Award-winning transaction monitoring system for a financial institution為金融機構打造的防洗錢交易監控系統，榮獲獎項肯定

Situation

A financial institution needed a production-ready transaction monitoring system within six months, under regulatory pressure to demonstrate compliance.

The starting point was closer to a blank page than a spec: there was no agreed definition of the risks the system should monitor, no confirmed inventory of source data, no performance framework, and no labelled dataset against which to train or evaluate a model.

Before developing any detection logic, we therefore had to define the monitoring problem itself: which behaviours required coverage, what evidence analysts would need, and how the resulting decisions could be explained to the regulator.

Strategy

Working with a cross-functional team of data engineers and compliance specialists, I led the design of the detection models and alert-triage workflow at the core of the system. I structured the solution around three connected components: a rules-based detection engine, an unsupervised anomaly-detection layer, and a human-in-the-loop workflow for reviewing and resolving alerts.

1. Translating regulatory requirements into detection rules

Without labelled outcomes, supervised learning was not a credible starting point. I first worked with the client’s compliance specialists to define what constituted suspicious activity, drawing on regulatory guidance and jurisdiction-specific requirements.

We translated those requirements into 16 financial crime typologies across three levels: customer, account, and transaction. Using data ingested and standardised from more than ten internal systems and external providers, I then designed the features and detection logic supporting each typology.

For example, the mule-account rule identified accounts where incoming funds were withdrawn unusually quickly relative to the account’s own historical behaviour. Using a dynamic baseline instead of a fixed threshold helped distinguish genuinely unusual activity from the normal behaviour of high-turnover accounts.

2. Extending coverage beyond known typologies

Rules provide strong coverage for known risks, but they cannot identify behaviours that have not already been defined. I therefore designed a complementary unsupervised anomaly-detection layer to surface statistically unusual activity even when it matched none of the 16 typologies.

This layer was intentionally designed as a discovery mechanism rather than a source of definitive conclusions. I made the precision trade-off explicit to the client: its outputs were hypotheses for analysts to investigate, not evidence that suspicious activity had occurred.

3. Turning model outputs into an operational workflow

Detection alone would not make the system operational. I designed the alert-triage workflow used by analysts to review flagged activity, including the supporting evidence shown for each alert, the available dispositions—close or escalate—and the audit trail required for regulatory review.

The wider team implemented this workflow as a web application. Outputs from both detection layers were fed into a single review queue, while analysts’ dispositions created a feedback loop for recalibrating rules and thresholds over time.

Result

The completed system was reviewed and accepted by the regulator. By 2025, it had been operating in production for more than three years, with compliance analysts using it daily to review, investigate, and resolve alerts.

The project turned an initially undefined regulatory requirement into an embedded operational capability, with explicit risk coverage, consistent analyst decisions, and a defensible audit trail.

The solution was subsequently named Best AML/CFT Data, Analytics & Visualisation Solution at the Regulation Asia Awards for Excellence 2023.