AML investigations: Following suspicious activity beyond the alert

When an anti-money laundering (AML) alert reaches an investigator, it often raises more questions than it answers.

Who is behind the activity? Are the people or companies involved connected? Does the same pattern appear across other accounts? Is there a reasonable explanation for what happened?

Answering these questions often requires investigators to bring together information from transaction histories, customer records, company registries, sanctions screening, and previous investigations. When that information sits in separate systems, even a straightforward alert can become difficult and time-consuming to investigate.

And the alert is only a starting point. Transaction monitoring systems flag activity that meets a rule, exceeds a threshold, or a model assesses as higher risk. But they rarely provide the full context an investigator needs to understand what has happened.

A payment that looks unremarkable in isolation might be part of a longer chain of transfers. Customers who appear unrelated might share an address, beneficiary, or other identifying information. Funds moving through several companies might ultimately reach the same individual.

Understanding these relationships means looking beyond individual transactions and examining the wider network of people, companies, accounts, and activities.

This is where graph-powered Financial Crime Intelligence can make a difference.

Following the money: The Azerbaijani Laundromat

The Azerbaijani Laundromat offers a compelling example of why financial crime investigations need to look beyond individual transactions.

In September 2017, the Organized Crime and Corruption Reporting Project (OCCRP) exposed a scheme in which approximately $2.9 billion had moved through four UK-registered shell companies and European banks between 2012 and 2014.

In our Connected Money webinar, GraphAware joined Senzing and OpenSanctions to explore the publicly available data from this case, demonstrating how graph technology, entity resolution, and external intelligence can help investigators uncover suspicious financial relationships.

Rather than starting with an alert from a bank’s transaction monitoring system, the team explored the financial network, identified relationships worth investigating, and followed those connections to understand the potential risks.

Starting with the transaction network

The initial view revealed a complex network of financial activity, with several organizations standing out for sending or receiving money from large numbers of counterparties.

The team focused on one of these organizations: LCM Alliance LLP.

LCM Alliance LLP had hundreds of connections. Expanding all of them into a single graph visualization would have made it difficult to distinguish meaningful patterns from the surrounding activity.

Instead, the team used a GraphAware Hume Action Board to examine the company’s activity in a more structured way.

The Action Board brought together transaction values and frequency over time, alongside the company’s largest payers and beneficiaries. This provided a clearer picture of how LCM Alliance LLP moved money, which counterparties were most significant, and where further investigation might be required.

But understanding how money moved through the company was only part of the picture. The next question was who actually controlled it.

Looking beyond the transaction data

The transaction records contained information about LCM Alliance LLP’s payments and counterparties, but they couldn’t establish who ultimately owned or controlled the company.

To answer that question, the team ingested data from the UK’s Companies House.

Records relating to LCM Alliance LLP from the different sources were ingested, resolved, and connected to the existing graph. The team could then explore the company’s financial activity alongside its corporate registration information. This revealed several potential red flags.

The Companies House records identified two Seychelles-registered businesses as corporate officers of LCM Alliance LLP, but did not identify a natural person as the ultimate beneficial owner.

The company’s registered address raised another question. A Google Street View check suggested it was a mailbox office rather than operating business premises.

The team also explored other UK companies associated with the same corporate officers. One officer was linked to hundreds of other company registrations, including businesses using the same addresses.

None of these findings, individually, established wrongdoing. Legitimate reasons can explain international corporate structures, shared addresses, or the use of registration agents. But together, they provided reasons to investigate further.

None of this context was visible in the transaction records alone.

Connecting the money to people and risk

The next step was to examine where money flowing through LCM Alliance LLP ultimately went.

Rather than reviewing individual payments one by one, the team used graph queries to follow transaction paths across multiple organizations and identify payments that ultimately reached individuals.

This revealed another limitation in the original data. Although the transaction records contained names and payment details, they did not necessarily explain who those individuals were or whether they presented additional risks.

The team connected the transaction data to OpenSanctions, using Senzing’s entity resolution capabilities to match records across the datasets.

That brought new information into the investigation. One individual in the transaction network could be matched to a record identifying them as a politically exposed person (PEP). The demonstration also uncovered transaction paths connecting LCM Alliance LLP to organizations appearing on sanctions lists.

These connections were significant because they placed the original financial activity in a much wider context.

A transaction that might have appeared routine when viewed in isolation could now be examined alongside information about the people and organizations involved, their other relationships, and their potential exposure to risks.

Of course, a PEP connection or association with a sanctioned organization does not automatically mean a transaction was unlawful. Investigators still need to assess the reliability of the matches, the nature of the relationships, and the circumstances of the payments. But the additional intelligence gives them a stronger basis for asking those questions.

Understanding how the network evolved

A financial network is not static. New counterparties appear, transactions accumulate, and activity patterns change.

Using GraphAware Hume’s time bar, the team could explore the transaction network across different periods, revealing how relationships developed rather than viewing all activity at once.

This matters because timing can change the significance of a relationship. A long-standing counterparty may warrant a different assessment from a newly connected business receiving a sudden increase in payments. A series of transfers that appears unremarkable over a year might look quite different when examined over a few days or weeks.

By exploring transactions and relationships over time, investigators can build a clearer understanding of when activity occurred, how patterns developed, and which events warrant closer scrutiny. 

From fragmented data to connected intelligence

The Azerbaijani Laundromat demonstration illustrates something fundamental about financial crime investigations: the information needed to understand suspicious activity is rarely contained in the original alert.

• The transaction network revealed the movement of money, but not necessarily who controlled the companies involved.
• Company registry information provided more context about those organizations, but also exposed gaps in ownership information and questions about their registration details.
• OpenSanctions data revealed relationships with politically exposed people and sanctioned organizations that the transaction records alone did not show.
• Examining the network over time offered another way to understand how the activity developed.

In financial crime investigations, every new discovery can open new questions, and every new question can expose new gaps in the data.

That’s what makes GraphAware Financial Crime Intelligence so valuable.

By connecting institutional knowledge, operational data, and internal and third-party intelligence in a shared knowledge layer, investigators can assess alerts in the context of what is already known, while adding new, case-specific information as the investigation progresses.

Rather than treating each source as a separate search or investigation, they can explore the relationships between them, follow new leads, and build a more complete picture of the activity under review.

The investigator still makes the call

Connected intelligence doesn’t replace the investigator’s judgment. It helps them understand the evidence, test their assumptions, and reach a more defensible decision.

An investigator must still determine whether a relationship is significant, whether a risk indicator has a legitimate explanation, and whether the evidence justifies closing or escalating an alert. They also need to be able to explain how they reached that conclusion.

GraphAware Financial Crime Intelligence supports this process by preserving connected evidence, its provenance, and the investigation rationale. It works with existing detection, data, and case management systems, helping investigators explore the wider context behind the alerts those systems generate.

In the Azerbaijani Laundromat demonstration, the transaction records were only the starting point. By connecting financial activity with corporate records, risk intelligence, and temporal analysis, the team uncovered relationships and potential warning signs that would have been difficult to recognize from individual transactions alone.

The result wasn’t an automated verdict. It was a richer intelligence picture that an investigator could use to decide what deserved further attention, what additional evidence was needed, and what action to take next.