 0.8}$

Table 5. ETH phishing node classification, PR-AUC and minority-class F1 (%). PR-AUC and minority-class F1 for node classification on the Ethereum phishing graph.

Figure 4. Test PR-AUC (%) against end-to-end cost (log minutes). Top left is better, the grey line the Pareto front, and

\times N

each model’s speed-up over the strongest baseline B . Six scatter panels, one per dataset, plotting test PR-AUC against end-to-end cost on a log scale. A grey line marks the Pareto front of each panel and the letter B marks the strongest baseline, against which the front's speed-up factors are given. The TCEE markers sit above and to the left of both the structural baselines and the node-level fusion baselines in five of the six panels.

Figure 5. Test PR-AUC on HI-Small after deleting the

k

top, bottom or random attended window transactions per endpoint. Line plot of test PR-AUC against the number of deleted window transactions per endpoint, 1 to 8 on a log scale. Deleting the most attended transactions lowers PR-AUC from 78.2 to 73.6 at eight, while deleting random or least attended ones lowers it only to 76.4 and 76.8. Deleting the whole window gives 70.0.

Financial Fraud Detection

Financial fraud detection identifies suspicious transactions, accounts, claims, and behavior to prevent losses and guide investigation.

See all 135 papers

Mar 31, 2026

Temporal Contrastive Transformer for Financial Crime Detection: Self-Supervised Sequence Embeddings via Predictive Contrastive Coding

We introduce the Temporal Contrastive Transformer (TCT), a representation learning framework designed to capture contextual temporal dynamics in sequences of financial transactions. The model is trained using a self-supervised contrastive objective to produce embeddings that encode behavioral patterns over time, with the goal of supporting downstream fraud detection tasks. We evaluate TCT in a realistic setting by using the learned embeddings as input features to a gradient boosting classifier. Experimental results show that embeddings alone achieve meaningful predictive performance (AUC 0.8644), indicating that the model captures non-trivial temporal structure. However, when combined with domain-engineered features, no measurable improvement is observed over the baseline (AUC 0.9205 vs. 0.9245), suggesting that the learned representations largely overlap with existing feature abstractions. These findings position TCT as a promising representation learning approach that captures relevant behavioral signal, while highlighting the challenges of achieving additive value over strong domain features. The results reflect an intermediate stage in the development of temporal representation learning for financial crime detection and motivate further research on model architecture, training objectives, and integration strategies. At this early stage, achieving performance comparable to a strong feature-engineered baseline is itself a meaningful outcome, indicating that learned representations approximate domain-specific features without manual engineering. While not yet production-ready, these results point to a promising direction for reducing reliance on feature engineering in financial crime detection.

Danny Butvinik, Yonit Marcus, Nitzan Tal +1

NICE Actimize

Self-Supervised Time Series Representation Learning Predictive Representation Learning Financial Fraud Detection Time Series Transformers Contrastive Learning

Ask PDF

Feb 24, 2026

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks

Illicit transaction detection is often driven by transaction level attributes however, fraudulent behavior may also manifest through network structure such as central hubs, high flow intermediaries, and coordinated neighborhoods. This paper presents a time respecting, leakage safe (causal) graph feature extraction protocol for temporal transaction networks and evaluates its utility for illicit entity classification. Using the Elliptic dataset, we construct directed transaction graphs and compute interpretable structural descriptors, including degree statistics, PageRank, HITS hub or authority scores, k-core indices, and neighborhood reachability measures. To prevent look ahead bias, we additionally compute causal variants of graph features using only edges observed up to each timestep. A Random Forest classifier trained with strict temporal splits achieves strong discrimination on a held out future test period (ROC-AUC about 0.85, Average Precision about 0.54). Although transaction attributes remain the dominant predictive signal, graph derived features provide complementary interpretability and enable risk context analysis for investigation workflows. We further assess operational utility using Precision at k and evaluate probability reliability via calibration curves and Brier scores, showing that calibrated models yield better aligned probabilities for triage. Overall, the results support causal graph feature extraction as a practical and interpretable augmentation for temporal fraud detection pipelines.

Hamideh Khaleghpour, Brett McKinney

The University of Tulsa, Tulsa, Oklahoma, USA

Financial Fraud Detection Temporal Data Leakage

Ask PDF

Sep 7, 2026

Temporal Heterogeneous Graph Transformer for Credit Card Fraud Detection

Credit card fraud detection typically relies on tabular features, while repeated attributes can also provide useful relational signals. This paper proposes THGT-FD, a Temporal Heterogeneous Graph Transformer for Fraud Detection. Each transaction is represented using one transaction token and six types of relation tokens and incorporates Time2Vec encoding into the transaction representation. A Transformer learns the interactions among these tokens within each individual transaction and then outputs a fraud probability. Experiments were conducted on 150,000 transactions sampled from the IEEE-CIS Fraud Detection dataset and chronologically partitioned according to TransactionDT. On the test set, THGT-FD achieved an AUC-ROC of 0.8536, an average precision of 0.4164, and a Recall@5% of 0.4708. The class-weighted histogram-based gradient-boosting baseline achieved an AUC-ROC of 0.8722. The results indicate that relation tokens provide useful information for fraud-risk ranking, although the current model does not yet incorporate entity-level historical aggregation.

Qinwen Yan

University of California, Los Angeles Los Angeles, California, USA

Financial Fraud Detection Transformer Feature Interaction Modeling

Ask PDF

Abstract

Financial Fraud Detection

Explore similar work

Temporal Contrastive Transformer for Financial Crime Detection: Self-Supervised Sequence Embeddings via Predictive Contrastive Coding

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks

Temporal Heterogeneous Graph Transformer for Credit Card Fraud Detection