Why rules cannot keep up: machine learning for transaction monitoring

Three ways to see it

1. 1

   A rule is a single sentence: 'if cash deposit exceeds X, alert.' It is easy to write, easy to audit, and easy to defend in front of an SBP inspector. This is why rules dominated the first generation of AML systems and still form the regulatory floor under SBP's AML/CFT Regulations. The problem is not that rules are wrong. The problem is that any single rule is a one-dimensional cut through a high-dimensional behaviour space. Real fraud lives in combinations: this customer, at this hour, from this device, sending this amount, to this counterparty, in this sequence. Writing a rule for every meaningful combination is combinatorially impossible. By the time you have a hundred rules, no analyst remembers all of them, and the rules begin to contradict each other.

2. 2

   Machine learning, in the AML context, is the practice of letting a model learn the combinations from labelled history. You take the last two years of transactions, you mark which ones were eventually confirmed as fraud or laundering, and you train a model to learn the joint patterns. The model never sees a single rule. It sees, instead, the statistical fingerprint of fraud across hundreds of variables at once. When a new transaction arrives, the model produces a score from zero to one, where one means 'this looks very much like the fraud I have seen before'. That score, not a rule, is what your analyst now triages. The rule engine becomes the safety net for the obvious patterns. The ML score becomes the prioritisation engine for everything else.

3. 3

   There are three families of model relevant to Pakistani transaction monitoring today. Supervised gradient-boosted trees, of which XGBoost and LightGBM are the household names, are the workhorse of card fraud and known-typology AML. They train fast, score in microseconds, and produce feature importance that satisfies SBP model risk reviewers. Unsupervised anomaly detection, including isolation forests and autoencoders, is used where labels are scarce, especially for novel typologies. Graph neural networks, the newest entrant, model the network of accounts and counterparties and are particularly strong on mule rings and trade-based laundering. Most production stacks at top-tier Pakistani banks today combine supervised tree models for known fraud with unsupervised models for drift detection.

The why-tree

Try this with Claude

AI-edge prompt: 'Here is a list of my bank's top 30 AML alerting rules with their volumes, precisions, and last-reviewed dates. Recommend which to retire, which to retune, and which to replace with an ML model. For each retire-or-replace recommendation, give me the SBP defensibility argument I would make to my Chief Compliance Officer.' Provide real (anonymised) data and inspect the model's reasoning critically.