Peer group behaviour outliers
Unsupervised scoring that compares an account's activity against its peer segment to surface emerging laundering patterns before any rule or label exists for them.
Discovery, not a referral queueTechnique: Anomaly Detection
Peer group behaviour outlier detection earns its place when the concern is a laundering pattern nobody has written a rule for yet, which is exactly the gap typology rules and triage scoring both share.
It compares each account against others like it, so an account whose wire velocity, counterparty diversity, or cash mix diverges sharply from its peer segment gets surfaced even though no rule was written for it and no SAR history taught a model to expect it.
Route its output to a discovery queue that a financial crime analyst works separately from the investigator referral queue, since low precision here is expected and normal rather than a sign the method has failed.
Its real value shows up downstream, when a confirmed new pattern, such as a cluster of accounts opened within days of each other and used briefly to receive and forward funds, becomes a new typology rule or a new labelled example for triage scoring.
It is the wrong tool when the goal is a defensible basis for a specific SAR filing, because an outlier score alone gives an investigator no typology to cite in the filing memo.
Strengths for this problem
- Finds emerging patterns, such as a new mule recruitment script or an unusual cluster of accounts receiving and forwarding round-dollar wires, before any rule has been written for them.
- Needs no confirmed SAR history, so it works even where disposition recording is immature.
- Generates candidate accounts worth escalating to investigators, whose confirmed findings become new typology rules or new training examples for triage scoring.
Limitations for this problem
- An unusual account is not the same as a laundering account, so precision in the flagged tail is typically low.
- Explaining why an account scored as an outlier takes real analyst work, since the score does not name a typology the way a fired rule does.
- Sensitive to how peer segments are defined; comparing a high-cash retail business against a professional services peer group manufactures false outliers.
Data needed
- A stable, correctly segmented peer population, grouped by business type, geography, and account tenure, to define what normal activity looks like.
- Transaction velocity, counterparty diversity, and channel mix, consistently captured across the comparison population.
- KYC-stated expected activity, to check observed behaviour against what the customer told the bank at onboarding.
How it is measured
- Precision of the reviewed tail once investigators close out the escalated accounts.
- Rate of genuinely novel typologies discovered that neither existing rules nor the triage score had captured.
- Overlap between outlier flags and accounts already alerted by typology rules, to confirm it is adding something new rather than duplicating.
Pitfalls
- Routing outlier flags straight into the investigator referral queue as if they were confirmed alerts, which floods it with low-yield reviews and erodes trust in every other flag.
- Segmenting peer groups too broadly, for example scoring money service businesses and standard retail accounts together, which manufactures outliers out of ordinary differences between business types.
- Treating a persistently high outlier rate in one segment as solved by retuning the model, when it usually signals a KYC data quality problem in that segment.
Human oversight
A financial crime analyst reviews outlier accounts as a discovery exercise, decides which represent a genuinely new pattern, and hands confirmed cases to investigators and to the team maintaining the triage scoring labels. Nothing here is escalated to a SAR filing decision automatically.