Anti-money-laundering transactions with ground truth
A bank's customers, accounts and transactions, with the laundering typologies labelled, the rule-based alerts raised, and the cases and SARs that followed.
A bank's first six months: 300 customers, their accounts, tens of thousands of transactions and a set of launderers whose behaviour follows five named typologies. Rule-based alerts fire with real false positives, and investigators turn some of them into cases and suspicious activity reports. The labels are the ground truth, so you can score a detector honestly.
86,299 rows across 6 tables, 1.4 MB zipped. Public domain (CC0), no signup, no attribution required.
What is in it
customer_id, segment, full_name, business_name, email, country, region, city, street_address, postal_code, phone, industry, annual_income, expected_monthly_volume, is_pep, risk_score, kyc_risk_rating, onboarded_at, is_suspicious
account_id, customer_id, account_type, opened_at, status
counterparty_id, counterparty_name, counterparty_type, country, jurisdiction_risk
transaction_id, account_id, customer_id, counterparty_id, txn_at, txn_type, direction, channel, amount, currency, counterparty_country, is_cash, is_suspicious, typology, ring_id
alert_id, customer_id, account_id, rule, raised_at, score, is_true_positive, typology
case_id, customer_id, opened_at, closed_at, alert_count, outcome, sar_filed, sar_filed_at, confirmed_typology, investigator, first_alert_id
What holds, and how it was checked
Each line was measured against these exact files rather than asserted. The same checks ship inside the zip as INTEGRITY.txt, so you can re-run them yourself.
- 8 foreign-key relationships checked, 0 orphaned rows
- No row is dated before the row it belongs to
- 15 of 300 customers (5.0%) are launderers, and the rate asked for is the rate in the data
- 259 suspicious transactions, each labelled with its typology (dormant_reactivation, layering, mule_funnel, round_tripping, structuring) so a detector can be scored against the truth
- Alerts are rule-based, not oracles: 46% of 145 alerts are true positives and the rest are false alarms
- 26 of 49 cases end in a filed suspicious activity report, and every one is filed after its case opened
- Structuring is visible: 52% of the 65 structured cash deposits sit just under the 10,000 reporting threshold
Questions it can answer
- What precision and recall does a simple amount-threshold rule reach against the typology labels?
- Which typology is hardest to catch with rules alone?
- How many alerts does an investigator work for each true launderer found?
- Do structured cash deposits cluster in the days before a case opens?
Generate a custom version
Make your own version in StudioThis dataset was built by Misata Studio's engine and is fixed. RECIPE.json in the zip records the archetype, the sizes and the seed. In Studio you can start from the same kind of data, change the sizes, the rates or the period, and get a new dataset with its own certificate.
Other datasets
- Retail star schema
A dimensional model you can actually practise joins on: one fact table, four dimensions, 63,170 rows, and every join resolving.
- Machine degradation
100 machines monitored from commissioning to failure, with an exact remaining-useful-life label on every one of 23,118 readings.
- Ecommerce storefront
A year of orders across five joined tables, with a real Q4 peak and totals that reconcile to the cent.
- B2B SaaS subscription analytics
Accounts, seats, MRR, churn and support load, where company size actually drives the plan.
- Credit risk portfolio
3,000 borrowers and 4,200 commercial loans, where a credit rating actually predicts whether the loan defaults, at the rate S&P's own data says it should.
- Network intrusion / netflow
500 hosts and 20,000 labeled flows, where a port scan, a DDoS flood, and a brute-force attempt each carry the real statistical signature their MITRE ATT&CK technique actually leaves in traffic.
- Contact center queueing (Erlang C)
4 queues, 2,400 half-hour intervals over a full business month, where agents_staffed is what Erlang C (1917) says is actually required to clear each queue's own SLA target, not a plausible-looking number.
- Manufacturing SPC (Cpk / Xbar-R)
5 processes, 450 subgroups, 2,250 measurements, where process capability and out-of-control detection come from a real Xbar-R control chart -- including one process with an engineered tool-wear drift that actually trips Western Electric rules where it happens.
- Clinical trial: sites, patients, visits and adverse events
Two trials across nine sites: enrolment, scheduled visits, dosing, lab biomarkers and graded adverse events, all in the right order.
- Hospital encounters, diagnoses and claims
Patients, providers, encounters, ICD-10 diagnoses, prescriptions, labs and insurance claims that reconcile from billed to paid.
- Factory sensors with failure labels
A year of hourly sensor readings from six machines, with the degradation stage, remaining useful life, and the failures and work orders they lead to.