Intelligent warning system

Abstract

To provide an intelligent warning system and a method that can be learned gradually from an investigator and automatically make decisions about some future potential cases with little human involvement.SOLUTION: An intelligent warning system triggers a potential case based on a set of scenarios, sends the potential case and a report with a default narrative to an investigator, learns a writing style of the investigator through a change made by the investigator to the default narrative, automatically submits the report with narrative that matches the writing style of the investigator, records a survey result for each potential case, the relevant set of scenarios that triggered the potential case, and the date and time of such survey in a database after the survey.SELECTED DRAWING: Figure 4

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001]

[0001] This application claims the benefit of U.S. patent application Ser. No. 16 / 742,766, entitled "INTELLIGENT ALERT SYSTEM," filed Jan. 14, 2020, and U.S. patent application Ser. No. 16 / 742,780, entitled "INTELLIGENT REPORT WRITER," filed Jan. 14, 2020, both of which claim priority to U.S. provisional patent application Ser. No. 62 / 805,085, entitled "INTELLIGENT ALERT SYSTEM," filed Feb. 13, 2019, the disclosures of which are expressly incorporated herein by reference in their entireties. [Technical Field]

[0002]

[0002] The present disclosure relates generally to intelligent alert systems. More particularly, the present disclosure relates to systems and methods for improving alert management. [Background technology]

[0003]

[0003] The amount of data available for public consumption is growing at an exponential rate. Data can be used to uncover hidden opportunities or uncover adverse events. Traditional information management systems may use manual searches, report-based search systems, and / or alert-based search systems. These traditional search systems may be used to detect and report suspicious activity.

[0004]

[0004] The U.S. Bank Secrecy Act was first established in 1970. Under the Bank Secrecy Act, financial institutions must report suspicious activity to the government. Until now, financial institutions have trained their front-line personnel (e.g., bank tellers) to observe and identify suspicious activity. However, most financial institutions have not been able to effectively comply with the Bank Secrecy Act. After the 9 / 11 tragedies, U.S. lawmakers believed that the 9 / 11 tragedies could have been prevented if financial institutions had effectively complied with the Bank Secrecy Act.

[0005] To further strengthen the Bank Secrecy Act, the U.S. Congress passed the USA PATRIOT Act, which established severe civil and / or criminal penalties for violations of the Bank Secrecy Act. Additionally, U.S. government agencies, such as the Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), the Federal Reserve Banks (FRB), the Federal Deposit Insurance Corporation (FDIC), the National Cooperative Association of Banks (NCUA), State Banking Departments, and the Bureau of Financial Institutions, strictly require financial institutions to comply with the Bank Secrecy Act, particularly their obligation to submit Suspicious Activity Reports (SARs) to FinCEN.

[0006]

[0006] Suspicious activity covers a very wide range: for example, money laundering, terrorist financing, fraud, embezzlement, identity theft, computer intrusion, private financial transactions, bribery, false statements, counterfeit securities, and mysterious disappearances are all classified as suspicious activity.

[0007]

[0007] Despite this, many financial institutions are unable to detect and report suspicious activity. In fact, many financial institutions use products that are effective at preventing fraud but ineffective at preventing money laundering or other financial crimes. Fraud can be detected based on changes in behavior, since fraudsters who have stolen a victim's personal information (or financial instruments) generally behave differently from the victim. Computer systems can detect instances of fraud when account activity differs from expected activity derived from past activity.

[0008] For example, US application (Publication No. 2003 / 0177087) specifies that high risk variables can include, for example, changes in the normal behavior of an account that are indicated when a transaction deviates from its profile. According to this publication, Beta, Delta, and Theta models are used to detect transactions that deviate from a customer's profile.

[0009] However, money laundering and some other financial crimes can be committed without changes in behavior. As a result, traditional approaches to detecting fraud based on changes in behavior fail to detect some basic money laundering activities or other financial crimes. In the field of money laundering, higher-risk customers may not be suspicious. For example, money service businesses (MSBs), pawnbrokers, ATM vendors, flight attendants, etc. are typically classified by banks as higher-risk customers in their anti-money laundering programs. However, this does not mean that these higher-risk customers will engage in money laundering activities. Although a higher risk is associated with these customers, there may be no problems with these customers.

[0010]

[0010] Some businesses are very difficult to monitor. For example, an MSB handles a large number of transactions every day, and traditional approaches may not be able to detect a single money laundering transaction mixed in with these many transactions.

[0011]

[0011] The challenges noted for complying with the USA PATRIOT Act and the Bank Secrecy Act (BSA) are just a few examples to illustrate the importance of identifying suspicious activity. Identifying suspicious activity can also be used to comply with other laws, such as the Fair and Accurate Credit Transactions Act (FACT Act), the Unlawful Internet Gambling Enforcement Act (UIGEA), the Elder Abuse Reporting Act (EARA), the Sarbanes-Oxley Act (SOX), regulations set forth by the Office of Foreign Assets Control (OFAC), and other laws and regulations.

[0012]

[0012] Regulatory compliance is traditionally implemented through policies and procedures that require human workers to take some specific action in response to certain conditions. For example, to comply with bank secrecy laws, banks train their branch tellers to observe and report anything that they find suspicious.

[0013]

[0013] This traditional approach is ineffective in the modern era because customers no longer need to appear in person at a bank branch. For example, customers can conduct remote electronic transactions (e.g., via the Internet), and there are numerous financial products available to customers (e.g., checks, credit cards, debit cards, etc.). Furthermore, criminals are sophisticated and know how to avoid the attention of tellers. As a result, relying on tellers to detect suspicious activity to comply with bank secrecy laws is insufficient.

[0014]

[0014] Furthermore, the cost of this human-based approach is very high. Human workers must undergo intensive training on a regular basis to ensure they comply with different laws and regulations and know exactly how to handle each different situation. However, human workers are prone to error. In fact, due to human oversight, many financial institutions have received severe penalties from government agencies for failing to comply with different laws and regulations.

[0015]

[0015] It is desirable to improve search systems to improve detection of different types of suspicious activity and to help businesses comply with different types of laws and regulations. The methods, features, embodiments, computer systems, networks, software, hardware, mechanisms, and other components used to detect suspicious activity may also be used in other applications or by other organizations for purposes other than detecting suspicious activity. Summary of the Invention

[0016] The present disclosure includes several embodiments that can be combined together to form various methods. The method detects money laundering activity. The method includes detecting, by a first computer system, a first potential case related to money laundering when a flagged scenario in a cause vector of the first potential case meets a detection criterion. The method also includes comparing, by the first computer system, a first ratio of a first value of the cause vector to a second value of the cause vector with a threshold. The method also includes transmitting the first potential case from the first computer system to a second computer system for investigation when the first ratio is less than the threshold. The method further includes, by the first computer system, adjusting the first value when results of the investigation indicate that the first potential case is a true positive. The method also includes adjusting, by the first computer system, the second value based on the cause vector meeting the detection criterion. The method further includes transmitting, by the first computer system, a first report related to the first potential case to a third computer system when the first potential case is a true positive.

[0017] Another method for detecting money laundering activity includes detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in a cause vector of the potential case meets a detection criterion. The method also includes calculating, by the first computer system, a conditional probability value for the potential case based on the cause vector. The method further includes comparing, by the first computer system, the conditional probability value to a threshold. The method also includes transmitting a report related to the potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold.

[0018] Yet another method for detecting money laundering activity includes detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in a first cause vector of the potential case meets a detection criterion. The method also includes generating, by the first computer system, a composite cause vector by combining the first cause vector with a second cause vector of a previous potential case. The method further includes calculating, by the first computer system, a conditional probability value for the case triggered by the composite cause vector. The method also includes comparing, by the first computer system, the conditional probability value with a threshold. The method also includes transmitting a report related to the potential case and the previous potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold.

[0019] Yet another method detects money laundering activity. The method includes detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in a cause vector of the potential case meets a detection criterion. The method also includes calculating, by the first computer system, a conditional probability value for the case triggered by a child vector of the cause vector. The method further describes comparing, by the first computer system, the conditional probability value to a threshold. The method also describes transmitting a report related to the potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold.

[0020] Another method detects money laundering activity. The method includes detecting, by a first computer system, a potential case for money laundering when a flagged scenario in a first cause vector of the potential case meets a detection criterion. The method also includes generating, by the first computer system, a composite cause vector by combining the first cause vector with a second cause vector of a previous potential case. The method also includes calculating, by the first computer system, a conditional probability value for a child vector of the composite cause vector. The method further describes comparing, by the first computer system, the conditional probability value to a threshold. The method also describes transmitting a report related to the potential case and the previous potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold.

[0021] A computer-implemented method generates a report. The method includes storing a first fact related to a first subject, a second fact related to a second subject, and a third fact related to a third subject in a database of a first computer system. The first fact, the second fact, and the third fact have the same field names in the database. The method also includes receiving, at the first computer system, a first report of the first subject from a second computer system. The first report includes the first facts and a first set of link words generated by a human writer. The method further includes transmitting the first report of the first subject from the first computer system to a third computer system. The method transmits the second facts and the first set of link words from the first computer system to the second computer system. The method further includes receiving, at the first computer system, a second report of the second subject from the second computer system. The second report includes second facts and a second set of link words generated by a human writer. The method transmits the second report of the second subject from the first computer system to a third computer system. The method also transmits a third report of the third subject from the first computer system to the third computer system when the first set of link words corresponds to the second set of link words. The third report includes a third fact and the second set of link words.

[0022]

[0022] The above methods are just a few examples. Many other methods can be formed by combining and rearranging the embodiments of the present disclosure.

[0023] This has outlined rather broadly the features and technical advantages of the present disclosure so that the detailed description that follows may be better understood. Additional features and advantages of the present disclosure are described below. It should be appreciated by those skilled in the art that this disclosure may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present disclosure. It should also be realized by those skilled in the art that such equivalent constructions do not depart from the teachings of the present disclosure as set forth in the appended claims. The novel features believed characteristic of the present disclosure, both as to its organization and method of operation, together with further objects and advantages, will be better understood from the following description when considered in connection with the accompanying drawings. It is to be expressly understood, however, that each of the figures is provided for the purpose of illustration and description only and is not intended as a definition of the limits of the present disclosure.

[0024]

[0024] The features, nature, and advantages of the present disclosure will become more apparent from the detailed description set forth below when considered in conjunction with the drawings. [Brief explanation of the drawings]

[0025] [Figure 1]

[0025] FIG. 1 illustrates a system and network diagram of an intelligent alert system according to an aspect of the present disclosure. [Figure 2]

[0026] 1 is a flow chart for an intelligent warning system according to an aspect of the present disclosure. [Figure 3] 1 is a flow chart for an intelligent warning system according to an aspect of the present disclosure. [Figure 4] 1 is a flow chart for an intelligent warning system according to an aspect of the present disclosure. [Figure 5] 1 is a flow chart for an intelligent warning system according to an aspect of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0026]

[0027] The detailed description set forth below, in conjunction with the accompanying drawings, is intended as a description of various configurations and is not intended to represent the only configurations in which the concepts described herein may be practiced. The detailed description includes specific details for the purpose of providing a thorough understanding of the various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid obscuring such concepts. As described herein, the use of the term "or" can mean either an "inclusive OR" or an "exclusive OR," depending on the context of the application based on common practice.

[0027]

[0028] Aspects of the present disclosure are directed to an intelligent alert system. In one configuration, a computer system monitors transactions and / or activities to generate alerts. The computer system can learn from humans and become smarter to automatically accept potential cases as true positives and / or reject potential cases as false positives. As a result, the computer system can help financial institutions reduce human resources while still complying with laws and regulations, such as the Bank Secrecy Act.

[0028]

[0029] Depending on the specifics of the law or regulation, the computer system may use different functions or methods to monitor different types of activity. The present disclosure provides various details for monitoring transactions and activities to reduce human resources while still complying with different requirements, laws, and regulations. The computer system of the present disclosure may also be used for other applications or purposes. The computer system of the present disclosure may reduce or eliminate human labor and / or human error, reducing resources, saving money, and improving results.

[0029]

[0030] In traditional information management systems, individuals manually search the internet and / or databases for data. Manual searches are time-consuming. To improve manual searches, decision makers often hire additional searchers to assist in performing the manual searches.

[0030]

[0031] Additionally, in some conventional information management systems, various reports with graphics are generated to summarize or compare data. Reading the reports can improve manual search. Nevertheless, reading the reports can be time-consuming when a large amount of data is involved. Additionally, it is impractical for the human eye to identify events among the various values ​​presented in the reports. Humans may not be able to identify different issues when tasked with reading a large number of reports.

[0031]

[0032] To improve the search, some conventional systems generate alerts when a condition is met. Alert systems can reduce the need for humans to read reports; that is, alerts can notify users of a specific event and provide data about that event. Compared to report-based approaches, alert systems reduce the amount of time and manpower required.

[0032]

[0033]

[0003] Improved alert systems are desirable to increase efficiency and reduce the need for human oversight. Aspects of the present disclosure are directed to information management systems that process alerts via a computer system. The information management systems may be referred to as intelligent alert systems.

[0033]

[0034] Alert systems may be used by various types of organizations. For example, financial institutions are required by law to report suspicious activity to the government. As such, financial institutions may use alert systems to determine when suspicious activity is detected. As another example, a loan company may use an alert system to generate an alert when a borrower is likely to default on a loan payment. In yet another example, a social media company may use an alert system to generate an alert when a cross-selling target is identified. As another example, a defense contractor may use an alert system to identify violations of security policies. In another example, police may use an alert system to generate an alert before a crime is committed. Alert systems are not limited to organizations but may also be used by families or individuals. For example, an individual may receive an alert when an investment opportunity materializes and / or before the stock market crashes.

[0034]

[0035] As described above, alert systems have a variety of uses. Aspects of the present disclosure are not limited to the uses described above. The methods, features, embodiments, computer systems, networks, software, hardware, firmware, mechanisms, and other components of the present disclosure may be used by other types of individuals and organizations for other purposes. For clarity, this disclosure describes the use of alert systems in financial institutions to detect suspicious activity.

[0035]

[0036] The U.S. government strictly enforces business compliance with the USA PATRIOT Act, the Bank Secrecy Act (BSA), the Fair and Accurate Credit Transactions Act (FACT Act), the Unauthorized Online Gambling and Equity Act (UIGEA), the Elder Financial Abuse Reporting Act (EARA), the Sarbanes-Oxley Act (SOX), regulations established by the Office of Foreign Assets Control (OFAC), and other related laws and regulations. Businesses may include financial institutions, such as banks, credit unions, mortgage lenders, money service providers, stockbrokers, and insurance companies. Financial institutions have been subject to billions of dollars in civil penalties (CMPs) assessed by the U.S. government for violating these laws and regulations. Criminal penalties have also been issued against some individuals employed by financial institutions.

[0036]

[0037] Financial institutions are just one type of business. They are not the only organizations that must comply with these laws and regulations. Many other types of businesses must comply with these laws and regulations. This disclosure applies to all businesses, including those that are obligated to comply with laws and regulations.

[0037]

[0038] The Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) are US organizations. This disclosure uses US laws and regulations as examples. Many other countries have similar organizations that perform similar tasks. Therefore, many other countries also have similar laws and regulations. This disclosure is also applicable in those countries to help companies comply with their respective laws and regulations. Aspects of this disclosure can also be used by companies, individuals, or organizations that are not required to comply with laws or regulations.

[0038]

[0039] In many cases, it can be difficult to determine whether one or a group of individuals have engaged in illegal activity. According to the U.S. Bank Secrecy Act, when a company submits a suspicious activity report (SAR) to FinCEN, the company is not required to prove whether the reported activity is illegal. In fact, the "safe harbor" rule encourages companies to report more suspicious activity without fear of being accused of falsely reporting legitimate activity as fraudulent. Under this "safe harbor" rule, a person (or organization) cannot file a lawsuit against an entity because the entity submitted a suspicious activity report (SAR) to FinCEN about the person (or organization). SARs are used by the government to gather information, and companies are required to provide only information and opinions in the SAR. Government agencies conduct their own investigations to determine whether the activity reported in the SAR is indeed illegal.

[0039]

[0040] Generally, the decision-making process regarding whether to report suspicious activity other than fraud is different from the decision-making process regarding whether to report a fraud case. In a fraud case, an entity, such as a business or a consumer, may lose money. Therefore, fraud is easier to detect compared to other crimes. Therefore, deciding whether to report a fraud case is easier. Preventing fraud is also easier compared to preventing other crimes. As an example, if a computer system detects a high fraud risk associated with a transaction, the computer system can block the transaction and have investigators investigate the transaction to determine whether it is indeed a fraud case.

[0040]

[0041] In one aspect of the present disclosure, for fraud detection purposes, the computer system calculates a risk score associated with a transaction based on different factors related to the transaction, which may include the account's past activity, deviations from expected activity, location, time, amount, frequency, and nature of the transaction, relationships between multiple accounts, type, nature, and structure of the account holder, etc.

[0041]

[0042] In one aspect of the present disclosure, for fraud detection, the computer system blocks a transaction if the fraud risk score of the transaction exceeds a threshold, which is predetermined based on company policy.

[0042]

[0043] In one aspect of the present disclosure, for fraud detection, a computer system creates a case based on detected high fraud risk transactions. The case and related information are presented to an investigator for further investigation.

[0043]

[0044] Unlike fraud, suspicious activity may not have clear evidence. For example, a customer may frequently deposit large amounts of cash. This customer may be involved in money laundering by selling illegal goods and accepting cash as payment. This customer may also sell homemade products at a farmers market and only accept cash as payment. In many cases, due diligence is required to determine whether there is anything suspicious.

[0044]

[0045] A customer may sell homemade products at a farmers' market, but at other locations, the customer may also sell illegal goods. Unless the bank is informed that the customer is selling illegal goods, there is no evidence for the bank to prove that the customer is selling illegal goods. If the customer is in fact selling illegal goods and the bank does not report such suspicious activity to FinCEN, if the government arrests the customer for selling illegal goods, the bank could later face severe penalties for failing to report the case to FinCEN.

[0045]

[0046] On the other hand, if a bank reports every instance that even remotely seems suspicious, it risks unnecessarily drawing the attention of government agencies, which may spend months inside the bank investigating the bank's operations, potentially severely impacting the bank's operations.

[0046]

[0047] The decision to report a case can be a subjective judgment by the person reviewing the case. Additionally, the decision-making process can be highly subjective. Furthermore, a company cannot block a transaction solely because it appears to be suspicious money laundering activity. A consumer can sue a company for blocking a consumer's transaction when the company cannot clearly prove that money laundering occurred. In fact, many government agencies often advise companies that report suspicious activity, such as money laundering or terrorist financing, to take no action and treat the suspicious transaction as a normal transaction, so that suspects do not receive warnings and flee. This approach gives government agencies more time and opportunity to identify all relevant perpetrators.

[0047]

[0048] Under the U.S. Bank Secrecy Act, a company that files a SAR must keep it confidential and must not allow suspects (e.g., people involved in the case) to know anything about it, including its existence. SARs may only be reviewed by authorized government agencies.

[0048]

[0049] As described above, handling suspicious activity cases is very different from handling fraud cases, so many traditional approaches and concepts applicable to fraud detection and prevention are no longer useful for detecting and managing suspicious activities such as money laundering, terrorist financing, elder abuse, online gambling, etc. In one aspect of the present disclosure, the computer system records the opinions of those who decide not to report a detected suspicious activity case. In such circumstances, the decision maker records the reasons justifying their decision.

[0049]

[0050] Unlike fraud cases, suspicious activity cases may not be apparent to the person reviewing the case until additional evidence becomes available. Thus, a person may initially dismiss a detected suspicious activity case but later change their mind when additional evidence becomes available. In one aspect of the present disclosure, a person reviewing a detected suspicious activity case may also need to review all previously detected cases involving the same suspect to determine whether any new evidence, possibly when combined with older evidence from any dismissed cases, makes the newly detected case more suspicious. As a result, even if a case was previously dismissed as a false positive, such a dismissed case may later be reconsidered.

[0050]

[0051] The implementation of this suspicious activity case review may differ from that of fraud case review because fraud cases typically have a clear conclusion. If a customer is the fraudster, the customer's account is closed and the customer is barred from future transactions / activity. If a customer is the victim of fraud, the detected fraud case is irrelevant to the customer and the evidence cannot be used against the customer in the future. Therefore, fraud investigators typically focus only on newly detected cases. Conversely, suspicious activity investigators may need to review the history of detected cases and make a decision after intensive research and analysis. In one aspect of the present disclosure, the justification for the decision not to report suspicious activity is stored in a database and available for future reference.

[0051]

[0052] In another aspect of the present disclosure, the computer system also records personal information of those who decide not to report detected cases. The computer system may compare decisions made by multiple people about not reporting suspicious activity of the same suspect(s) to determine whether investigators are attempting to cover up detected suspects or cases.

[0052]

[0053] For a large enterprise, thousands of suspicious activities may be detected each month. A group of people may be tasked with reviewing the detected cases to determine whether the enterprise needs to file SARs for these cases. In one aspect of the present disclosure, a computer system automatically assigns the detected cases to different people based on enterprise-defined policies. The computer system may monitor and record the status of each detected case. If case review is delayed by a particular person, the computer system alerts the enterprise of such delay.

[0053]

[0054] In yet another aspect of the present disclosure, the computer system monitors the workload of each person reviewing detected cases, and if a person reviews an abnormally high number of cases compared to others who also reviewed detected cases during the same time period, that person may be suspect or called into question.

[0054]

[0055] On the other hand, if a person has reviewed fewer cases compared to others who have also reviewed cases during the same period, this person may also be suspect or questioned. In either of the above two situations, company managers may want to investigate the situation and draw their own conclusions and solutions.

[0055]

[0056] Generally, suspicious activity can occur in many different types of activity, so different detection features are used to detect suspicious activity. Because the detection of suspicious activity is not clear-cut, some detected cases may turn out not to be truly suspicious after investigation. Under such circumstances, such detected cases are dismissed as false positives or false positives. A false positive or false positive is generally considered the conclusion of a case investigation, but it does not justify why the case was dismissed.

[0056]

[0057] For example, if a financial institution detects a case in which several customers living at the same address deposit large amounts of cash with the financial institution, this case may be related to a drug dealer family in which many of the family members deposit the proceeds of selling drugs. However, upon investigation, this case may actually be a group of students living together who are depositing tips from working at a restaurant. The justification for the decision not to report this case would be "students living together deposit tips from their part-time jobs." Therefore, for the given reason, the conclusion of the detected case is a false positive or a false positive.

[0057]

[0058] Generally, after reviewing a detected case, the case may be classified as a false positive (or a false positive) by the person reviewing the case. In one aspect of the present disclosure, the computer system provides information and / or statistics for a user to analyze all detected cases classified as false positives. From these false positives, the user may identify detection features that generated a number of false positives greater than a threshold. The user may further improve the identified detection features to improve detection of future suspicious activity.

[0058]

[0059] The USA PATRIOT Act, Bank Secrecy Act (BSA), Anti-Money Laundering (AML), and Anti-Terrorist Financing (ATF) have been important compliance matters in the financial industry since 9 / 11. Many financial institutions have invested a large amount of capital in these compliance matters, but still miss genuine money laundering and terrorist financing cases.

[0059]

[0060] The main cause of these compliance problems is that many financial institutions do not detect even basic cases of money laundering, and senior managers at financial institutions have difficulty understanding these issues. Many financial institutions use fraud detection principles to detect money laundering activities, and some conflate fraud cases with money laundering cases.

[0060]

[0061] However, in reality, money laundering is very different from fraud. Fraud detection products can easily compare an account holder's current activity with the account holder's past activity and detect possible fraud when the current activity deviates from expected activity derived from past activity. For example, if a fraudster steals a victim's credit card, the fraudster will make purchases that differ from the victim's past activity. It is simply a matter of time before the credit card company detects the fraud and blocks the credit card. If the account is new and the past record is not yet complete, fraud detection products compare the account holder's current activity with what the account holder said during the account opening process.

[0061]

[0062] Because the goal of fraud detection products is to stop losses as quickly as possible, financial institutions typically perform fraud detection or risk scoring in real time, or at least daily. In contrast, the real-time risk scoring, real-time detection, daily risk scoring, and daily detection methods available for fraud detection cannot detect many basic money laundering activities. In fact, as explained earlier, higher-risk customers may not be money launderers. Assuming that higher-risk customers are engaging in suspicious money laundering activities is a waste of time.

[0062]

[0063] Financial institutions typically have a Bank Secrecy Act Officer (BSA Officer) who is responsible for reporting suspected money laundering or terrorist financing activity to FinCEN. The following example shows how a BSA officer within a financial institution may waste a significant amount of time reviewing the results of real-time or daily risk scoring, yet still miss genuine cases of money laundering. This example consists of the following facts: (a) Client A sends less than $3,000 to XYZ around the 5th of each month, (b) Client B sends less than $3,000 to XYZ around the 8th of each month, (c) Client C sends less than $3,000 to XYZ around the 12th of each month, (d) Client D sends less than $3,000 to XYZ around the 17th of each month, (e) Client E sends less than $3,000 to XYZ around the 24th of each month, (f) Client F sends less than $3,000 to XYZ around the 29th of each month, (g) A, B, C, D, E, and F are unrelated individuals, and (h) XYZ is a drug dealer in Los Angeles with no criminal record.

[0063]

[0064] In the example above, if a BSA officer were to compare a client's current activity with the client's past activity to detect changes in behavior, the BSA officer would not detect an anomaly because the client consistently makes similar transactions from month to month. If a bank teller were to ask the client about the purpose of a fund transfer, the client could easily lie. Because these clients make transactions on different days throughout the month, the BSA officer would not be able to detect risk on any day of the month.

[0064]

[0065] "Furthermore, because these clients are unrelated, BSA officers will not see their overall activity. Additionally, because each transaction involves a small amount and occurs once a month, and the recipients of the funds reside in U.S. cities with large populations and thriving commercial activity, none of these clients would be considered high-risk or suspicious based on these transactions. As a result, despite the diligent daily work of BSA officers using fraud detection products, fraud detection products will miss these basic cases of money laundering."

[0065]

[0066] To detect these money laundering cases, in one configuration, a computer system collects transaction data from financial institutions and performs data mining based on anti-money laundering and anti-terrorist financing scenarios across all transactions of all clients over a specified period, such as 30 days or more. The computer system may collect details of all funds transfer transactions from different data sources within the financial institution, such as wire, ACH, card payments, mobile payments, etc. The computer system may then identify common recipients of these funds transfer transactions.

[0066]

[0067] Once a common payee is identified, the computer system can display all transactions sent to the common payee to BSA personnel. BSA personnel review the identified transactions through the computer system. BSA personnel also review all past cases related to the suspect in the newly detected case. If a BSA personnel (e.g., a responsible person) agrees that the common payee is receiving so much money that such transactions constitute suspicious activity, the computer system assists the BSA personnel in filing a SAR with FinCEN. If the BSA personnel decides not to file a SAR, the BSA personnel enters into the computer system a reason justifying the decision not to report such detected activity.

[0067]

[0068] There are several ways to report a SAR case to FinCEN. One approach is to submit the SAR report in electronic format directly to a server at FinCEN. In such circumstances, BSA personnel can instruct the computer system that detected the suspicious activity to submit the SAR report. The computer system prepares the SAR report based on the suspects and transactions identified by the BSA personnel and then transmits the SAR report to the computer system at FinCEN.

[0068]

[0069] As can be understood, mining the vast amount of transaction data of all of a financial institution's clients accumulated over a long period of time takes some time, even for very small financial institutions. Because financial institutions do not directly lose money in money laundering cases, regulatory guidelines state that BSA officers have a maximum of 30 days to file an SAR. This example illustrates the waste of time and resources involved in real-time or daily risk scoring, which in fact misses true money laundering activity.

[0069]

[0070] A common complaint expressed by BSA personnel is that they waste time every day on false positives at the expense of detecting actual cases of money laundering. This frustration is the result of a widespread misconception that money laundering and fraud are often crimes perpetrated by the same criminals and should be detected together based on detected behavioral changes. After purchasing fraud detection products, some financial institutions attempt to detect both money laundering and fraud cases together. This has resulted in enormous wasted time, money, and resources. This misconception can be corrected with a proper understanding of the sophisticated aspects of transaction risk.

[0070]

[0071] Transaction risk is defined as the risk directly associated with a transaction. For example, money laundering risk and fraud risk are directly associated with a transaction. Nevertheless, these risks have very different characteristics. Clients who launder money through financial institutions attempt to use the institution as a means to achieve their goals. These money launderers usually pose as good customers because they need the financial institution's assistance to achieve their plans. From the financial institution's perspective, these money launderers are desirable customers because they do not mind paying additional fees or losing interest on their money. This is one of the main reasons why financial institutions need to conduct data mining on all transactions to detect money laundering activities hiding behind them.

[0071]

[0072] In contrast, fraud risk manifests itself differently. Customer-perpetrated fraud generally falls into two categories: (1) third-party fraud and (2) counterparty fraud. Third-party fraud is defined as fraud committed by a third party that is neither the financial institution nor the customer. For example, if a fraudster (e.g., a third party) steals a customer's checkbook, both the financial institution (e.g., the first party) and the customer (e.g., the counterparty) may be victims. Under such circumstances, the transactions committed by the third-party fraudster are unrelated to the customer. Therefore, it is a waste of time, money, and resources for BSA personnel to be swayed by ineffective fraud detection products and assume that a customer has committed money laundering simply because the customer is the victim of fraud committed by a third party (e.g., when there is a change in behavior).

[0072]

[0073] Counterparty fraud is defined as fraud committed by a customer (e.g., a counterparty) who deceives a financial institution (e.g., a first party). If a customer successfully deceives a financial institution, they quickly disappear and do not launder money through the financial institution. A fraudster may use Financial Institution A to launder money that the fraudster stole from Financial Institution B. To Financial Institution B, this is a case of fraud. To Financial Institution A, this is a case of money laundering. However, neither Financial Institution A nor Financial Institution B realizes that both a case of fraud and a case of money laundering have occurred with this same customer. It is clear that a system that attempts to detect cases of fraud every day will systematically create many false positives for money laundering and, in fact, miss true cases of money laundering. Using such an approach increases the workload of BSA personnel and exposes financial institutions to unnecessary regulatory risk.

[0073]

[0074] There are other risks in the category of third-party fraud. For example, counterfeit checks, credit card fraud, debit card fraud, ATM fraud, and online fraud are typical risks that fall under the category of third-party fraud. Similarly, there are many different risks in the category of counterparty fraud, such as check kiting, deposit fraud, and loan fraud. Therefore, a good transaction risk management system will successfully detect fraud by using multiple detection algorithms that intelligently consider the unique characteristics of each of the various types of fraud.

[0074]

[0075] Furthermore, as explained above, multiple customers may engage in money laundering or terrorist financing together by making one small transaction for each person on different days, and daily monitoring would miss such cases. This leads to the logical conclusion that a system using a single method to detect behavioral changes would waste resources and miss true cases of money laundering and terrorist financing. In one aspect of the present disclosure, money laundering and terrorist financing activities are detected by different detection methods that data mine all transactions across a financial institution accumulated over a period of time based on user-defined scenarios.

[0075]

[0076] In one aspect of the present disclosure, a computer system uses multiple detection methods to monitor transactions and integrates the detection results into a centralized case management platform. This approach integrates and streamlines anti-money laundering, anti-fraud, and anti-financial crimes measures to improve detection while maintaining a holistic and accurate picture at all times. As a result, financial institutions can improve compliance with regulatory requirements, eliminate risk, avoid losses, increase productivity, reduce resources used to manage transaction risk, reduce costs associated with hardware, databases, and software, lower IT maintenance workloads, and increase overall profitability.

[0076]

[0077] In one aspect of the present disclosure, a computer system compares a customer's (or a group of customers') transaction patterns with known money laundering transaction patterns to detect suspected money laundering activity. If there is a match, possible money laundering activity may have been detected.

[0077]

[0078] For example, many criminals know that if more than $10,000 in cash is deposited into a bank account on the same day, the bank must submit a Currency Transaction Report (CTR) to the U.S. government. To avoid submitting a CTR, criminals often split a single large cash deposit into multiple smaller cash deposits, each on a different day, each for less than $10,000. This transaction pattern, known as "structuring," is a known money laundering transaction pattern, and computer systems can detect this type of transaction pattern. There are many other types of transaction patterns known as money laundering transaction patterns. Computer systems can be designed to detect each of these known money laundering transaction patterns. As a result, money laundering activity can be detected based on the transaction patterns of one or more suspects, even without any changes in behavior.

[0078]

[0079] In one aspect of the present disclosure, a BSA officer (or responsible person) investigates a detected case to determine whether it is a true money laundering case. In one aspect of the present disclosure, a BSA officer also reviews all past cases related to the suspect(s) in the currently detected case. In one aspect of the present disclosure, if the BSA officer agrees that such transactions are suspicious activity, the computer system assists the BSA officer in filing a SAR with FinCEN. In another aspect of the present disclosure, if the BSA officer decides not to file a SAR, the BSA officer enters into the computer system a reason justifying the decision not to report such detected activity.

[0079]

[0080] In another aspect of the present disclosure, to detect suspicious money laundering activities, groups of customers with one or more common risk factors (or characteristics), such as business type, business model, organizational structure, size, location, products, services, carrier type, and position, are compared together. If a customer's trading activity (e.g., trading pattern, trading volume, trading frequency, trading tendency, number of trades, trading value, trading derivatives, etc.) differs from that of other customers, the customer may have engaged in suspicious money laundering activities. In one aspect of the present disclosure, statistical values, such as the mean, variance, and standard deviation of a group of customers, are used to facilitate such comparison. Similarly, if a customer behaves differently from other customers with the same set of risk factors (or characteristics), the customer may have engaged in suspicious money laundering activities. As a result, suspicious money laundering activities can be detected even when there is no change in behavior in any of the accounts.

[0080]

[0081] Sometimes, it may not be easy to compare groups of customers together. For example, an MSB with 100 branches will have much more cash activity than another MSB with only two branches. In one aspect of the present disclosure, to achieve a more effective comparison, it is useful to compare some derivatives (e.g., ratios of some numerical values) instead of the original raw data. For example, the ratio may be "total cash withdrawals from the bank divided by total number of checks deposited in the bank." In this example, the number of checks deposited may be used to measure the size of the MSB's check cashing business. Thus, the ratio of "total cash withdrawals divided by total number of checks deposited" essentially scales the check cashing business of a 100-branch MSB to the check cashing business of a 2-branch MSB to approximately the same level based on check cashing activity, allowing them to be compared on a more equitable basis.

[0081]

[0082] Many other derivatives can be used to achieve better comparisons. In general, derivatives for more effective comparisons may include a first variable of interest divided by a second variable measuring the size of the company (or business). For example, "total ACH outgoing transactional amount divided by total number of checks deposited," "total wire outgoing transactional amount divided by total number of checks deposited," "total number of prepaid cards issued divided by total number of checks deposited," "total ACH outgoing transactional amount divided by total number of branches," "total wire transfer transactional amount divided by total number of branches," "total number of prepaid cards issued divided by total number of branches," "total ACH outgoing transactional amount divided by total number of prepaid cards issued," "total wire transfer transactional amount divided by total number of prepaid cards issued," etc. are just a few examples of derivatives that may be used. In one aspect of the present disclosure, in addition to the ratios above, other forms of mathematical transformations create derivatives.

[0082]

[0083] In one aspect of the present disclosure, a computer system compares a particular customer's derivatives with those of a group of customers (e.g., the same type of business or occupation) that share one or more common risk factors (or characteristics) with the particular customer. If the particular customer's derivatives deviate significantly from those of the group of customers, the particular customer may have engaged in suspected money laundering activities. In one aspect of the present disclosure, statistical analysis, such as the mean, variance, and standard deviation of the group of customers, facilitates such comparisons.

[0083]

[0084] In one aspect of the present disclosure, a computer system uses many different risk factors to determine the money laundering risk of each customer of a financial institution. For example, these risk factors may include the customer's industry, the customer's business type, the customer's geographic area, the customer's country of residence, the nature of the customer's business, the business's product type, the business's service type, the business's structure, the customer's occupation, nationality, past records (including compliance records such as the number of currency transaction reports, the number of suspicious activity reports, matches to OFAC lists, matches to 314(a) lists, matches to Politically Exposed Persons lists, and special designations under compliance programs), the type of transaction made, account balance, fund inflows, fund outflows, transaction patterns, number of transactions, transaction amounts, transaction volumes, transaction frequency, derivatives of the transaction, transaction location, transaction time, transaction country, sender of remittance transaction, sender's location, sender's country, sender's characteristics, recipient of remittance transaction, recipient's location, recipient's country, recipient's characteristics, relationships, social status, political exposure, past transactions, etc. Indeed, thousands of risk factors may be considered to determine a customer's money laundering risk. For the purposes of this disclosure, a "risk factor" is also referred to as a "representative element of a risk dimension" or simply as a "risk dimension."

[0084]

[0085] According to aspects of the present disclosure, each attribute of a customer that may affect the customer's risk is a risk factor. Additionally, each characteristic of a customer that may affect the customer's risk may be a risk factor. Furthermore, each type of customer activity that may affect the customer's risk is a risk factor. Risk factors may also be influenced by other risks, such as a piece of information related to the customer, the customer's transaction type, and / or the customer's transaction pattern. Each risk factor is assigned a risk value.

[0085]

[0086] In one configuration, each degree of risk of the same type is a risk factor and is assigned a risk score. For example, a 30-day cash transaction amount can be used to measure the degree of risk associated with money laundering. For example, cash transaction amounts (or degrees) can be defined as follows: $0 to $5,000 over a 30-day period has a risk score of 10, $5,001 to $50,000 has a risk score of 50, $50,001 to $250,000 has a risk score of 100, $250,001 to $1,000,000 has a risk score of 200, $1,000,001 to $10,000,000 has a risk score of 500, and $10,000,000 or more has a risk score of 1,000. In this example, someone with a total cash transaction value of $60,000 over a 30-day period would fall into the "$50,001 to $250,000" total transaction value level and have a risk score of 100.

[0086]

[0087] "Cash transaction amount" is used merely as an example. Other considerations, such as the number of cash transactions and the rate of growth of cash transactions, may also be used to measure the degree of risk associated with money laundering. In addition to cash, other financial transactions, such as checks, wires, ATMs, ACH, virtual currencies, virtual securities, virtual instruments, credit cards, debit cards, prepaid cards, monetary instruments, and transfers, may also be used to measure the degree of risk associated with money laundering. Those skilled in the art can easily identify numerous risk factors based on the above examples.

[0087]

[0088] In one aspect of the present disclosure, the risk score-based scenarios are based on customer data. Each piece of information about a customer is a risk factor and is assigned a risk score. Additionally or alternatively, the risk score-based scenarios are based on transaction data. Each amount level (or degree of amount) of a transaction type is a risk factor and is assigned a risk score.

[0088]

[0089] In one aspect of the disclosure, the customer data may include the customer's industry, the customer's business type, the customer's geographic area, the country where the customer is located, the nature of the customer's business, the product type of the business, the service type of the business, the structure of the business, the customer's occupation, the customer's nationality, past records, the type of transaction made, the account balance, the inflow of funds, the outflow of funds, the transaction pattern, the number of transactions, the amount of transactions, the volume of transactions, the frequency of transactions, the derivative of the transaction, the location of the transaction, the time of the transaction, the country of the transaction, the sender of the remittance transaction, the location of the sender, the country of the sender, the nature of the sender, the recipient of the remittance transaction, the location of the recipient, the country of the recipient, the nature of the recipient, the relationship, social status, political exposure, past transactions, the number of suspicious activity reports (SARs) filed for money laundering and terrorist financing cases, the category of the first financial institution, the business type of the first financial institution, the geographic area of ​​the first financial institution, the country where the first financial institution is headquartered, the nature of the business of the first financial institution, the age of the person, the gender of the person, the income level of the person, the appearance of the person, judgments about the person, the personal status of the person, the family status of the person, the status of a person's family members, the status of a person's family members, the status of a person's friends, the past records of a person, the person's industry, the person's geographic area, the country in which the person resides, the person's occupation, the employee's job type, the employee's education level, the employee's income level, the length of employment at the current job, the performance evaluation records, the employment history, the length of each employment in the employment history, the reason for leaving each employment in the employment history, the employee's age, the employee's gender, the employee's personal status, the employee's family members, the status of the employee's family members, the status of the employee's friends, the employee's past records, the type of work performed, the number of transactions executed, the amount of transactions executed, the highest amount of transactions, the number of transactions with a specific counterparty, the amount of transactions with a specific counterparty, the number of changes to material records, the number of changes to material records related to a specific counterparty, the geographic area of ​​the employee's home, the geographic area of ​​the employee's office, the country in which the employee resides, the customer due diligence results, the length of account history, the number of names matched to gambling organizations in transactions, or any combination thereof.

[0089]

[0090] In one aspect of the present disclosure, the transaction data is associated with one or more of cash, check, wire transfer, ATM (Automated Teller Machine), ACH (Automated Clearing House), virtual currency, virtual securities, virtual certificates, credit cards, debit cards, prepaid cards, electronic funds transfer, wires, monetary instruments, letters of credit, notes, securities, commercial paper, commodities, precious metals, account openings, account closures, account applications, deposits, withdrawals, cancellations, balance checks, inquiries, credits, debits, or combinations thereof.

[0090]

[0091] In one aspect of the present disclosure, each risk factor is assigned a risk score, and the customer is assigned an overall risk score that is the sum of all of the risk scores of the risk factors associated with the customer. This process of generating an overall risk score for each customer may be referred to as risk scoring. This overall risk score is used to determine the level of risk associated with the customer. In this disclosure, summation is used as an example. In fact, many different types of mathematical transformations may also be used to achieve a similar effect.

[0091]

[0092] In one aspect of the present disclosure, each risk factor is assigned a risk score, and the customer is assigned an overall risk score that is a value derived from a mathematical transformation of all of the risk scores of the risk factors associated with the customer.

[0092]

[0093] As explained earlier, unlike in fraud situations, higher risk clients may not be suspected of money laundering or terrorist financing. High risk may simply be a characteristic of the client. For example, MSBS, pawnbrokers, car dealers, pilots, and flight attendants are often classified as higher risk clients for anti-money laundering and anti-terrorist financing purposes, but this does not mean that these clients are engaging in money laundering or terrorist financing activities.

[0093]

[0094] Nevertheless, because a customer has a high risk score, the customer may be monitored more closely and a different monitoring method may be applied. Thus, in one aspect of the present disclosure, a customer's total risk score is used to determine the monitoring method to be applied to monitor the customer. If the customer's total risk score is higher, a more strict monitoring method is applied to monitor the customer. If the customer's total risk score is low, a less strict monitoring method is applied to monitor the customer.

[0094]

[0095] In other words, in one aspect of the present disclosure, a customer's total risk score is not used to determine whether the customer is suspicious. Instead, the customer's total risk score is used to select an algorithm or set of algorithms for monitoring the customer.

[0095]

[0096] At times, customers with very high risk scores may be suspicious. Thus, in one aspect of the present disclosure, if a customer's total risk score is higher than a predetermined value, an alert is triggered for this customer so that investigators can investigate the potential case. The predetermined value may be set by the software module, by someone who designs the system, by someone who tunes the system, by someone who uses the system, or a combination thereof.

[0096]

[0097] In one aspect of the present disclosure, groups of customers with the same risk factors are compared together. For example, all customers who are flight attendants can be compared together. In one aspect of the present disclosure, if a particular flight attendant's total risk score is much higher than a reference value derived from the total risk scores of all flight attendants, this particular flight attendant may have engaged in some suspicious money laundering activity. The reference value may include an average, median, mean, mode, weighted average, and / or other statistical value.

[0097]

[0098] Statistical approaches can also be applied to facilitate the detection of suspicious activity. For example, a mean, variance, and standard deviation can be derived from the total risk scores of all customers who are flight attendants. In one aspect of the present disclosure, if a particular flight attendant's total risk score is more than four standard deviations higher than the average total risk score of all flight attendants, then the particular flight attendant may have engaged in suspicious activity.

[0098]

[0099] The "four times" mentioned above is merely an example. The number "four" can be any number, such as 3.75, 4.21, 10, etc. In one aspect of the present disclosure, if a particular flight attendant's total risk score is more than x standard deviations higher than the average total risk score of all flight attendants, then this particular flight attendant may have engaged in suspected money laundering activity, where x is a number assigned by the BSA officer (or responsible person). This statistical approach is applicable whenever group comparisons are used.

[0099]

[0100] Flight attendants are merely one example used to illustrate this method of detecting suspicious money laundering activity among a group of entities. In fact, many other risk factors may be used for similar purposes. Because tens of thousands of risk factors exist, in one aspect of the present disclosure, the computer system allows a user to select any risk factor to identify all customers with the same risk factor. In one aspect of the present disclosure, if a particular customer has a total risk score that is much higher than a reference value derived from the total risk scores of other customers with the same risk factor, the particular customer may have engaged in suspicious money laundering activity. The reference value may include a mean, median, average, mode, weighted average, and / or other statistical value.

[0100]

[0101] Instead of a single risk factor, a group of risk factors can also be used. In fact, a group of risk factors can improve the accuracy of detection results. For example, in addition to the risk factor of occupation (e.g., flight attendant), the country of destination of the flight where the flight attendant works can be another useful risk factor for detecting money laundering risks. For example, a flight attendant working on a New York-Chicago flight may have different activities from another flight attendant working on a Miami-Mexico City flight. It may be more accurate to compare subgroups of flight attendants working on a Miami-Mexico City flight. In this example, two risk factors, namely occupation and flight destination city, are considered to improve the accuracy of detection.

[0101]

[0102] In one aspect of the present disclosure, a set of risk factors is used to identify a group of entities. If a particular entity has a total risk score that is much higher than a reference value derived from the total risk scores of all entities with the same set of risk factors, the particular entity may have engaged in suspicious money laundering activities. The reference value may include the mean, median, average, mode, weighted average, and / or other statistical values. To simplify calculations, standard group statistics such as the mean, variance, and standard deviation, which can be easily calculated based on existing software development tools, may be derived to facilitate such comparisons among groups of entities. As a result, even if there is no behavioral change in an account, the computer system can still detect suspicious money laundering activities based on the above approach.

[0102]

[0103] At times, some entities are so different from others that it may be useful to exclude such entities from the group comparison process. In one aspect of the present disclosure, the computer system allows the user to select some entities that will not be included in the group comparison process.

[0103]

[0104] Detecting flight attendants as having suspicious money laundering activity is just one example. Similar methods are applicable to many other different situations. For example, it is typically very difficult for a bank or credit union to detect a customer of a money service business (MSB) as having suspicious money laundering or terrorist financing activity because MSBs conduct many transactions every day and one money laundering transaction can be hidden among many other normal transactions.

[0104]

[0105] In one aspect of the present disclosure, an additional risk factor (e.g., proximity to the Mexican border) is used to identify a group of MSBs having this same set of risk factors (e.g., in addition to the first risk factor, i.e., type of business). If a particular MSB has a total risk score higher than a reference value derived from the total risk scores of all MSBs having the same set of risk factors, then the particular MSB has likely engaged in suspected money laundering activity. Reference values ​​include the mean, median, average, mode, weighted average, and / or other statistical values. Similarly, standard group statistics such as the mean, variance, standard deviation, etc. may be derived to facilitate such comparisons among groups of MSBs.

[0105]

[0106] Sometimes, it may not be easy to compare groups of MSBs because they may have different types of operations and different sizes. In one embodiment of the present disclosure, part-time MSBs and full-time MSBs are assigned two different risk factors because the nature of their businesses may differ. In another embodiment of the present disclosure, a risk factor is assigned to each of the different types of MSB products and / or services. For example, money transfers, check cashing, currency transactions, prepaid card management, etc. are each assigned a risk factor, even though they may all be provided by the same MSB. In one embodiment of the present disclosure, a set of risk factors that precisely defines the type of product and / or service is used to identify risk.

[0106]

[0107] In one aspect of the present disclosure, some risk factors are adjusted based on the size of the operation to make group comparisons more effective. For example, an MSB with 50 branches may necessarily have five times the total cash transaction volume of another MSB with 10 branches. Sometimes, to make group comparisons, risk factors affected by the size of the operation can be adjusted to take into account the size of the operation. For example, for an MSB with 50 branches, the total cash transaction volume over a 30-day period can be divided by 50 to establish adjusted risk factors and risk scores for group comparisons. Branches are used here as an example to measure the size of the operation. Other information, such as the number of customers, number of transactions, number of employees, and asset size, can also be used to measure the size of the operation.

[0107]

[0108] In one aspect of the present disclosure, a set of risk factors adjusted based on the size of operations (e.g., adjusted risk factors) is used to identify a group of entities having this adjusted set of risk factors. The risk score of the adjusted risk factors is referred to as the adjusted risk score. If a particular entity has an adjusted total risk score that is much higher than a reference value derived from the adjusted total risk scores of all entities having the same set of adjusted risk factors, the particular entity may have engaged in suspicious money laundering activities. The reference value may include a mean, median, average, mode, weighted average, and / or other statistical value. Generally, in one aspect of the present disclosure, detection algorithms that incorporate risk factors into their detection algorithms may also be modified to incorporate adjusted risk factors into their detection algorithms. Detection algorithms that incorporate risk scores into their detection algorithms may also be modified to incorporate adjusted risk scores into their detection algorithms.

[0108]

[0109] To simplify the calculations, standard group statistics such as means, variances, and standard deviations based on the adjusted risk factors and adjusted risk scores can be derived to facilitate such comparisons among groups of entities. As a result, even if there is no behavioral change in an account, the computer system can still detect suspicious money laundering activity based on the above approach.

[0109]

[0110] Because MSBs may have different transactional activities than other types of businesses, it is more effective to monitor MSBs based on their unique transactional activities. Therefore, in one aspect of the present disclosure, different sets of detection algorithms may be used to monitor entities with different sets of risk factors. In one aspect of the present disclosure, a set of risk factors is used to identify a group of entities with the set of risk factors, and a specific set of detection algorithms is used to detect suspicious money laundering activity in the group of entities. In other words, a set of detection algorithms is selected to monitor a group of entities based on a set of risk factors associated with the group of entities.

[0110]

[0111] In another aspect of the present disclosure, a set of risk factors is adjusted based on the size of operations and used to identify a group of entities having this adjusted set of risk factors, and a particular set of detection algorithms is used to detect suspected money laundering activity in this group of entities. In other words, a set of detection algorithms is selected for monitoring the group of entities based on the set of adjusted risk factors associated with the group of entities.

[0111]

[0112] Sometimes it makes sense to monitor higher risk entities more closely than lower risk entities. Thus, different sets of detection algorithms are used to monitor different entities having different levels of risk. In one aspect of the present disclosure, a set of detection algorithms is selected to monitor an entity based on the entity's total risk score. In another aspect of the present disclosure, a set of detection algorithms is selected to monitor an entity based on the entity's adjusted total risk score, where the adjusted total risk score is obtained from the risk scores of the adjusted risk factors.

[0112]

[0113] In one aspect of the present disclosure, when an MSB is detected as having potential money laundering activity, the computer system may identify a transaction (or group of transactions) that caused the detected MSB to have an aggregate risk score higher than a reference value derived from the aggregate risk scores of all MSBs, including a mean, median, average, mode, weighted average, and / or other statistical value.

[0113]

[0114] Similarly, when an MSB is detected as having possible money laundering activity, the computer system identifies a transaction (or group of transactions) that caused the detected MSB to have an adjusted total risk score higher than a reference value derived from the adjusted total risk scores of all MSBs. The reference value may include a mean, median, average, mode, weighted average, and / or other statistical value. As a result, a money laundering transaction (or group of money laundering transactions) may be identified by this approach. This approach of identifying specific transactions (or groups of transactions) with higher risk scores (or higher adjusted risk scores) can be used not only with MSBs, but also with other types of customers.

[0114]

[0115] Conventionally, a higher risk score means a higher risk. However, there is no rule prohibiting a person or company from defining a lower risk score for a higher risk. To avoid confusion, the explanation in this disclosure is based on the convention that a higher risk score means a higher risk. Furthermore, the risk score may be a negative value. A negative risk score means a reduced risk based on this convention.

[0115]

[0116] As noted above, MSBs are just one example. Other types of businesses, such as pawn shops, car dealerships, etc., can be monitored in a similar manner. As a result, the risk factors, risk scores, adjusted risk factors, adjusted risk scores, total risk scores, and adjusted total risk scores can be used in a variety of ways to detect suspicious money laundering activity even in the absence of behavioral changes in accounts.

[0116]

[0117] Indeed, governmental or non-governmental agencies such as the OCC, FDIC, Federal Reserve, NCUA, FinCEN, SEC, and FINRA may monitor financial institutions such as banks, credit unions, insurance companies, and stockbrokers based on approaches similar to those described above for monitoring MSBs. Different risk factors, risk scores, adjusted risk factors, and adjusted risk scores may be defined for this monitoring purpose.

[0117]

[0118] In one aspect of the present disclosure, a computer system uses many different risk factors to determine whether a financial institution is in compliance with regulatory requirements regarding the filing of SARs to report money laundering and terrorist financing cases. For example, these risk factors may include the number of SARs filed for money laundering and terrorist financing cases, the financial institution's category, the financial institution's business type, the financial institution's geographic area, the financial institution's country of headquarters, the financial institution's business nature, the business's product type, the business's service type, the business's structure, the financial institution's customer profile, past records, the type of transaction conducted, fund inflows, fund outflows, transaction patterns, the number of transactions, the transaction amount, the transaction volume, the transaction frequency, the transaction derivative, the transaction location, the transaction time, the transaction country, the sender of the remittance transaction, the sender's location, the sender's country, the sender's nature, the remittance transaction recipient, the recipient's location, the recipient's country, the recipient's nature, relationships, the customer's social status, the customer's political exposure, the sender's political exposure, the recipient's political exposure, past transactions, etc. In fact, thousands of risk factors may be considered to determine a financial institution's compliance risk.

[0118]

[0119] In one aspect of the present disclosure, the number of branches is used to adjust the risk factors and risk scores. In another aspect of the present disclosure, asset size is used to adjust the risk factors and risk scores. Many other factors may also be used to adjust the risk factors and risk scores. In this current example, the risk factor "number of SARs submitted" may have a negative value because the more SARs submitted by a financial institution, the less likely the financial institution will fail to submit a SAR.

[0119]

[0120] In one aspect of the present disclosure, the set of risk factors is adjusted based on the size of operations and used to identify a group of banks having this adjusted set of risk factors. If a particular bank has an adjusted total risk score that is much higher than the baseline adjusted total risk score of all banks having the same set of adjusted risk factors, the particular bank may have failed to meet its compliance obligations to detect and report suspected money laundering and / or terrorist financing activities. The baseline may include the mean, median, average, mode, weighted average, and / or other statistical values. To simplify calculations, standard group statistics such as the mean, variance, and standard deviation may be derived to facilitate such comparisons among groups of entities.

[0120]

[0121] Additionally, different detection algorithms may be used to monitor different banks having different sets of risk factors. In one aspect of the present disclosure, a set of risk factors is used to identify a group of banks having the set of risk factors, and a particular set of detection algorithms is used to detect possible oversight of compliance matters in the group of banks. Thus, in one aspect of the present disclosure, a set of detection algorithms is selected for monitoring a group of banks based on a set of risk factors associated with the group of banks.

[0121]

[0122] In another aspect of the present disclosure, a set of risk factors is adjusted based on business size and used to identify a group of banks having this adjusted set of risk factors, and a specific set of detection algorithms is used to detect possible oversight of compliance matters in this group of banks. In other words, a set of detection algorithms is selected for monitoring the group of banks based on the set of adjusted risk factors associated with the group of banks.

[0122]

[0123] Although banks are used in the above examples, the same set of methods can be used to monitor credit unions, stockbrokers, insurance companies, other financial institutions, and other types of businesses. Furthermore, the scope of monitoring is not limited to compliance with anti-money laundering and counter-terrorist financing issues. Indeed, all types of issues in all types of businesses can be monitored by the methods described in this disclosure by appropriately defining the risk factors, risk scores, adjusted risk factors, adjusted risk scores, and detection algorithms associated with such issues.

[0123]

[0124] MSBs also must comply with numerous laws and regulations. However, unlike a bank or credit union, MSBs do not actually know who their customers are. A typical MSB provides money services to consumers who walk into its offices. Even if an MSB collects identifying information from all of its clients, the MSB may not be able to correctly identify money laundering activity. For example, a consumer may use a Mexican passport to transfer $7,000 in cash to an MSB in the morning, and then use a California driver's license to transfer $8,000 in cash to the same MSB in the afternoon. Because two identification documents are used, this same consumer may be considered two different people. Although required by law to file currency transaction reports because more than $10,000 in cash is provided by the same consumer, an MSB may not do so. This situation is further complicated when an MSB has multiple branches, as the same consumer can walk into different branches and conduct transactions based on different identification documents.

[0124]

[0125] In one aspect of the present disclosure, a computer system compares the names, phone numbers, addresses, dates of birth, etc. of all consumers who have conducted transactions with the MSB to identify all transactions that may have been conducted by the same consumer. After all transactions associated with the consumer have been identified, the computer system can detect suspicious money laundering activity associated with the consumer based on the transactions associated with the consumer.

[0125]

[0126] In one aspect of the present disclosure, a BSA officer (e.g., a person tasked with investigating) investigates the detected case to determine whether it is a true money laundering case. The BSA officer also reviews all past cases related to the consumer of the newly detected case. If the BSA officer agrees that the detected case is a suspected money laundering case, the computer system assists the BSA officer in filing a SAR with FinCEN. If the BSA officer decides not to file a SAR, the BSA officer enters into the computer system a reason justifying the decision not to report the detected case.

[0126]

[0127] Sometimes, Correspondent Bank A and Correspondent Bank B do not have a direct banking relationship, so one bank will receive a wire transfer from a client of Correspondent Bank A and resend the wire transfer to another client of Correspondent Bank B. This situation often occurs during international wire transfers, as banks in two different countries may not have a direct banking relationship. This type of wire transfer is often called an intermediary wire transfer.

[0127]

[0128] Banks that provide intermediary wire transfer services are exposed to a very high money laundering risk because the sender and recipient of the intermediary wire transfer are not the bank's customers. In addition, banks may not know the true background of the sender and recipient of the wire transfer. The sender may be a terrorist financier and the recipient may be a terrorist. Banks that handle intermediary wire services may unknowingly become a channel for money laundering and terrorist financing.

[0128]

[0129] In one configuration of the present disclosure, a computer system compares the names, addresses, countries, phone numbers, email addresses, etc. of all senders and recipients of intermediated wire transfers to identify transactions associated with each sender and each recipient. In one aspect of the present disclosure, if the computer system detects an unusually large number of wire transfers from the same sender, the sender and recipient may be involved in money laundering or terrorist financing activities. If the computer system detects an unusually large total amount of wire transfers from the same sender, the sender and recipient may be involved in money laundering activities.

[0129]

[0130] Similarly, if a computer system detects an unusually large number of wire transfers to the same recipient, the sender and recipient may be involved in money laundering or terrorist financing activities. If a computer system detects an unusually large amount of wire transfers to the same recipient, the sender and recipient may be involved in money laundering activities.

[0130]

[0131] If a computer system detects an unusual number of wire transfers from the same sender to the same recipient, the sender and recipient may be involved in money laundering or terrorist financing activities.If a computer system detects an unusually large amount of wire transfers from the same sender to the same recipient, the sender and recipient may be involved in money laundering or terrorist financing activities.

[0131]

[0132] In one aspect of the present disclosure, BSA personnel investigate such detected cases to determine whether they are true money laundering cases. BSA personnel also review all past cases related to the suspect in the newly detected case. If the BSA personnel agree that there is suspected money laundering activity, the computer system assists the BSA personnel in filing a SAR with FinCEN. If the BSA personnel decides not to file a SAR, the BSA personnel enters into the computer system a reason justifying the decision not to report such detected activity.

[0132]

[0133] With a large portion of the population rapidly aging, several states recently enacted the Elder Financial Abuse Reporting Act (EARA) to protect elderly people who are unable to protect themselves. Elderly people are frequently tricked into giving money to perpetrators. Therefore, financial institutions train their frontline staff to observe and report what appear to be possible cases of elder abuse. This human-based approach is ineffective because transactions can be conducted remotely and perpetrators can effectively hide their activities. Furthermore, human workers are prone to error and mistakes. Relying on human workers to detect and report cases of elder abuse is ineffective.

[0133]

[0134] Many businesses store customer birthdate information in a database. In one aspect of the present disclosure, a computer system collects the birthdate information and identifies seniors who are above a predetermined age. The computer system monitors all seniors' transactions and detects changes in their activities.

[0134]

[0135] For example, if an unusually large amount of funds is withdrawn from an elderly person's account, the financial institution may wish to investigate the purpose of the fund transfer. In one aspect of the present disclosure, if an unusually large check is deposited into an elderly person's account, the financial institution may wish to investigate whether a counterfeit check was given to the elderly person in exchange for the elderly person's real money or assets. If there is an unusual transaction pattern (e.g., unusual frequency or volume) on an elderly person's account, the financial institution may wish to investigate the transaction(s). If an elderly person's account balance is rapidly decreasing, the financial institution may wish to investigate transactions related to this account.

[0135]

[0136] In one aspect of the present disclosure, the methods for selecting risk factors, risk scores, adjusted risk factors, adjusted risk scores, total risk scores, adjusted total risk scores, statistical approaches, and detection algorithms described above are applicable to detect possible cases of elder abuse. Because elder abuse is different from money laundering, different sets of risk factors and risk scores may be used to detect elder abuse. For example, these risk factors may include the person's age, the person's gender, the person's income level, the person's appearance, judgments about the person, the person's personal condition, the person's family condition, the person's family members, the status of the person's family members, the person's friends, the status of the person's friends, the person's past record, the person's industry, the person's geographic area, the person's country of residence, the person's occupation, nationality, the type of transaction made, the account balance, the inflow of funds, the outflow of funds, the transaction pattern, the number of transactions, the amount of transactions, the volume of transactions, the frequency of transactions, the derivative of the transaction, the location of the transaction, the time of the transaction, the country of the transaction, the sender of the remittance transaction, the location of the sender, the country of the sender, the nature of the sender, the recipient of the remittance transaction, the location of the recipient, the country of the recipient, the nature of the recipient, the relationship, social status, political exposure, past transactions, etc. Indeed, many different risk factors may be considered to determine an individual's risk of elder abuse.

[0136]

[0137] For example, in one aspect of the present disclosure, risk factors are used to identify a group of elderly people who have the same risk factors. If a particular elderly person has a total risk score higher than a reference value derived from the total risk scores of all elderly people who have the same risk factors, the particular elderly person may be a victim of a potential elder abuse case. The reference value may include a mean, median, average, mode, weighted average, and / or other statistical value. In another aspect of the present disclosure, a set of risk factors is used to identify a group of elderly people who have the set of risk factors. If a particular elderly person has a total risk score higher than a reference value derived from the total risk scores of all elderly people who have the same set of risk factors, the particular elderly person may be a victim of a potential elder abuse case. The reference value may include a mean, median, average, mode, weighted average, and / or other statistical value.

[0137]

[0138] To simplify the calculations, standard group statistics such as mean, variance, standard deviation, etc. can be derived to facilitate such comparisons among groups of entities. As a result, even if there is no behavioral change in an account, a computer system can still detect possible cases of elder abuse based on the above approach.

[0138]

[0139] Very often, a business will have a compliance officer who is responsible for all regulatory compliance matters. In one aspect of the present disclosure, an investigator (e.g., a compliance officer) investigates the detected case to determine whether a true case of elder abuse has occurred. The compliance officer also reviews all past cases related to the elderly person in the newly detected case. If the compliance officer agrees that the case is a possible case of elder abuse, the computer system assists the compliance officer in reporting the detected case. If the compliance officer decides not to report the detected case, the compliance officer enters into the computer system a reason justifying the decision not to report the detected case.

[0139]

[0140] According to the Sarbanes-Oxley Act (SOX), certain companies (e.g., publicly traded companies) must conduct internal control monitoring to prevent fraud committed by their employees. Traditionally, such internal control monitoring is performed by human workers (e.g., auditors) who spend several months each year auditing a company's financial records. This human-based approach is ineffective because human workers are prone to error and mistakes. Furthermore, because it takes a considerable amount of time to audit financial records, it may be too late to prevent crime.

[0140]

[0141] In one aspect of the present disclosure, a computer system monitors accounting general ledger items and detects anomalous patterns (e.g., abnormal frequency, volume, rate of increase, etc.) associated with the general ledger items to identify suspected insider fraud activity. For example, if the general ledger item for travel expenses suddenly increased by 500% this month compared to its history over the past 12 months, this could indicate that some employees are abusing their privileges to incur anomalous expenses.

[0141]

[0142] In one aspect of the present disclosure, a computer system compares the current value of an accounting general ledger item to a reference value derived from historical values ​​of the same accounting general ledger item for the past x months, where the value x is predefined. If the current value is greater than the reference value by a significant margin, some employees may have committed fraud. The reference value may include the mean, median, average, mode, weighted average, and / or other statistical values. Further investigation may be conducted to determine why the general ledger item's value deviated from its historical value.

[0142]

[0143] In another aspect of the present disclosure, the computer system compares an employee's current activity with the employee's past activity to detect any changes. For example, if a loan officer issues an unusually large number of loans in a month compared to the number per previous month, the loan officer's activity may be suspicious. If a loan officer issues a loan with an unusually large loan amount compared to the amount in the past, the loan officer's activity may be suspicious. If a loan officer issues a loan with an unusually large total amount in a month compared to the total amount in the past month, the loan officer's activity may be suspicious.

[0143]

[0144] Very often, activity can be measured by a value called an activity value. For example, a loan officer's activity can be measured by the number of loans, the largest loan amount, the total amount of loans, the average amount per loan, the number of loans to the same customer, the number of loan record changes, the number of loan record changes with the same customer, the frequency of loan record changes, the frequency of loan record changes with the same customer, the type of loan, etc. A bank teller's activity can be measured by the total number of transactions, the total amount of transactions, the largest transaction amount, the average amount per transaction, the type of transaction, the number of customers with whom the teller transacts, the average number of transactions per customer, the number of transactions with the same customer, the number of customer record changes, the number of customer record changes with the same customer, the frequency of customer record changes, the frequency of customer record changes with the same customer, etc. In one aspect of the present disclosure, a computer system compares the current value of an activity to a reference value derived from historical values ​​of the same activity. If the current value is greater than the reference value by a significant margin, the person performing the activity may have committed fraud. Further investigation can be conducted to determine whether the person has indeed committed fraud. The metric may include the mean, median, average, mode, weighted average, and / or other statistical value.

[0144]

[0145] In one aspect of the present disclosure, the computer system compares the employee's activities with the activities of other employees with the same role at the company. For example, if a teller (or loan officer, etc.) behaves very differently from other tellers (or loan officers, etc.) at the same branch, the teller (or loan officer, etc.) may have engaged in some suspicious activity.

[0145]

[0146] In one aspect of the present disclosure, the computer system compares the activity value of a particular employee to a reference value derived from all activity values ​​for the same activity of all employees with the same responsibilities as the particular employee. If the activity value of the particular employee significantly deviates from the reference value, the particular employee may have committed fraud. Further investigation can be conducted to determine whether the employee has indeed committed fraud. The reference value may include the mean, median, average, mode, weighted average, and / or other statistical value.

[0146]

[0147] When comparing a single employee to a group of employees, the statistical approach used in the flight attendant example above can be applied. For example, a comprehensive set of risk factors associated with the employee can be identified, and a risk score assigned to each risk factor. As a result, each employee has an overall risk score obtained from a mathematical transformation (e.g., summation) of all risk scores associated with the employee.

[0147]

[0148] A set of risk factors for detecting employee-related fraud may differ from a set of risk factors for detecting other types of suspicious activity, such as money laundering. For example, risk factors for detecting employee fraud may include the employee's job type, the employee's educational background, the employee's income level, length of employment at current job, performance evaluation records, employment history, length of each employment in the employment history, reason for leaving each employment in the employment history, the employee's age, the employee's gender, the employee's personal status, the employee's family status, the employee's family members, the status of the employee's family members, the status of the employee's friends, the employee's past records, type of work performed, number of transactions performed, amount of transactions performed, maximum transaction amount, number of transactions with a specific counterparty, amount of transactions with a specific counterparty, significant These risk factors may include the number of changes to important records, the number of changes to important records related to a particular counterparty, the geographic area of ​​the employee's home, the geographic area of ​​the employee's office, the country in which the employee resides, nationality, the type of transaction made, the balance of the account, the inflow of funds, the outflow of funds, the transaction pattern, the number of transactions, the amount of transactions, the volume of transactions, the frequency of transactions, the derivative of the transaction, the location of the transaction, the time of the transaction, the country of the transaction, the sender of the remittance transaction, the location of the sender, the country of the sender, the nature of the sender, the recipient of the remittance transaction, the location of the recipient, the country of the recipient, the nature of the recipient, relationships, social status, political exposure, past transactions, etc. Indeed, numerous risk factors may be considered to determine an employee's risk of fraud. In one aspect of the present disclosure, different sets of risk factors may be used to detect different types of suspicious activity.

[0148]

[0149] In one aspect of the present disclosure, if a particular employee's total risk score is higher than the average total risk score of all employees with the same risk factors as the particular employee by a significant margin, the particular employee may have engaged in suspicious activity. The significant margin may be set in terms of a number of standard deviations or other reference value.

[0149]

[0150] To improve the accuracy of the detection results, multiple risk factors may be used instead of one risk factor. In one aspect of the present disclosure, if a particular employee's total risk score is higher by a significant margin than the average of the total risk scores of all employees who have the same set of risk factors as the particular employee, the particular employee may have engaged in some suspicious activity. In one example, the significant margin is set in terms of the number of standard deviations or other reference value.

[0150]

[0151] Indeed, by identifying risk factors associated with a group of entities and appropriately assigning a risk score to each risk factor, a statistical approach based on each entity's total risk score to identify suspicious activity of a particular entity is applicable to many other situations in addition to money laundering, terrorist financing, and employee fraud.

[0151]

[0152] In one aspect of the present disclosure, a number of risk factors are associated with a group of entities. Each of the risk factors may be assigned a risk score. Each entity may be given a total risk score based on a mathematical transformation, such as a summation. For example, other possible mathematical transformations include, but are not limited to, multiplication, division, and subtraction, sums of squares, squares of sums, mixtures of the above, and other similar methods of combining risk scores.

[0152]

[0153] In one aspect of the present disclosure, if a particular entity's total risk score is higher than the average of the total risk scores of all entities that have the same risk factors as the particular entity by a predetermined margin, the particular entity may have engaged in some suspicious activity. The predetermined margin may be set in terms of a number of standard deviations or other reference value.

[0153]

[0154] In another aspect of the present disclosure, if a particular entity's total risk score is higher by a predetermined margin than the average of the total risk scores of all entities that have the same set of risk factors as this particular entity, then this particular entity may have engaged in some suspicious activity.

[0154]

[0155] In one aspect of the present disclosure, the computer system identifies a transaction (or group of transactions) that caused a particular entity to have a total risk score higher than the average of the total risk scores of all entities. Such a transaction (or group of transactions) may be suspicious activity.

[0155]

[0156] The statistical approach described above is only one way to manage risk. Many other group comparison methods can also be used. Furthermore, suspicious activity may not be limited to illegal or prohibited activity. Activity becomes suspicious because it differs from normal activity. It may be harmless or even activity with good intentions. Therefore, investigation is often required to make a final decision on whether to report a detected case.

[0156]

[0157] In one aspect of the present disclosure, a responsible person investigates a newly detected case to determine whether it is illegal. The responsible person also reviews all past cases related to the suspect(s) of the newly detected case. If the responsible person agrees that the detected case is illegal, the computer system assists the responsible person in reporting the detected case. If the responsible person decides not to report the detected case, the responsible person inputs into the computer system a reason justifying the decision not to report the detected case.

[0157]

[0158] Following the 9 / 11 tragedies, the U.S. Congress passed the Unauthorized Online Gambling and Evasion Act (UIGEA) because online gambling could be a means for money laundering and terrorist financing activities. Regulation GG was established in response to this law. Regulation GG requires financial institutions to ask new customers during the account opening process whether they will engage in any online gambling activities. Because perpetrators know that online gambling is illegal, they often lie during the account opening process. As a result, the "question and answer" approach defined in Regulation GG is merely a formality. However, Regulation GG clearly states that it does not alter financial institutions' obligations to file SARs under the Bank Secrecy Act.

[0158]

[0159] In other words, if a perpetrator lies during the account opening process and actually conducts an illegal online gambling business, the financial institution is obligated to report the case to FinCEN through a SAR. In one aspect of the present disclosure, a computer system compares the senders and recipients of all funds transfer transactions during a certain period. If a customer sends a large amount of money to a recipient and receives a large amount of money from the same recipient during a certain period, such transactions may be deposits of wagers and payments of money earned from gambling activities between online gamblers and online gambling organizations. The computer system detects such cases as possible cases of illegal online gambling. Once a case is detected, further investigation is required.

[0159]

[0160] In one aspect of the present disclosure, because online gambling organizations typically transact with large amounts of money and with large numbers of clients, if the computer system detects a large number of transactions of large amounts of money associated with a customer, the computer system detects the customer as a possible online gambling organization. The computer system detects such cases as possible cases of illegal online gambling. When a case is detected, further investigation is required.

[0160]

[0161] In one aspect of the present disclosure, a computer system compares a list of known names of online gambling organizations with the sender and recipient of funds transfer transactions associated with a customer. If there is a match, the customer may be engaged in online gambling activity. The computer system detects this case as a possible case of illegal online gambling. Once a case is detected, further investigation is required.

[0161]

[0162] In addition to the aforementioned transaction pattern monitoring, the aforementioned group comparison method can also be applied to detect possible illegal online gambling activity. In one aspect of the present disclosure, all risk factors related to online gambling are identified. For example, these risk factors may include customer due diligence results, length of account history, customer industry, customer business type, number of names matching gambling organizations in transactions, customer geographic area, customer's country of headquarters, nature of the customer's business, business product type, business service type, business structure, customer occupation, nationality, past records, type of transactions conducted, account balance, fund inflow, fund outflow, transaction pattern, number of transactions, transaction amount, transaction volume, transaction frequency, transaction derivative, number of chargebacks, transaction location, transaction time, transaction country, sender of remittance transaction, sender location, sender country, sender characteristics, recipient of remittance transaction, recipient location, recipient country, recipient characteristics, relationship status, social status, political exposure, past transactions, etc. Indeed, many different risk factors may be considered to determine online gambling risk. As previously described in this disclosure, adjusted risk factors may also be used so that adjusted risk scores are applicable based on the size of the business.

[0162]

[0163] In one aspect of the present disclosure, risk factors are used to identify a group of customers having the same risk factors. If a particular customer has a total risk score higher than a reference value derived from the total risk scores of all customers having the same risk factors, the particular customer is likely to be involved in illegal online gambling. In another aspect of the present disclosure, a set of risk factors is used to identify a group of customers having the set of risk factors. If a particular customer has a total risk score higher than a reference value derived from the total risk scores of all customers having the same set of risk factors, the particular customer is likely to be involved in illegal online gambling. Reference values ​​include the mean, median, average, mode, weighted average, and / or other statistical values. To simplify calculations, standard group statistics such as the mean, variance, and standard deviation can be derived to facilitate such comparisons among groups of customers.

[0163]

[0164] In one aspect of the present disclosure, a responsible person (or BSA officer) investigates the detected case to determine whether it is a true case of online gambling. The BSA officer also reviews all past cases related to the suspect in the newly detected case. If the BSA officer agrees that the detected case is a possible case of illegal online gambling, the computer system assists the BSA officer in filing a SAR with FinCEN. If the BSA officer decides not to file a SAR, the BSA officer enters into the computer system a reason justifying the decision not to report the detected case.

[0164]

[0165] The U.S. Congress passed the Fair and Accurate Credit Transactions Act (FACT Act) to protect consumers. Among other things, it requires businesses to identify and report cases of identity theft. Financial institutions are also required to file SARs when cases of identity theft are detected.

[0165]

[0166] In one aspect of the present disclosure, a computer system monitors consumer reports and other available information to detect credit freeze notices, address mismatch notices, and / or fraud or emergency alerts contained in consumer reports. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0166]

[0167] In one aspect of the present disclosure, a computer system monitors consumer reports and available information to detect consumer reports that exhibit activity patterns inconsistent with an applicant's or customer's past and usual activity patterns. For example, a recent significant increase in the volume of inquiries, an unusual number of recently established credit relationships, a material change in the use of credit, particularly with respect to recently established credit relationships, or accounts that have been closed for cause or identified as an abuse of account privileges by a financial institution or creditor may indicate an abnormal pattern. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0167]

[0168] In one aspect of the present disclosure, a computer system detects whether documents provided for identification purposes appear to have been tampered with or forged, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0168]

[0169] In one aspect of the present disclosure, the computer system detects whether the photograph or physical characteristics on the identification document are inconsistent with the appearance of the applicant or customer presenting the identification document, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible person.

[0169]

[0170] In one aspect of the present disclosure, the computer system detects whether other information on the identification document is inconsistent with information provided by the person opening the new account or presenting the identification document. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0170]

[0171] In one aspect of the present disclosure, the computer system detects whether other information on the identification document is inconsistent with readily available information on file with the financial institution or creditor, such as a signature card or recent check, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0171]

[0172] In one aspect of the present disclosure, the computer system detects whether an application appears to have been tampered with or forged, or torn and reassembled, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0172]

[0173] In one aspect of the present disclosure, the computer system determines whether the provided personal identifying information does not match when compared against external sources used by financial institutions or creditors, such as if an address does not match any addresses in a consumer report or if a Social Security Number (SSN) has not been issued or is listed in the Social Security Administration Death Master File. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0173]

[0174] In one aspect of the present disclosure, the computer system determines whether some personal identifying information provided by a customer is consistent with other personal identifying information provided by the customer. For example, there may be no correlation between SSN ranges and dates of birth. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0174]

[0175] In one aspect of the present disclosure, the computer system determines whether the provided personally identifiable information is associated with known fraudulent activity as indicated by internal or third-party sources used by the financial institution or creditor. For example, an address on an application may be the same as an address provided on a fraudulent application, or a phone number on an application may be the same as a number provided on a fraudulent application. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0175]

[0176] In one aspect of the present disclosure, the computer system determines whether the provided personally identifiable information is of a type commonly associated with fraudulent activity indicated by internal or third-party sources used by financial institutions or creditors, such as if the address on the application is fictitious, a mailbox, or a prison, or if the phone number is invalid or associated with a pager or answering service. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0176]

[0177] In one aspect of the present disclosure, the computer system determines whether the provided social security number is the same as that submitted by another person opening an account or another customer. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0177]

[0178] In one aspect of the present disclosure, the computer system determines whether the provided address or telephone number is the same as or similar to account numbers or telephone numbers submitted by an unusually large number of other people or other customers opening accounts. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0178]

[0179] In one aspect of the present disclosure, the computer system determines whether a person opening an account fails to provide all required personal identifying information at the time of application or in response to a notice that the application is incomplete. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0179]

[0180] In one aspect of the present disclosure, the computer system determines whether the provided personally identifiable information is consistent with personally identifiable information on file with the financial institution or creditor. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0180]

[0181] In one aspect of the present disclosure, the computer system determines whether a person opening an account is unable to provide authentication information, such as answers to challenge questions, beyond what is typically available from a wallet or consumer report. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0181]

[0182] In one aspect of the present disclosure, the computer system determines whether there is unusual use of the account or suspicious activity associated with the account, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0182]

[0183] In one aspect of the present disclosure, the computer system determines whether the institution or creditor receives a request for a new, additional, or replacement card or mobile phone, or a request to add an authorized user to the account, shortly after notification of a change of address for the account. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0183]

[0184] In one aspect of the present disclosure, the computer system determines whether a new revolving credit account is being used in a manner commonly associated with known fraudulent patterns, such as when a large portion of the available credit is used for cash advances or items easily convertible to cash (e.g., electronics or jewelry), or when a customer fails to make an initial payment or makes an initial payment but no subsequent payments. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0184]

[0185] In one aspect of the present disclosure, the computer system determines whether an account is being used in a manner inconsistent with established patterns of activity on that account, such as late or missed payments with no history of missed payments, a significant increase in the use of available credit, a significant change in purchasing or spending patterns, a significant change in electronic fund transfer patterns associated with a deposit account, or a significant change in phone call patterns associated with a mobile phone account. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0185]

[0186] In one aspect of the present disclosure, the computer system determines whether an account that has been inactive for a significant period of time is being used (taking into account the type of account, expected usage patterns, and other relevant factors). If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0186]

[0187] In one aspect of the present disclosure, the computer system determines whether mail sent to a customer is repeatedly returned as undeliverable despite continued transactions occurring associated with the customer's account. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by a responsible party.

[0187]

[0188] In one aspect of the present disclosure, the computer system closely reviews all transactions when a financial institution or creditor is notified that a customer has not received a paper account statement, and if an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0188]

[0189] In one aspect of the present disclosure, the computer system closely reviews all transactions when a financial institution or creditor is notified of unauthorized charges or transactions related to a customer's account. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0189]

[0190] In one aspect of the present disclosure, the computer system closely reviews all transactions when a financial institution or creditor is notified by a customer, a victim of identity theft, law enforcement, or any other person that a fraudulent account has been opened for a person engaged in identity theft. If an instance of suspicious activity is detected, the computer system makes the detected instance available for review by responsible parties.

[0190]

[0191] In addition to monitoring transaction patterns as described above, the group comparison method described above can also be applied to detect possible cases of identity theft. Identity theft cases can be divided into two main categories. The first category involves cases in which a fraudster steals a victim's accounts, financial instruments, or identification documents to conduct an activity. In such situations, as described above, a computer system can detect activity that deviates from the victim's expected activity, which can be established from the victim's past activity.

[0191]

[0192] The second category involves cases where a victim's personal information is stolen to open a new account and / or initiate some new activity. In such situations, the victim is irrelevant from the start. Without the victim's true past activity, it is impossible to accurately establish the victim's expected activity for fraud prevention purposes. While it is possible to ask the perpetrator several questions and collect their answers during the account opening process with the intention of establishing the perpetrator's expected activity, this question-and-answer approach may not work because the perpetrator knows how to answer the questions to establish the expected activity in a way that does not trigger an alert.

[0192]

[0193] To detect identity theft when true past activity is unavailable, in one aspect of the present disclosure, all risk factors for a new account or new customer are identified. For example, these risk factors may include the customer's due diligence results, the customer's previous record with other businesses, the customer's credit report record, the customer's industry, the customer's business type, the customer's geographic area, the customer's country of address, the customer's business nature, the business's product type, the business's service type, the business's structure, the customer's occupation, nationality, past records, the type of transaction made, the account balance, the inflow of funds, the outflow of funds, the transaction pattern, the number of transactions, the transaction amount, the transaction volume, the transaction frequency, the transaction derivative, the number of chargebacks, the transaction location, the transaction time, the transaction country, the sender of the remittance transaction, the sender's location, the sender's country, the sender's nature, the remittance transaction recipient, the recipient's location, the recipient's country, the recipient's nature, the relationship status, the social status, the political exposure, past transactions, etc. Indeed, numerous risk factors may be considered to determine identity theft risk.

[0193]

[0194] In one aspect of the present disclosure, risk factors are used to identify a group of people with the same risk factors. If a particular person has a total risk score that is much higher than a reference value derived from the total risk scores of all people with the same risk factors, the particular person may be involved in an identity theft case. A set of risk factors can be used to identify a group of people with this set of risk factors. If a particular person has a total risk score that is higher than a reference value derived from the total risk scores of all people with the same set of risk factors, the particular person may be involved in an identity theft case. Reference values ​​include the mean, median, average, mode, weighted average, and / or other statistical values. To simplify calculations, group statistics such as the mean, variance, and standard deviation can be derived to facilitate such comparisons within a group of people.

[0194]

[0195] In one aspect of the present disclosure, a responsible person (or compliance officer) investigates the detected case to determine whether it is a true case of identity theft. The compliance officer also reviews all past cases related to the newly detected case. If the compliance officer agrees that the case is a possible case of identity theft, the computer system assists the compliance officer in filing a SAR with FinCEN. If the compliance officer decides not to file a SAR, the compliance officer enters into the computer system a reason justifying the decision not to report the detected activity.

[0195]

[0196] The Office of Foreign Assets Control (OFAC) has a very simple rule that states that any business transactions with entities on the list issued by the Office of Foreign Assets Control are illegal. This list is commonly referred to as the "OFAC List." This rule applies to all U.S. persons and entities, including financial institutions. For example, Walmart has been fined by OFAC for violating this rule. U.S. financial institutions, which are under the strictest regulatory scrutiny, must naturally adhere to this rule strictly.

[0196]

[0197] Originally, this was a very simple rule. However, the implications of this rule have become much more complex over the past 20 years. A common problem occurs when people misspell (including mistyping, mispronouncing, etc.) their own names. If an entity's name is misspelled but is on the OFAC list, financial institutions are still obligated to identify this entity as an entity on the OFAC list (commonly referred to as an OFAC match).

[0197]

[0198] A reasonable question is: How far can a name deviate from the original name on the OFAC list before it is classified as a "misspelling"? OFAC and government regulators have never provided detailed guidance on this question. A very common exercise that examiners or auditors can perform is to use infamous names like "Osama bin Laden" as a sample to test companies. Generally, companies are expected to identify all transactions related to "Osama bin Laden," "Osama Laden," "Osama Latin," "Latin Osama," "Latin Obama," etc. as possible OFAC matches. However, if the scope of deviations from OFAC names were broadened further, it is questionable whether financial institutions would be expected to identify the single word "Obama," the name of a former U.S. president, as a possible OFAC match. It is easy to see how such a simple OFAC rule has caused much confusion in recent years.

[0198]

[0199] In one embodiment of the present disclosure, an "OFAC match scale" is used to measure the degree of deviation. To measure the similarity between two names, the OFAC match scale generates a value called a "relative correlation" ("RC value"). For example, if a name has an RC value of 100%, it is an exact match with an OFAC name on the OFAC list. If a name has an RC value of 97%, it may differ from an OFAC name on the OFAC list by only one or two characters. If a name has an RC value of 0%, it is completely different from all OFAC names on the OFAC list.

[0199]

[0200] In one aspect of the present disclosure, name length also affects the RC value: for example, a 25-character name that differs from an OFAC name by only one character may have an RC value of 96%, while another 10-character name may have an RC value of 90%, even though it also differs from another OFAC name by only one character.

[0200]

[0201] Some long words, such as "international," "international," "limited," "company," and "organization," are commonly used in business names, and such words are also present on the OFAC name list. As a result, these long words generate higher RC values ​​for businesses that use these long words in their names. To avoid unnecessary false positives, in one aspect of the present disclosure, commonly used long words may be replaced with shorter words to reduce their impact on the RC value. For example, the word "international" may be replaced with "intl."

[0201]

[0202] Additionally, some countries do not use the descriptions "first name" and "last name." As a result, when a person is asked to provide their first and last name, they may use names in a different order. "Osama Laden" may become "Laden Osama." In one aspect of the present disclosure, the OFAC match scale identifies possible "off-sequence" OFAC matches.

[0202]

[0203] Furthermore, some words are commonly used in a particular culture without contributing a clear distinction. For example, in Islamic cultures, "bin" means "son of" and "binti" means "daughter of." Legal names in Islamic cultures have either "bin" or "binti" in the name. For example, if a Muslim father is named "John," his daughter "Mary" would be legally named "Mary binti John," and his son "David" would be legally named "David bin John." In such a situation, the commonly used words "bin" and "binti" in Islamic names create a "false similarity" between the two Islamic names. To provide more scientifically accurate results, in one aspect of the present disclosure, the OFAC agreement scale may filter out these types of "trivial words" before calculating the RC value. Sometimes, names are translated into English based on sound. Therefore, in one aspect of the present disclosure, the OFAC agreement scale must measure sound agreement to determine the RC value.

[0203]

[0204] In one aspect of the present disclosure, a financial institution decides which threshold to use when performing an OFAC check. For example, if the financial institution uses a 75% threshold, a potential OFAC match is detected when a name has an RC value of 75% or greater. Because each financial institution may have different risk exposures, it is very likely that X is the best threshold for Financial Institution A, while Y is the best threshold for Financial Institution B. As a general guideline, the X or Y value is selected according to risk-based principles.

[0204]

[0205] Generally, the higher the threshold a financial institution uses, the fewer OFAC matches the institution will likely find. This saves time during the review process by avoiding more false positives. However, if the threshold is too high, the institution may miss plausible deviations from OFAC names, such as "Osama bin Laden." If the threshold is too low, the institution may mistakenly identify many of its clients as possible OFAC matches. Best practice is to find a trade-off between reviewing too many possible OFAC matches and missing true OFAC name deviations caused by spelling errors.

[0205]

[0206] In one aspect of the present disclosure, a user can randomly select several OFAC names from the OFAC list and find how the OFAC match scale responds to deviations from these selected OFAC names. The user can then determine what to call a "possible OFAC match" based on this test. It may be desirable to retain the results of this test for future review by auditors and examiners.

[0206]

[0207] It is possible that certain names are very close to OFAC names. For example, American Express is a highly reputable credit card company, but is often erroneously detected as an OFAC match due to the word "express." Therefore, to avoid this type of frequent false positive, in one aspect of the present disclosure, an exemption list is generated by the user, and these well-known, reputable companies are placed on the exemption list. Companies on the exemption list are classified as false positives, either automatically by the computer or manually by the user, when detected as a possible OFAC match.

[0207]

[0208] Very often, a company will have an OFAC officer who handles all OFAC-related matters. In one aspect of the present disclosure, when a financial institution's OFAC officer (e.g., a responsible person) detects a possible OFAC match with an RC value above a predetermined threshold, the OFAC officer investigates whether this is a true OFAC match. If the OFAC officer is convinced that it is a true match, the OFAC officer must handle the case in accordance with guidelines issued by the Office of Foreign Assets Control. According to OFAC regulations, in some cases, the OFAC officer may be required to block a transaction to prevent a person on the OFAC list from benefiting from the transaction. If, after investigation, the OFAC officer determines that the OFAC match is a false positive, the OFAC officer must enter into a computer system a reason justifying the decision not to report the OFAC match to the Office of Foreign Assets Control and / or not to block the transaction.

[0208]

[0209] Section 314(a) of the USA PATRIOT Act requires financial institutions to match names on the 314(a) list, which is periodically published by FinCEN. Computer systems can process 314(a) compliance matters using an approach similar to the processing of OFAC compliance matters, as described above.

[0209]

[0210] Sometimes, the 314(a) list also includes additional personal identifying information, such as identification document number, date of birth, address, etc. In one aspect of the present disclosure, in addition to the methods described above for detecting potential OFAC matches, personal identifying information, such as identification document number, address, and / or date of birth, is used by a computer system to determine whether a detected 314(a) match is a true match. This approach can reduce false positives in the 314(a) matching process.

[0210]

[0211] In one aspect of the present disclosure, when a compliance officer (e.g., a director) at a financial institution detects a possible 314(a) match with an RC value above a predetermined threshold, the compliance officer investigates whether this is a true 314(a) match. In one aspect of the present disclosure, if the compliance officer believes it is a true match, the compliance officer reports the 314(a) match to FinCEN. If, after investigation, the compliance officer determines the 314(a) match is a false positive, the compliance officer enters a reason into a computer system justifying why the 314(a) match is not reported to FinCEN.

[0211]

[0212] In one aspect of the present disclosure, a computer system receives customer information and transaction data from a core data processing system of a financial institution or from other data processing systems that may be internal or external to the financial institution. The customer information may include background information.

[0212]

[0213] In one aspect of the present disclosure, a computer system receives information regarding suspicious activity observed by frontline personnel. For example, the computer system may receive information entered by the frontline personnel. The computer system may also receive information provided by other internal or external sources.

[0213]

[0214] Although a "financial institution" is used as an example for ease of explanation, the present disclosure applies to other types of businesses as well. In general, any enterprise that must comply with laws and regulations may employ the intelligent alert system described in this disclosure.

[0214]

[0215] In one aspect of the present disclosure, the risk scores or degrees of risk factors may be assigned by a computer software module, a person designing or adjusting the system, or a user using the system. In most cases, the absolute value of the risk score is not important, and the relative relationship between all the risk scores may be more important.

[0215]

[0216] Furthermore, a subject's total risk score should only fluctuate within a reasonable range. In one embodiment of the present disclosure, if a subject's total risk score suddenly increases and exceeds a threshold, the subject may have engaged in suspicious or abnormal activity. That is, if the difference between the subject's first total risk score and the second total risk score is greater than an increase threshold, and the first total risk score is less than the second total risk score, the subject may have engaged in suspicious or abnormal activity. In another embodiment of the present disclosure, if a subject's total risk score suddenly decreases significantly, the subject may also have engaged in suspicious or abnormal activity. That is, if the difference between the subject's second total risk score and the first total risk score is greater than a decrease threshold, and the first total risk score is greater than the second total risk score, the subject may have engaged in suspicious or abnormal activity. Therefore, an alert is sent to an investigator, BSA officer, compliance officer, or other type of responsible person who will be investigating the subject when the total risk score suddenly increases or decreases significantly.

[0216]

[0217] A subject's observation data may fluctuate from time to time. Therefore, the intelligent warning system may allow a certain range of variation from the subject's total risk score to avoid false alarms. In one aspect of the present disclosure, the intelligent warning system increases the subject's allowable total risk score variation range when the subject's total risk score is lower than a threshold. In another aspect of the present disclosure, the intelligent warning system decreases the subject's allowable total risk score variation range when the subject's total risk score is higher than a threshold. The allowable variation range may be determined (e.g., set) by a software module, a person who designs the system, a person who adjusts the system, or a person who uses the system.

[0217]

[0218] For example, if a subject's total risk score is higher than the average of all subjects' total risk scores plus a certain number of standard deviations of all risk scores, such as four standard deviations, the intelligent alert system may modify the subject's allowable total risk score variation range to be within half a standard deviation without triggering an alert. In another example, if a subject's total risk score is within the average of all subjects' total risk scores plus a certain number of standard deviations, such as three standard deviations, the intelligent alert system may allow the subject's total risk score to vary within one standard deviation without triggering an alert.

[0218]

[0219] In yet another example, if a subject's total risk score is within a certain number of standard deviations, such as two standard deviations, above the mean of all subjects' total risk scores, the intelligent alert system may allow the subject's total risk score to fluctuate within a range of 1.5 standard deviations without triggering an alert. In yet another example, if a subject's total risk score is within a certain number of standard deviations, such as one standard deviation, above the mean of all subjects' total risk scores, the intelligent alert system may allow the subject's total risk score to fluctuate within a range of two standard deviations without triggering an alert.

[0219]

[0220] In the field of machine learning, a negative is a set of data that does not trigger an alert. A true negative is a set of data that does not trigger an alert and does not contain true cases to trigger an alert. A false negative is a set of data that does not trigger an alert but does contain true cases to trigger an alert that the system missed. As an example, a false negative money laundering case could result in a financial institution being fined by the U.S. government if the false negative case is discovered by the U.S. government. Therefore, it is desirable to prevent false negatives in alert systems designated to prevent money laundering (e.g., anti-money laundering alert systems).

[0220]

[0221] In the US financial institution anti-money laundering alert system, genuine cases of money laundering are reported to FinCEN, a US government agency. FinCEN has a set of communication protocols. Based on FinCEN's communication protocols, US financial institutions can report cases to FinCEN by sending a file from the anti-money laundering alert system to FinCEN's computer system.

[0221]

[0222] Traditionally, rule-based systems are used to detect suspicious activity, with each rule potentially triggering an alert. Many financial institutions have used rule-based approaches that can trigger numerous alerts. For example, there are over 200 countries in the world. If a financial institution uses a rule-based approach to monitor wire transfers to and from each country, the financial institution may have over 200 branches at the country decision node of the decision tree. As another example, there are thousands of different industries. If a financial institution uses a rule-based approach to monitor wire transfers to and from each industry, the financial institution may have thousands of branches at the industry decision node of the decision tree. Countries and industries are two of many risk categories that pose a money laundering risk. Similarly, wire transfers are one of many transaction types that pose a money laundering risk. For example, cash, check, ACH, ATM, credit card, debit card, and letter of credit are other possible transaction types.

[0222]

[0223] There are many risk factors for money laundering. There are many (e.g., millions) possible combinations of branches to form a path from the root of a decision tree to a leaf node of the decision tree. In other words, a rule-based system may use millions of rules to cover the entire range of money laundering risks and detect suspicious money laundering activities. A rule-based system with a limited number of rules may have an increased number of false negatives (e.g., the system misses true cases of money laundering) and a high number of false positives (e.g., the number of impurities in the leaf nodes of the decision tree increases, making it impossible to achieve the classification goal). Due to the number of false negatives and false positives when a rule-based approach is used, financial institutions hire investigators to review a large number of alerts. It is difficult for financial institutions to mitigate all false negatives with a rule-based system.

[0223]

[0224] In the field of machine learning, traditional systems consider 70% accuracy to be satisfactory. Training a machine learning model to have a high accuracy, such as 100%, is difficult, if not impossible. Unfortunately, while 70% accuracy may be effective for some purposes, this 70% target cannot meet regulatory standards, such as those set by the U.S. government. As mentioned, financial institutions may face severe regulatory penalties if they do not detect certain activities, such as money laundering. Therefore, financial institutions are unlikely to use an alert system with 70% accuracy. Therefore, traditional machine learning models are not satisfactory for intelligent anti-money laundering alert systems.

[0224]

[0225] According to aspects of the present disclosure, an intelligent anti-money laundering alert system uses a risk scoring approach. Each risk factor or degree of a risk factor may be similar to a branch in a rule-based system. Thus, as described in this disclosure, a risk scoring process for generating an overall risk score from many risk factors may integrate information from many rules into the overall risk score. For example, if the overall risk score is generated from 10,000 risk factors, a user need only pay attention to alerts with an overall risk score above a threshold, without having to evaluate each of the 10,000 risk factors. When a rule-based approach is used, each risk factor may have two possible outcomes: match or mismatch. The total number of possible combinations of outcomes for 10,000 risk factors is 2 to the power of 10,000 (e.g., 2 10,000 ), so an assessment based on the total risk score is effectively 2 to the power of 10,000 (e.g., 2 10,000 ) possible outcomes. 10,000 The result is 2 10,000 Since an intelligent anti-money laundering alert system can potentially generate alerts of different types, it is essential to have at least two 10,000 Therefore, an intelligent anti-money laundering alert system is a considered improvement over traditional rule-based systems.

[0225]

[0226] A single total risk score can replace many rules, but not all rules. For example, if a person frequently deposits a certain amount of cash (e.g., $9,900) that is slightly below the CTR reporting threshold of $10,000, a financial institution is required to report this person to the Financial Crimes Enforcement Network (FinCEN) as a case of structuring. It is difficult to accurately detect cases of structuring based on the total risk score. Therefore, an alert system based on risk score-based technology may include several rules in addition to the criteria based on the risk score.

[0226]

[0227] In one aspect of the present disclosure, an intelligent anti-money laundering alert system uses risk score-based scenarios instead of rules. In one example, the intelligent anti-money laundering alert system may use approximately 20 to 30 scenarios. The scenarios may include both risk score-based scenarios and non-risk score-based scenarios.

[0227]

[0228] In addition to or instead of a scenario, other conditions can be used to generate an alert. For example, a computer system such as a machine learning network can be trained to generate a model. After training, the discriminant used by the model can be converted into an if-then conditional format to trigger an alert.

[0228]

[0229] For purposes of this disclosure, a scenario may be defined as a condition or set of conditions that can trigger an alert or can be used to categorize a subject for a particular purpose. For example, a customer with a total risk score within a particular range would not trigger an alert. Further, in this example, the total risk score may categorize the customer into a particular risk category, such as high risk, medium risk, or low risk. As another example, a customer who was previously a suspect in a suspicious activity report (SAR) would not trigger an alert. In this example, the customer may be categorized into a particular category, such as a prior SAR suspect, or another similar category. As another example, a customer who matches an OFAC list, a 314(a) list, a politically exposed person list, and / or other list may be categorized into one or more categories.

[0229]

[0230] A scenario may be composed of a rule, a set of rules, a criterion, or a set of criteria based on rules, facts, behavioral patterns, risk scores, risk dimensions, total risk scores, special categories, mathematical models, and / or machine learning models. A scenario may trigger an alert by using rule-based methods, behavior-based methods, risk-based methods, model-based methods, and / or machine learning-based methods (e.g., artificial intelligence-based methods). An intelligent alert system may include one or more scenarios.

[0230]

[0231] As mentioned, an alert may be triggered by a scenario. A scenario may be flagged when one or more conditions are met. A potential case that triggered an alert may be referred to as a positive. A potential case may include one or more alerts. Thus, the cause of a potential case may be one or more scenarios. A potential case, or positive, may be investigated. A true positive may refer to a potential case (e.g., a positive) that is a true case. If an investigation indicates that the potential case is not a true case, the potential case may be referred to as a false positive. As a result, the false positive may be dismissed, and the associated alert may be dismissed as a false alert. A true positive may be reported to authorities, such as FinCEN or law enforcement.

[0231]

[0232] In one configuration, the posterior probability can be estimated via Bayes' principle. The product of the posterior probability and the evidence is the prior probability multiplied by the class likelihood. Using the application of reporting suspected money laundering activity to FinCEN as an example, Bayes' equation is p(S / c)p(c)=p(c / S)p(S). The evidence p(c) is the probability of a potential case triggered by cause c among all potential cases. The class likelihood p(S) is the probability of a true positive S (e.g., a true SAR case) among all potential cases. The prior probability p(c / S) is the probability of a true positive triggered by cause c among all true positives. As a result, the posterior probability p(S / c) can be determined as follows: p(S / c)=p(c / S)p(S) / p(c). The posterior probability P(S / c) is also the conditional probability that a potential case triggered by cause c is a true positive. That is, the conditional probability P(S / c), derived from historical data, is a best estimate of the future probability that a potential case triggered by cause c will become a true positive. As such, posterior probability can also be called the conditional probability for the future or the future conditional probability.

[0232]

[0233] Many risk factors (e.g., thousands of risk factors) can affect the risk of money laundering. In one configuration, when risk score-based scenarios are used as part of the scenarios, the number of scenarios used by the intelligent money laundering warning system is not large. As an example, the intelligent money laundering warning system may use 30 scenarios. A potential case may be triggered by one or more of the scenarios. In this example, a vector with 30 elements may represent the possible causes of a potential case. As a result, in this example, two of the causes may be 30 There are different possible combinations. Each triggered scenario is identified by a flag. For example, the cause vector may be initialized to have a value of "0" for each element. When a scenario is triggered, the value of the element corresponding to this scenario may change from "0" to another value, such as "1."

[0233]

[0234] For example, if a potential case is triggered by a first scenario and a third scenario, the vector x may contain a "1" in the first and third positions and a "0" in all other positions. That is, the vector may be represented as x = (1, 0, 1, 0, 0, 0, ... , 0). As another example, if a potential case is triggered by a third scenario and a fourth scenario, the third and fourth positions of the vector may contain a "1" value and all other positions may contain a "0" value. In this example, the vector x may be represented as x = (0, 0, 1, 1, 0, 0, ... , 0). In the present disclosure, a vector containing scenarios (e.g., causes) for triggering an alert for a potential case may be referred to as a cause vector.

[0234]

[0235] A scenario may include one or more conditions for classifying a subject into one or more categories, but the scenario itself would not trigger a potential case. A potential case may be triggered by multiple scenarios in the associated cause vector. For example, if a scenario attempts to classify a subject into the ex-SAR suspect category, such a scenario would not trigger a money laundering alert by itself. However, if a customer is an ex-SAR suspect and triggers another scenario (e.g., remittance to a high-risk country of over $10 million), a potential case may be triggered. Furthermore, a cause vector may have two scenarios: one for remittance transactions and another for ex-SAR suspects. It is a good idea to include various special categories (e.g., ex-SAR suspects) in the cause vector because these special categories may increase the accuracy of suspicious activity detection.

[0235]

[0236] A potential case with multiple triggered scenarios in its cause vector may be more likely to be a true positive. For example, if a customer receives $250,000 via wire transfer, one scenario in the cause vector may be flagged (e.g., triggered). This cause vector with one flagged scenario may be registered as a potential case, and it may or may not be a true money laundering case. Similarly, if the customer withdraws $250,000, another scenario in the cause vector may be flagged. Still, this potential case may or may not be a true money laundering case.

[0236]

[0237] However, if a customer receives a wire transfer of $250,000 and then withdraws $250,000 in cash from their account, two different scenarios may be flagged in the cause vector. A cause vector with two flagged scenarios may be registered as a potential case, which is likely to be a true money laundering case because the combined activity described by these two different scenarios matches a common money laundering behavior pattern. Therefore, rather than calculating the conditional probability based on a single flagged scenario, it is desirable to calculate the conditional probability of a potential case based on a cause vector with multiple flagged scenarios.

[0237]

[0238] If a causal vector has 30 scenarios, each scenario has two possibilities (e.g., triggered or not triggered), so the possible combinations of the 30 scenarios are at most 2 30 However, if none of the scenarios are triggered, no case is triggered, so the total number of possible combinations for triggering a case is (2 30 −1). Each combination can have a unique conditional probability for triggering a potential case. 30Because C(m,n) is a very large number, calculating these conditional probability values ​​may be impractical. In practice, a potential case averages five or fewer simultaneously triggered scenarios. Therefore, the actual total number of significant combinations of scenarios that can trigger a potential case is much smaller and can be managed via a computing device associated with the intelligent alert system. For example, if the maximum number of possible scenarios in a potential case is five, the total number of possible potential cases that can be triggered by these 30 scenarios is C(30,1) + C(30,2) + C(30,3) + C(30,4) + C(30,5), where C(m,n) is the number of possible different choices for selecting n objects from m targets. For example, since there are 30 possible choices for selecting one object from 30, C(30,1) is 30; C(30,2) is 435; C(30,3) is 4,060; and C(30,4) is 27,405. C(30,5) is 142,506. The total number of possible causal vectors is 174,436. These causal vectors and their associated conditional probability values ​​can be managed via a database associated with a computing device and an intelligent alert system.

[0238]

[0239] Investigators may use an intelligent alert system to investigate potential cases triggered by a causal vector. A causal vector may include multiple flagged scenarios. A potential case may be a false positive or a true positive. A true positive refers to a potential case that is a true case. A false positive refers to a potential case that is not a true case. If it is a false positive, all alerts for the potential case are dismissed as false alerts. If it is a true positive, the potential case becomes a true case that may be reported to authorities such as FinCEN.

[0239]

[0240] Investigating a single potential case generally takes time. In the United States, it is common for large financial institutions to employ hundreds of investigators. Each investigator is tasked with investigating whether potential cases triggered by various anti-money laundering systems are true cases of money laundering. If there are true cases of money laundering, U.S. law requires the financial institution to report the money laundering case to FinCEN within 30 days. However, as mentioned above, whether a potential case is true is a subjective opinion of the investigator.

[0240]

[0241] Financial institutions are protected by the safe harbor rule and are not penalized if investigators report false positives as true money laundering cases. Generally, because there are significant regulatory penalties for failing to report true money laundering cases to FinCEN, it is advisable to report potential cases to FinCEN rather than dismiss them. Therefore, it is common practice for investigators to treat potential cases as true positives as long as there is reasonable doubt. Under current U.S. law, investigators are not required to prove that a potential case is a true case. In other words, investigators tend to report potential cases when they believe it is likely to be a true case. This also means that probability plays a role in this decision-making process.

[0241]

[0242] A user's decision-making can be improved based on knowledge of the conditional probability p(S / x) that a potential case will become a true SAR case based on a causal vector x. For example, if the conditional probability is greater than a threshold, the user may wish to report the case to FinCEN without spending time investigating. In one configuration, the intelligent alert system automatically reports a case to the appropriate entity (e.g., FinCEN) when the conditional probability for the case is greater than a threshold. The threshold may be set by a software module, a person designing or tuning the system, and / or a user of the system. Alternatively, the threshold may be set by the intelligent alert system, which learns the user's preferences by evaluating the user's past behavior. For example, if a user often submits SARs when the conditional probability of a causal vector is greater than a value Z, the system can use the value Z as a threshold to automatically submit SARs for the user in the future. In one configuration, the system stores potential cases in a database to determine the conditional probability. For each potential case, the system also stores the associated causal vector. The system may also store the results of the investigation, such as whether the potential case triggered by the causal vector was accepted by the investigator as a true positive or rejected by the investigator as a false positive.

[0242]

[0243] As a user continues to use the intelligent alert system, the system accumulates historical data in a database. In one aspect of the present disclosure, over any given period of time, the system may determine from the database how many potential cases were triggered by cause vector x and how many of the potential cases triggered by cause vector x became true positives (e.g., SAR cases reported to FinCEN). The ratio of the number of true positives triggered by the cause vector to the number of potential cases triggered by the cause vector is the conditional probability p(S / x). The conditional probability may also be referred to as the posterior probability. The posterior probability indicates the probability that a future potential case triggered by the cause vector will become a true case reported to FinCEN. In general, the conditional probability of a potential case is equivalent to the conditional probability of the cause vector that triggered the potential case.

[0243]

[0244] In one aspect of the present disclosure, the intelligent alert system calculates and displays a conditional probability for each potential case based on its cause vector. The conditional probability indicates the probability that a potential case triggered by the cause vector will be a true positive reported to FinCEN. In another aspect of the present disclosure, the intelligent alert system accepts the potential case as a true positive and reports it to FinCEN in response to the conditional probability of the cause vector being higher than a predetermined value. This predetermined value is also referred to as a true positive acceptance threshold.

[0244]

[0245] The intelligent alert system may also reject a potential case as a false positive in response to the conditional probability of the causal vector being less than a false positive rejection threshold. The false positive rejection threshold and true positive acceptance threshold may be set by a software module, a person designing or tuning the system, and / or a user of the system. Alternatively, these thresholds may be set by the intelligent alert system learning user preferences by evaluating the user's past behavior. For potential cases that are neither accepted as true positives nor rejected as false positives, an investigator may manually review the potential cases and determine whether each of the potential cases is a false positive or a true positive.

[0245]

[0246] The data for determining the conditional probabilities may be obtained over a period of time. For example, the period may be the past 12 months, the past three years, or any period of time. In one configuration, the conditional probabilities are determined from a rolling period that continues forward. For example, if the environment (e.g., company policies, customer demographics, products, services, etc.) changes, older probability values ​​may no longer be accurate after the change. Furthermore, if the financial institution modifies the scenario, the older probability values ​​may be affected. Therefore, a rolling period (e.g., the past three years) provides the intelligent alert system with the ability to continue self-adjusting to generate up-to-date, accurate probability values.

[0246]

[0247] Many computer systems perform data processing in batches (e.g., one batch per month). A number of batches can be used instead of a period to define the amount of historical data used in the probability calculation. For example, a computer system can use a rolling period of the past 36 batches instead of a rolling period of the past three years if the computer system performs one batch per month.

[0247]

[0248] In one configuration, the intelligent warning system intentionally leaves some potential cases for the human investigator to process. The intelligent warning system can use the results of these cases to train the system, i.e., adjust the probability values ​​to better fit the current environment. Thus, the intelligent warning system is a learning system that improves its predictions as more potential cases are evaluated by the human investigator.

[0248]

[0249] The intelligent alert system may generate a flag or display a message about a potential case triggered by a causal vector when the causal vector has not generated a potential case within a specified period of time. In such circumstances, a user may manually investigate the potential case to determine whether it is a false positive or a true positive. The results of the manual investigation may be used to calculate a conditional probability value for the causal vector. The calculated conditional probability value may be used to evaluate future potential cases. This manual investigation process has the same effect as supervised training and increases the accuracy and reliability of the intelligent alert system.

[0249]

[0250] The intelligent alert system may also display or link to past potential cases and / or true positives triggered by the causal vector. In addition, users can view additional details (e.g., drill down) for each case. Thus, investigators can use historical data as a reference when deciding whether to pursue a potential case.

[0250]

[0251] The system may also display or link to past potential cases triggered by the same suspect as the current potential case and the decisions regarding those potential cases. Investigators can drill down to detailed background and transaction information for the suspect. As a result, investigators can determine whether the current potential case is a false positive or a true positive.

[0251]

[0252] In some cases, there may not be enough cause to report a current potential case to authorities. However, when the current potential case is combined with past potential cases, the cause for reporting may be sufficient. Under such circumstances, the true cause for reporting the case is composed of the cause vector of the current potential case plus the cause vectors of past potential cases. The past potential cases may be referred to as previous potential cases. A composite cause vector may be used for this true cause. A composite cause vector may be a combination of multiple cause vectors of multiple potential cases.

[0252]

[0253] As an example, the cause vector x1 of the current case may have a "1" in the first and fifth positions of the vector and a "0" in all other positions (e.g., x1 = (1,0,0,0,1,0,0,···0)). In this example, the cause vector x2 of a past potential case may have a "1" in the third and fifth positions and a "0" in all other positions (e.g., x2 = (0,0,1,0,1,0,0,···0)). The composite cause vector x3 (e.g., the combination of x1 and x2) may have a "1" in the first, third, and fifth positions and a "0" in all other positions (e.g., x3 = (1,0,1,0,1,0,0,···0)). Although the above example uses only one cause vector from one past potential case, a composite cause vector may be composed of multiple cause vectors from multiple past potential cases.

[0253]

[0254] In one configuration, an investigator manually reviews multiple past potential cases and a current potential case to determine whether the combined case is a false positive (e.g., should not be reported) or a true positive (e.g., should be reported). The results of the manual review can be used to calculate a conditional probability value p(S / cbv) (e.g., a posterior probability value) for a composite cause vector cbv. The composite cause vector cbv is a combination of the cause vector of the current potential case with one or more cause vectors of past potential cases.

[0254]

[0255] In some cases, it may be difficult for the intelligent alert system to know which past potential cases have been investigated by investigators, so the intelligent alert system may prompt the investigator to select past potential cases to be combined with the current case to be reported to authorities.

[0255]

[0256] Additionally, in some cases, it may be difficult for the intelligent alert system to know which scenario in the composite causal vector or causal vector caused the investigator to report a potential case, and therefore the intelligent alert system may prompt the investigator to select the scenario that caused the investigator to report a potential case.

[0256]

[0257] Many reports of suspicious activity require investigators to provide a comment or narrative for a potential case. To improve processing time, it is desirable for the intelligent alert system to automatically populate the comment or narrative for a reported case. Generally, the information for writing the comment or narrative consists of background and transaction information for the suspect. Because this information is stored in a database, the intelligent alert system can learn from the user how to write the comment or narrative, as described later in this disclosure.

[0257]

[0258] In one aspect of the present disclosure, the intelligent alert system prompts an investigator to select past potential cases to be combined with a current potential case for reporting. Based on the causal vectors of the selected past potential cases and the causal vector of the current potential case, the intelligent alert system prepares a commentary or narrative. The prepared commentary or narrative is provided in a report about the combined cases.

[0258]

[0259] When the intelligent alert system writes a comment or narrative, it may also identify a composite cause vector for the reported case. Thus, a conditional probability value p(S / cbv) may be associated with the identified composite cause vector cbv based on the results of the human investigation.

[0259]

[0260] The intelligent alert system may prompt the investigator to select a scenario of the cause vector or composite cause vector that caused the investigator to report the potential case. Based on the selected scenario, the intelligent alert system prepares a comment or narrative to be included in the report for the case. These selected scenarios form the true cause vector of the reported case. The scenario of the true cause vector of the reported case is identified. A conditional probability value of the true cause vector may be calculated based on the results of the human investigation.

[0260]

[0261] Because each person may have their own unique writing style (or preferences), an investigator may initially dislike the comments or narrative generated by the intelligent alert system. If the investigator dislikes the comments or narrative generated based on a selected scenario and has no way to modify it, the investigator will not bother selecting the scenario to allow the intelligent alert system to generate the comments or narrative. Under such circumstances, the intelligent alert system cannot learn the true reasons why the investigator decided to report the case to authorities. As a result, the intelligent alert system may not be able to calculate the future conditional probability value of the true causal vector based on the results of human investigations.

[0261]

[0262] It is therefore desirable for the intelligent alert system to learn and adapt to the writing style (or preferences) of the researcher. In one configuration, the intelligent alert system learns the writing style (or preferences) of the researcher and generates future comments or narratives based on the writing style (or preferences) of the researcher.

[0262]

[0263] In one configuration, to learn a person's writing style (or preferences), the intelligent alert system displays a commentary or narrative for the initially selected scenario based on a pre-stored default commentary or narrative for the initially selected scenario. The pre-stored default commentary or narrative consists of two main parts. The first main part consists of facts, such as the suspect's name, identifying information, suspect's background, suspect's relationships, event location, event description, event date and time, information related to the event, and transaction details. The second main part may include words, phrases, sentences, symbols, etc. used to link facts to one another. These words, phrases, sentences, symbols, etc. are collectively referred to as "linking words."

[0263]

[0264] Facts may be obtained from stored data or information associated with the intelligent alert system. Researchers rarely modify stored facts. Researchers may modify linking words based on the researchers' writing style (or preferences). Thus, the intelligent alert system tracks facts and linking words for comments and narratives. The intelligent alert system may also track where facts are stored in memory (e.g., a database) and the relationships between those facts.

[0264]

[0265] Generally, a person's writing style (or preference) is determined by the order (e.g., format) of presentation of link words and facts. Because researchers should avoid changing facts, including related facts, writing style (or preference) will not be determined solely based on fact selection. In some cases, when the same scenario finds two different instances, the facts may be different. Nevertheless, the same researcher will not change the order (e.g., format) of presentation of link words and facts in their comments or narratives because their writing style (or preference) is the same.

[0265]

[0266] In one configuration, the intelligent alerting system provides editing capabilities for the investigator to add, delete, or modify linking words that link facts to one another. The intelligent alerting system may provide editing capabilities for the investigator to add, delete, or modify facts in the narrative. The intelligent alerting system may provide editing and database search capabilities for the investigator to extract and insert additional facts from a database into the narrative.

[0266]

[0267] After the researcher revise the comment or narrative for the originally selected scenario, the researcher may remember this revised comment or narrative as the next default comment or narrative. In the future, when the researcher reselects the originally selected scenario in another instance, a revised comment or narrative (e.g., the next default comment or narrative) based on a different set of facts may be displayed for the researcher to edit. After several revisions, the researcher may become satisfied with the then-current revised version and not want to edit it again. Through this evolutionary revision process, the intelligent alert system learns from the researcher and generates comments or narratives that match the researcher's writing style (or preferences).

[0267]

[0268] The intelligent alerting system can process a next selected scenario based on the same approach as described above for the first selected scenario. The intelligent alerting system can process other selected scenarios in the same manner. Over time, the intelligent alerting system gradually learns how to write comments or narratives for each scenario based on the investigator's preferences.

[0268]

[0269] As mentioned, based on the learning, the intelligent alert system can automatically generate comments or narratives on behalf of the investigator. Based on aspects of the present disclosure, the investigator does not need to write the comments or narratives. The investigator can select a scenario, and in response, the intelligent alert system automatically fills out the SAR form and comments or narratives. The intelligent alert system can then report the case to the appropriate authorities. Currently, investigators may spend several hours writing comments or narratives for SAR cases. The intelligent alert system can reduce the investigator's considerable effort.

[0269]

[0270] In some cases, a person's writing style may be affected by their mood. For example, a person in a good mood may write a detailed narrative. As another example, a person in a bad mood may write a poorly written or incomplete narrative. Aspects of the present disclosure eliminate the influence of a human writer's mood on a narrative so that the narrative maintains a consistent standard.

[0270]

[0271] In an exemplary situation, when an intelligent alert system detects that customer John Doe deposited $9,990 into an account at Bank ABC on June 1st and $9,995 on June 2nd, an alert may be generated using the default narrative as follows: John Doe teeth, June 1st to $9,990 of, June 2 to $9,995 of ABC BankIn this example short narrative, the underlined words are facts and the remaining words are linking words.

[0271]

[0272] In one example, the researcher might change the narrative to: John Doe teeth, June 1st to $9,990 of, June 2 to $9,995 of ABC Bank This is a typical cash structuring pattern, so we will report this case as suspicious activity pursuant to the Bank Secrecy Act. In the above narrative, the underlined words are facts and the remaining words are link words. When the investigator saves the SAR form for John Doe, the intelligent alert system remembers the revised narrative as the default narrative.

[0272]

[0273] At a later point in time, the intelligent alert system may detect customer Jack Daniel depositing $9,999 into an account at Bank ABC on July 1 and $9,999 on July 2. In response, the intelligent alert system may generate a SAR case using the default narrative as follows: Jack Daniel teeth, July 1st to $9,999 of, July 2nd to $9,999 of ABC Bank This is a typical cash structuring pattern, and we will be reporting this as suspicious activity in accordance with the Bank Secrecy Act."

[0273]

[0274] In one example, an investigator might change this narrative to the following narrative: “Pursuant to the Bank Secrecy Act, financial institutions are required to report cash structuring activity through suspicious activity reports (SARs). Jack Daniel but, July 1st to $9,999 of, July 2nd to $9,999 of ABC BankThis is a typical cash structuring activity to avoid filing a Currency Transaction Report (CTR). Therefore, we are reporting this case as a suspicious structuring activity through a SAR.” When the investigator saves the SAR form about Jack Daniel's, the intelligent alert system remembers the revised narrative as the default narrative.

[0274]

[0275] In a later period, the intelligent alert system detects customer Jim Beam depositing $9,980 into an account at Bank ABC on August 3 and $9,985 on August 4. In response, the intelligent alert system may generate a SAR case using the default narrative as follows: "Pursuant to the Bank Secrecy Act, financial institutions are required to report cash structuring activity through suspicious activity reports (SARs). Jim Beam but, August 3 to $9,980 of, August 4th to $9,985 of ABC Bank This is a typical cash structuring activity to avoid filing a Currency Transaction Report (CTR). Therefore, we are reporting this case as a suspicious structuring activity through the SAR."

[0275]

[0276] Investigators may want to look at the above narrative and add a few words such as: “Pursuant to the Bank Secrecy Act, financial institutions are required to report cash structuring activities through suspicious activity reports (SARs). Jim Beam but, August 3 to $9,980 of, August 4th to $9,985 of ABC Bank This is a typical cash structuring activity to avoid filing a Currency Transaction Report (CTR). Therefore, we are reporting this case as a suspicious structuring activity through SAR. Jim Beam teeth, March 1, 2019The average account balance for the past three months is $123,197 During this case review process, the investigator included additional facts extracted from the Intelligent Warning System database. These additional facts are underlined in the following sentence: Jim Beam teeth, March 1, 2019 The average account balance for the past three months is $123,197 When an investigator saves a SAR form about Jim Beam, the intelligent alert system remembers the revised narrative as the default narrative.

[0276]

[0277] In yet another later period, the intelligent alert system detects customer Remy Martin depositing $9,998 into an account at Bank ABC on September 5 and $9,998 on September 6. In response, the intelligent alert system may generate a SAR case using the default narrative as follows: "Pursuant to the Bank Secrecy Act, financial institutions are required to report cash structuring activity through suspicious activity reports (SARs). Remy Martin but, September 5 to $9,998 of, September 6 to $9,998 of ABC Bank This is a typical cash structuring activity to avoid filing a Currency Transaction Report (CTR). Therefore, we are reporting this case as a suspicious structuring activity through SAR. Remy Martin teeth, February 15, 2019 The average account balance for the past three months is $83,225 is."

[0277]

[0278] An investigator may look at the above narrative and decide that no further changes are necessary. Until the investigator makes changes in the future, any cases detected by the same scenario will use the following comment or narrative: "In accordance with the Bank Secrecy Act, financial institutions are required to report cash structuring activity through suspicious activity reports (SARs). (Suspect name) but, (First deposit date) to (First cash transaction amount) , (Second deposit date) to (Second cash transaction amount) of (Bank name) This is a typical cash structuring activity to avoid filing a Currency Transaction Report (CTR). Therefore, we are reporting this case as a suspicious structuring activity through SAR. (Suspect name) teeth, (Account opening date) The average account balance for the past three months is (Average account balance) The underlined words will be extracted from the intelligent alert system's database. The remaining words in the narrative are the preferred link words used by the investigator that the intelligent alert system has learned from the investigator based on the style of their narratives of past cases detected by the same scenario.

[0278]

[0279] In the above example, the set of facts consists of suspect name, first cash transaction amount, first deposit date, second cash transaction amount, second deposit date, bank name, account opening date, and average account balance. These different pieces of facts may be extracted from a storage location such as a database.

[0279]

[0280] Furthermore, John Doe, Jack Daniel, Jim Beam, and Remy Martin are facts of the same type that are subordinate to the field name "suspect name." Each suspect name can be defined as a corresponding fact to the other suspect names. For example, Remy Martin can be a corresponding fragment of a fact for Jim Beam. Similarly, a set of corresponding fragments of facts can be defined based on the following fields: first cash transaction amount, first deposit date, second cash transaction amount, second deposit date, bank name, account opening date, and average account balance.

[0280]

[0281] When the intelligent alert system indicates a default narrative based on a new set of facts for a new suspect, the intelligent alert system replaces each old fact for the old suspect with a new corresponding fact for the new suspect. In the example above, the old suspect name Jim Beam is replaced with the new suspect name Remy Martin, $9,980 is replaced with $9,998, August 3 is replaced with September 5, $9,985 is replaced with $9,998, August 4 is replaced with September 6, ABC Bank is replaced with ABC Bank, March 1, 2019 is replaced with February 15, 2019, and $123,197 is replaced with $83,225. The linking words remain unchanged.

[0281]

[0282] If a researcher uses the same default narrative a predetermined number of times without revising it, and this default narrative is consistent with the researcher's writing style (or preferences), an intelligent warning system may skip or advise the researcher to skip the narrative review process.

[0282]

[0283] In one configuration, in addition to providing one commentary or narrative for each scenario, the intelligent alerting system provides an introductory section for each case. Additionally or alternatively, the intelligent alerting system may provide a conclusion section for each case. The introductory section is placed at the beginning of the overall narrative, and the conclusion section is placed at the end of the overall narrative. For example, if a case has three scenarios selected by the investigator, the overall commentary or narrative will have one introductory section, three commentary or narrative sections that match the three selected scenarios, and one conclusion section.

[0283]

[0284] In one application of the present disclosure, the introductory and conclusion sections may also be modified and saved by the researcher. Similarly, the intelligent alert system will learn to construct the researcher's preferred introductory and conclusion sections. This general format, including the introductory and conclusion sections, provides the researcher with additional flexibility to write a more comprehensive and universal narrative.

[0284]

[0285] In one configuration, if a case includes multiple suspects, each suspect is detected by a set of scenarios. The overall commentary or narrative for the case may include an introductory section, a relationship section that explains the relationships between these suspects, a single set of commentary (or narrative) sections for each scenario, and a conclusion section.

[0285]

[0286] Updating the link words and relative positions of facts in the default narrative based on different sets of facts can simplify the SAR case review and filing process. For example, when the intelligent alert system detects an alert about a suspect, the intelligent alert system sends the current matching scenario and all scenarios that match past alerts about the suspect to an investigator's computer system. The investigator selects the scenarios that constitute the reason for filing the SAR and sends the selected scenarios back to the intelligent alert system. The intelligent alert system searches a database to identify a default narrative for the selected scenario and sends the default narrative, based on the suspect's facts, back to the investigator's computer system. The investigator can review the narrative and make changes as needed.

[0286]

[0287] When the investigator saves the revised narrative, the investigator's computer system sends the revised narrative back to the intelligent alert system. The intelligent alert system stores the revised narrative and sends the SAR form with the revised narrative to the BSA officer's computer system. When the BSA officer approves the SAR form, the intelligent alert system sends the SAR form to FinCEN's computer system. If the investigator determines that no changes need to be made to the default narrative, the intelligent alert system can send the SAR with the default narrative directly to the BSA officer's computer system for approval.

[0287]

[0288] In some cases, investigators are also BSA personnel, or BSA personnel allow investigators to submit SARs directly without approval. In these cases, investigators can accept a default narrative based on the then-current facts. In response, the intelligent alert system can send the SAR with a default narrative based on the current facts directly to FinCEN's computer system.

[0288]

[0289] After an investigator has consecutively accepted a default narrative for a scenario based on different sets of facts without any changes for a predetermined number of times, the intelligent alert system can assume that the default narrative is consistent with the investigator's writing style (or preferences) for that scenario. Thus, when a future true positive case is detected again for the same scenario against the then-current suspect, the intelligent alert system can send a SAR with a default narrative based on the then-current facts for the then-current suspect directly to FinCEN's computer system. This situation eliminates the effort associated with investigators and BSA personnel.

[0289]

[0290] The above description of one selected scenario can also be applied to multiple selected scenarios. For example, if an investigator successively accepts default narratives for all selected scenarios of a detected case based on different sets of facts over a predetermined number of times, the intelligent alert system can send SARs to FinCEN's computer system with default narratives for multiple selected scenarios based on the then-current facts of the then-current suspect.

[0290]

[0291] In addition to the application of SAR filing, aspects of the present disclosure may be used by a computer system to automatically generate different types of reports based on the preferences of a human writer. For example, a hospital may need to create a report for each patient. A police department may need to create a report for each incident. A school may need to create a report for each student. There are many other report generation needs. Traditional reports are created using significant human resources. Aspects of the present disclosure may reduce the human resources used in generating reports.

[0291]

[0292] Reports may be categorized into different types of reports based on different factors, such as reasons, purposes, criteria, and scenarios. For example, in a hospital, different types of reports may be used based on the reason a patient checked into the hospital. For example, the reason may be heart surgery, childbirth, etc. A patient may have multiple reasons for checking into a hospital. Additionally, for each main reason, there may be multiple sub-reasons. For example, if a patient checks into a hospital in need of heart surgery, there may be many reasons for that need. Because each different reason may require a different type of writing style (or preference) for generating the report, it is desirable to further categorize these reasons. As another example, there are many different reasons, purposes, criteria, scenarios, etc. for a police department to write an incident report. As yet another example, there are many different reasons, purposes, criteria, scenarios, etc. for a school to generate a report for each student.

[0292]

[0293] A report may be written based on one or more facts. These facts may be stored in a database and may consist of data entered by humans, data detected by sensors, data collected from different sources, and / or data derived from other data. Furthermore, humans use words, phrases, sentences, symbols, etc. to link facts together to form a report. For ease of reference, the words, phrases, sentences, symbols, etc. that link facts together are collectively referred to as "linking words."

[0293]

[0294] In one configuration, the computer system stores the facts in a database. The computer system provides editing capabilities for a human writer to create a set of factors, which may include reasons, objectives, criteria, scenarios, etc. The computer system may provide editing capabilities for the human writer to use the set of facts to create a default narrative for each factor. Additionally, the computer system provides editing capabilities for the human writer to write linking words for the default narrative for each factor. The computer system may also store the default narrative for each factor. The default narrative includes facts and linking words.

[0294]

[0295] In one configuration, the computer system stores a default narrative for each factor in the database. In this configuration, the default narrative includes a link word, the position of each fact in the narrative, and a storage location in the database for storing each fact. For example, the default narrative may be, "(Object 1) caused a car accident on (Object 2)." In this example, Object 1 and Object 2 are two facts. The computer system stores the entire sentence containing the link word "had a car accident on," and the positions of Object 1 and Object 2 in this sentence in the database. In addition, the computer system stores the table names and field names of Object 1 and Object 2, respectively, in the database.

[0295]

[0296] Data fields with the same definitions may be stored in the same database table. For example, all patient names are stored in the same database table. Thus, when two different sets of facts are used to write two narratives for two cases, corresponding pairs of facts in the same position in each respective narrative will be in the same database table. When multiple database tables are used to generate facts, database keys for linking these multiple database tables may also be stored in the database. As a result, when a default commentary or narrative based on an old set of facts is used to generate a new narrative for a new set of facts, the computer system identifies each corresponding pair of facts and replaces the old facts with the corresponding new facts.

[0296]

[0297] For example, Object 1 is the "Patient Name Field" stored in the Patients table, and Object 2 is the "Date Field" in the Events table. In the above example, "Jack Daniel had a car accident on January 20, 2018" and "Jim Beams had a car accident on February 3, 2018" are based on the same narrative format but contain two different pieces of facts (e.g., patient name and event date). The link word for these two scenarios is the same: "had a car accident on."

[0297]

[0298] In one configuration, the computer system lists a set of factors, which may include reasons, objectives, criteria, scenarios, etc. The computer system may allow a human writer to select factors for displaying a default narrative based on a new set of facts. The human writer may add, delete, or modify linking words in the narrative displayed by the computer system.

[0298]

[0299] In one configuration, the computer system provides database search and editing capabilities so that a human writer can add, delete, or modify facts and change their positions in the narrative displayed by the computer system. The human writer can store the revised narrative as a new default narrative, which includes the facts, the positions of each piece of fact, and linking words. The computer system stores database table, key, and field information for each fact in the new default narrative.

[0299]

[0300] In one aspect of the present disclosure, a human writer selects factors for displaying a new default narrative based on a new set of facts and the same set of link words stored in a database. The computer system extracts each new fragment of a new fact based on where the old corresponding fragment of the old fact was stored in the database. The computer system may display each new fact between link words in the narrative based on the location of each old corresponding fact in the narrative.

[0300]

[0301] In one configuration, the computer system provides functionality for a human writer to add, delete, or modify link words in the new default narrative displayed by the computer system. The human writer may also add, delete, or modify facts and change the position of facts in the new default narrative displayed by the computer system. The human writer may re-store the revised new default narrative as the next new default narrative.

[0301]

[0302] The above process can be repeated to allow the human writer to continue revising the default narrative based on new sets of facts and store the revised default narrative as the next new default narrative. As a result of this evolutionary process, future default narratives can conform to the preferences of the human writer.

[0302]

[0303] In one aspect of the present disclosure, a narrative is considered mature for a selected factor if a human writer has not changed the narrative for different cases using different sets of facts across a predetermined number of instances based on the same factor selected by the human writer, where the predetermined number can be defined by a human and / or a computer system.

[0303]

[0304] In one configuration, a link word is considered mature for a selected factor if a human writer has not changed the link word displayed by the computer system for different instances that used different sets of facts based on the same factor selected by the human writer over a predetermined number of instances, where the predetermined number of instances can be defined by a human and / or the computer system.

[0304]

[0305] In one configuration, when the narrative is mature for a factor selected by the human writer, the computer system automatically skips or encourages the human writer to skip the narrative review process and generates a report on the selected factor using the current default narrative as a standard narrative format that includes facts that may vary from report to report and the same set of linking words that match the writing style (or preferences) of the human writer.

[0305]

[0306] In one configuration, if the link words are mature for a factor selected by a human writer, the computer system automatically skips or encourages the human writer to skip the narrative review process and generates a report on the selected factor using the current default link words as standard link words.

[0306]

[0307] In one configuration, if a human writer selects multiple factors for writing the report, the computer system uses the selected factors to generate one narrative section for each factor and combines multiple narrative sections together based on the multiple selected factors to generate the report.

[0307]

[0308] An introductory section may be inserted at the beginning of the report, the introductory section including facts and / or linking words, which may be revised by a human writer over multiple reports to ultimately match the writing skills (or preferences) of the human writer based on an evolutionary process described in this disclosure.

[0308]

[0309] A link section may be inserted in the middle of the report, containing facts and / or link words that may be revised by human writers over multiple reports to ultimately match the writing skills (or preferences) of the human writers based on the evolutionary process described in this disclosure.

[0309]

[0310] A conclusion section may be inserted at the end of the report, containing facts and / or linking words that may be revised by a human writer over multiple reports to ultimately match the writing skills (or preferences) of the human writer based on the evolutionary process described in this disclosure.

[0310]

[0311] As a result of this disclosure, a computer system may learn the writing style (or preferences) of each human writer and automatically generate various reports for each human writer based on the writing style (or preferences) of the human writer.

[0311]

[0312] One or more of the above examples are based on anti-money laundering applications in financial institutions. Nevertheless, the present disclosure is also applicable to many other different types of applications for different organizations and different purposes. For example, an intelligent alert system may be used by a government agency to identify employees who may be stealing confidential information from the government. An intelligent alert system may be used by a school to identify students who may be dropping out of school. An intelligent alert system may be used by a social networking company to identify members who may be engaging in illegal activities on social networks. An intelligent alert system may be used by an employer to identify employees who may be quitting their jobs. An intelligent alert system may be used by a marketing company to identify potential business targets. An intelligent alert system may also be a mobile application used by an individual to identify potential stocks or commodities for investment purposes. In a public health application, an intelligent alert system may be a mobile app that monitors a person's health status and sends a message if there is a potential health concern. Intelligent alert systems have countless uses. The following procedure is an example of how to design and develop an intelligent alert system to monitor a group of subjects for any specific goal.

[0312]

[0313] In one configuration, the intelligent alert system assigns scores to various factors. Additionally or alternatively, the intelligent alert system assigns a score to each degree of each factor. The degree of a factor is used to distinguish between different levels of the factor's impact. For example, sending a wire transfer is a risk factor to be considered for anti-money laundering purposes. However, the amount of the wire transfer may have a different impact. For example, a wire transfer amount of $0 to $10,000 may have a low level of money laundering risk, while a wire transfer amount of $250,000 to $1,000,000 may have a high level of money laundering risk. The factors may be based on data related to subjects having a positive or negative impact on the achievement of the goal. The intelligent alert system assigns a score to each factor. The intelligent alert system may identify the possible degrees of factors in the data related to subjects having a positive or negative impact on the achievement of the goal. The intelligent alert system assigns a score to each degree of each factor. In one configuration, the intelligent alert system generates a total score for each subject under surveillance by summing all of the scores for the factors or magnitudes of factors associated with the subject.

[0313]

[0314] The intelligent alert system uses a set of scenarios based on different criteria. The criteria may include factors from data related to the subject, the magnitude of factors from data related to the subject, and / or a score derived from data related to the subject. Additionally or alternatively, the criteria may be based on rules derived from decision trees, special categories related to the subject, if-then conditional formats derived from models trained by machine learning networks, if-then conditional formats derived from behavioral patterns, if-then conditional formats derived from trading patterns, factors established by a software module, and / or factors established by a user or designer of the system.

[0314]

[0315] Through the above methods, scenarios for the intelligent alert system are established in various ways. These scenarios may trigger alerts to generate potential cases, and each potential case may have one or more scenarios in its causal vector. The intelligent alert system may list a set of potential cases triggered by one or more scenarios. An investigator may review the potential cases to determine which cases are true positives and which cases are false positives. Additionally, an investigator may review current potential cases with past potential cases to determine which combinations of cases are true positives or false positives.

[0315]

[0316] In one configuration, the intelligent alert system allows an investigator to review scenarios of a potential case to determine which combinations of scenarios will produce true positives and which combinations of scenarios will produce false positives. The intelligent alert system also provides an investigator with the ability to review scenarios of a current potential case along with scenarios of past potential cases to determine which combinations of scenarios are true positives and which combinations of scenarios are false positives.

[0316]

[0317] Although a composite cause vector is obtained from the combination of multiple cause vectors, the composite cause vector has the same form as a cause vector. By definition, a composite cause vector is the cause vector of combined cases. Therefore, the conditional probability P(S / cbv) of a composite cause vector and the conditional probability P(S / x) of a cause vector can be calculated through a similar method.

[0317]

[0318] Furthermore, a cause vector (or a composite cause vector) may trigger a potential case for investigation, but the reason for reporting the case may be based on a subset of the scenarios in the cause vector. To maintain accuracy in the posterior probability calculation, it is desirable to identify the subset of scenarios that form the true cause vector for a true positive.

[0318]

[0319] The intelligent alert system provides investigators with the ability to review scenarios of potential cases to identify a true causal vector if the potential case is a true positive. Investigators may review scenarios of combined potential cases to identify a true causal vector if the combined potential cases are true positive. The intelligent alert system may store the investigation results and associated causal vector (or true causal vector) for each potential case. As previously described, once a true causal vector is identified, a set of narratives can be generated using the set of scenarios that make up the true causal vector, and a SAR form can be automatically completed and sent to FinCEN.

[0319]

[0320] In one configuration, the intelligent alert system stores the combined case investigation results and the associated composite cause vectors (or true composite cause vectors) for the combined cases. Each composite cause vector (or true composite cause vector) may be composed of one or more scenarios. The results and other information may be stored in a database or other data structure.

[0320]

[0321] After an investigator uses the intelligent alert system for a period of time, the intelligent alert system accumulates a large amount of data related to the subject. The data may include past potential cases, past investigation results (e.g., true positives or false positives), and associated causal vectors (or true causal vectors). As a result, the accuracy of the system may increase as the system is used more and more. That is, the accuracy of the system may increase through the accumulation of data.

[0321]

[0322] For clarity, a cause vector or a real cause vector will generally be referred to hereinafter as a cause vector. Furthermore, a cause vector will generally be referred to hereinafter as both a cause vector and a composite cause vector. Thus, a cause vector will generally refer to a cause vector, a composite cause vector, a real cause vector, and / or a real composite cause vector.

[0322]

[0323] In one configuration, the system calculates a conditional probability for each cause vector after the amount of historical data is greater than a threshold. The threshold may be based on the number of true cases, potential cases, data size, and / or other factors. The conditional probability of a cause vector based on a given time period is the number of true positives triggered by the cause vector divided by the total number of potential cases triggered by the cause vector.

[0323]

[0324] In one aspect of the present disclosure, the intelligent alert system rejects a potential case triggered by a causal vector as a false positive when the conditional probability of the causal vector is lower than a false positive rejection threshold, which may be set by the software module, the person designing the system, the person tuning the system, and / or the user of the system.

[0324]

[0325] In some cases, if the potential cases triggered by the cause vector always have low conditional probabilities, the cause vector's scenarios may not be properly defined. In such a situation, the user can adjust the cause vector's scenarios to increase their probability predictions. The intelligent warning system can prompt the user to make such changes.

[0325]

[0326] The intelligent alert system may accept a potential case triggered by a causal vector as a true positive in response to the conditional probability of the causal vector being higher than a true positive acceptance threshold, which may be set by the software module, a person designing the system, a person tuning the system, and / or a user of the system.

[0326]

[0327] A vector with multiple elements can be transformed into a combination of multiple vectors. For example, vector A has three elements v1, v2, and v3. In this example, vector A can be a combination of three vectors (e.g., vector B with element v1, vector C with element v2, and vector D with element v3). For clarity, vector A will be referred to as the parent vector. Vectors B, C, and D may be referred to as child vectors. In the following disclosure, the causal vector will be considered the parent vector.

[0327]

[0328] The above example assumes that the child vector has only one element. In general, a child vector can have multiple elements. For example, vector A in the above example can have a child vector with elements v1 and v2. Because each element can be included in or excluded from the parent vector to form the child vector, a parent vector with N elements can have a total of 2 elements, including itself, which all has N elements, and a null vector, which has no elements. N Therefore, a parent vector with N elements can have 2 N - There can be two possible significant child vectors. Each element of a cause vector corresponds to a scenario. If an element is 1, the corresponding scenario is included. If an element is 0, the corresponding scenario is excluded. A subset of the scenarios of a parent cause vector can form the scenarios of a child cause vector.

[0328]

[0329] In general, the conditional probability value of a cause vector may increase as the number of scenarios in the cause vector increases. For example, if a first cause vector has only scenario A as its vector element and a second cause vector has both scenario A and scenario B as its vector element, the conditional probability value of the second cause vector should be the same as or higher than the conditional probability value of the first cause vector.

[0329]

[0330] Thus, a parent cause vector has the same or higher conditional probability value as any of its child vectors. That is, if a child vector already has a conditional probability value greater than the true positive acceptance threshold, then the parent cause vector's conditional probability value will also be greater than the true positive acceptance threshold.

[0330]

[0331] In one configuration, the intelligent alert system accepts a potential case triggered by a causal vector as a true positive when the conditional probability value of one of its child vectors is equal to or greater than a threshold value. The threshold value may be set by the software module, the person designing the system, the person tuning the system, and / or the user of the system.

[0331]

[0332] A current potential case may be combined with a group of past potential cases to form a composite cause vector. The intelligent alert system may accept a composite cause vector of a potential case as a true positive when the conditional probability value of one of the composite cause vector's child vectors is equal to or greater than a threshold. The threshold may be set by the software module, the person designing the system, the person tuning the system, and / or the user of the system.

[0332]

[0333] It may be difficult for an intelligent alert system to try all possible combinations of past potential cases to determine whether a particular combination of a current potential case and a past potential case meets the automated true positive acceptance criteria. Thus, in one configuration, the intelligent alert system accepts a composite cause vector as a true positive when the conditional probability value of one of the composite cause vector's child vectors is equal to or greater than a threshold. The threshold may be set by the software module, the person designing the system, the person tuning the system, and / or the user of the system.

[0333]

[0334] In general, all potential cases related to one subject may be related to one another. Additionally, all potential cases related to a group of related subjects may be related to one another. For example, if five students live in the same dormitory, all potential cases related to any of these five students are related cases. The scope of relationships for defining related potential cases may be set by the software module, the person designing the system, the person adjusting the system, and / or the user of the system.

[0334]

[0335] When an intelligent alert system is used over a long period of time, it may not be practical or efficient to use all relevant potential cases. That is, the number of relevant potential cases may be too large, resulting in poor performance. Therefore, it may be desirable to limit the scope of relevant cases to a certain period of time. In one configuration, a composite cause vector may be generated from a current potential case and a group of relevant past potential cases that occurred within a predetermined period of time. The intelligent alert system may accept a composite cause vector as a true positive when the conditional probability value of the child vectors of the composite cause vector is equal to or greater than a threshold. The threshold may be set by the software module, the person designing the system, the person adjusting the system, and / or the user of the system. The predetermined period of time may be set by the software module, the person designing the system, the person adjusting the system, and / or the user of the system.

[0335]

[0336] The intelligent alert system provides an opportunity for investigators to investigate cases that are neither automatically rejected as false positives nor automatically accepted as true positives. The intelligent alert system records the investigation results for each potential case and the associated cause vector for the potential case. This information can be used to calculate future conditional probability values ​​for the cause vector.

[0336]

[0337] Because the intelligent warning system continues to use the investigation results to further adjust future conditional probability values, the intelligent warning system may adjust itself to future environmental changes. The more potential cases the intelligent warning system can process without human interaction, the fewer potential cases remain for investigators to process.

[0337]

[0338] An intelligent warning system can exclude cases that are automatically accepted as true positives or rejected as false positives from the calculation of the posterior probability value. This approach avoids problems caused by positive feedback. For example, if a potential case triggered by cause vector x is automatically accepted as a true positive, the value of the conditional probability p(S / x) may increase when the result of this case is included in the calculation of the posterior probability value of cause vector x. As a result, the next potential case triggered by cause vector x may be automatically accepted as a true positive. Because the posterior probability value continues to increase, the automatic acceptance of future potential cases triggered by cause vector x continues. In other words, once a potential case triggered by a cause vector is automatically accepted as a true positive, all future potential cases triggered by the same cause vector will be automatically accepted as true positives if the accepted case is included in the calculation of the posterior probability value of the cause vector. This is undesirable because this "no-return" process deprives the intelligent warning system of the ability to readjust itself backwards when the environment changes in the future.

[0338]

[0339] In one configuration, the intelligent alert system does not automatically reject a potential case when its conditional probability value is lower than a false positive rejection threshold. As a result, an investigator may fine-tune the conditional probability value through this potential case. For reference, this case is referred to as a false positive validation case. The number, rate, and / or frequency of occurrence of false positive validation cases is determined by the software module, the person designing or tuning the system, and / or the user of the system.

[0339]

[0340] Additionally, in some cases, the intelligent alert system may not automatically accept a potential case as a true positive when the conditional probability value of the potential case is higher than the true positive acceptance threshold. As a result, an investigator may fine-tune the conditional probability value through this potential case. For clarity, this case is referred to as a true positive validation case. The number, proportion, and / or frequency of occurrence of the true positive validation cases is determined by the software module, the person designing or tuning the system, and / or the user of the system.

[0340]

[0341] In some cases, certain subjects are treated differently for different reasons. For example, some subjects are on a "Do Not Compare List" or a "White List." Potential cases related to subjects on such lists may be treated as false positives without the need for investigation. For example, it may be politically correct to place a politician on an anti-money laundering system's "Do Not Compare List," regardless of what is detected. Similarly, potential cases related to subjects on other lists for other purposes may be treated as true positives without the need for investigation.

[0341]

[0342] Because these cases are treated differently, they are considered outliers. It is desirable to exclude these outliers from the calculation of the posterior probability values. The intelligent warning system may skip potential cases associated with subjects on a "no comparison list" or "white list." Skipped cases will not be used when calculating the posterior probability values ​​of the causal vector.

[0342]

[0343] In some cases, an alert triggered by a scenario for a subject may prove to be a false alert because the scenario is not suitable for monitoring the subject. For example, a cash-intensive business may naturally have more cash than other types of businesses, and a scenario comparing the amount of cash between this business and others may not be meaningful and appropriate. Under such circumstances, an investigator can mark the scenario as verified for this subject. This means that the scenario has already been verified by the investigator for this subject, and no action needs to be taken if another alert is triggered by this scenario for this subject. Therefore, a potential case triggered by a scenario with a verified status is also considered an outlier.

[0343]

[0344] In one configuration, the intelligent alert system skips potential cases associated with subjects that have a verified status on the scenario that triggered the potential case, and the intelligent alert system does not include the skipped cases in the calculation of the posterior probability value of the causal vector.

[0344]

[0345] When an investigator dismisses a potential case as a false positive, the intelligent alert system prompts the investigator to determine whether the scenario that triggered the potential case should be marked as verified. If the scenario is not marked as verified, it may trigger another false positive in the future. Therefore, it is desirable to mark the scenario as verified when the potential case triggered by the scenario is determined to be a false positive.

[0345]

[0346] The number of potential cases used to calculate a conditional probability value can also affect the reliability of the conditional probability value. For example, if only one potential case is triggered by cause vector x and this potential case is accepted by the investigator as a true positive, the conditional probability p(S / x) may not be reliable even if it has a value of 100%. However, if five potential cases are triggered by cause vector x and the conditional probability p(S / x) is 100%, this conditional probability may be more reliable than the previous example.

[0346]

[0347] The intelligent warning system may automatically dismiss a potential case triggered by a causal vector as a false positive when the conditional probability of the causal vector is less than threshold A and the number of potential cases triggered by the causal vector and used to calculate the conditional probability is greater than threshold B. Each of thresholds A and B may be set by a software module, a person designing or tuning the system, and / or a user of the system.

[0347]

[0348] The intelligent alert system accepts a potential case triggered by a cause vector as a true positive when the conditional probability of the cause vector is higher than threshold A and the number of potential cases triggered by the cause vector and used to calculate the conditional probability is greater than threshold B. Each of thresholds A and B can be set by a software module, a person designing or tuning the system, and / or a user of the system.

[0348]

[0349] When an intelligent alert system automatically accepts a potential case as a true positive or rejects a potential case as a false positive based on a conditional probability threshold, it may be desirable to use different conditional probability thresholds for subjects in different categories. For example, a financial institution may submit a SAR for a potential case related to a subject who was a suspect in a past SAR case, even if the conditional probability of the current potential case is lower than the true positive acceptance threshold.

[0349]

[0350] In one configuration, the intelligent alert system uses different true-positive acceptance thresholds and false-positive rejection thresholds for subjects in different categories. The different categories may be defined by the software module, the person designing or tuning the system, and / or the user of the system. In an example anti-money laundering application, these categories may include customers who were the subject of previous SARs, customers matched on OFAC lists, customers matched on 314(a) lists, customers matched on Politically Exposed Person lists, customers matched on other watch lists, high-risk customers, medium-risk customers, low-risk customers, high-risk counterparties, medium-risk counterparties, low-risk counterparties, high-risk countries, medium-risk countries, low-risk countries, high-risk regions, medium-risk regions, low-risk regions, high transaction value, medium transaction value, low transaction value, etc.

[0350]

[0351] Because these categories may also be factors (e.g., risk factors) used for purposes of score (e.g., risk score) assignment and calculation, it may be desirable to use different true positive acceptance thresholds and false positive rejection thresholds for different factors. In one aspect of the present disclosure, the intelligent alert system allows a user to assign a true positive acceptance threshold and a false positive rejection threshold to each factor.

[0351]

[0352] In one configuration, the intelligent alert system accepts a potential case as a true positive if the conditional probability of the causal vector is higher than one of the true positive acceptance thresholds for the factors associated with the potential case. The intelligent alert system may reject a potential case as a false positive if the conditional probability of the causal vector is lower than one of the false positive rejection thresholds for the factors associated with the potential case.

[0352]

[0353] Such an approach can become complicated when many factors are involved. Therefore, it is desirable to select only a few important factors to assign different true-positive acceptance thresholds and false-positive rejection thresholds. In one configuration, the intelligent alert system allows a user to select a set of factors and assign a true-positive acceptance threshold to each selected factor. The user may also select a set of factors and assign a false-positive rejection threshold to each selected factor.

[0353]

[0354] As such, the intelligent alert system may accept a potential case triggered by a cause vector as a true positive if the conditional probability of the cause vector is higher than one of the true positive acceptance thresholds for selected factors associated with the potential case. Additionally, the intelligent alert system may reject a potential case triggered by a cause vector as a false positive if the conditional probability of the cause vector is lower than one of the false positive rejection thresholds for selected factors associated with the potential case.

[0354]

[0355] For improved accuracy, it is desirable for the total number of potential cases to be greater than a threshold when calculating the conditional probability. The threshold can be the number of cases or a time period. The threshold can be arbitrarily set by the user.

[0355]

[0356] In one configuration, the intelligent alert system records the potential case, the investigation results, the associated cause vector, and the date and time the record was established. The intelligent alert system may calculate the conditional probability of cause vector x, which is the number of true positives triggered by cause vector x divided by the total number of potential cases triggered by cause vector x.

[0356]

[0357] After calculating the conditional probability values, the intelligent alert system also records additional values ​​in the database, such as: (1) the number of true positives triggered by cause vector x up to that time, (2) the total number of potential cases triggered by cause vector x up to that time, and (3) the date and time of the calculation, which may be referred to as the last calculation time for cause vector x. As a result of storing these additional values, the intelligent alert system does not need to repeat the same calculation to obtain the same value for cause vector x again.

[0357]

[0358] The intelligent alert system may update the conditional probability of cause vector x based on the sum of the number of true positives triggered by cause vector x (before the last computation time) and the number of true positives triggered by cause vector x (since the last computation time), divided by the sum of the total number of potential cases triggered by cause vector x (before the last computation time) and the total number of potential cases triggered by cause vector x (since the last computation time).

[0358]

[0359] In the above calculation, the number of true positives triggered by cause vector x (before the last calculation time) plus the number of true positives triggered by cause vector x (since the last calculation time) is equal to the number of true positives triggered by cause vector x during the current calculation. Similarly, the total number of potential cases triggered by cause vector x (before the last calculation time) plus the total number of potential cases triggered by cause vector x (since the last calculation time) is equal to the total number of potential cases triggered by cause vector x during the current calculation. Therefore, the above calculations arrive at the same conditional probability p(S / x), which is the number of true positives triggered by cause vector x divided by the total number of potential cases triggered by cause vector x.

[0359]

[0360] Both the number of true positives triggered by cause vector x (before the last calculation time) and the total number of potential cases triggered by cause vector x (before the last calculation time) can be stored in a database after the last calculation of the conditional probability. The intelligent alert system can then search the database to find these two values. The intelligent alert system then calculates two new values ​​based on the potential cases detected since the last calculation time. This approach eliminates many calculations, thereby reducing the amount of data stored in memory.

[0360]

[0361] In one aspect of the present disclosure, upon completion of the calculation of the conditional probability values, the intelligent alert system stores, in addition to the potential cases, investigation results, and cause vector x, additional values ​​such as: (1) the number of true positives triggered by cause vector x up to that time, (2) the total number of potential cases triggered by cause vector x up to that time, and (3) the date and time of the calculation, which may be referred to as the new last calculation time for cause vector x. As a result, these values ​​simplify the calculation of the next round of conditional probabilities for potential cases triggered by cause vector x.

[0361]

[0362] The above method can be further modified during the software coding process. In one aspect of the present disclosure, the intelligent alert system maintains two counters for a cause vector x, one counter for the number of true positives (NTPX) and the other counter for the number of potential cases (NPCX).

[0362]

[0363] In one aspect of the present disclosure, the intelligent alert system resets both counters NTPX and NPCX to 0 to begin counting. As an example, a potential case triggered by cause vector x may be manually reviewed by an investigator and determined to be a true positive. In this example, the number of manually reviewed true positives triggered by cause vector x has increased by one, so the intelligent alert system increments the NTPX counter by one. In the current example, the number of potential cases triggered by cause vector x has increased by one, so the system also increments the NPCX counter by one.

[0363]

[0364] As another example, a potential case triggered by cause vector x is manually reviewed by an investigator and determined to be a false positive. In this example, the intelligent alert system adds 0 to the NTPX counter because the number of manually reviewed true positives triggered by cause vector x has not increased, and adds 1 to the NPCX counter because the number of potential cases y triggered by cause vector x has increased by one.

[0364]

[0365] In one configuration, the conditional probability p(S / x) for a new potential case triggered by a cause vector x is NTPX divided by NPCX. This method can reduce the computational complexity of the conditional probability p(S / x) and simplify the software coding effort.

[0365]

[0366] Although the example uses cause vector x, the above method can be used for any cause vector. An intelligent warning system can have many pairs of counters, one pair per cause vector. As explained earlier, the total number of pairs is limited because only a very small number of scenarios can coexist in the same cause vector to trigger a potential case.

[0366]

[0367] By using the above methods, the intelligent warning system may reduce the amount of time for calculations. Furthermore, the conditional probability values ​​become more accurate as more potential cases are used in the calculations to derive the conditional probability values.

[0367]

[0368] Because the intelligent alert system continues to learn from human workers, it is simply a matter of time before the intelligent alert system automatically detects the alert, makes the decision to file a SAR, completes the SAR form, writes the narrative, and sends the SAR form to FinCEN. The intelligent alert system reduces human resources and handles SAR compliance matters similar to how humans handle SAR compliance matters.

[0368]

[0369] Although suspicious activity detection, SAR case investigation, and suspicious activity report submission are used as examples, the same set of methods as in this disclosure can be used to process currency transaction detection, CTR case investigation, and currency transaction report (CTR) submission to FinCEN.

[0369]

[0370] Similarly, the same set of methods as those in the present disclosure can be used to detect potential OFAC matches, investigate potential matches, and report true matches to the Office of Foreign Assets Control (OFAC). Under such circumstances, the relative correlation (RC) value used to measure the degree of match is equivalent to the risk score used to measure the degree of risk. Therefore, instead of using risk score-based scenarios, the intelligent warning system can use RC-based scenarios.

[0370]

[0371] The OFAC list is just one example of many regulatory lists. The same set of methods as in this disclosure can be used to detect, investigate, and report matches for all types of regulatory lists, such as 314(a) lists, denied persons lists, politically exposed persons lists, and any other lists published by governmental and / or non-governmental agencies. Those familiar with regulatory compliance requirements will understand that the set of methods in this disclosure can be used to detect, investigate, and report any subject to comply with any type of regulatory reporting requirement.

[0371]

[0372] As stated, this disclosure describes a set of methods that can be used by an intelligent alert system for any application and purpose. Whenever an application involves alert generation, human review of the alert, and follow-up action by the human in response to the alert review results, the intelligent alert system gradually learns from the human, makes decisions on behalf of the human, and performs follow-up actions for the human. As a result, the intelligent alert system can reduce human effort and time and replace some or all humans in such applications.

[0372]

[0373] As contemplated by the described embodiment, one of many possible combinations is described below as an example: Intelligent alert system 500 and computer network 600, such as a local area network, enable BSA officers 100, compliance officers 200, investigators 300, and other responsible parties 400 to comply with different types of laws and regulations and to send SAR cases directly to another computer system 700 located at FinCEN, as shown in FIG.

[0373]

[0374] Compliance officer 200 configures and / or adjusts parameters of computer system 500 through computer network 600. Computer system 500 uses an internal workflow function to send potential cases to investigator 300 through computer network 600. After investigation, investigator 300 sends the potential cases and their investigation results to computer system 500 through computer network 600. Computer system 500 uses an internal workflow function to send the potential cases and their investigation results through computer network 600 to BSA official 100 for approval. After BSA official 100 approves the investigation results, if the potential case is a true positive, computer system 500 receives approval from BSA official 100 through computer network 600. Computer system 500 then sends the true positive to computer system 700 at FinCEN.

[0374]

[0375] In some smaller financial institutions, the same person may have multiple roles. For example, one person may be a BSA officer, a compliance officer, and an investigator. In such situations, the intelligent alert system uses its internal workflow capabilities to assign different tasks to this person based on their different roles at different stages of the workflow.

[0375]

[0376] As computer system 500 gradually learns from investigators 300's experiences, computer system 500 becomes smarter and will automatically accept potential cases as true positives if the potential case's conditional probability is higher than a predetermined value. Under such circumstances, computer system 500 sends the true positives directly to computer system 700 at FinCEN without any human intervention. The more investigators 300 use computer system 500, the smarter it becomes. Computer system 500 is expected to eventually process nearly all potential cases by itself with minimal human intervention.

[0376]

[0377] As shown in the flowchart of FIG. 2 in combination with the system diagram of FIG. 1, computer system 500 is used for anti-money laundering applications. Initially (block 2001), computer system 500 receives customer background data and transaction data from a financial institution. Then (block 2002), computer system 500 assigns a risk score to each risk factor in the data. Compliance officer 200 has the option to adjust the risk score over network 600. Additionally (block 2003), computer system 500 assigns a risk score to each degree of risk factor in the data. Compliance officer 200 again has the option to adjust the risk score over network 600. After the risk scores have been assigned and adjusted, computer system 500 calculates a total risk score for each customer (block 2004). Additionally (block 2005), computer system 500 establishes a set of risk score-based detection scenarios. Compliance officer 200 has the option to adjust the scenarios over network 600. Additionally (2006), computer system 500 establishes a set of non-risk score-based detection scenarios. Compliance officer 200 again has the option to adjust the scenarios through network 600. After the scenarios are established and adjusted, computer system 500 uses the scenarios to detect potential cases (block 2007). Computer system 500 uses its workflow functionality to communicate with investigator 300 and BSA officer 100 through network 600 (block 2008) based on the following mechanism: Computer system 500 sends potential cases to investigator 300 through network 600; investigator 300 investigates the potential cases and sends its investigation results to computer system 500 through network 600; computer system 500 sends the investigation results to BSA officer 100; BSA officer 100 approves the investigation results and sends approval to computer system 500 through network 600.After BSA personnel 100 approves the findings, computer system 500 stores the potential case, findings, and associated causal vectors in a database along with a timestamp (block 2009). Through network 600, BSA personnel 100 instructs computer system 500 to report the true positives to FinCEN. Computer system 500 sends the true positives to computer system 700 at FinCEN based on FinCEN's communication protocols.

[0377]

[0378] 3 illustrates a flowchart for reporting potential cases of money laundering according to an embodiment of the present disclosure. According to an embodiment of the present disclosure, computer system 500 improves its ability to detect true positive cases after accumulating potential cases, investigation results, and causal vectors (as described above) for a period of time. Computer system 500 uses a set of true positive acceptance thresholds. Compliance officer 200 approves the true positive acceptance thresholds over network 600.

[0378]

[0379] As shown in FIG. 3, in block 3001, computer system 500 detects a potential case triggered by cause vector x. Then (block 3002), computer system 500 calculates the conditional probability p(S / x) for cause vector x. Computer system 500 compares the conditional probability value of cause vector x to a set of true positive acceptance thresholds (decision block 3003). If the conditional probability value of cause vector x exceeds any of the thresholds (YES branch 3005), computer system 500 sends the potential case as a true positive to computer system 700 at FinCEN (block 3011). If the conditional probability value does not exceed any of the thresholds (NO branch 3004), computer system 500 sends the potential case over network 600 to investigator 300 for manual review (block 3006). Investigator 300 sends the results of the review to computer system 500 over network 600. Computer system 500 sends the findings to BSA personnel 100 over network 600. Computer system 500 receives approval of the findings from BSA personnel 100 over network 600. After approval, computer system 500 stores the potential case, the findings, the timestamp, and the associated cause vector in a database, and the stored information will be used in future calculations of the conditional probability value of the cause vector x (block 3007). Furthermore, computer system 500 determines whether the findings indicate that the potential case is a true positive (decision block 3008). If the potential case is a true positive (YES branch 3010), computer system 500 sends the true positive to computer system 700 at FinCEN (block 3011). If the potential case is not a true positive (NO branch 3009), computer system 500 rejects the potential case as a false positive.

[0379]

[0380] In block 3003, computer system 500 compares the conditional probability value of cause vector x with a set of true positive acceptance thresholds to determine whether computer 500 can automatically accept the potential case as a true positive. However, if the total number of potential cases previously triggered by cause vector x is a very small number, the conditional probability value of cause vector x may not be reliable. Under such circumstances, computer system 500 may still send the potential case over network 600 to investigator 300 for manual review (block 3006).

[0380]

[0381] However, as explained above, if the conditional probability value of one of the child vectors of cause vector x is reliable and higher than one of the true positive acceptance thresholds, computer system 500 can still send the potential case as a true positive to computer system 700 at FinCEN (block 3011).

[0381]

[0382] As shown in the flowchart of FIG. 4 in combination with the system diagram of FIG. 1, the computer system 500 uses a method to calculate the conditional probability p(S / x) of a cause vector x based on the investigator 300's investigation results. The computer system 500 uses a counter NTPX to count the number of true positives triggered by the cause vector x. Additionally, the computer system 500 uses a counter NPCX to count the total number of potential cases triggered by the cause vector x. Initially, the computer system 500 sets the values ​​of both counters to 0. When a potential case is detected, the computer system 500 determines whether the potential case was triggered by the cause vector x (decision block 4002). If the potential case is not triggered by the cause vector x (NO branch 4004), the process ends (block 4005), and the computer system 500 moves on to the next potential case. If the potential case is triggered by the cause vector x (YES branch 4003), the computer system 500 determines whether the potential case needs to be manually processed (decision block 4006). As previously explained, sometimes a potential case may exceed the true positive acceptance threshold, and manual processing of the potential case is not necessary. Sometimes, even if a potential case exceeds the true positive acceptance threshold, the potential case may still require manual processing so that investigator 300 can further refine the conditional probability value. If the potential case should not be processed manually (NO branch 4008), computer system 500 processes the potential case in another manner (e.g., automatically sending the true positive to computer system 700 at FinCEN). As a result, because there is no manual review and the conditional probability is not affected by the potential case, the process ends (block 4005), and computer system 500 moves on to the next potential case.

[0382]

[0383] If the potential case should be processed manually (YES branch 4007), computer system 500 determines whether the potential case requires review, e.g., investigation (decision block 4009). For example, as previously described, if the customer is on an exclusion list, computer system 500 should skip the potential case, and the conditional probability should not be affected by the skipped case being an outlier. Thus, if the potential case does not need to be reviewed (NO branch 4011), the process ends (block 4005) and computer system 500 moves on to the next potential case.

[0383]

[0384] If the potential case requires review (YES branch 4010), a number of events can occur, as previously described. For example, computer system 500 sends the potential case to investigator 300 over network 600. Investigator 300 sends the investigation results to computer system 500 over network 600. Computer system 500 sends the investigation results to BSA representative 100 over network 600. Computer system 500 receives an acknowledgement of the investigation results from BSA representative 100 over network 600. Based on the investigation results, computer system 500 determines whether the potential case is a true positive (decision block 4012).

[0384]

[0385] If the potential case is not a true positive (NO branch 4014), the computer system 500 increments the NTPX counter by 0 and the NPCX counter by 1 (block 4016), and then stores the investigation result and the date and time of the investigation decision in the database along with the potential case and the cause vector x (block 4017).

[0385]

[0386] If the potential case is a true positive (YES branch 4013), computer system 500 increments the NTPX counter by 1 and the NPCX counter by 1 (block 4015), and then stores the investigation result and the date and time of the investigation decision along with the potential case and cause vector x in a database (block 4017). The process then ends (block 4005), and computer system 500 moves on to the next potential case.

[0386]

[0387] The cause vector of a potential case defines the possible causes for reporting the potential case. Thus, two potential cases for two different customers may have the same cause vector. Although cause vector x was used in the above description, there may be many cause vectors. Each cause vector may have a flowchart similar to that of FIG. 4. For example, a potential case triggered by cause vector y may also be processed in the same manner as shown in the flowchart of FIG. 4, except that counters NTPY and NPCY are used instead of counters NTPX and NPCX.

[0387]

[0388] In the above-described method, the total number of potential cases triggered by the cause vector x and manually investigated by the investigator 300 is also identified via the NPCX counter, so the computer system 500 can also determine whether the conditional probability value is reliable. For example, if NPCX has a value of 1 or 2, the conditional probability value of the cause vector x, e.g., NTPX / NPCX, may not be reliable. However, if the NPCX value is greater than a threshold, the conditional probability value of the cause vector x becomes highly reliable. Therefore, the computer system 500 can set a true positive acceptance threshold for the cause vector x under the condition that the value of NPCX is greater than a predetermined value. The predetermined value may be set by the software module, the person designing the system, the person adjusting the system, and / or the user of the system.

[0388]

[0389] As shown in the flowchart of FIG. 5 in combination with the system diagram of FIG. 1, the computer system 500 gradually learns the writing style of the researcher 300 so that the computer system 500 can automatically generate the researcher's report. As previously explained, each subject (e.g., customer) can have its own corresponding set of facts. The position of the facts relative to the link words is generally referred to as the format. The relative positions (e.g., format) of the link words and each piece of fact generally define the writing style of the human writer. The human writer may modify the link words, the position of the facts, or add or delete pieces of facts to complete the report.

[0389]

[0390] First, computer system 500 generates a report based on a default format and a default set of linking words along with a set of facts for the current subject (block 5002). Then (decision block 5003), computer system 500 determines whether researcher 300 modified a previous report generated by computer system 500. If researcher 300 did not modify a previous report (NO branch 5004), no additional modifications need to be made by researcher 300 to the current report, and the current report can be sent to BSA official 100 for approval (or alternatively, to computer system 700 at FinCEN, if researcher 300 has the authority to send reports directly to FinCEN).

[0390]

[0391] If the researcher 300 modified the previous report generated by the computer system 500 (YES branch 5005), the computer system 500 sends the current report to the researcher 300 for review and modification (block 5006). The report is then sent back to the computer system 500 after the researcher 300 completes its review (block 5007).

[0391]

[0392] The computer system 500 then determines whether the researcher 300 has made any modifications to the current report (decision block 5008). If the researcher 300 has not made any modifications to the current report (NO branch 5009), the existing default format and existing default set of link words are a good match for the researcher's 300 writing style and may be used for future reports. If the researcher 300 has modified the current report (YES branch 5010), the computer system 500 uses the set of link words modified by the researcher 300 as the format (e.g., fact location) and default set of link words for the next subject (block 5011).

[0392]

[0393] The above process is repeated for subsequent subjects, and the computer system 500 allows the researcher 300 to continue revising the format and linking words for subsequent subjects until the reports generated by the computer system 500 successfully match the writing style of the researcher 300 without any modification by the researcher 300.

[0393]

[0394] Even after computer system 500 successfully generates a report that matches researcher 300's writing style, computer system 500 may still periodically send that report to researcher 300 so that computer system 500 can adapt if researcher 300 changes his or her writing style. This continuous learning process is desirable to allow computer system 500 to adapt to changing needs. The frequency of sending reports to researcher 300 for the purpose of adapting computer system 500 to changes in writing style may be determined by the system designer, the system user, an engineer, or a computer algorithm that self-adjusts based on researcher 300's past behavior.

[0394]

[0395] In the present disclosure, thresholds, predetermined values, or parameters that may be set by a person, such as a designer or user, may also be set by an intelligent system that learns the person's preferences by evaluating the person's past behavior.

[0395]

[0396] In this disclosure, the term "network" generally refers to one or more communications networks, which may be wireless or wired, private or public, real-time or non-real-time, or a combination thereof, and includes the well-known Internet.

[0396]

[0397] In this disclosure, the term "computer" or "computer system" generally refers to either a computer or a group of computers that may function alone or together to accomplish the purpose of the system.

[0397]

[0398] In this disclosure, the term "processor" generally refers to either one processor or a group of processors that may function alone or together to accomplish the purpose of the processor.

[0398]

[0399] In this disclosure, the term "module" refers to a single component or multiple components, which may be hardware, software, firmware, or a combination thereof, that may function alone or together to achieve the purpose of the module.

[0399]

[0400] In this disclosure, "bank" or "financial institution" generally refers to a financial service provider, either a bank or a non-bank, where financial and money services are provided. Some examples of financial institutions are banks, credit unions, insurance companies, insurance agents, stockbrokers, stock agents, bond brokers, bond agents, commodity brokers, commodity agents, securities firms, mortgage lenders, mortgage institutions, securities companies, money service providers, agents for money service providers, agents for organizations that provide financial or money services, financial holding companies, trading companies, trading agents, other financial service providers, other financial institutions, stock exchanges, commodity exchanges, securities exchanges, currency exchanges, virtual currency companies, virtual currency issuers, virtual currency service providers, virtual currency network providers, virtual currency computer providers, virtual currency dealers, virtual currency exchanges, virtual securities exchanges, bond exchanges, other exchanges, fund managers, investment companies, private equity firms, venture capital firms, merchant acquirers, payment processors, payment card issuers, payment card program administrators, internet merchants, transaction processors, securities processors, other organizations related to financial services, etc.

[0400]

[0401] In this disclosure, a "bank account" or "financial account" generally refers to an account associated with either a bank or non-bank financial institution through which financial transactions can be conducted through financial instruments such as cash, virtual currency, virtual certificates, virtual securities, checks, credit cards, debit cards, ATM cards, stored value cards, gift cards, prepaid cards, wires, monetary instruments, letters of credit, notes, securities, commercial paper, commodities, securities, precious metals, electronic funds transfers, automated note clearing houses, and the like.

[0401]

[0402] For purposes of this disclosure, "financial transactions" generally refer to transactions related to financial activities, including, but not limited to, payments, funds settlement, money services, securities issuance, securities trading, currency trading, commodity trading, payroll, billing, trading, escrow, insurance, underwriting, mergers, acquisitions, account opening, account closure, account status checks, etc.

[0402]

[0403] In this disclosure, "trading" generally refers to both private and public trading activities, including but not limited to trading of stocks, currencies, virtual currencies, virtual certificates, virtual securities, commodities, rights, value, securities, derivatives, goods, services, items, etc.

[0403]

[0404] For purposes of this disclosure, "securities" are generally considered to conform to the definition given in the Securities Act of 1933 and other laws and regulations related to the Securities Act of 1933. For example, securities generally include notes, stocks, bonds, debentures, checks, money orders, warrants, travelers' checks, letters of credit, warehouse receipts, negotiable bills of lading, evidence of indebtedness, certificates of interest or participation in any profit-sharing agreement, collateral-trust certificates, preorganization certificates or subscriptions, transferable shares, investment contracts, voting-trust certificates; valid or blank vehicle title certificates; certificates of interest in property, tangible or intangible assets; any instrument or document evidencing goods, products, and articles, or transferring any right, title, or interest in goods, products, and articles; or any instrument commonly known as a "security," or any certificate of interest or participation in, temporary or interim certificate for, receipt for, warrant, or right to subscribe to or purchase any of the foregoing.

[0404]

[0405] In this disclosure, "consumer" generally refers to a customer, person, subject, payer, payee, beneficiary, user, client, etc., who seeks to conduct a transaction with an individual, organization, merchant, and / or financial institution.

[0405]

[0406] As used herein, the term "identification document" generally refers to passports, driver's licenses, voter cards, benefit cards, student ID cards, social security cards, national identification cards, identity cards, certificates of legal status, and other official documents and informational instruments that identify a designated individual by certain verifiable characteristics and are issued or certified by a consulate, embassy, ​​government agency, public or private organization, or other government authority and protected from unauthorized copying or alteration by one or more responsible parties. In particular, such "identification documents" may be made from a variety of materials, including paper, plastic, polycarbonate, PVC, ABS, PET, Teslin, composite materials, etc., and may have identifying information embedded in them in a variety of formats, e.g., printed or embossed on the document (or card), written on a magnetic medium, programmed into an electronic device, stored in memory, and combinations thereof. "Identifying Information" includes, but is not necessarily limited to, name, identification number, date of birth, signature, address, password, telephone number, email address, personal identification number, taxpayer identification number, national identification number, country issuing ID, state issuing ID, ID expiration date, photograph, fingerprint, iris scan, physical characteristics, and other biometric information. The embedded information may be read via optical, acoustic, electronic, magnetic, electromagnetic, and other media.

[0406]

[0407] For purposes of this disclosure, "personal identifying information" generally refers to name, address, date of birth, personal identification number, user ID, password, taxpayer identification number, type of identification document used, identification number associated with the identification document, the country, state, government agency and / or private organization that issued the identification document, expiration date of the identification document, telephone number, screen name, email address, photograph, fingerprints, iris scan, physical characteristics, biometric information, and other information that can be used to identify a person.

[0407]

[0408] For purposes of this disclosure, "personal information" includes personal identification information, relationships, personal status, personal background, personal hobbies, and personal financial information, including information regarding financial instruments, financial accounts, and financial activities, and other information about a person.

[0408]

[0409] In this disclosure, "financial instrument" generally refers to an instrument used to conduct a financial transaction. Examples of financial instruments include cash, virtual currency, virtual securities, virtual certificates, credit cards, debit cards, ATM cards, prepaid cards, stored value cards, gift cards, checks, monetary instruments, wire transfers, ACH transfers, letters of credit, notes, securities, commercial paper, commodities, precious metals, gold, silver, etc.

[0409]

[0410] In this disclosure, "personal communication device" generally refers to a device interface used for personal communication purposes.

[0410]

[0411] In this disclosure, "device interface" generally refers to keyboards, keypads, monitors, displays, terminals, computers, control panels, vehicle dashboards, network interfaces, mechanical interfaces, video interfaces, audio interfaces, electrical interfaces, electronic interfaces, magnetic interfaces, electromagnetic interfaces including electromagnetic wave interfaces, optical interfaces, light interfaces, acoustic interfaces, video interfaces, audio interfaces, contactless interfaces, mobile phone interfaces, smartphone interfaces, smartbook interfaces, tablet interfaces, other communication device interfaces, personal digital assistant (PDA) interfaces, handheld device interfaces, portable device interfaces, wireless interfaces, wired interfaces, and other interfaces.

[0411]

[0412] As used herein, the term "terminal" or "kiosk" generally refers to equipment, including computers and / or their peripherals, microprocessors and / or their peripherals, ATM terminals, check cashing kiosks, money services kiosks, merchant checkout stands, cash registers, currency exchange machines, parking payment machines, other payment machines, contactless devices, wired phones, mobile phones, smartphones, smartbooks, tablets, personal communication devices, tablet devices, digital assistants, entertainment devices, network interface devices, routers, and / or personal digital assistants (PDAs), etc., that interfaces a user with a computer network so that the user can interact with computer systems and other devices connected to the computer network.

[0412]

[0413] The methods described herein may be implemented by various means depending on the application. For example, these methods may be implemented in hardware, firmware, software, or any combination thereof. In the case of a hardware implementation, the processing may be implemented within one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, electronic devices, other electronic units designed to perform the functions described herein, or combinations thereof.

[0413]

[0414] For a firmware and / or software implementation, methods may be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. Any machine-readable medium tangibly embodying instructions may be used in implementing the methods described herein. For example, software code may be stored in a memory and executed by a processor. The memory may be implemented within the processor or external to the processor. As used herein, the term "memory" refers to any type of long-term, short-term, volatile, non-volatile, or other memory and should not be limited to any particular type or number of memories or the type of medium on which the memory is stored.

[0414]

[0415] If implemented in firmware and / or software, the functions may be stored as one or more instructions or code on a computer-readable medium. Examples include computer-readable media encoded with data structures and computer-readable media encoded with a computer program. Computer-readable media include physical computer storage media. Storage media may be any available medium accessible by a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM, DVD, or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium accessible by a computer that can be used to store desired program code in the form of instructions or data structures. As used herein, disk and disc include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically and discs reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0415]

[0416] In addition to being stored on a computer-readable medium, the instructions and / or data may be provided as signals on a transmission medium included in a communications device. For example, a communications device may include a transceiver having signals indicative of the instructions and data. The instructions and data are configured to cause one or more processors to implement the functions outlined in the claims. A communications device may not store all of the instructions and / or data on a computer-readable medium.

[0416]

[0417] The embodiments described in this disclosure can be assembled to form various applications based on needs. Those skilled in the art and to whom this disclosure pertains will understand that modifications and variations of the described structures can be made without significantly departing from the principles, spirit, and scope of the present disclosure. Such modifications and variations should not be construed as a departure from the present disclosure.

Claims

1. 1. A method for detecting money laundering activity, comprising: Detecting, by a first computer system, a first potential case for money laundering when a flagged scenario in the causal vector of the first potential case meets a detection criterion; comparing, by the first computer system, a first ratio of a first value of the cause vector to a second value of the cause vector with a threshold; transmitting the first potential case from the first computer system to a second computer system for investigation when the first ratio is less than the threshold; adjusting, by the first computer system, the first value when results of the investigation indicate that the first potential case is a true positive; adjusting, by the first computer system, the second value based on the cause vectors meeting the detection criteria; transmitting a first report associated with the first potential case from the first computer system to a third computer system when the first potential case is the true positive; A method comprising:

2. detecting, by the first computer system, a second potential case of money laundering triggered by the causal vector; and comparing, by the first computer system, a second ratio of the adjusted first value to the adjusted second value with the threshold; transmitting a second report associated with the second potential case from the first computer system to the third computer system when the second ratio is not less than the threshold; The method of claim 1 further comprising:

3. The method of claim 2 , further comprising bypassing investigation of the second potential case when the second ratio is not less than the threshold.

4. the first value is based on the number of true positives triggered by the flagged scenarios in the causal vector during a period of time; the second value is based on the number of potential cases triggered by the flagged scenarios in the cause vector during the time period; The method of claim 1.

5. 10. The method of claim 1, further comprising flagging one scenario of a plurality of scenarios in the causal vector based on at least one of customer data, transaction data, or a combination thereof satisfying a condition.

6. The customer data may include the customer's industry, the customer's business type, the customer's geographic area, the customer's country of address, the nature of the customer's business, the product type of the business, the service type of the business, the structure of the business, the customer's occupation, the customer's nationality, past records, the type of transaction made, account balance, inflow of funds, outflow of funds, transaction pattern, number of transactions, transaction amount, transaction volume, transaction frequency, derivative of transaction, location of the transaction, time of the transaction, country of the transaction, sender of remittance transaction, location of the sender, country of the sender, the nature of the sender, the recipient of the remittance transaction, the location of the recipient, the country of the recipient, the nature of the recipient, relationships, social status, political exposure, past transactions, the number of suspicious activity reports (SARs) provided for money laundering and terrorist financing cases, the category of the first financial institution, the business type of the first financial institution, the geographic area of ​​the first financial institution, the country in which the first financial institution is headquartered, the nature of the business of the first financial institution, the age of the person, the gender of the person, the income level of the person, the appearance of the person, judgments about the person, Personal status of an object, the status of the person's family, the family members of the person, the status of the family members of the person, the person's friends, the status of the person's friends, the past records of the person, the person's industry, the person's geographic area, the person's country of residence, the person's occupation, the employee's job type, the employee's educational background, the employee's income level, the length of employment in the current job, performance evaluation records, employment history, the length of each employment in the employment history, the reason for leaving each employment in the employment history, the employee's age, the employee's gender, the employee's personal status, the employee's family status, the employee's family structure membership, status of said employee's family members, status of said employee's friends, past records of said employee, type of work performed, number of transactions executed, amount of transactions executed, maximum transaction amount, number of transactions with a specific counterparty, amount of transactions with a specific counterparty, number of changes to material records, number of changes to material records related to a specific counterparty, geographic area of ​​the employee's home, geographic area of ​​the employee's office, country in which said employee resides, due diligence results of said customer, length of account history, number of names matched to gambling organizations in transactions,or a combination thereof.

7. 6. The method of claim 5, wherein the transaction data is associated with at least one of cash, check, wire transfer, ATM (Automated Teller Machine), ACH (Automated Clearing House), virtual currency, virtual securities, virtual certificates, credit cards, debit cards, prepaid cards, electronic funds transfer, wires, monetary instruments, letters of credit, notes, securities, commercial paper, commodities, precious metals, account openings, account closings, account applications, deposits, withdrawals, cancellations, balance checks, inquiries, credits, debits, or combinations thereof.

8. The method of claim 1 , wherein the report comprises a suspicious activity report (SAR).

9. The method of claim 1 , wherein the second computer system comprises a device interface resident at a financial institution.

10. 10. The method of claim 9, wherein the financial institution comprises at least one of a bank, a credit union, a money services provider, a financial holding company, an insurance company, an insurance agency, a mortgage lender, a mortgage institution, a stockbroker, a stock agency, a bond broker, a bond agency, a commodity broker, a commodity agency, a trading company, a trading agency, another financial service provider, another financial institution, a stock exchange, a commodity exchange, a currency exchange, a virtual currency company, a virtual currency issuer, a virtual currency service provider, a virtual currency network provider, a virtual currency computer provider, a virtual currency dealer, a virtual currency exchange, a virtual securities exchange, a bond exchange, another exchange, a fund manager, an investment company, a private equity firm, a venture capital firm, a virtual currency company, a merchant acquirer, a payment processor, a payment card issuer, a payment card program administrator, an internet merchant, another financial services organization, or a combination thereof.

11. The method of claim 1 , wherein the third computer system comprises a device interface resident at a government agency.

12. The method of claim 11 , wherein the government agency comprises the Financial Crimes Enforcement Network (FinCEN).

13. The method of claim 1 , wherein the flagged scenarios include at least one scenario.

14. The method of claim 1 , wherein the detection criteria includes at least one criterion.

15. 1. A method for detecting money laundering activity, comprising: Detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in the causal vector of the potential case meets a detection criterion; calculating, by the first computer system, a conditional probability value for the potential case based on the causal vector; comparing, by the first computer system, the conditional probability value to a threshold; transmitting a report associated with the potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold; and A method comprising:

16. 1. A method for detecting money laundering activity, comprising: Detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in a first causal vector of the potential case satisfies a detection criterion; generating, by the first computer system, a composite cause vector by combining the first cause vector with a second cause vector of a previous potential case; calculating, by the first computer system, conditional probability values ​​for cases triggered by the multicausal vector; comparing, by the first computer system, the conditional probability value to a threshold; transmitting a report associated with the potential case and the previous potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold; A method comprising:

17. 1. A method for detecting money laundering activity, comprising: Detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in the causal vector of the potential case meets a detection criterion; calculating, by the first computer system, conditional probability values ​​for cases triggered by child vectors of the cause vector; comparing, by the first computer system, the conditional probability value to a threshold; transmitting a report associated with the potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold; and A method comprising:

18. 1. A method for detecting money laundering activity, comprising: Detecting, by a first computer system, a potential case related to money laundering when a flagged scenario in a first causal vector of the potential case satisfies a detection criterion; generating, by the first computer system, a composite cause vector by combining the first cause vector with a second cause vector of a previous potential case; calculating, by the first computer system, conditional probability values ​​for child vectors of the multicause vector; comparing, by the first computer system, the conditional probability value to a threshold; transmitting a report associated with the potential case and the previous potential case from the first computer system to a second computer system when the conditional probability value is greater than the threshold; A method comprising:

19. 1. A computer-implemented method for generating a report, comprising: storing a first fact related to a first subject, a second fact related to a second subject, and a third fact related to a third subject in a database of a first computer system, wherein the first fact, the second fact, and the third fact have the same field names in the database; receiving, at the first computer system, a first report of the first subject from a second computer system, wherein the first report includes the first facts and a first set of link words generated by a human writer; transmitting the first report of the first subject from the first computer system to a third computer system; transmitting the first set of second facts and link words from the first computer system to the second computer system; receiving, at the first computer system, a second report of the second subject from the second computer system, wherein the second report includes the second facts and a second set of link words generated by the human writer; transmitting the second report of the second subject from the first computer system to the third computer system; sending a third report of the third subject from the first computer system to the third computer system when the first set of link words corresponds to the second set of link words, wherein the third report includes the third fact and the second set of link words; 10. A computer-implemented method comprising:

20. 20. The computer-implemented method of claim 19, wherein the third fact is based on at least customer data.

21. 21. The computer-implemented method of claim 20, wherein the customer data is associated with at least one of an individual, an organization, or a combination thereof.

22. The customer data may include the type of business of the customer, the type of business of the customer, the geographic area of ​​the customer, the country where the customer is located, the nature of the business of the customer, the product type of the business, the service type of the business, the structure of the business, the occupation of the customer, the nationality of the customer, past records, the type of transaction made, the balance of the account, the inflow of funds, the outflow of funds, the transaction pattern, the number of transactions, the amount of transactions, the volume of transactions, the frequency of transactions, the derivative of the transaction, the location of the transaction, the time of the transaction, the country of the transaction, the sender of the remittance transaction, the location of the sender, the country of the sender, the nature of the sender, the Recipient, location of the recipient, country of the recipient, nature of the recipient, relationships, social status, political exposure, past transactions, number of Suspicious Activity Reports (SARs) provided for money laundering and terrorist financing cases, category of the first financial institution, business type of the first financial institution, geographic area of ​​the first financial institution, country where the first financial institution is headquartered, nature of business of the first financial institution, age of the person, gender of the person, income level of the person, appearance of the person, judgment about the person, personal status of the person, family status of the person , the person's family members, the status of the person's family members, the person's friends, the status of the person's friends, the person's past records, the person's industry, the person's geographic area, the person's country of residence, the person's occupation, the employee's job type, the employee's educational background, the employee's income level, the length of employment in the current job, performance evaluation records, work history, the length of each employment in the work history, the reason for leaving each employment in the work history, the employee's age, the employee's gender, the employee's personal status, the employee's family status, the employee's family members, the status of the employee's family members, the employee's associated with at least one of the following: friend status, the employee's past record, the type of work performed, the number of transactions executed, the amount of transactions executed, the maximum amount of transactions, the number of transactions with a particular counterparty, the amount of transactions with a particular counterparty, the number of changes to material records, the number of changes to material records related to a particular counterparty, the geographic area of ​​the employee's home, the geographic area of ​​the employee's office, the country in which the employee resides, the customer's due diligence results, the length of account history, the number of names matched to gambling organizations in transactions, or a combination thereof;21. The computer-implemented method of claim 20.

23. 20. The computer-implemented method of claim 19, wherein the third fact is based on at least transaction data.

24. 24. The computer-implemented method of claim 23, wherein the transaction data is associated with at least one of a person, an organization, or a combination thereof.

25. 24. The computer-implemented method of claim 23, wherein the transaction data is associated with at least one of cash, check, wire transfer, ATM (Automated Teller Machine), ACH (Automated Clearing House), virtual currency, virtual securities, virtual certificates, credit cards, debit cards, prepaid cards, electronic funds transfer, wires, monetary instruments, letters of credit, notes, securities, commercial paper, commodities, precious metals, account openings, account closings, account applications, deposits, withdrawals, cancellations, balance checks, inquiries, credits, debits, or combinations thereof.

26. 20. The computer-implemented method of claim 19, wherein the third report comprises a suspicious activity report (SAR).

27. 20. The computer-implemented method of claim 19, wherein the second computer system comprises a device interface resident at a financial institution.

28. 28. The computer-implemented method of claim 27, wherein the financial institution comprises at least one of a bank, a credit union, a money services provider, a financial holding company, an insurance company, an insurance agency, a mortgage lender, a mortgage institution, a stockbroker, a stock agency, a bond broker, a bond agency, a commodity broker, a commodity agency, a trading company, a trading agency, another financial service provider, another financial institution, a stock exchange, a commodity exchange, a currency exchange, a virtual currency company, a virtual currency issuer, a virtual currency service provider, a virtual currency network provider, a virtual currency computer provider, a virtual currency dealer, a virtual currency exchange, a virtual securities exchange, a bond exchange, another exchange, a fund manager, an investment company, a private equity firm, a venture capital firm, a virtual currency company, a merchant acquirer, a payment processor, a payment card issuer, a payment card program administrator, an internet merchant, another financial services organization, or a combination thereof.

29. 20. The computer-implemented method of claim 19, wherein the third computer system comprises a device interface resident at a government agency.

30. 30. The computer-implemented method of claim 29, wherein the government agency comprises the Financial Crimes Enforcement Network (FinCEN).

Images