Financial crime perpetrators use many different and sophisticated types of schemes, techniques and transactions to accomplish their goals. However, for a large class of financial crimes, such as doing harm to a company, they cannot escape a powerful principle: illegal proceeds have to return to or be under control of managers to achieve a personal gain. This circular flow of transaction attributes is characteristic of another type of financial crimes: such as a VAT carousel or a Polish fuel mafia scheme. In this work we propose a minimal model of descriptions of a doing harm to a company crime, combined with money laundering. Such a model uses sufficient ontology to build evidence and assign legal qualifications to criminal activities and nothing more. The scheme can be described by using 8 layers of concepts and relations that follow in logical order of uncovering a crime. For example, on the first level that describes money transfers there are only 6 parameters necessary assuming that certain operations can be grouped. Using conceptual graphs with subsumption and negation operations, one can reason on people involvement in a crime and choose between strategies of building a case. The model captures over 90% of relevant information for a typical use case of issuing fictitious invoices, the so called Hydra case and is able effectively reason over relevant facts, which means that legal qualification for this case is basically correct. To what extent the model can be generalized to more complex schemes will be a subject of a further study.
1.1
Financial Crimes
Money laundering (ML) as a criminal activity accompanying most serious crimes
is seriously undermining economic and social order. There are many schemes
of complex nature that are recognized by FATF [
This approach is preliminary and limited, but provides an essential model
for evidence building of a very important class of financial crimes: among them
money laundering and acting to a harm to a company. Our approach is an
extension of an approach used by Badia and Kantardzic [
Data and Red Flags Used in Financial Crime Investigations The analysis begins with information from banks on suspicious operations symptoms of financial crimes (red flags) - that are transferred to countries’ Financial Intelligence Units (FIUs). The common red flags detected by financial institutions and designated non-financial businesses and professions using data mining of transaction records are: – Unconventionally large currency transactions, particularly in exchange for negotiable instruments or for the direct purchase of fund transfer services; – Apparent structuring of transactions to avoid identification requirements or regulatory record-keeping and reporting thresholds; – Introduction of a client by an overseas associate or financial institution based in a country or jurisdiction known for drug trafficking and production, other financial crimes and ”bank secrecy”.
FIUs employ data mining techniques of suspicious activity patterns (over 750
in case of the Polish FIU - GIIF). These employ rule-based systems, customer
profiling, and statistical techniques [
We define concepts only to the level necessary to ask questions and reason on the main mechanisms of financial crimes. We assume from the start that we capture 80-95% of relevant knowledge - but this type of knowledge will be universal. In some cases deciding whether a work has been done or not is left to a human. Although less ambitious, such a procedure opens a provision of using an opinion of an expert (i.e. expert accountant). The class of crimes we consider is presented in Fig. 1 (modeled after a real case, the so called Hydra case with real data).The fraudulent scheme is based on invoicing work not done.
The CEO of company A subcontracts construction work which the company A does itself. The work is then consecutively subcontracted though a chain of phony companies. Each of them is getting a commission for money laundering and commits that contracted work has been done with fictitious statements. At the end of a chain an owner of a single person company D attempts to withdraw cash, and there is a suspicion that this cash reaches ”under the table” the management of company A (possibly through a trusted intermediary, here associated with company C). People associated with company D may not know full details of a case. In this scenario money leaves companies and goes to physical persons.
The knowledge base (KB) is modeled at several (here 8) levels to describe a mechanism of crime, that are presented in Section 3.
The concepts come in a hierarchy according to a prevailing mode of gathering data. 3
The facts for a case we analyze (the Hydra case) can be presented in 7 pages of a natural language text. This case is one of the easiest for which we have data (only 4 companies and 10 people involved) but contains all elements of the financial crime mechanisms. The full analysis is beyond the scope of the paper, however, in the minimal model the first 3 layers are described by the following top level concepts:
General concepts related to layers 1-3: – General Flow (From Entity, To Entity, Date, Flow), – Flow (Money Transfer, Invoice, Work/Service).
Specifically layer 1 concepts are modeled as follows: – MoneyTransfer (From Entity, To Entity, Method of Transfer, Date, Value,
Title of transfer, i.e. for Work, registered/unregistered) – MethodOfTransfer (Electronic transfer, Cash) – ElectronicTransfer(Account1, Account2) – Account (Time of setting, History) The unregistered transfer could be cash or a transfer to tax heavens banks. We model the remaining layers in a similar way (to be presented in future publications). At each level we assign concerns, and type of analysis. Answers to questions infer assignment of relevant penalty as sanctioned by articles of the Polish Penal Code (”Kodeks Karny” in Polish).
In this Section we show details of modeling and data querying for layers 1-3. The source of data is twofold: structured documents, eg. Excel or Calc spreadsheets containing flows data and additional, manually entered data about persons and companies. That data is stored in relational database and is further converted to Conceptual Graphs relations.[13, 14]. We use elements of graph theory to effectively process and query details of financial data. Our goal is to find suspicious behavior, described by patterns (discussed later). There are three basic parts in our system: a knowledge base, a set of rules and a set of patterns. The knowledge base contains facts about companies: their cash flow, invoice flow, work or goods flow and related physical persons. Facts are represented by entity nodes connected with relation nodes. Fig. 2 contains visualization of a fragment of knowledge base. Formally, we can describe Fig. 2 with a formula:
KB = MoneyTransfer(CompanyA, CompanyB, 01.02.2007, ”Invoice no 18/07”, 500000) Nodes can be typed such as Company, Transfer, Person and other. This kind of data description is an extension of conceptual graphs [13] that preserves its soundness and decidability. We use simple query and ontological constructs (subsumption and negation) that are needed for our data analysis and computing crime qualifications. Knowledge base can contain thousands of facts about transactions and for our analysis the crucial thing is the transaction flow. Such flows can be described by rules of form as in Fig. 3. The main part of a rule is a pattern, which can contain variables. Pattern can be complemented with additional variable constraints (date d1 is earlier than d2). Rule in Fig. 3 states that if a company transfers money to another company, and that company transfers later the same amount of money to a third company, then the middle company acts as a broker and in fact the first company transfers money to the third company (minus a provision). This pattern can be easily extended to include more intermediary companies, as shown in Fig. 4. Application of such rules to the KB produces a web of transfers and shows the real starting and ending points of a money flow. Presented transitive rules can be set to include only transfers above minimum value or within a period of time. For the sake of clarity we used simple less and equal operators to compare dates and values, but in fact they can be far more complex. We developed sophisticated algorithms that can aggregate small transfers (technique often used to disguise real money flow), not discussed here. One of patterns that exploits such a transitive use of broker companies is money laundering where additional physical persons and unregistered money transfer are involved. Such a pattern is shown in Fig. 5: Transfer from one person to another can also be more complex and involve intermediary persons.
After applying specified rules to the KB, the crime detection phase takes place. In this phase we try to find homomorphism between data collected in KB and defined crime patterns. Our computational machinery searches for crime symptoms described by a pattern (like VAT fraud or money laundering). Data sets that are closest to match the pattern are presented to a user. At this level the user can judge probability of crime and provide additional data, such as bank transfers and invoices from other companies that look suspicious, or data from expert analysis (e.g. that work or service was fictitious). System works in cycles: data input, analysis, propositions of directions of further investigation. After gathering enough information additional functionality is triggered, that is a crime qualification for humans involved. The qualifications are proposed based on roles persons play in a discovered crime schema. In this paper we have presented a computational background and an use case of our tool that is still being developed. Although it is not fully completed yet, we have obtained first promising practical results. The success is due to several reasons: 1. Guidance of legal experts as to legal procedures and crime schemes [12]. 2. Existence of an invariant in the scheme (the cycle of money transfers). 3. The minimal model description.
The first feature bootstraps relevant questions. The second one introduces clarity
to a description, at a price of some decrease of power of expression. The problem
with complete ontologies is that a formulation relevant questions becomes very
difficult [
Acknowledgments. Our research is supported by the Polish Ministry of Science and Higher Education, Polish Technological Security Platform grant 0014/R/2/T00/06/02. We thank drs. J. Cybulka and Jacek Martinek; and Mr. Z. Wieckowski and Mr T. Dela for guiding information and discussions. 12. Wieckowski J.: Regional Prosecutors Bureau in Katowice, Poland, private communication, February-May 2008. 13. Chein M., Mugnier M., Graph-based Knowledge Representation Computational
Foundations of Conceptual Graphs, Springer London 2008 14. Allemang D., Hendler J.: Semantic Web for the Working Ontologist: Effective Modeling in RDFS and OWL, Morgan Kaufmann Publishers 2008