AML Transaction Monitoring

• Transaction monitoring and model benchmarks

  score a detector against the truth, not against the bank's partial labels. 43.0% of truly suspicious transactions were never labelled by the bank, so a model trained on the observed labels can be tested on what it would really miss.

• Alert triage and false positives

  6,947 rule alerts, 91.6% of them false positives, the share banks report. Build a triage model, tune rule thresholds, or measure each rule's productivity.

• Case management and STR workflow

  every alert worked by a first-line analyst (11.0% escalated, the rest closed as false positives, some real laundering among them), cases opened from the escalations with investigators, outcomes and filing dates, STRs filed without delay (a median 5 days after an analyst escalated the alert), and the goAML XML report for each one, the format the UAE FIU takes.

• Targeted financial sanctions

  a few customers are listed while they bank here; each is frozen within a day of the listing, the debits they try afterwards are blocked and their accounts read frozen, beside a screening test set of confirmed matches and namesakes.

• Drift and robustness

  crypto_offramp from 2026-02 and app_scam from 2026-04 are schemes the bank has never seen before they start. Train on the early months and watch a model meet them.

• Graph and network detection

  rings with roles (principal, mule, pass-through), mule herds whose members bank here and pass money on to their collector, layering chains through other customers' accounts, and a counterparty network.

• KYC, beneficial ownership and screening

  risk ratings with their reasons, owners behind business customers, PEPs, and planted watchlist near-matches with the decision a screener should reach.

• A bank that lives in the UAE

  salaries paid through the Wage Protection System at the month's turn, with overtime for hourly trades; firms' payroll files, VAT for those past the registration threshold, corporate tax from 2024; expatriates sending home a part of pay that falls as pay rises; rent by post-dated cheques; homes, offices and labour accommodation by emirate and district; the Saturday-Sunday week for banks and firms while people shop through weekends and Eid; Ramadan's late nights and the run-up to Eid.

• Teaching and demos

  a complete AML data model for a course, a dashboard, or a RegTech or case-management demo.

• transactions.is_suspiciousThe truth: the transaction is part of a laundering or fraud scheme, whether or not anyone found it.true on 0.1% of rows
• transactions.typologyWhich of the sixteen schemes it belongs to.16 values: cash_commingling, mule_funnel, synthetic_identity…, 99.9% empty
• transactions.ring_idThe scheme instance, joining to rings and ring_members for every account it touched.211 values: R00001, R00009, R00004…, 99.9% empty
• transactions.label_observedWhat the bank's records show: the typology an investigation confirmed, empty where nothing was found.16 values: cash_commingling, mule_funnel, funnel_account…, 99.9% empty
• transactions.labelled_atWhen the bank learned it, weeks or months after the activity; empty if it had not by the end of the data.2025-07-05 00:44:28 to 2026-10-30 19:17:20, 99.9% empty
• transactions.lookalike_ofHonest activity that resembles a scheme: the false positives a good model must leave alone.15 values: mule_funnel, cash_commingling, funnel_account…, 100% empty
• customers.is_suspiciousThe customers who are laundering principals, exactly the share the recipe asked for.true on 1.4% of rows
• alerts.is_true_positiveWhether the rule alert pointed at real crime.true on 8.4% of rows
• alerts.typologyThe scheme a true alert pointed at; empty on false positives, so it is truth, not a feature.16 values: layering, structuring, trade_based…, 91.6% empty
• screening_expected.expected_decisionThe decision a sanctions screener should reach on each planted near-match.2 values: false_positive, true_match

• 91.6% of alerts are false positives (banks report 90-98%; SynthAML, built from a real bank, reports 95-98%).
• 3.1% of alerts end in an STR (typical programmes 1-5%).
• 0.103% of transactions are truly suspicious (public synthetic sets sit at 0.10-0.2%).
• STRs are filed a median 5 days after an analyst escalated the alert, never more than 10: the UAE requires reporting without delay. Counted from the rule's alert, its wait in the first-line queue included, the median is 13 days.
• The bank's records label 57.0% of truly suspicious transactions; the rest were never found.
• 53.3% of structuring cash deposits sit within 20% under the AED 55,000 line and none above it, against 0.03% of honest cash deposits.
• Mule accounts pass money on fast: 28.5% of value leaves within 15 minutes of the last deposit, 43.9% within an hour, 74.0% within a day.
• Honest amounts follow Benford's first-digit law (MAD 0.0043); suspicious ones conform less (MAD 0.0139).
• Shortcut audit: no column on its own finds the crime. The strongest, amount, reaches an average precision of 0.019 against a base rate of 0.0010.

• every key resolves and every primary key is unique; a transaction's customer owns its account; nothing happens before the account opens or the customer is onboarded; a case opens on or after its first alert and files its STR after it opens;
• every goAML report parses and belongs to a case with an STR;
• every customer was an adult when onboarded; dormant accounts have been quiet for a year; closed accounts stop;
• no value of any column, nor its being empty, marks crime on its own: declined payments, new devices and transfers between customers are overwhelmingly honest, as in a real bank;
• honest look-alike customers never carry a truly suspicious transaction;
• each scheme that starts part-way through starts when the recipe says;
• no column on its own gives the label away (the shortcut audit below).

• transactionsEvery movement: channel, type, direction, amount, cash flag, counterparty country, status (approved, declined, or blocked under a sanctions freeze); the truth (is_suspicious, typology, ring_id), what the bank's records show (label_observed, labelled_at), and lookalike_of for honest activity that resembles a scheme7,116,298 rows · 22 cols
• loginsOnline and mobile banking logins with device ids, one opening each session a payment is made in and others that only look: customers change phones and browsers, and a takeover arrives on a new device among many honest ones4,069,456 rows · 8 cols
• payeesEach payee a customer registered before first paying them, when and through which channel; a takeover's payee is added from the new device minutes after it logged in368,068 rows · 9 cols
• counterpartiesThe people, firms, banks and exchange houses on the other side of payments, each named as its own country names it, with country25,000 rows · 5 cols
• accountsCurrent, savings, business and foreign-currency accounts with UAE-format IBANs (valid check digits, never live) and BIC; status active, dormant, closed (with the day it closed) or frozen17,282 rows · 10 cols
• customersRetail, small-business, corporate and private-banking customers: KYC risk rating at onboarding and its reason, the rating as it stands now (raised after a report), PEP flag and PEP ownership, nationality, residency and visa, Emirates ID, occupation, income, the monthly volume they declared at onboarding, onboarding channel; for a firm its trade licence and licensing authority, office or yard and company email; and the truth (is_suspicious)10,000 rows · 34 cols
• alertsWhat the monitoring rules raised: rule, score, the transaction it fired on, the first-line review (analyst, when the queue reached it, escalated or closed as a false positive), and the truth (is_true_positive, typology)6,947 rows · 12 cols
• beneficial_ownersThe people who own or control each business customer, with their share4,933 rows · 9 cols
• watchlist_aliasesSpelling variants, transliterations and aliases of watchlist names861 rows · 5 cols
• casesInvestigations opened from escalated alerts: opened, closed, investigator, alerts taken in, outcome (closed, escalated, STR filed, or covered by a report filed in the last 90 days), filing date and confirmed typology708 rows · 11 cols
• watchlistA sanctions-style watchlist of invented names500 rows · 10 cols
• ring_membersWho was in each scheme and their role: principal, mule, pass-through, victim, unwitting beneficiary384 rows · 5 cols
• str_reportsOne goAML suspicious transaction report per filing, the XML file next to it in goaml/: reporting officer, the customer as goAML holds them (Emirates ID or trade licence), the grounds written out, and the transactions reported216 rows · 6 cols
• ringsEvery scheme planted: typology, kind, start, end, accounts, transactions, amount, parameters211 rows · 11 cols
• lookalikesHonest customers whose behaviour resembles a typology, and what it resembles100 rows · 4 cols
• screening_expectedPlanted pairs between customers and the watchlist, with the decision a screener should reach and, for a confirmed match, when the customer was frozen and when the freeze was reported (a Fund Freeze Report within two business days)63 rows · 11 cols

Want it bigger, in another setting, or with your own columns? Have us build it or make it in Studio.