Real-Time Anomaly Detection In Cross-Border SWIFT Transactions: A Streaming ML Framework For Global AML Compliance

Abstract

The growing digital finance cross-border ecosystem has made it harder to spot financial crimes within high-frequency flows of SWIFT messages. The traditional batch-oriented Anti Money Laundering (AML) system is usually inefficient for real-time regulatory compliance due to its high false-positive rate and high detection latency. This work introduces a novel streaming machine learning (ML) system that includes Apache Kafka based data ingestion, sliding window based feature aggregation, and an ensemble of heterogeneous models (Isolation Forest, Autoencoder Neural Networks, Graph Neural Networks (GNN), and Gradient Boosting) to identify transactions as anomalous at sub-50 millisecond latency. The proposed architecture is tested with a dataset of 2 years of cross-border transactions, comprised of 3.5 million annotated SWIFT MT103 and MT202 messages, on a purpose built test infrastructure. The ensemble model outperforms individual baseline models with an AUC-ROC = 0.981, F1 = 0.925 and a precision = 0.932 on a held-out test set. When the sliding window aggregation module or the GNN component is removed, the results of an ablation study show that these two modules are uniquely needed to achieve the best performance (ΔAUC = −0.047 and ΔAUC = −0.023, respectively, on removing the sliding window aggregation module or the GNN component). Scalability tests show mean processing time of less than 50ms for up to 16,000 transactions per second (TPS). It is written to meet the FATF Recommendation 16, EU AMLD6 directives and Basel III correspondent banking guidelines, and is a solution that financial institutions under strict real time AML requirements can deploy.