<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Rule-based Anti-Money Laundering in Financial Intelligence Units: Experience and Vision</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Luigi Bellomarini</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Eleonora Laurenza</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Emanuel Sallinger</string-name>
          <xref ref-type="aff" rid="aff2">2</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Banca d'</institution>
          <country country="IT">Italia</country>
        </aff>
        <aff id="aff1">
          <label>1</label>
          <institution>Financial Intelligence Unit for</institution>
          <country country="IT">Italy</country>
        </aff>
        <aff id="aff2">
          <label>2</label>
          <institution>TU Wien &amp; University of Oxford</institution>
        </aff>
      </contrib-group>
      <abstract>
        <p>Money laundering is a major threat to the good functioning of financial systems. Despite huge technological investments, with machine learning at the heart of the Fintech revolution, we are still lacking explainable solutions in fighting money laundering, especially for Financial Intelligence Units (FIUs). This paper is based on the joint committment of the Fintech community and academia in applying state-of-the-art rule-based reasoning to counteract money laundering. We report a visionary position about the application of logic-based Knowledge Graphs and reasoning with languages in the Datalog+/- family in the anti-money laundering (AML) domain. After motivating the impact and the importance of an explainable rule-based solution, we pin down the core AML problems in the form of high-level decision tasks. We envision that the FIU knowledge is modeled as the ground truth of a KG, so that AML tasks are formulated and carried out as reasoning tasks, addressing specific quality desiderata. We provide technical zoom and concrete exemplification of the approach with a real money laundering case. We discuss relevant research and technological challenges.</p>
      </abstract>
      <kwd-group>
        <kwd>Knowledge Graphs Reasoning Anti-money laundering Fintech</kwd>
      </kwd-group>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>-</title>
      <p>This paper is based on our experience with the Financial Intelligence Unit (FIU) for
Italy, one of the most relevant in the world, and the University of Oxford in applying
state-of-art rule-based reasoning to counteract money laundering. Recent guidelines of
the Financial Action Task Force [18] make us aware that the AML and FIU
communities are permeable to and in strong need for such declarative and fully explainable
approaches. Yet, it is our experience that no systematic approach, methodology or
system has been developed at any FIU or shared in the literature. This paper contributes a
visionary opinion based on a real-world experience, with the ambitious goal of steering
processes and systems at FIUs towards a rule-based direction, for explainable, efficient
and ethical AML decisions.</p>
      <p>Money laundering is the process of making illegally-gained money proceeds, that
is dirty money, appear legal and clean [21], by obfuscating the origin of the money.
Anti-money laundering is a global challenge, which involves financial and non-financial
intermediaries of the private sector (banks, trusts, money transfers, casinos, securities</p>
      <p>The views and opinions expressed in this paper are those of the authors and do
not necessarily reflect the official policy or position of the Italian FIU or Banca d’Italia.
Copyright c 2020 for this paper by its authors. Use permitted under Creative Commons License
Attribution 4.0 International (CC BY 4.0).
dealers, real estate brokers, public notaries, dealers , etc.), Financial Intelligence Units
and law enforcement agencies. Our interest here is in FIUs, the government agencies
that act as intermediaries between the private sector and law enforcement agencies.
FIUs collect and analyze raw transactional data, namely, Suspicious Transaction
Reports (STRs), filed by the intermediaries and conduct financial intelligence
investigation to produce detailed, inspectable and logically consequential inquiry reports of the
money laundering cases as well as justifiable hypotheses on the underlying crime
(technically the predicate offences) for legal follow-up.</p>
      <p>The current outlook on worldwide money laundering is disconcerting: The
International Monetary Fund [28], estimates the amount of laundered money to be between 1.7
and 4.5 trillion USD. Meanwhile, according to Refinitiv [33], over the last year there has
been an increase of over 50% in AI-based Fintech investment in improvements in
contrasting financial crime. Machine learning (ML) approaches are gaining ground [11]:
novel supervised [34] and unsupervised [30] techniques are being proposed, with a
recent focus on graph deep learning [37], natural language processing applications [26]
and social network analysis [13]. Despite these efforts, the global progress in fighting
financial crime is insufficient to address the uprising emergency [3]. In fact, AI
vendors [36] and ML literature [11,14,31] have been concentrating on “compliance use
cases” to support financial intermediaries (e.g., to accommodate the Fifth AML
Directive [16]), while the entire AML community is looking at the AI technology in its
growing demand for viable solutions able to fulfill the requirements of the FIU business.</p>
      <p>FIU use cases are far from the compliance ones and involve several core quality
desiderata: 1. Complex reasoning tasks on sophisticated money laundering cases
involving a network of many heterogeneous entities should be possible; 2. Fully
explainable elicitation of the specific financial fraudulent schemes is desired in order to sustain
legal follow-ups and avoid unethical or unjustified conclusions; 3. A careful balance of
inductive approaches and the extensive domain experience must be stricken; 4.
Solutions should be scalable to support very high volumes. None of the above requirements
are currently met by any existing framework or set of techniques for AML [11].
Contribution. In this paper, we leverage our experience with the Italian FIU and our
work on state-of-art Knowledge Representation and Reasoning (KRR) languages such
as Warded Datalog [5], a language of the Datalog family. Datalog extends Datalog
with existential rules, while introducing syntactic restrictions to guarantee decidability
and tractability of the reasoning task. We have successfully applied Warded Datalog as
a core language for reasoning on Knowledge Graphs (KGs) [5], a data model for which
applied reasoning use cases are growing [19]. We suggest that the favourable features
of such languages and the availability of engineered systems such as VADALOG [7],
enable reasoning on complex cases of general interest to FIUs and provide a visionary
position motivating the application of a rule-based approach in order to fulfill the above
desiderata. In particular, the main contributions of this work are:
– A novel comprehensive formulation of AML use cases as high-level decision tasks,
with unprecedented attention to the aspects of relevance for FIUs.
– An introduction of our vision on a rule-based reasoning approach to AML. In
particular, we envision that the enterprise knowledge available to FIUs and intermediaries
is modeled as the ground truth of an AML KG. Domain experience from financial
analysts as well as machine learning models should be represented as reasoning rules
over the KG, so that AML tasks are formulated and carried out as reasoning tasks.
– A technical zoom and concrete exemplification of the benefits of a rule-based
approach to AML thanks to an anonymized and stylized Italian money laundering case.
– In the light of the described desiderata, a deep discussion of the most relevant research
and technological challenges in a reasoning approach to AML: data wrangling,
compliance checks, analytics, detection of seen and unseen laundering patterns, handling
uncertainty, and taking ethical decisions.</p>
      <p>Overview. Section 2 includes the use cases and our vision. Section 3 analyzes a
realworld case from the Italian FIU. Section 4 focuses on challenges and opportunities for a
rule-based approach to AML. Relevant related work is extensively discussed throughout
the paper and summed up in Section 5. In Section 6 we draw our conclusions.
2</p>
    </sec>
    <sec id="sec-2">
      <title>A Rule-based Vision on AML</title>
      <p>We start in Section 2.1 by getting to the core of the complex set of AML-related
processes a FIU carries out. We capture them in the form of business use cases, presented
as straightforward research problems. In Section 2.2, we introduce a visionary
position and model business use cases as reasoning tasks over a comprehensive rule-based
Knowledge Graph for AML.
2.1</p>
      <sec id="sec-2-1">
        <title>AML Use Cases: Getting to the Core</title>
        <p>AML is the task of preventing the process of money laundering as a whole, in all its
phases. It is frequently presented only through the lens of regulatory compliance, as the
burden falls primarily on intermediaries, responsible for meeting Know Your Customer
(KYC) standards posed by regulations or conducting Customer Due Diligence to avoid
the related high penalties. On the other hand, FIUs, at the heart of the money-laundering
contrast system, conduct many intertwined activities, culminating in financial
intelligence analysis and disseminating the results to the judicial authority. At the core of
such activities, we see the following two high-level decision tasks:
1. Suspicion assessment. Decide whether a financial transaction or a case meets a
definition of “suspicious”.</p>
      </sec>
      <sec id="sec-2-2">
        <title>2. Suspicious offence determination. Decide whether a suspicious predicate offence</title>
        <p>underlies a transaction or case.</p>
        <p>In both the tasks we need to distinguish between transaction and case. While the former
is a money/asset transfer together with its related attributes (e.g., transaction amount,
KYC profiles of the involved subjects), cases are sets of cohesive transactions along
with their context, which may include: The network of involved subjects, assets,
companies, shareholding structures, etc. The definition of suspicious may either derive from a
national regulatory body or be independently adopted by the FIU. It can be either based
on certain criteria or on probabilistic ones. A detailed example of case is in Section 3.</p>
        <p>
          Task (
          <xref ref-type="bibr" rid="ref2">2</xref>
          ) complements Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          ) in that it makes the explainability requirement
explicit: Besides knowing the fully detailed cause of suspiciousness, we want to decide on
possible underlying predicate offences. More advanced characterizing tasks of practical
utility for the FIUs can be formulated as derived tasks extending the previous ones:
- Suspiciousness scoring. Produce a heuristic measure (e.g., a score) of the level of
suspiciousness of a transaction or a case (see Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          )).
- Suspicion classification. Classify a case or transaction by its underlying predicate
offences or produce a heuristic measure (e.g., a score) of the level of confidence that
a specific predicate offence underlies a case or transaction (see Task (
          <xref ref-type="bibr" rid="ref2">2</xref>
          )).
- Risk-driven optimization. Perform a risk-based scheduling or planning of the
overall AML activity to optimize an enterprise-level (FIU or intermediary) objective
function based on suspiciousness (see Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          )) or predicate offence (see Task (
          <xref ref-type="bibr" rid="ref2">2</xref>
          )).
        </p>
        <p>
          For example, process first more suspicious cases or higher-impact crimes.
- Reconstruction. Produce an explanation about the suspiciousness of a transaction
or case (see Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          )) or for the presence of a given predicate offence (see Task (
          <xref ref-type="bibr" rid="ref2">2</xref>
          )).
2.2
        </p>
      </sec>
      <sec id="sec-2-3">
        <title>Towards Rule-based Knowledge Graphs for AML</title>
        <p>In order to lay out our reasoning framework for AML, let us point out the basic notions
of Knowledge Graphs and Knowledge Representation and Reasoning (KRR) languages.</p>
        <p>A KG can be defined as a semi-structured data model characterized by three
components: 1. a ground extensional component (EDB), with constructs, namely facts, to
represent data in terms of a graph or a generalization thereof; 2. an intensional
component (IDB), with reasoning rules over the facts of the ground extensional component;</p>
        <sec id="sec-2-3-1">
          <title>3. a derived extensional component, produced in the reasoning process, which applies</title>
          <p>rules on ground facts [7]. In this work, we refer to logic-based KGs, i.e., where the
intensional component is defined with a logic-based KRR language. We envisage the
adoption of VADALOG, a reasoning language revolving around Warded Datalog , a
language of the Datalog family that extends Datalog with existential quantification.
Warded Datalog captures full Datalog [10,27], so it supports full recursion, essential
to navigate graph structures; at the same time it allows ontological reasoning, being able
to express SPARQL queries under set semantics and the entailment regime for OWL 2
QL while guaranteeing scalability thanks to PTIME data complexity for the reasoning
task [24]. VADALOG supports additional features of practical utility: a form of
aggregation [35], stratified negation, Boolean conditions, mathematical expressions,
probabilistic reasoning, embedded functions and arbitrary machine learning models [7].</p>
          <p>The IDBs are defined in terms of existential rules, i.e. first-order sentence of the
form: 8G8H ¹i¹G Hº ! 9I k ¹G Iºº, where i (the body) and k (the head) are
conjunctions of atoms with constants and variables. Heads can also equate variables. We write
i¹G Hº ! 9I k ¹G Iº and replace ^ with comma to denote conjunction of atoms. The
semantics of such a rule is intuitively as follows: if there is a fact i¹C C 0º in the derived
extensional component (denoted as ¹ º and which initially coincides with the EDB),
then there exists a tuple C 00 such that the facts k ¹C C 00º are also in ¹ º. Roughly, the
reasoning process is the generation of ¹ º to answer specific queries.
A KG for AML. We are now ready to apply the above definitions to our domain. We
see the set of AML tasks of interest to a FIU as reasoning over an encompassing KG,
modeling all the relevant domain objects and interconnections including: transactions,
enterprise data stores, compliance rules, suspicious patterns, etc. In particular,
transaction data and Suspicious Transaction Reports (STRs) should be represented as EDBs
as well as data from enterprise knowledge systems. For intermediaries, they include
transaction, enterprise and KYC data; EDBs derive from: STRs, business, person,
asset, real estate and invoice registers, facts from social networks and media, newspapers
or follow-up feedback from law enforcement authorities. IDBs should be used to
represent and operationalize official regulations — in a “RegTech” approach — and encode
custom criteria, including money laundering patterns (e.g., circular wire transfers,
pyramidal control structures), domain rules and suspicious behaviours.</p>
        </sec>
      </sec>
      <sec id="sec-2-4">
        <title>AML Intensional Knowledge and Reasoning. We believe that most of the money</title>
        <p>laundering patterns, suspicious behaviours and financial business rules can be described
with a KRR language like VADALOG, supporting full recursion, ontological reasoning,
probabilistic reasoning, and machine learning models. We envision that some reasoning
rules are designed by financial analysts and domain engineers, while others are learnt
from data, e.g., with statistical relational learning approaches [32].</p>
        <p>Crafted rules embody valuable domain knowledge that cannot be induced from the
data (e.g., a compliance regulation, the internals of a money laundering pattern, a
complex domain rule) or is well known to the analysts (e.g., money laundering patterns,
tactics for financial trail obfuscation) and inducing it from data would result in lower
accuracy and explainability. The following two VADALOG rules, for instance, are part
of the intensional component of an invoice KG and encode (a simplified version of) the
domain knowledge to detect off-the-books slush funds, set up via false invoices:</p>
        <p>
          Transaction¹G H &gt;º ! 9I Invoice¹I H G &gt;º
Invoice¹I H G &gt;º :Transaction¹G H &gt;º ! PotentialSlushFund¹Hº
(
          <xref ref-type="bibr" rid="ref1">1</xref>
          )
(
          <xref ref-type="bibr" rid="ref2">2</xref>
          )
        </p>
        <p>
          Normally, whenever there is a transaction from a subject G to H for a product/service
&gt;, then H issues an invoice I to G for &gt; (Rule (
          <xref ref-type="bibr" rid="ref1">1</xref>
          )). Yet, if we have an invoice for &gt;, but
no transaction from G to H exists, likely H is creating a slush fund (Rule (
          <xref ref-type="bibr" rid="ref2">2</xref>
          )). This is
an elementary case, representing a typical domain knowledge snippet. We shall see a
full-fledged intensional component for a real AML case in Section 3.
        </p>
        <p>
          Modern KRR languages allow for general and robust rules that capture both seen
and unseen money laundering patterns. When rules embed parametric machine learning
models, such parameters can in turn be inferred from data. On the other hand,
learning rules from data can sensitively expedite ordinary rule design process. The learning
bus in Figure 1 denotes such a hybrid deductive/inductive approach. AML tasks
described in Section 2.1 should be modeled as reasoning tasks on the AML KG and used
to develop value added services or APIs to support the various business processes of
intermediaries and FIUs. In particular, we envisage the development of KG-enhanced
AML applications that rely on the outcome of Tasks (
          <xref ref-type="bibr" rid="ref1 ref2">1-2</xref>
          ) for crucial decisions. For
example, tools for STR workflow processing at intermediaries should query the AML
KG for Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          ) in order to finalize transactions and decide, according to regulatory or
custom criteria, whether to file STRs to their local FIUs. Symmetrically, FIUs, upon
receiving STRs from intermediaries, should trigger Task (
          <xref ref-type="bibr" rid="ref1">1</xref>
          ) to perform the follow-up
assessments. Task (
          <xref ref-type="bibr" rid="ref2">2</xref>
          ) should be used by FIUs when specific cases need to be pursued,
for autonomous investigations or instances issued by the enforcement authorities.
3
        </p>
      </sec>
    </sec>
    <sec id="sec-3">
      <title>Reasoning on a Real Money Laundering Case</title>
      <p>
        In the daily investigation duties of a FIU, deciding on the suspiciousness of an STR is
a prominent activity: The Italian FIU handles 100 such cases per year, for which
timely and explainable decisions are mandatory [20]. This causes Task (
        <xref ref-type="bibr" rid="ref1">1</xref>
        ) to emerge in
terms of practical utility, with the need to develop effective decision heuristics. Hence,
suspiciousness scoring is of strategic relevance among derived sub-tasks in Section 2.1.
Let us now see how it can be carried out with a rule-based approach by analyzing a real
pattern of money laundering cases, anonymized and stylized.
      </p>
      <p>Description of the Data. The
extensional component of the KG is in
Figure 2. Solid black edges and nodes
represent the EDB. In this case 14
companies, 4 financial intermediaries, and 4
individuals are involved. Depending on the
case, the reasoning process may need to
explore millions of entities in a KG with</p>
      <p>22M nodes and 255M links.</p>
      <sec id="sec-3-1">
        <title>Description of the Case. Dashed edges</title>
        <p>and nodes in Figure 2 exemplify the
derived extensional component. The case is Fig. 2: An example of AML KG.
triggered by an STR B (the red edge in
Figure 2), reporting a loan instance from an individual G having a criminal record (the
red node), to Acme Bank. Our goal is to score and explain suspiciousness of B). We
start from the search for a typical laundering pattern: A person G who is issuing a loan
request to a bank 1 of which he/she is the ultimate beneficial owner (UBO), may intend
to launder unclean money via the bank.</p>
        <p>
          A UBO is a person who ultimately, i.e., directly or via his/her undertakings, owns
or controls a given entity (Acme Bank, in our case) on whose behalf a transaction (the
loan) is being conducted [18]. In our case, if G were a UBO of Acme Bank (
          <xref ref-type="bibr" rid="ref1">1</xref>
          ), G might
be requesting a fake loan to a bank he/she exerts control upon, with the likely intent to
justify money illegally gained. What typically happens is that perpetrators also try to
conceal their ultimate ownership. As we shall see, KG reasoning allows to go beyond
the literal recognition of the pattern and detects the suspicious behaviour in a general
sense, overcoming ownership concealment.
        </p>
        <p>The following set of VADALOG rules (explained in detail in the next paragraphs) encode
the intensional component representing the domain we have just described:
? :: Person¹81 511     5=1º Person¹82 512     5=2º
? = #B8&lt; ¹ 511     5=1 512     5=2º ! Spouses¹81 82º</p>
        <p>Person¹8   º ! 9 5 Family¹ 5 º In¹8 5 º
Spouses¹81 82º In¹81 51º In¹82 52º ! 51 = 52</p>
        <p>Control¹G Gº</p>
        <p>Own¹G H Fº F ¡ 05 ! Control¹G Hº
Control¹G Iº Own¹I H Fº msum¹F hIiº ¡ 05 ! Control¹G Hº</p>
        <p>IsCeoAt¹G Hº ! Own¹G H 10º
Own¹G I F1º Own¹I H F2º ! Own¹G H msum¹F1 F2 hIiºº</p>
        <p>
          Own¹G H Fº In¹G 5 º 9 = msum¹F hGiº ! Own¹ 5  H 9 º
F :: STR¹B 1 Gº Loan¹Bº In¹G 5 º Control¹ 5  1º ! Suspicious¹Bº
(
          <xref ref-type="bibr" rid="ref1">1</xref>
          )
(
          <xref ref-type="bibr" rid="ref2">2</xref>
          )
(
          <xref ref-type="bibr" rid="ref3">3</xref>
          )
(
          <xref ref-type="bibr" rid="ref4">4</xref>
          )
(
          <xref ref-type="bibr" rid="ref5">5</xref>
          )
(
          <xref ref-type="bibr" rid="ref6">6</xref>
          )
(
          <xref ref-type="bibr" rid="ref7">7</xref>
          )
(
          <xref ref-type="bibr" rid="ref8">8</xref>
          )
(
          <xref ref-type="bibr" rid="ref9">9</xref>
          )
(
          <xref ref-type="bibr" rid="ref10">10</xref>
          )
Control. Represented in Rule (
          <xref ref-type="bibr" rid="ref10">10</xref>
          ), the suspiciousness degree of B depends on the
probability of G controlling (Control) 1. To this end, Rules (
          <xref ref-type="bibr" rid="ref4 ref5 ref6">4-6</xref>
          ) define control with a
broadly accepted formulation, also present in logic programming contexts [10]:
        </p>
        <sec id="sec-3-1-1">
          <title>A company (or a person/family) G controls a company H, if: (i) G directly owns more than</title>
          <p>
            50% of H (Rule (
            <xref ref-type="bibr" rid="ref5">5</xref>
            )); or, (ii) G controls a set of companies that jointly (i.e., summing the
share amounts), and possibly together with G, own more than 50% of H (Rule (
            <xref ref-type="bibr" rid="ref6">6</xref>
            )).
Moreover, Rule (
            <xref ref-type="bibr" rid="ref7">7</xref>
            ) extends the notion of control with the simplifying assumption that
the CEO of a company has full control over it. Rule (
            <xref ref-type="bibr" rid="ref8">8</xref>
            ) accumulates direct and indirect
ownerships that G exerts on H, along all possible ownership paths. In our case, individual
G does not control Acme Bank: G is actually concealing control through his/her family.
Family Relationships. Let us consider Rules (
            <xref ref-type="bibr" rid="ref1 ref2 ref3">1-3</xref>
            ). Rule (
            <xref ref-type="bibr" rid="ref2">2</xref>
            ) states that every individual
belongs to a family, his/her own. Rule (
            <xref ref-type="bibr" rid="ref3">3</xref>
            ) merges families 51 and 52 whenever they
contain two spouses, 81 and 82. The overall effect is clustering the person space.
          </p>
          <p>
            Family relationships are detected by Rule (
            <xref ref-type="bibr" rid="ref1">1</xref>
            ). It contains a specialized machine
learning model for link prediction (denoted by the #sim embedded function). It takes
as input the features of 81 and 82 and returns a score ? measuring how likely 81 and
82 are spouses. Rule (
            <xref ref-type="bibr" rid="ref1">1</xref>
            ) produces Spouses facts with a probability depending on ?.
In our case, let %1 (in Figure 2) be the suspicious individual’s partner. The family also
contains %2, %3 and potentially more people. Knowing the family members, we can
determine the overall relationship of 5 with Acme Bank. To this aim, Rules (
            <xref ref-type="bibr" rid="ref9">9</xref>
            ) aggregates
ownership amounts originating from different family members.
          </p>
          <p>
            Overall Pattern. %2 directly owns 034 of My Bank and %1 indirectly owns 021 =
1 093 023 of My Bank (by Rule (
            <xref ref-type="bibr" rid="ref8">8</xref>
            )). In total, 5 controls My Bank owning 055 of
the shares. My Bank, in turn, controls Acme Bank holding with 0.52 of the shares via a
pyramidal shareholding structure, probably set up to obfuscate the connection between
the two companies. In conclusion, family 5 controls Acme Bank.
          </p>
          <p>
            Now we have all the ingredients to apply Rule (
            <xref ref-type="bibr" rid="ref10">10</xref>
            ). While G is not literally the UBO
of Acme Bank, we have that his/her family as a whole is. Therefore we conclude there
is actual suspicion G is perpetrating money laundering by justifying unclean money with
a fake loan from 1, a bank he/she controls (and therefore can force to issue the loan).
The overall confidence in this conclusion depends on the certainty ? in the existence of
the personal relationship — the output of a link prediction model — as well as on the
intrinsic reliability F of the money laundering pattern.
          </p>
        </sec>
      </sec>
      <sec id="sec-3-2">
        <title>Discussion of Real and Artificial Cases, and Performance. We tested this kind of</title>
        <p>tasks in a VADALOG system instance running on a memory-optimized virtual machine
with 16 cores and 64 GB RAM (Intel Xeon architecture). The evaluation of one single
case in the real Italian company KG requires 420 seconds, averaged over 100 runs.
Elapsed times are compatible with production use of the solution. A massive execution
on the real KG, in search of all the cases respecting the same laundering pattern
successfully individuated 1365 cases having a suspiciousness score of at least 08, in 1600
seconds. Evaluating accuracy of the specific suspiciousness scoring model adopted in this
example is out of the scope of our discussion. Assessing accuracy of STR scores is
controversial and usually built as a comparison against the human analyst’s performance.
Nevertheless, as common in unsupervised settings, automated decisions often improve
human performance, finding new unseen patterns or defusing others. This makes
accuracy evaluation even more challenging and matter of dedicated studies.</p>
        <p>The core complexity element affecting reasoning times lies in the number of
“ownership paths” connecting companies and individuals. In order to assess the scalability
of our approach, we developed a graph generator able to build networks with the same
topological characteristics as the real KG: It adopts a variant of the Baraba´si–Albert
model [2] for directed scale-free networks, with parameters fitted from the real KG. In
the generation of the graph, the attachment likelihood tuning has been used to generate
instances of increasing density, while keeping the other characteristics stable.
Quantitative features have been generated by sampling from appropriate distributions, also fitted
from the real KG (e.g., a Beta distribution for company shares). With this tooling, we
have built 8 artificial cases showing that ownership paths can be evaluated in less than
20 seconds for graphs with 1M nodes and density similar to the real one. For graphs
much denser than the real-world financial networks, elapsed time grows to 3000
seconds for the same number of nodes. Execution time is polynomially affected by the
number of nodes, e.g., with 4600 seconds for a 28M nodes graph (much larger than
the real one) having realistic density. In conclusion, the solution is highly scalable and
ready to support even multi-national KGs, e.g., at European level, which are comparable
in number of nodes yet have dramatically lower density than our synthetic cases.
4</p>
      </sec>
    </sec>
    <sec id="sec-4">
      <title>Challenges and Opportunities for Rule-Based AML</title>
      <p>
        Let us now extend our discussion and deal with what we consider the most relevant
research, technological challenges and opportunities for a rule-based view of AML.
Distributed Reasoning. End-to-end AML processes involve the cooperation of
different FIUs and intermediaries (e.g., within the European FIU.net4). Processes should be
designed as distributed reasoning tasks: At FIU level, an overall scheduling of AML
activities based on STR and predicate offence scores could be performed, so as to
concentrate computational resources only (or first) on the most relevant cases. FIUs and
intermediaries (and law enforcement agencies in the longer term) would cooperate in the
4https://ec.europa.eu/home-affairs/e-library/glossary/fiunet en
execution of Tasks (
        <xref ref-type="bibr" rid="ref1 ref2">1-2</xref>
        ) to converge to AML decisions with a global/local perspective.
In particular, reasoning tasks should span multiple KGs, deployed at and maintained
by the different actors. Reasoning should be performed as coordinated sub-tasks, each
local to its respective data shard. For example: an intermediary could trigger suspicion
assessment before issuing a transaction; then, this process, would in turn activate the
respective suspicion assessment and suspicious offence determination on the FIU side.
Trust, Information Sharing and Data Integration. Distributed reasoning would
sustain trust thanks to a form of reasoning locality with shared processes and
intermediary/FIU-level EDBs. This would overcome, for example, the need for the FIUs to retrieve
and store transaction data from the intermediaries or to share privileged intelligence
information with one another. On the other hand, the approach would encourage actors to
share IDBs, e.g., in the form of AML criteria or patterns, so fostering standardization
and reproducibility of checks. Moreover KGs should contribute to the construction of
an integrated information asset for intermediaries and FIUs, to standardize compliance
checks and contrast the proliferation of diverse implementations of the various tasks.
Data Wrangling: Building the EDBs. Data wrangling is the construction of the EDBs
from the various sources involved in AML such as transaction data, enterprise stores,
business registers, KYC profiles, and requires the solution to non-trivial data
management problems such as entity resolution [12], data fusion [15], natural language
processing algorithms for unstructured sources [26], etc. These tasks can be specified in
the form of reasoning rules in VADALOG, a very effective lingua franca for data
wrangling [22,29], with a a solid history in the data management community [17,23].
Computing Analytics. For tactical and strategic planning of AML activities, the
availability of aggregate analytics is fundamental. VADALOG benefits from recent
extensions to recursive logic formalisms, namely monotonic aggregations in Datalog that
support queries and reasoning about the number of distinct variable assignments
satisfying specific goals and conjunction of goals [35]. It is our experience that typical AML
aggregate indicators can be expressed by such formalisms, which support scalable
implementations with limited memory footprint.
      </p>
      <p>Finding seen and unseen Money Laundering Patterns. Graph database technology
lacks sufficient expressive power to capture many known money laundering patterns
as, e.g., RPQ-based languages [9] do not handle full recursion; also, as they do not
support ontological reasoning, patterns can be matched only on a case-by-case basis,
with an unaffordable proliferation of queries. KGs represent a very good opportunity to
industrialize pattern detection, which should be modeled in the form of reasoning rules
of the intensional component. VADALOG is a good choice to represent any pattern,
thanks to high expressive power, scalability and full explainability.</p>
      <p>In order to keep up with the evolving pace of financial crime, we need to rely on
self-adapting reasoning rules, robust and able to generalize unseen patterns as well.
VADALOG copes with these requirements. First, the support for intensional predicates,
existential quantification and, more generally, full ontological reasoning enables
automatic interaction of seemingly unrelated domain areas to detect unforeseen illicit
situations. Second, the possibility to embed machine learning models allows to detect fuzzy
patterns and limit the proliferation of special cases. Reasoning can also be used to
implement scalable and explainable clustering to group the entities (e.g., the suspicious
transactions) according to their features or topological role in their network. Vice versa,
reasoning can be operated inside clusters calculated with standard techniques (e.g.,
kmeans) to perform fine-grained comparisons. Another promising technique for unseen
patterns is link analysis [11], consisting in establishing connections between entities
(individuals, transactions, etc.) and using them to assess suspiciousness.
Usability and Effectiveness. VADALOG embodies many usability characteristics [24]:
plainess, as it is based on the basic Datalog syntax; simplicity, as facts can be seen as
database tuples; modularity, as rules do not rely on any form of compilation dependency
or procedural ordering. Practical adoption in AML shows VADALOG to be a very
compact formalism, able to encode in tens of rules, thousands of lines of procedural code.
The semantics, highly based on first-order logic, is intuitive also for non-IT domain
experts and the use of recursion is easily grasped as a form of inductive definitions.
We observed high appreciation for the presence of inductive definitions involving
existentials and aggregations, traditionally absent in domain-specific languages of financial
and statistical realms. Although the development of complex cases may require the
support of “VADALOG engineers”, the language sparks users’ interest in understanding core
business details, with reduced IT costs, especially w.r.t. non-declarative technology.
Scalability. VADALOG offers a transparent and safe approach to scalability. When only
core features are used (we are in the Warded Datalog core), the language guarantees
polynomial complexity, suitable to the majority of AML use cases. For ultra-scale
scenarios, VADALOG trades minor syntactic restrictions (rules are in the Piecewise Linear
Warded Datalog [8] fragment) for high parallelizability. The adoption of the full range
of advanced features, may come at the cost of higher complexity.</p>
      <p>Handling Uncertainty. Mutually connected levels of uncertainty are involved in AML
reasoning to define the similarity of patterns, the suspiciousness level of a transaction or
the likelihood of a predicate offence, etc. VADALOG can handle uncertainty primarily
with probabilistic reasoning [6]: Weights can be used to specify importance of rules;
specifically, they are parameters of log-linear models defining the marginal
probability of the resulting facts. Embedded machine learning models, e.g., for graph
embeddings [25], are also supported and can provide input facts to or receive training data
from the rules (see learning bus in Figure 1) in hybrid deductive/inductive reasoning.
Taking Ethical Decisions. Dealing with AML in a global perspective poses
non-negligible ethical and legal issues in that one individual’s subnetwork should be inspected
only as a consequence of explicit suspicion. By contrast, some techniques (e.g., social
network analysis [13,34]) move from emerging statistical evidence and then focus on
specific subjects as a consequence. This behaviour can be considered intrusive
misconduct for a FIU and rarely produces arguable evidence in judicial follow-ups. AML
approaches based on reasoning on KGs overcome these difficulties by operating in a
query driven fashion [7]: The traversal of the KG is driven by specific goal of the AML
task and the portion of the graph that is actually analyzed is the minimal expansion of
the suspicious individual/bank/transaction vicinity.
5</p>
    </sec>
    <sec id="sec-5">
      <title>Related Work</title>
      <p>Logic-based KGs and VADALOG are fully covered in [5,7]; recent works already delve
into practical applications [1] and KG architecture [4]. An interesting recent collection
of KG use cases, under diverse perspectives, is provided by Toma et al. [19].</p>
      <p>The most comprehensive survey on AI approaches to AML can be found in Chen et
et al. [11], where they focus on machine learning techniques, including supervised [34]
and unsupervised [30] algorithms, graph deep learning [37] and NLP [26]. Most of
machine learning approaches proposed in the AML literature suffer from some
limitations [11]: classification exhibits affordable performance only for medium datasets
and suffer from slow training; approaches based on fuzzy logic capture specific
statistical models and require intensive human work for rule writing [11]; neural approaches
suffer from low explainability, which makes them hardly applicable for a FIU. Such
patterns need to be carefully balanced with inductively learned patterns.</p>
      <p>Finally, the related field is social network analysis on money laundering data has
the primary objective of computing emerging statistical properties that are specific
measures referring to the network as a whole [13,34].
6</p>
    </sec>
    <sec id="sec-6">
      <title>Conclusion</title>
      <p>Money laundering is a significant financial risk for intermediaries and a severe threat for
economies, governments and ultimately for personal wealth and freedom. The potpourri
of rising AI techniques for AML too often neglect domain experience and fail to address
requirements of relevance to FIUs. With this paper, we wish to share our experience in
making tangible actions to combat money laundering with AI: We aim to systematize
and stimulate the research debate by offering a unifying framework for explainable
AML. Logic-based KGs are the right means towards a holistic approach, balancing the
power of the inductive techniques, with the brilliancy of top-level financial analysis.
Acknowledgements. This work was supported by EPSRC programme grant EP/M025268/1, the
EU H2020 grant 809965, and the Vienna Science and Technology (WWTF) grant VRG18-013.
12. Christen, P.: Data Matching Entity Resolution, and Duplicate Detection. Springer (2012)
13. Colladon, A.F., Remondi, E.: Using social network analysis to prevent money laundering.</p>
      <p>Expert Syst. Appl. 67, 49–58 (2017)
14. Dias, L.F.C., Parreiras, F.S.: Comparing data mining techniques for anti-money laundering.</p>
      <p>
        In: SBSI. pp. 73:1–73:8. ACM (2019)
15. Dong, X.L., Naumann, F.: Data fusion - resolving data conflicts for integration. PVLDB 2(
        <xref ref-type="bibr" rid="ref2">2</xref>
        ),
1654–1655 (2009)
16. European Parliament: Directive (eu) 2018/843 of the european parliament and of the council.
      </p>
      <p>https://bit.ly/3gWZYFX (2018), [Online; accessed 17-Jan-2020]
17. Fagin, R., Kolaitis, P., Miller, R., Popa, L.: Data exchange: Semantics and query answering.</p>
      <p>In: ICDT (2003)
18. FATF: Transparency and Beneficial Ownership. https://bit.ly/2UklJWj (2016), [Online;
accessed 17-Jan-2020]
19. Fensel, D., Simsek, U., Angele, K., Huaman, E., Ka¨rle, E., Panasiuk, O., Toma, I., Wahler,</p>
      <p>J.U..A.: Knowledge Graphs - Methodology, Tools and Selected Use Cases. Springer (2020)
20. Financial Intelligence Unit for Italy: Rapporto annuale 2018. https://bit.ly/3fwYH6W
(2019), [Online; accessed 19-Jun-2020]
21. Fincen: History of AML Laws. https://bit.ly/2AMlNau (2015), [Online; accessed
17-Jan2020]
22. Furche, T., Gottlob, G., Neumayr, B., Sallinger, E.: Data wrangling for big data: Towards a
lingua franca for data wrangling. In: AMW (2016)
23. Golshan, B., Halevy, A.Y., Mihaila, G.A., Tan, W.: Data integration: After the teenage years.</p>
      <p>In: PODS. pp. 101–106. ACM (2017)
24. Gottlob, G., Pieris, A.: Beyond SPARQL under OWL 2 QL entailment regime: Rules to the
rescue. In: IJCAI. pp. 2999–3007 (2015)
25. Grover, A., Leskovec, J.: node2vec: Scalable feature learning for networks. In: KDD (2016)
26. Han, J., Barman, U., Hayes, J., Du, J., Burgin, E., Wan, D.: Nextgen AML: distributed deep
learning based language technologies to augment aml investigation. In: ACL (2018)
27. Huang, S.S., Green, T.J., Loo, B.T.: Datalog and emerging applications. In: SIGMOD (2011)
28. International Monetary Fund: World economic outlook, april 2019. https://bit.ly/3cKyuzL
(2019), [Online; accessed 17-Jan-2020]
29. Konstantinou, N., Abel, E., Bellomarini, L., Bogatu, A., Civili, C., Irfanie, E., Koehler, M.,
Mazilu, L., Sallinger, E., Fernandes, A., Gottlob, G., Keane, J.A., Paton, N.W.: VADA: an
architecture for end user informed data preparation. J. Big Data 6, 74 (2019)
30. Larik, A.S., Haider, S.: Clustering based anomalous transaction reporting. In: WCIT. vol. 3,
pp. 606–610. Elsevier (2011)
31. Oeben, M., Goudsmit, J., Marchiori, E.: Prerequisites and ai challenges for model-based
anti-money laundering. In: IJCAI 2019 Workshop (2019)
32. Raedt, L.D., Kersting, K., Natarajan, S., Poole, D.: Statistical Relational Artificial
Intelligence: Logic, Probability, and Computation. Synthesis Lectures on AI and machine learning,
Morgan &amp; Claypool (2016)
33. Refinitiv: Innovation and fight against financial crime. https://www.refinitiv.com/en (2019),
[Online; accessed 17-Jan-2020]
34. Savage, D., Wang, Q., Zhang, X., Chou, P., Yu, X.: Detection of money laundering groups:</p>
      <p>Supervised learning on small networks. AAAI Workshops (2017)
35. Shkapsky, A., Yang, M., Zaniolo, C.: Optimizing recursive queries with monotonic
aggregates in deals. In: ICDE. pp. 867–878 (2015)
36. Weber, M., Chen, J., Suzumura, T., Pareja, A., Ma, T., Kanezashi, H., Kaler, T., Schardl,</p>
      <p>C.E.L..T.B.: Scalable graph learning for aml: A first look. CoRR abs/1812.00076 (2018)
37. Weber, M., Domeniconi, G., Chen, J., Weidele, D.K.I., Bellei, C., Robinson, T., Leiserson,
C.E.: Anti-money laundering in bitcoin: Experimenting with graph convolutional networks
for financial forensics. CoRR abs/1908.02591 (2019)</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <surname>Atzeni</surname>
            ,
            <given-names>P.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Bellomarini</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Iezzi</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Vlad</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          :
          <article-title>Weaving enterprise knowledge graphs: The case of company ownership graphs</article-title>
          .
          <source>In: EDBT</source>
          (
          <year>2020</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <string-name>
            <surname>Barabasi</surname>
            ,
            <given-names>A.L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Albert</surname>
            ,
            <given-names>R.</given-names>
          </string-name>
          :
          <article-title>Emergence of scaling in random networks</article-title>
          .
          <source>Science</source>
          (New York, N.Y.)
          <volume>286</volume>
          ,
          <fpage>509</fpage>
          -
          <lpage>12</lpage>
          (11
          <year>1999</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          3. Basel Institute on Governance:
          <source>AML Index</source>
          <year>2018</year>
          . https://bit.ly/2Yd3ray (
          <year>2019</year>
          ), [Online; accessed 17-Jan-2020]
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <string-name>
            <surname>Bellomarini</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Fakhoury</surname>
            ,
            <given-names>D.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gottlob</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          :
          <article-title>Knowledge graphs and enterprise AI: the promise of an enabling technology</article-title>
          .
          <source>In: ICDE</source>
          . pp.
          <fpage>26</fpage>
          -
          <lpage>37</lpage>
          . IEEE (
          <year>2019</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <string-name>
            <surname>Bellomarini</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gottlob</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Pieris</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
          </string-name>
          , E.:
          <article-title>Swift logic for big data and knowledge graphs</article-title>
          .
          <source>In: IJCAI</source>
          (
          <year>2017</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <surname>Bellomarini</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Laurenza</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sherkhonov</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          :
          <article-title>Reasoning under Uncertainty in Knowledge Graphs (to appear)</article-title>
          . In: RuleML+RR (
          <year>2020</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7.
          <string-name>
            <surname>Bellomarini</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gottlob</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          :
          <article-title>The vadalog system: Datalog-based reasoning for knowledge graphs</article-title>
          .
          <source>PVLDB</source>
          <volume>11</volume>
          (
          <issue>9</issue>
          ),
          <fpage>975</fpage>
          -
          <lpage>987</lpage>
          (
          <year>2018</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          8.
          <string-name>
            <surname>Berger</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gottlob</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Pieris</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sallinger</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          :
          <article-title>The space-efficient core of vadalog</article-title>
          .
          <source>In: PODS</source>
          . pp.
          <fpage>270</fpage>
          -
          <lpage>284</lpage>
          . ACM (
          <year>2019</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          9.
          <string-name>
            <surname>Bonifati</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Fletcher</surname>
            ,
            <given-names>G.H.L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Voigt</surname>
            ,
            <given-names>H.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Yakovets</surname>
            ,
            <given-names>N.: Querying</given-names>
          </string-name>
          <string-name>
            <surname>Graphs</surname>
          </string-name>
          .
          <source>Synthesis Lectures on Data Management</source>
          , Morgan &amp; Claypool (
          <year>2018</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10.
          <string-name>
            <surname>Ceri</surname>
            ,
            <given-names>S.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gottlob</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Tanca</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          :
          <article-title>Logic programming</article-title>
          and databases. Springer (
          <year>2012</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <string-name>
            <surname>Chen</surname>
            ,
            <given-names>Z.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Khoa</surname>
            ,
            <given-names>L.D.V.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Teoh</surname>
            ,
            <given-names>E.N.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Nazir</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Karuppiah</surname>
            ,
            <given-names>E.K.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Lam</surname>
            ,
            <given-names>K.S.:</given-names>
          </string-name>
          <article-title>Machine learning techniques for AML solutions in STR detection: a review. K. Inf</article-title>
          . Syst.
          <volume>57</volume>
          (
          <issue>2</issue>
          ),
          <fpage>245</fpage>
          -
          <lpage>285</lpage>
          (
          <year>2018</year>
          )
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>