AML feature engineering: what data actually flags laundering

Three ways to see it

1. 1

   A feature is a number derived from raw data that the model can learn from. The raw data in a Pakistani bank looks like rows in a transactions table: account number, timestamp, amount, channel, counterparty account, counterparty bank, narration. None of those raw columns by itself tells you fraud is happening. The signal lives in derivations: how many distinct counterparties has this account transacted with in the last 30 days, what is the standard deviation of transaction amounts in the last week, how concentrated is the account's geography by IP or branch, how does the current week compare to this account's own 90-day baseline. Each derivation is a feature. Modern AML models work on hundreds to low thousands of such features.

2. 2

   Feature families that have proven robust across Pakistani retail and SME monitoring fall into six groups. Velocity features count actions per unit time, like transactions per hour or unique counterparties per week. Aggregation features sum or average over windows, like total inflow in last 7 days or median amount in last 30 days. Ratio features divide one quantity by another, like inflow-to-outflow ratio or actual-versus-declared turnover ratio. Distance features measure how far the current event is from a baseline, like z-score of today's amount against the account's own 90-day mean. Diversity features measure spread, like number of distinct counterparty banks or entropy of transaction-hour distribution. Network features describe the position of the account in the wider graph of accounts, which lesson 6 covers in depth.

3. 3

   Raast and 1Link have introduced features specific to Pakistani peer-to-peer rails. Structuring detection became important the day Raast removed the friction of frequent small transfers. Useful Raast-specific features include: transactions in the last hour rounded just below the daily limit divided by total daily transactions, distinct mobile-number counterparties in the last 24 hours, fraction of counterparties whose accounts are less than 90 days old, and the entropy of receiving banks (a wide spread is more suspicious than concentration with one familiar bank). Mobile-money rails like JazzCash and Easypaisa add features around CNIC-to-account mapping and SIM-change recency, both of which the SBP has signalled in its 2025 supervisory guidance as priority risk indicators.

The why-tree

Try this with Claude

AI-edge prompt: 'I have account-level Raast and IBFT transaction data for one Pakistani retail bank for 90 days, schema attached. Suggest 25 candidate features for an XGBoost AML model, grouped into the six families velocity, aggregation, ratio, distance, diversity, and network. For each feature, give me the SQL or pseudocode, the expected fraud signal it captures, and the latency tier required: real-time, near-real-time, or batch.' Review the model output with your data engineer.