Money laundering intelligence

The Australian framework, briefly

Reporting entities operate under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, regulated by AUSTRAC. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 received Royal Assent on 10 December 2024. The reformed obligations apply to existing reporting entities from 31 March 2026, and from 1 July 2026 to newly regulated tranche 2 entities, which include lawyers, accountants, real estate agents, conveyancers and dealers in precious metals and stones. The amendments also replace the term digital currency with virtual asset and extend regulation to more virtual asset services, as summarised in the Home Affairs overview of the Amendment Act.

Three reports drive most analytics work:

• Suspicious matter reports (SMRs), due within 3 business days of forming a suspicion, or within 24 hours where the suspicion relates to terrorism financing. Telling the customer, or anyone else, that a suspicion has been formed or reported is an offence.
• Threshold transaction reports (TTRs) for physical currency of A$10,000 or more, due within 10 business days of the transaction.
• International funds transfer instruction reports (IFTIs), due within 10 business days after the instruction is sent or received.

We build analytics and tooling. The decision to form a suspicion and lodge a report stays with your AML/CTF compliance officer and analysts.

Transaction monitoring that goes past thresholds

Rules are transparent and auditable, but they are static, and launderers learn them. We keep rules where they belong, as hard detectors for obligations and known patterns, and layer three things on top: behavioural baselines that compare each customer with their own history and with a peer group by product, segment and geography; supervised typology models trained on historical case outcomes, with weak supervision where confirmed labels are scarce; and graph features that describe how money moves between parties rather than how one account behaves. Thresholds are tuned with above-the-line and below-the-line testing, so a change in alert volume can be traced to a measured change in what is caught.

Typologies we model

• Structuring and smurfing. Cash deposits held just under the A$10,000 TTR threshold, spread across branches, ATMs, days and depositors. Detection clusters near-threshold amounts in rolling windows and links the depositors, not just the account.
• Cuckoo smurfing. Criminal cash is deposited into the account of a person expecting a legitimate overseas transfer, and the offshore funds are diverted. AUSTRAC's financial crime guide on cuckoo smurfing lists indicators such as multiple third-party cash deposits under A$10,000. We match unrelated depositors and deposit locations against expected inbound remittance amounts.
• Money mule networks. Accounts that receive many inbound transfers and forward them quickly: a pass-through ratio near 1, short dwell time, recent account opening and shared devices, IP addresses or contact details across accounts.
• Layering. Rapid movement across accounts, products and jurisdictions to break the audit trail. In a graph this shows as long temporal paths, fan-out and fan-in motifs, and cycles that return value to near its origin.
• Trade-based money laundering. Over- and under-invoicing, multiple invoicing and phantom shipments. We compare declared unit prices against price distributions for the same commodity code and route, and reconcile trade documents with payment flows.
• Virtual asset laundering. Mixers, peel chains and chain-hopping through swaps and cross-chain bridges. We combine on-ramp and off-ramp transaction data with blockchain analytics feeds and score exposure by hop distance to illicit or sanctioned clusters.

Entity resolution

One person can appear as a dozen records across products, acquisitions and channels, with name variants, transliterations, old addresses and shared phone numbers. Entity resolution uses blocking keys to keep comparisons tractable, probabilistic matching in the Fellegi-Sunter tradition alongside learned similarity models for names in multiple scripts, and explicit review bands where a human decides. Survivorship rules choose the attribute values the resolved entity carries, and every merge records why it happened, so an analyst can unpick a bad match.

Graph analytics and network link analysis

We build a heterogeneous graph of customers, accounts, devices, addresses, counterparties and transactions, then run analytics suited to each question: community detection with Louvain or Leiden to surface clusters that behave as a unit, personalised PageRank to propagate risk outward from confirmed bad actors, motif counts for fan-in, fan-out and cycles, time-respecting path queries for layering, and graph neural networks such as GraphSAGE for node classification once enough labels exist. Analysts get an interactive link chart for each alert, built from the same graph the models use.

Risk scoring and alert triage

Customer risk ratings combine inherent risk (product, channel, jurisdiction, politically exposed person and sanctions status) with observed behaviour. Gradient-boosted models with monotonic constraints guarantee that raising a risk factor never lowers the score, and outputs are calibrated so a score of 0.8 means what it says.

For triage, a model trained on historical dispositions estimates each alert's probability of escalation and orders the queue. Low-risk alerts can be closed only with the evidence recorded and a quality-assurance sample reviewed by people. We validate on a later time period than training and report recall on escalated cases, so the gain in efficiency is not paid for with missed suspicious matters.

Case management and explainable SMR support

A case view assembles the transactions, the entity graph snapshot, KYC data, prior alerts and the reason codes for each score, using SHAP values for model features and highlighted graph paths for network signals. An optional language model running inside your environment drafts a grounds-for-suspicion narrative in which every statement cites a transaction or document. The analyst edits it, the compliance officer decides, and nothing is lodged automatically. Access to cases is restricted and logged to protect against tipping off.

Questions