Final Report Summary - HEMOLIA (Hybrid Enhanced Money Laundering Intelligence, Investigation, Incrimination and Alerts)
Executive Summary:
HEMOLIA
Hybrid Enhanced Money Laundering Investigation, Intelligence, Incrimination and Alerts
HEMOLIA is a new generation of Investigation and Intelligence System for Anti-Money-Laundering (AML) and Counter-Terrorism-Financing (CTF), which in addition to the traditional Financial Plane Sources, makes extensive use of modern society Telecom Plane sources, thereby opening up a new dimension of capabilities to Money Laundering Fighters (FIUs, LEAs). Adding the Telecom Plane to the existing Financial Plane improves and changes dramatically AML doctrines, since another dimension is added to the analysis and investigation processes
HEMOLIA, taking into account existing legal frameworks, hybridizes and correlates the financial and telecom planes for creating a richer and more accurate case management tools, as well as generation of alerts and information sharing, both nationally and internationally
P3A-HEMOLIA Global Information Sharing
Significant Money Laundering (ML) activities are usually done across the globe, therefore ML fighters have to collaborate and share information for better intelligence, investigation and incrimination. Being a WEB based system in its nature, HEMOLIA enables secure networking (IPSEC) and global information sharing between FIUs/LEAs in Europe and around the globe in a way that enables each donor FIU/LEA to be a ‘master’ that have full control about the data parameters to share with any recipient country. The shared data formation is usually determined based on bilateral agreements between countries.
HEMOLIA info sharing mechanism and network is called ‘P3A’, which stands for Privacy Preserving Push Alerts (and Reports), meaning that HEMOLIA enables FIUs/LEAs to protect the suspect privacy because of the above two reasons (using IPSEC and a donor which is master). P3A can be implemented in any FIU who has HEMOLIA system in its premises.
Gideon Hazzani – Gideon.hazzani@verint.com
HEMOLIA Project coordinator
Project Context and Objectives:
The overall mission of the HEMOLIA consortium was to research and develop an innovative AML intelligent multi-agent alert and investigation system that will demonstrate the extensive benefits of fusing the Telecom Plane and Financial Plane for the sake of fighting financial crime, fraud and ML. Even deployed in a very strict legal environment (from the point of view of access to financial/telecom data), HEMOLIA represented an innovative approach and raise the level of ML activity detection by performing a deep analysis of the fused Financial/Telecom information.
Today, all FIs run a Commercial Off-The Shelf (COTS) ML alerts application on their financial databases. This application creates a COTS ML alert about any suspicious transaction or customer. The alert must be reported by the FI to the FIU. The FIU may issue (manually or automatically) an investigation warrant against a suspect which will initiate the HEMOLIA processes where analysis and automatic investigation tools are operated in FIs, TOs, Judicial authorities in order to detect all people linked to the COTS alert.
The analysis and auto-investigation products are of 2 different types: (i) P3A alerts represent the ML risk level and warn the FIs and FIUs/LEAs about a specific customer, yet without disclosing any privacy details. Based on the legal research objective, unlike FIs, FIUs/LEAs may receive detailed P3A which includes some customer information. (ii) ML network (of people) built based on hybridization of both financial and telecom information. The P3A alerts are pushed to the FIU and possibly to all FIs and Judicial authorities. The ML network is displayed only to the FIU/LEA upon request. Dashed arrows (4) represent P3A push to FIs and FIUs/LEAs and display of the ML network to the FIU/LEA.
Research Objectives: The research performed in HEMOLIA can be divided into 3 categories:
I. Technological objectives: The technological research was based on the envisaged HEMOLIA architecture composed of two main parts: (i) Data-collection and data-mining from the Financial Plane and from the Telecom Plane and (ii) the HEMOLIA Core Modules which analyzed the Telecom Plane and Financial Plane Data Sources and created enhanced alerts.
II. Legal framework of AML Systems: The legal research included several areas: (i) Telecom Plane Legal Framework and the “Financial Plane Legal Framework” for the different categories of end users (banks and financial institutes, FIUs/LEAs on the other hand) under the existing laws; (ii) Content of the alerts; (iii) Harmonization of the AML related data and boundaries (levels of permission) for access/use of the data by FI’s and LEA/FIUs.
Project Results:
EU AML Legal Framework Definition
• An overview has been given on international norms, including the European Union and national legal norms, relevant for the software to be developed for the HEMOLIA system
• Analysis of the positions of the parties and data streams in relation to the applicable and future law (including Telecom) and has been published
• The role of the Financial Institutions (IFs), of the Financial Intelligence Unit (FIUs) and of the Law Enforcement Authorities (LEAs) Involved in the AML/CTF Field were defined
• The Guidelines for both the ML fighters and the HEMOLIA system were produced
System Architecture
• Architecture and solution principles
• Technology requirements and characteristics
• Security principles and guidelines
• Business functions
• A service model
• A topology model
Analysis, Fusion, Indexing and Hybridisation
• The software components of layer-1 and layer-2 of the HEMOLIA framework were developed
• Adequate algorithms for combining, analyzing and indexing data from different sources were Implemented
Alerts Engine Tool
The IOS (Intelligent Observation System) developed for HEMOLIA is used to obtain alerts in ML/TF (Money laundering/Terrorism Financing). Two IOS alerts have been defined with different purposes:
• Analysis of suspicious transaction reports. Prioritize suspicious reports based on information reported by the suspicious report, information contained in the general repository and information collected by analysts.
• Analysis of reported individuals. Fully supervision on any reported subject, both natural and legal, even if he/she only appears in systematic reporting.
Two algorithms for ML/TF networks have been defined:
• Refinement algorithm. An algorithm to create scores for people with not enough banking data.
This algorithm is based on label propagation techniques. This algorithm let us create suspiciousness IOS scores onto people with few or no banking data.
• MLND algorithm. An algorithm based on SNA community detection algorithms for Money Laundering Network Detection using relationships and bank data. Normally community detection in SNA does not have extra information such as IOS scores or banking data, which means this procedure and developed algorithm is unique.
Clustering in data mining and community detection in graph structures was undertaken using Social Network Analysis theory. Given this introduction to those sorts of techniques, HEMOIA describes different algorithms for Money Laundering
Network Detections using the AIA’s Intelligent Observation System Score which measures the suspiciousness of Money Laundering activities
GUI Investigation Tool
The GUI system tool developed for HEMOLIA helps users to complete initial money laundering alerts, with the goal of detecting and fully uncovering money laundering networks. All available data sources are brought to bear, including financial, telephony, Internet, and any other databases at the disposal of the FIU.
Before the HEMOLIA user is aware, the GUI system analyzes financial data including STRs, CTRs and ETRs. It uses artificial intelligence to go through the vast amount of information to find the needle in the haystack – the persons or organizations that have high potential or risk in money laundering. The GUI system generates alerts regarding the persons and organizations, and also passes on data about the financial networks it has found. In this way, much of the work in identifying suspects and filling out the relevant data is done even before the HEMOLIA user enters into the picture.
Using these alerts and networks from the GUI system, HEMOLIA users utilize the tools in the HEMOLIA user GUI to continue completing the money laundering alerts and networks. The HEMOLIA system includes hybridized profile pages and visual link analysis maps that show the gathered data from the many sources in different slices and from many angles. This leads cyclically to more persons/organizations of interest which expand the investigation until the entire money laundering network is laid bare.
Potential Impact:
Technological Impact:
HEMOLIA is a new generation AML system capable of integrating two powerful sources of information; financial transactions and telecommunication activity. Its technological impact is twofold. On the one hand HEMOLIA generates an intelligent AML alerts system based on financial data that is the basis of future AML systems. On the other hand, the hybridization between financial and telecommunication data analysis is a breakthrough approach to ML prevention and contributes to the technological challenges involved in obtaining and analyzing such data. Other technological fields which HEMOLIA contributes to include the management of very large volumes of heterogeneous data, the integration of different data sources with different formats, the analysis of hybrid information and the generation of automatic reports using hybrid alert information. The main technological challenge was to build the ML network alerts and manage all the individual information in a way that facilitates ML investigation by FIUs.
HEMOLIA enables FIs such as banks, insurance companies, credit card companies, etc. to access the alerts in addition to LEAs and FIs. The ability to access alerts that were originally formed not only based on finance information of their own but also based on telecom information and financial information of other FIs, opens a new dimension of enriched knowledge and brings a new era for AML doctrines. As a by-product, the envisaged HEMOLIA provides commercial FIs a significant enhancement for detecting fraudulent financial activities (another incentive for FIs to use HEMOLIA).
HEMOLIA has a technological impact at the international level by proposing a solution that could connect legal, financial and telecom organizations from different countries and enable the sharing of information and alerts between them and thereby improve the cooperation between countries (FIUs).
This is critical to the success of AML because significant amount of the financial crimes and ML acts are done in several hops between different countries till the final destination.
Socio-economic benefits of HEMOLIA
• Significant Reduction in Criminal Activity and Terrorism
• Raises the Reputation of European Countries Implementing the HEMOLIA AML System
• Raises the Integrity of Individual FIs Implementing HEMOLIA
• Enhanced Stability of FIs
• Reduces Operational Risk
• Reduces Legal Risks for an FI
• Reduces Legal Risks for an FI
• Reduces Concentration Risk for an FI
Economic Benefits
• Increases Stability of a Country’s Financial Sector and of Individual Financial Institutions
• Increases Economic Growth
Main Dissemination activities and exploitation results
Over the course of the HEMOLIA project, several dissemination events were undertaken:
• Participation in numerous scope related events (EGMONT, MILIPOL)
• Publications in various magazines
• Development of training materials
• Project workshops:
1st Workshop:
“The Financial Intelligence Units’ Workshop: Defining End Users’ Requirements on HEMOLIA in the EU Legal Framework” was performed, which took place in Bran, Romania on October 24-25, 2011. During the workshop the general objectives of the HEMOLIA Project were presented and a discussion was held on how the FIUs could use a system like HEMOLIA – having in mind the need for performing financial analysis based on multi-sources of information and alerts.
The workshop was attended by 42 participants representing 9 EU FIUs, 2 FP7 associate member FIUs, 1 observer FIU, FIU.NET Bureau and other consortium members.
2nd Workshop
The second HEMOLIA Workshop was organized and performed in Amsterdam, the Netherlands on June 18, 2012.
The workshop was named “HEMOLIA – A significant enhancement of WEB and Telecom data to AML"
3rd Workshop
The final HEMOLIA workshop and final dissemination event was organized and performed on February 10-11, 2014 in Bucharest, Romania.
The workshop was named “HEMOLIA Conference and Demonstration” and gathered over 100 participants, including a strong representation of the European FIUs.
List of Websites:
http://www.hemolia.eu/
HEMOLIA
Hybrid Enhanced Money Laundering Investigation, Intelligence, Incrimination and Alerts
HEMOLIA is a new generation of Investigation and Intelligence System for Anti-Money-Laundering (AML) and Counter-Terrorism-Financing (CTF), which in addition to the traditional Financial Plane Sources, makes extensive use of modern society Telecom Plane sources, thereby opening up a new dimension of capabilities to Money Laundering Fighters (FIUs, LEAs). Adding the Telecom Plane to the existing Financial Plane improves and changes dramatically AML doctrines, since another dimension is added to the analysis and investigation processes
HEMOLIA, taking into account existing legal frameworks, hybridizes and correlates the financial and telecom planes for creating a richer and more accurate case management tools, as well as generation of alerts and information sharing, both nationally and internationally
P3A-HEMOLIA Global Information Sharing
Significant Money Laundering (ML) activities are usually done across the globe, therefore ML fighters have to collaborate and share information for better intelligence, investigation and incrimination. Being a WEB based system in its nature, HEMOLIA enables secure networking (IPSEC) and global information sharing between FIUs/LEAs in Europe and around the globe in a way that enables each donor FIU/LEA to be a ‘master’ that have full control about the data parameters to share with any recipient country. The shared data formation is usually determined based on bilateral agreements between countries.
HEMOLIA info sharing mechanism and network is called ‘P3A’, which stands for Privacy Preserving Push Alerts (and Reports), meaning that HEMOLIA enables FIUs/LEAs to protect the suspect privacy because of the above two reasons (using IPSEC and a donor which is master). P3A can be implemented in any FIU who has HEMOLIA system in its premises.
Gideon Hazzani – Gideon.hazzani@verint.com
HEMOLIA Project coordinator
Project Context and Objectives:
The overall mission of the HEMOLIA consortium was to research and develop an innovative AML intelligent multi-agent alert and investigation system that will demonstrate the extensive benefits of fusing the Telecom Plane and Financial Plane for the sake of fighting financial crime, fraud and ML. Even deployed in a very strict legal environment (from the point of view of access to financial/telecom data), HEMOLIA represented an innovative approach and raise the level of ML activity detection by performing a deep analysis of the fused Financial/Telecom information.
Today, all FIs run a Commercial Off-The Shelf (COTS) ML alerts application on their financial databases. This application creates a COTS ML alert about any suspicious transaction or customer. The alert must be reported by the FI to the FIU. The FIU may issue (manually or automatically) an investigation warrant against a suspect which will initiate the HEMOLIA processes where analysis and automatic investigation tools are operated in FIs, TOs, Judicial authorities in order to detect all people linked to the COTS alert.
The analysis and auto-investigation products are of 2 different types: (i) P3A alerts represent the ML risk level and warn the FIs and FIUs/LEAs about a specific customer, yet without disclosing any privacy details. Based on the legal research objective, unlike FIs, FIUs/LEAs may receive detailed P3A which includes some customer information. (ii) ML network (of people) built based on hybridization of both financial and telecom information. The P3A alerts are pushed to the FIU and possibly to all FIs and Judicial authorities. The ML network is displayed only to the FIU/LEA upon request. Dashed arrows (4) represent P3A push to FIs and FIUs/LEAs and display of the ML network to the FIU/LEA.
Research Objectives: The research performed in HEMOLIA can be divided into 3 categories:
I. Technological objectives: The technological research was based on the envisaged HEMOLIA architecture composed of two main parts: (i) Data-collection and data-mining from the Financial Plane and from the Telecom Plane and (ii) the HEMOLIA Core Modules which analyzed the Telecom Plane and Financial Plane Data Sources and created enhanced alerts.
II. Legal framework of AML Systems: The legal research included several areas: (i) Telecom Plane Legal Framework and the “Financial Plane Legal Framework” for the different categories of end users (banks and financial institutes, FIUs/LEAs on the other hand) under the existing laws; (ii) Content of the alerts; (iii) Harmonization of the AML related data and boundaries (levels of permission) for access/use of the data by FI’s and LEA/FIUs.
Project Results:
EU AML Legal Framework Definition
• An overview has been given on international norms, including the European Union and national legal norms, relevant for the software to be developed for the HEMOLIA system
• Analysis of the positions of the parties and data streams in relation to the applicable and future law (including Telecom) and has been published
• The role of the Financial Institutions (IFs), of the Financial Intelligence Unit (FIUs) and of the Law Enforcement Authorities (LEAs) Involved in the AML/CTF Field were defined
• The Guidelines for both the ML fighters and the HEMOLIA system were produced
System Architecture
• Architecture and solution principles
• Technology requirements and characteristics
• Security principles and guidelines
• Business functions
• A service model
• A topology model
Analysis, Fusion, Indexing and Hybridisation
• The software components of layer-1 and layer-2 of the HEMOLIA framework were developed
• Adequate algorithms for combining, analyzing and indexing data from different sources were Implemented
Alerts Engine Tool
The IOS (Intelligent Observation System) developed for HEMOLIA is used to obtain alerts in ML/TF (Money laundering/Terrorism Financing). Two IOS alerts have been defined with different purposes:
• Analysis of suspicious transaction reports. Prioritize suspicious reports based on information reported by the suspicious report, information contained in the general repository and information collected by analysts.
• Analysis of reported individuals. Fully supervision on any reported subject, both natural and legal, even if he/she only appears in systematic reporting.
Two algorithms for ML/TF networks have been defined:
• Refinement algorithm. An algorithm to create scores for people with not enough banking data.
This algorithm is based on label propagation techniques. This algorithm let us create suspiciousness IOS scores onto people with few or no banking data.
• MLND algorithm. An algorithm based on SNA community detection algorithms for Money Laundering Network Detection using relationships and bank data. Normally community detection in SNA does not have extra information such as IOS scores or banking data, which means this procedure and developed algorithm is unique.
Clustering in data mining and community detection in graph structures was undertaken using Social Network Analysis theory. Given this introduction to those sorts of techniques, HEMOIA describes different algorithms for Money Laundering
Network Detections using the AIA’s Intelligent Observation System Score which measures the suspiciousness of Money Laundering activities
GUI Investigation Tool
The GUI system tool developed for HEMOLIA helps users to complete initial money laundering alerts, with the goal of detecting and fully uncovering money laundering networks. All available data sources are brought to bear, including financial, telephony, Internet, and any other databases at the disposal of the FIU.
Before the HEMOLIA user is aware, the GUI system analyzes financial data including STRs, CTRs and ETRs. It uses artificial intelligence to go through the vast amount of information to find the needle in the haystack – the persons or organizations that have high potential or risk in money laundering. The GUI system generates alerts regarding the persons and organizations, and also passes on data about the financial networks it has found. In this way, much of the work in identifying suspects and filling out the relevant data is done even before the HEMOLIA user enters into the picture.
Using these alerts and networks from the GUI system, HEMOLIA users utilize the tools in the HEMOLIA user GUI to continue completing the money laundering alerts and networks. The HEMOLIA system includes hybridized profile pages and visual link analysis maps that show the gathered data from the many sources in different slices and from many angles. This leads cyclically to more persons/organizations of interest which expand the investigation until the entire money laundering network is laid bare.
Potential Impact:
Technological Impact:
HEMOLIA is a new generation AML system capable of integrating two powerful sources of information; financial transactions and telecommunication activity. Its technological impact is twofold. On the one hand HEMOLIA generates an intelligent AML alerts system based on financial data that is the basis of future AML systems. On the other hand, the hybridization between financial and telecommunication data analysis is a breakthrough approach to ML prevention and contributes to the technological challenges involved in obtaining and analyzing such data. Other technological fields which HEMOLIA contributes to include the management of very large volumes of heterogeneous data, the integration of different data sources with different formats, the analysis of hybrid information and the generation of automatic reports using hybrid alert information. The main technological challenge was to build the ML network alerts and manage all the individual information in a way that facilitates ML investigation by FIUs.
HEMOLIA enables FIs such as banks, insurance companies, credit card companies, etc. to access the alerts in addition to LEAs and FIs. The ability to access alerts that were originally formed not only based on finance information of their own but also based on telecom information and financial information of other FIs, opens a new dimension of enriched knowledge and brings a new era for AML doctrines. As a by-product, the envisaged HEMOLIA provides commercial FIs a significant enhancement for detecting fraudulent financial activities (another incentive for FIs to use HEMOLIA).
HEMOLIA has a technological impact at the international level by proposing a solution that could connect legal, financial and telecom organizations from different countries and enable the sharing of information and alerts between them and thereby improve the cooperation between countries (FIUs).
This is critical to the success of AML because significant amount of the financial crimes and ML acts are done in several hops between different countries till the final destination.
Socio-economic benefits of HEMOLIA
• Significant Reduction in Criminal Activity and Terrorism
• Raises the Reputation of European Countries Implementing the HEMOLIA AML System
• Raises the Integrity of Individual FIs Implementing HEMOLIA
• Enhanced Stability of FIs
• Reduces Operational Risk
• Reduces Legal Risks for an FI
• Reduces Legal Risks for an FI
• Reduces Concentration Risk for an FI
Economic Benefits
• Increases Stability of a Country’s Financial Sector and of Individual Financial Institutions
• Increases Economic Growth
Main Dissemination activities and exploitation results
Over the course of the HEMOLIA project, several dissemination events were undertaken:
• Participation in numerous scope related events (EGMONT, MILIPOL)
• Publications in various magazines
• Development of training materials
• Project workshops:
1st Workshop:
“The Financial Intelligence Units’ Workshop: Defining End Users’ Requirements on HEMOLIA in the EU Legal Framework” was performed, which took place in Bran, Romania on October 24-25, 2011. During the workshop the general objectives of the HEMOLIA Project were presented and a discussion was held on how the FIUs could use a system like HEMOLIA – having in mind the need for performing financial analysis based on multi-sources of information and alerts.
The workshop was attended by 42 participants representing 9 EU FIUs, 2 FP7 associate member FIUs, 1 observer FIU, FIU.NET Bureau and other consortium members.
2nd Workshop
The second HEMOLIA Workshop was organized and performed in Amsterdam, the Netherlands on June 18, 2012.
The workshop was named “HEMOLIA – A significant enhancement of WEB and Telecom data to AML"
3rd Workshop
The final HEMOLIA workshop and final dissemination event was organized and performed on February 10-11, 2014 in Bucharest, Romania.
The workshop was named “HEMOLIA Conference and Demonstration” and gathered over 100 participants, including a strong representation of the European FIUs.
List of Websites:
http://www.hemolia.eu/