Geospatial analysts involved in AML/CTF investigations plan and conduct analysis to provide actionable location intelligence for decision makers trying to stop transactions that fund crime and terrorism. This lesson continues the AML/CTF case study with additional information and datasets.

Section 6.1 reviews methods of integrating geospatial analysis into AML/CTF, considerations of the laws and higher authorities guiding investigations, and ways to present findings for decision making.

What is due for Lesson 6?

Lesson 6 will take us one week to complete. There are a number of required activities in this lesson listed below. For assignment details, refer to the lesson page noted.

Note: Please refer to the Calendar in Canvas for specific time frames and due dates.

Requirements for Lesson 6

AML and CTF requires action to mitigate the risks, actually to disrupt and prevent money laundering. This lesson on AML/CTF investigations examines the analysis of geospatial and financial information to produce location intelligence.

This is the intersection of geospatial data of all types, to include social data, remote sensing where applicable, data analytics, and data visualization. Geospatial data sources enrich the initial available information for analysis from structured and unstructured data, open source, third-party, internal, and collected data. Think of how funds are transferred in the 21st century, the vast information accessible to evaluate risk summaries on FI, sectors, and countries. The role of the geospatial analyst is not as investigator or determiner of illegal activities, but tasked to analyze geospatial factors surrounding suspicious activity.

Combining a geospatial analytics methodology and tradecraft to enhance AML/CTF investigations, following a method, process, and secret approach to produce location intelligence. Analysts perform geospatial analysis to assess threats and hazards, discover and model patterns, relationships and networks, and apply predictive and prescriptive analysis to map likely areas at similar risks. These are key elements to risk assessments; however, the criminal intent goes beyond certain nations with bad or weak policies that allow opportunities for money laundering.

Laws, Higher Authority, and Official Organizations

Authorities from the local to global level direct effort and establish boundaries on the geospatial analyst's involvement in AML/CTF investigations to comply with procedures, protect client and business rights, and produce location intelligence of suspicious cases.

U.S. Laws governing banking and the financial sector.

1. Bank Secrecy Act of 1970
2. Money Laundering Control Act (1986)
3. Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)
4. Intelligence Reform & Terrorism Prevention Act of 2004

Higher Authorities publish expert guidance, conduct oversight, and provide support for AML/CTF investigations. A significant international organization for law enforcement and finance is the Financial Action Task Force (FATF) providing AML recommendations with a view to global risks to regulate financial sector, curb corruption, and assessments of specific country strengths and weaknesses.

1. Financial Action Task Force (FATF)
2. US Treasury, Financial Crimes Enforcement Network
3. US Department of State
4. US Secret Service
5. INTERPOL; countering financial crimes, payment card fraud, money laundering, and currency counterfeiting
6. United Nations Office on Drugs and Crime (UNODC), The Money-Laundering Cycle (2019)
7. World Bank, World Governance Indicator (WGI)

Process of geospatial analysis to produce Location Intelligence

For this lesson and case study, you will examine a sequence of geospatial analysis methods and pertinent AML/CTF analytic questions. This involves complex geospatial analysis to detect patterns, corridors, and networks. Examine the process, purpose, and value of descriptive, real-time, predictive, and prescriptive analysis techniques. Similar methods include fraud ring analysis, link analysis, or network analysis.

Investigators ask investigative, analytic, behavioral, and risk questions. We interpret the question to determine a method of geospatial analysis to expose:

1. the flow of illicit funds,
2. funding streams, and
3. the potential risks to nearby FIs.

The workflow depends on the business question an analyst is addressing. Bank and FI objectives range in scope, possibly to identify money laundering, follow up on a client's SAR, prevent money laundering, and comply with laws, financial sector policies, or local adverse situations. Each situation requires an approved target and organized method.

Figure 6.1. Location Intelligence Methodology to Support AML/CTF Investigations.

Click here for a text description of the diagram above.

The process begins with Step 1: Geospatial EDA, which likely refers to exploratory data analysis of geospatial data. It then moves to Step 2: Problem & Environment, where the context and challenges are defined. In Step 3: Enrich Data, additional data is integrated to enhance the analysis. This leads to Step 4: Geospatial Analysis, which is marked with a grey oval labeled "ABI Related", indicating that this step is specifically tied to Activity-Based Intelligence methodologies. Finally, the process culminates in Step 5: Recommend COA, where COA stands for "Courses of Action." Feeding into this final step are three smaller labeled boxes: COA 1, COA 2, and COA x, representing different potential recommendations or strategies derived from the analysis.

Credit: Daniel Steiner © Penn State, licensed CC BY-NC-SA 4.0

The foundation of geospatial analysis in AML/CTF is a workflow, as depicted in Figure 6.1, a process to:

1. Identify suspicious activity or potential of illicit activity. This step often starts with exploratory data analysis (EDA) using descriptive and graphical statistical tools to explore and understand each dataset.
2. Restate the problem as a question with outcomes that support an investigation and define the environment.
3. Assemble and enrich all relevant geospatial information, data, and imagery if applicable. This is similar to activity-based intelligence (ABI) through which human behaviors, events, and transactions are analyzed to produce pattern of life assessments. Analysts who produce ABI focus on events as recognizable movements or changes conducted by an entity and spatial metadata components, relating them to time and space.
4. Perform geospatial analysis to assess threats and hazards, model patterns, relationships, and networks. To optimize the location intelligence assessment, analysts may apply prescriptive analytics forming valid courses of action for decision makers.
5. Present Recommendations, Courses of Action. Map, visualize, chart, and summarize for presentation or to develop analytic recommendations to alert authorities.

To that extent, this is not simply a Boolean analysis to layer all our banking and law enforcement data sets to locate hubs of money laundering. It's useful to use domain-specific theories to better understand the actual phenomena being investigated.

It also requires choosing the appropriate method or technique of geospatial analysis to describe the situation and answer key questions.

Prescriptive analytics adds a previously unappreciated decision advantage to AML and CTF investigations for the business, financial, and public safety sectors. Where appropriate and within the scope of duties, recommended courses of action provide location intelligence insights. Optimization and simulation algorithms advise on possible outcomes that calculate predictions, providing courses of action to decision makers.

In geospatial analytics, coding and AI may automate routine tasks and elevate alerts, reports, and situational awareness to well-trained analysts. Advanced machine learning is currently applied to identify high-risk procedural aberrations, false links, and patterns of fraud. Location intelligence provides insights of regions, customers, and FIs where multiple-SAR related transactions meet regulations or cumulative illicit activity falls below thresholds.

Case Study

Identify regions likely exposed to:

• The flow of illicit funds
• Potential funding streams
• Risks to nearby Financial Institutions (FI)

Recognize the Global Financial Audit Trail, "Follow the Money" to understand the broader global financial networks and investment strategies. Bad money is intermingled with good money in a complex attempt by criminals to throw off investigators and complicate a financial audit trail.

By leveraging the wealth of data available to FIs and exploring additional physical features, such as important rail and road networks, location intelligence can be utilized to enhance the understanding of potential illicit funding corridors. There's a process for geospatial analysts to work, which you may consider for the case study.

• Integrate business segments to detect banking anomalies regarding customers, FIs, and transactions
• Discover patterns of money laundering
• Assist FI’s to connect additional geospatial information to “know their customers”
• National and International practices to enrich data for discovery
• Create models to identify and visualize patterns, risk areas, corridors

Presentations

Present findings for actionable decision.

Present location intelligence for referral; summary, charts, maps, pattern diagrams

Submit report to authorities

It's important to recognize the significance of visualizations for decision-making; seeing patterns emerge from data, identifying linked networks, and discovering instances of suspicious activity.

Advanced Analytics

Choosing the right tool falls into the analyst's ability for critical thinking. This encompasses math, statistics, computer science, and analytical reasoning. One will use a variety of geospatial analytical tools; but the software platform doesn't drive analysis. In your studies, you are learning methods of geospatial analysis, developing elements of tradecraft, and applying location intelligence workflows to a problem. Learning to use a particular software or tool is more training than education. Develop your critical thinking through your courses and personal continuing education.

The AML/CTF case study is a learning exercise to reinforce the main points of location intelligence and material in Lessons 5 & 6. In this section, we're presenting advanced geospatial analytics material, which may require additional software tools to accomplish (outside this course and not for the assignments). This may be a refresher from other experiences or your introduction to advanced visualizing methodologies:

1. Outliers or anomalies

Spatial outliers and anomalies are spatial objects whose non-spatial attributes differ from their spatial neighbors. This technique is quite effective with suspicious behavior and outlier transaction detection. May be represented by a graph analysis of events by latitude and longitude to identify outliers; and then dive deeper into feature attributes to detect anomalies and refer for other investigative tools or methods.

2. Collocation patterns

Colocation patterns can be detected through event-centric models to build neighbor groupings of data points. Alteryx (Alteryx) is an example of a data management software in which the analyst creates a workflow to statistically analyze and filter structured and unstructured financial data. A robust analytic software tool supports exploring a wide range of datasets to uncover patterns. The advantage in point data analysis is to apply statistical significance tests to remove chance patterns. Data management and data analytics tools, e.g. R, GeoDa, SQL, predictive analytics or graph analytics, can perform colocation pattern detection where geolocated events are often sited in a geographic neighborhood.

3. Hotspot detection

Geospatial hot spot regions are significantly more active than surrounding areas in density, frequency, and appearance. This method is common with ABI and fraud ring analysis. Signature Analyst (Maxar) has been successfully applied to depict the likelihood of terrorist threats and event corridors in foreign conflicted areas.

4. Teleconnection detection in space & time

Teleconnection technique is used to discover pairs of correlated spatial time series at large distances, with either positive or negative correlation. There are situations and conditions where imagery adds value in AML/CTF investigations to detect, measure, and visualize patterns in space and time. Imagery is remotely sensed from space, airplanes, unmanned aerial systems, and surveillance video/photos. Tools like ENVI (L5 Geospatial Solutions) provide reliable automation of complex and repetitive digital functions.

5. Predictions

Predictive analysis works with a Bayesian approach, calculating probabilities on georeferenced information from numerous datasets. Spatial prediction relies on selection of an appropriate model for classification and regression, relying on accurate training samples. Signature Analyst (Maxar) effectively works through dependent and independent variable relationships to identify likely locations where similar AML/CTF events may occur.

The financial community recognizes the advantages of combining location intelligence workflows with advanced computing applications. Current literature provides insight on companies researching and programming AI to automate routine foundational tasks, e.g. elevate alerts, reports, situational awareness to analysts. Advanced machine learning has advantages to cue patterns, financial anomalies, and - since we're dealing with the human domain - to rule out false leads.

Errors, Cautions, False Leads

Geospatial scientists understand the potential errors which traditional data mining creates on geospatial data. You may have found that traditional density-based clustering methods will generate chance patterns if applied to geospatial hotspot detection. Methods that test for statistical significance can potentially reduce such random patterns.

Unlike classic data mining for businesses, these geospatial techniques must handle spatial point distributions and the associated challenges of auto-correlation.

False positives or false leads present challenges in AML/CTF investigations. Data or events may appear suspicious when they are actually the result of standard transactional activity. This may be caused by randomness in data, errors of bias in prediction assumptions, AI training data, or investigation. People are not always predictable. The purchase of a $9,000 necklace isn't always to hide a transaction below the $10,000 bank reporting threshold. There's significant corporate marketing that goes into selling jewelry, and one buyer may be inspired to spend less than $10,000 on a fancy necklace.

Conclusion

What actions should a financial organization take in finding, freezing, and forfeiting criminally derived income and assets?

All of this analysis effort is to support the people involved:

• Customers
• Analysts
• Bank tellers trained to spot odd behavior, and
• Senior decision makers

Analysts detect patterns, quantify the events, risks, and potential consequences. Investigators and decision makers follow these leads to stop criminal and terrorist access to money.

Developing new prescriptive methods, deploying machine learning, AI, and critical thinking will advance the discipline of investigating and stopping financial criminal activity.

Proven geospatial analytic methods of location intelligence transform the efficiency of investigations, location-based business problem-solving, and global commerce which is moving at high speed, undergoing great change.

Case Study: Location Intelligence to Support AML/CTF Investigations,
Part 2 - Integration, Geospatial Analysis, and Presentation

Your work in Lesson 5 uncovered patterns of money laundering placement and layering. Let's continue the case study in Lesson 6 to expand the location intelligence supporting the fictional college student AML/CTF investigation to identify any integration activities.

Investigators created a link to additional media reports, financial, and geospatial information for your analysis. Use the Canvas, Lesson 6.2 link to download pertinent financial reports.

Case Study: Step 3 - Integration

1. Your assignment in Lesson 6 is to identify integration activities of money laundering, if applicable, in the case of Blake Glover. What do you find?
2. It is often difficult to separate legitimate purchases from false leads; examine the location, methods, and timing of possible layering activities with an open mind in these situations.

Case Study: Step 4 – Geospatial Analysis

1. Using the available data and information you researched, perform a formal geospatial analysis to produce location intelligence. The results of your analysis will be used by investigators to supplement other forms of legal analysis.
2. Perform a predictive analysis to understand the future consequences or prescriptive analysis to advise on possible outcomes.
3. Develop a recommendation or courses of action (COAs) for the investigative decision makers.

Case Study: Step 5 – Maps, visualization, charts, executive summary

1. Present your findings in a powerpoint or other format presentation.
2. To demonstrate your critical thinking skills and understanding of location intelligence, present your top recommendation on the next step for investigators to prevent money laundering in the FI/or identify money laundering earlier. From your job role as a geospatial analyst, what do you recommend or what COAs do you develop?

Threats to global commerce range from destructive weather events to criminal theft to cyber attacks on the supply chain infrastructure. The responsibilities to secure a business’ supply chain are a daunting task and require education, awareness, teamwork, strategic planning, inspections, and continual surveillance. This falls under the headings, roles, and departments of Supply Chain Security and Supply Chain Management (SCM).

Supply Chain Security is a major concern for commercial and government leaders alike. Building resilience in the supply chain is an effective planning element to responding to disasters, intrusions, and catastrophic events. A Supply Chain is that network which identifies, tracks, reports, monitors, and fulfills demand for products. Products may be perishable foods, technical manufactured tools, pharmaceuticals, digital software, or granite countertops; transported by air, land, rail, sea, e-delivery, cloud storage, and in-person.

The fundamental issues to learn in this short lesson are the risks, threats, and vulnerabilities of an organization’s supply chain. Security topics or needs include:

• People, personnel security (background checks, behavioral, termination control)
• Physical security and access controls
• IT systems, IT and operations accounts, supply chain data
• Shipping and receiving workflow documentation
• Business/firm/broker relationships (know your partners)
• Security process & security awareness throughout the organization and supply-chain

Fundamentals of Supply Chain Security

• Describe the drivers
• Explain the methods used to understand the operating environment and threats
• Understand and apply the fundamentals of Location Intelligence to Supply Chain Security

Multisource Intelligence for Supply Chain Security

• Employ the concepts of intelligence management & collection
• Illustrate intelligence collation & analysis
• Apply the elements of intelligence dissemination

Operational Methods for Supply Chain Security

• Describe and develop operational models & intelligence estimates
• Complete and critique a case study

Based on the feedback that you received from other students and from me, revise your original project proposal and submit a final draft this week. Note that you may lose points if your draft suggests that you haven't been developing or expanding your project business problem and possible data sources.

In your draft project, you should respond to as many of the comments made by your reviewers as possible. However, it is OK to stick to your guns! You don't have to adjust every aspect of the proposal to accommodate reviewer concerns, but you should consider every point seriously, not just ignore them.

Your draft project should be between 600 and 800 words in length (about 1.5 ~ 2 pages double spaced max.). The maximum number of words you can use is 800. You will lose points if your word count exceeds 800. Make sure to include the same items as before:

• Topic, business question, and scope
• Aims
• Dataset(s)
• Data sources
• Intended analysis and outputs—This is a little different from before. It should list some specific outputs (ideally several specific items) that can be used to judge how well you have done in attaining your stated aims. Note that failing to produce one of the stated outputs will not result in an automatic loss of points, but you will be expected to comment on why you were unable to achieve everything you set out to do (even if that means simply admitting that some other aspect took longer than anticipated, so you didn't get to it).
• Begin your References/Bibliography page using proper formatting from the start.

Additional writing and formatting guidelines are provided in the document (TermProjectGuidelines.pdf) in 'Term Project Overview ' in Canvas.