Stop Token-Incinerating Your Risk Engine

Solutions Engineer, Neo4j

September 15, 2026

13 min read

The winners in fintech won’t buy larger context windows, they will build context rich semantic layers. Here is the math proving why.

The global financial system spends over $200 billion annually on anti-money laundering (AML) and compliance. Yet, law enforcement recovers less than 1% of illicit financial flows globally.

The companies that win the next decade of fintech won’t be the ones buying larger context windows or burning millions on bigger models. The winners will build context rich semantic layers, capable of translating raw network structures into instant structural intuition.

The Three Evolutions of Context

In his book Blink, Malcolm Gladwell writes about “thin-slicing”, human’s ability to spot macro patterns from micro signals in a fraction of a second using intuition. Modern AI models possess extraordinary processing power, but when we hand them financial transaction records, we trap them in a blind spot.

To understand why AI struggles with financial fraud, you have to look at the three ways we represent the world to a machine:

1. Flat Data

For decades, compliance has relied on relational databases (flat, tabular spreadsheets). Account A sent $5,000 to Account B at 10:01 AM. When you feed flat data to an AI agent, you are asking it to solve a complex mystery by reading isolated names out of a phone book. It can analyze individual events, but it has no awareness of the relationships between things.

2. Standard Knowledge Graphs

To fix this, the industry upgraded to Knowledge Graphs. We mapped entities as nodes and transfers as edges. Now the AI knows that Account A is connected to Account B. But here is the trap: dumping raw graph connections into an LLM’s context window forces the model to manually trace every edge, step-by-step. And while the patterns exist, there is a chance it will miss it or it will hallucinate.

3. Enriched Knowledge Graphs

This is the breakthrough. Instead of forcing the AI to manually trace every transaction between accounts, we pre-calculate the underlying structure of the network using graph algorithms (e.g. Community Detection, Centrality, Shortest-Path, Similarity) and save the results as node properties to enrich the knowledge graph (KG).

The Hypothesis

An AI agent provided with an enriched graph context, augmented with pre-computed graphy metrics (PageRank centrality, Louvain community clusters, node similarity, and shortest-path distance matrices), will identify synthetic identities, suspicious fraudulent accounts, and central mules significantly faster and with higher precision than an identical agent given raw graph data.

Over the next three sections, we put this hypothesis to a head-to-head trial using a synthetic dataset of 30,000 accounts, 5 million transactions, hidden mule rings, and stitched identities. We challenge our agents with the three hardest questions in modern financial crime:

Spotting Synthetic Identities: Can the agent isolate stitched fake profiles operating across shared PII clusters?
Identifying Suspicious Fraud Targets: Can the agent spot low-volume accounts acting as critical structural bridges before a bust-out occurs?
Isolating Influential Mules: Can the agent trace multi-hop circular laundering loops?

Look at this first image. What you’re staring at is the digital footprint of a modern financial institution: a tangled, high-entropy web of clients, merchants, banks, and wire transfers. Somewhere inside this labyrinth of ordinary life, millions of illicit dollars are silently moving. To a traditional rule-based monitoring engine, it looks like ambient noise. To a human investigator, it looks like a haystack with an invisible needle.

Zooming closer into the network reveals the raw connective tissue. You begin to see how individual entities anchor themselves to the grid , not just through financial transfers, but through shared Personally Identifiable Information (PII) like Social Security Numbers, phone numbers, and email addresses. On paper, these are isolated transactional records; in reality, they are the subtle, structural threads connecting real people to digital phantoms.

Before Large Language Models entered the auditor’s toolbelt, unmasking this hidden topology required a deliberate, multi-step data science workflow. Forensic analysts couldn’t simply query a database for “fraud”; they had to systematically reshape the graph’s geometry. First, you applied community detection algorithms, like Louvain or Connected Components, to slice through the ambient noise and group tightly interconnected clusters into distinct digital neighborhoods. Once those boundary lines were drawn, you ran centrality algorithms, such as PageRank or Betweenness Centrality , to measure topological gravity. Suddenly, out of a chaotic mass of thousands of client nodes, the math isolated the high-traffic hubs and critical structural bridges. This was the traditional playbook: convert raw, overwhelming scale into a tight, highly targeted short-list of suspicious suspects for human sleuths to audit.

The magic of graphy metrics, like centrality, distance, or clusters, isn’t that it gives you more data; it’s that it gives you instant spatial intuition. When you look at this cluster, your eyes don’t wander across hundreds of transactions, they drop straight onto the bright pink nodes bridging these communities. In a matter of milliseconds, pre-computed centrality transforms a complex, invisible money-laundering web into an obvious pattern you can’t unsee.

And this is what we expect the LLM to use when we prompt it to answer the three questions above. Our main suspects from the image above when we filter by community size and centrality are Lillian Nichols, Nicholas Quinn, Evelyn Frost, Charlotte Mccoy, Nathaniel Mcdaniel, Kimberly Alvarado, Thomas Gomez, Olivia Charles, Chase Dunlap, and Samuel Petty.

Spotting Synthetic Identities

Prompt: Identify potential synthetic identities using personal identifiable information like email, phone number, social security number, and customer name

Raw knowledge graph results

Claude: Virtually every case of a shared identifier comes with a different name each time — never the same person’s name reappearing on the same SSN/email/phone. That pattern (one anchor identifier + a rotating cast of names) is the textbook signature of synthetic identities: a real or fabricated core credential stretched across multiple constructed personas.

Enhanced knowledge graph results

Claude: Using GDS Weakly Connected Components (WCC) over the identity graph, I found accounts linked by shared PII — the classic synthetic-identity signature: distinct customer names recycling a limited pool of real/stolen emails, phone numbers, and SSNs. 855 clusters of 2+ accounts sharing at least one identifier, covering 3,042 accounts total (average cluster size 3.6, largest cluster 11 accounts). 15 clusters have 8 or more members.

Look closely at the raw KG results, our AI agent walked right past the biggest fire in the building. It completely missed an 11-person cluster built on top of just 3 recycled Social Security Numbers , the exact smoking gun of a syndicate operating in plain sight. The agent didn’t get a better model, a larger context window, or a smarter prompt. The only difference was the pre-calculation of clusters using community algorithms. By simply shifting from raw graph to pre-computed properties, the invisible identity factory instantly lit up like a neon sign.

On the other hand, the agent using the enhanced KG accurately spotted the largest cluster with 11 clients and 3 shared SSNs.

Identifying Suspicious Fraud Targets

Prompt: identify “bridge” client nodes within suspicious transaction communities that include 7 or more client nodes.

Raw knowledge graph results

Claude: I then searched for pure Client nodes that transact with members of 2+ of these large rings — same method as before (pure Cypher traversal + aggregation, no gds.*).
Excluded again as noise: Andrew Harvey, Thomas Gomez, Samuel Petty — the three mega-hub clients keep surfacing because their sheer transaction volume (50K–106K transactions) makes them touch dozens of rings incidentally, not deliberately.
Of 262 remaining candidates, most connect exactly 2 communities. A few stand out by connecting 3–4 communities:

Enhanced knowledge graph results

Claude: Expanding the search to every synthetic-identity ring of size ≥7 (65 such rings found via GDS WCC on the graph) and checking, for each, which external account receives confirmed-fraud transfers from 2+ of its members.
Headline numbers: 65 of the 65+ rings have an identifiable bridge account, 66 unique bridge accounts total, funneling ≈ $16.44M combined, averaging 7.4 ring members routed through each bridge.
Top 15 bridges by amount moved:

The empirical divide between these two approaches couldn’t be starker.

When we call the Enriched Agent, it didn’t just stumble onto our primary suspect accounts; it mapped the entire battlefield. Cross-referencing its findings against our manual forensic baseline revealed a stunning 100% capture rate: every single client node possessing an above-average betweenness centrality score was identified instantly. The agent didn’t need to guess where the structural risk lay , the network properties pointed straight at the bottlenecks. Notice in the image below, a subsection of the biggest suspect community, where Lillian Nichols and Nicholas Quinn (among others) act as central nodes.

Meanwhile, the Raw Agent was completely lost in the fog.

Operating on un-enriched graph data, it failed to identify a single primary suspect from our target list. Out of the four clients it flagged as “suspicious,” only two actually belong to the suspect communities, and both possess negligible betweenness scores. The raw model was effectively chasing ghost signals: blowing tokens on low-value noise while walking right past the high-leverage bridges running the entire syndicate. Take Dylan Collier as an example. Although he belongs to one of our suspect communities, he is clearly not influencing its behavior.

This isn’t an incremental upgrade in AI performance. It is the definitive proof that without pre-computed topological context, even the smartest models are functionally blind to systemic financial crime.

Identifying Money Laundering Loops

Prompt: Give me the top 10 most suspicious accounts and the accounts in the biggest money laundering loop ranked by transaction amount.

Raw knowledge graph results

Claude: Part 1 — Top 10 most suspicious accounts I pulled the strongest signal from every angle we’ve explored this session — confirmed fraud-ring leadership, cross-community bridging, and literal circular money loops — and ranked by severity of evidence, then amount.

rows 1–3 and 10 are a genuinely new finding — a real circular fund flow, invisible to every fraud flag or ring-detection method we’d used so far, because none of these six people (across the two loops) are labeled Mule .

Part 2 — Biggest money-laundering loop, ranked by transaction amount
Searching for actual directed cycles (not just fan-in rings) turned up none inside the confirmed-fraud mule network — that network is a pure fan-in/collector structure with zero reciprocal flow. But widening to all Client/Mule transfers, real 3-party loops exist. The largest by total value moved:
Ethan Vinson → Parker Hester → David Browning → Ethan Vinson, total $13,363,364.27 circulated.

All three are unflagged Client accounts with moderate, unremarkable transaction volume (152–407 total transactions each) — nothing about them would trip a standard fraud filter individually. It’s only the closed-loop shape of the money (funds leaving and eventually returning to the origin through two intermediaries) that reveals it as a classic layering/round-tripping pattern. Runner-up loop: Emma Sherman → Molly Santos → Ariana Wilder → Emma Sherman, $10,227,463 total.

Enhanced knowledge graph results

Claude: Top 10 most suspicious accounts (ranked by total dollar amount touching confirmed fraud transfers, sent + received):

All ten are pure receivers except Brooklyn Welch, who’s the only one that sent rather than received. Gianna Kane is also the #1 bridge account from the previous analysis (funneling an 8-member synthetic ring). None of these 10 belong to the 5 originally-tagged big_fraud_group rings, confirming again that the highest-dollar fraud activity sits outside current monitoring tags.
On the “biggest laundering loop”: I checked rigorously for an actual circular structure (A→B→C→A) using GDS Strongly Connected Components on the fraud-only transaction graph, plus explicit 2-hop and 3-hop cycle searches across every account touched by confirmed fraud — there is no closed loop. The confirmed-fraud network has zero cycles; money only flows one direction, from synthetic identities into a single collector (hub-and-spoke, not circular).
Given that, the closest legitimate answer to “biggest loop” is the largest fraud ring we identified (cluster 31271), ranked by transaction amount:

The takeaway from this trial delivers a fascinating, counter-intuitive plot twist, one that completely reshapes how, I at least, think about human-AI collaboration in financial forensics, or any other investigation really.

When we turned the Enriched Agent loose to hunt for laundering loops, something unexpected happened. Because we strictly instructed it to rely on pre-computed graph properties, it was mathematically constrained: it actually failed to trace the closed-loop transaction chains step-by-step.

Yet, it pulled off something far more valuable. Instead of getting bogged down in individual money trails, it leveraged the macro-geometry of the network to isolate the single largest cluster of initial suspects, instantly identifying it as a coordinated laundering cartel.

Meanwhile, the Raw Agent played the role of the meticulous, microscopic investigator.

By filtering raw transaction flows tied to known fraud, it successfully mapped a classic, closed-loop laundering sequence (image above), the exact multi-hop circuit bad actors use to layer illicit cash. Out of our ten baseline hypotheses, it hit on two, while surfacing a fresh batch of previously unsuspected accounts that warrant a deep-dive audit. Where the enriched model saw the whole forest, the raw model actually managed to trace a specific tree.

The winning strategy isn’t choosing one agent over the other. It’s building a hybrid context engine, one that uses pre-computed graph data science properties to narrow the search, and raw cypher to catch the thieves in the act.

I’d like to thank my colleague Laura Parra for her help in creating this experiment.

Stop Token-Incinerating Your Risk Engine was originally published in Neo4j Developer Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.