Behavioral Analytics in AML — Detailed Explanation with Case Laws

Subject: Anti-Money Laundering (AML) / Behavioral Analytics
Jurisdiction: International AML framework, with EU/UK/US comparative case law
Focus: Banking, fintech, transaction monitoring, customer behaviour, AI/ML and regulatory compliance

1. Meaning of Behavioral Analytics in AML

Behavioral analytics in AML means using information about how a customer normally behaves to identify transactions or activities that are inconsistent with that customer's established pattern.

Traditional transaction monitoring often asks:

"Is this transaction above a predetermined threshold?"

Behavioral analytics asks:

"Is this transaction or sequence of activities unusual for this particular customer?"

This is an important distinction.

For example, suppose a customer normally:

• receives €3,000–€5,000 monthly;
• makes domestic payments;
• maintains a relatively stable balance; and
• rarely uses cash.

Suddenly, the account begins:

• receiving numerous payments from unrelated countries;
• transferring funds rapidly to other accounts;
• making large cash withdrawals; and
• sending money to high-risk jurisdictions.

No single transaction may necessarily prove money laundering.

However, the change in behaviour can produce a high-risk AML alert.

2. Why behavioral analytics matters

Money laundering is often designed to avoid simple threshold-based detection.

Criminals can structure activity so that individual transactions remain below conventional thresholds.

For example:

20 transfers × €4,900

may be less obviously suspicious to a simple threshold system than:

1 transfer × €98,000.

Behavioral analytics can identify the pattern, rather than merely the size of an individual transaction.

3. Main sources of behavioral data

A bank may analyse:

Customer information

• occupation;
• business type;
• expected account activity;
• geographic connections;
• source of wealth;
• source of funds;
• customer risk classification.

Account behaviour

• transaction frequency;
• transaction size;
• account balance;
• counterparties;
• payment destinations;
• cash usage;
• ATM behaviour;
• international transfers.

Digital behaviour

Subject to applicable privacy law:

• login patterns;
• device changes;
• unusual authentication activity;
• IP/geographic inconsistencies;
• rapid changes in beneficiary information;
• unusual digital-channel activity.

Relationship behaviour

The institution can also examine:

• linked accounts;
• common counterparties;
• common addresses;
• common directors;
• common devices;
• ownership structures; and
• transaction networks.

4. Customer behavioral baseline

The first stage is establishing a baseline.

For example:

Customer A

Normal monthly activity:

The system establishes this behavioural profile.

If the customer suddenly receives €500,000 from 40 unrelated entities and transfers most of it abroad within 24 hours, the system can calculate a significant behavioural deviation.

5. Behavioral analytics versus traditional transaction monitoring

Traditional monitoring

Uses predetermined rules such as:

Flag transfers above €10,000.

Behavioral analytics

Uses patterns such as:

Flag a customer whose transaction frequency, counterparties, geography and payment velocity have changed materially from their historical behaviour.

Advanced analytics

May use:

• statistical models;
• anomaly detection;
• clustering;
• graph analytics;
• machine learning;
• supervised classification;
• unsupervised learning; and
• network analysis.

The strongest AML programmes generally combine several techniques.

6. Customer Risk Scoring

A bank may calculate a risk score using multiple factors.

For illustration:

Risk Score =

Customer Risk

• Geographic Risk
• Product Risk
• Transaction Risk
• Behavioral Deviation
• Network Risk

The resulting score may determine whether the account requires:

• ordinary monitoring;
• enhanced monitoring;
• enhanced due diligence;
• investigation; or
• suspicious transaction reporting.

Importantly, a risk score is not itself proof of money laundering.

It is a mechanism for prioritising investigation.

7. Anomaly detection

Anomaly detection identifies behaviour that deviates from expected patterns.

Suppose:

Historical average monthly international transfers: 3

Current month:

37 international transfers

The system can identify a statistical anomaly.

But the bank must ask:

Why did the behaviour change?

There may be a legitimate explanation—for example, the customer expanded into international trade.

Therefore:

Anomaly ≠ Suspicion

and:

Suspicion ≠ Proof of criminal conduct.

This distinction is fundamental to responsible AML compliance.

8. Peer-group analytics

A customer can also be compared with similar customers.

For example:

A bank could compare:

Spanish restaurant businesses

with other Spanish restaurant businesses of similar size.

If one customer suddenly has:

• substantially higher international transfers;
• unexplained cash deposits;
• unusual counterparties; and
• payment patterns inconsistent with its business model,

the deviation from its peer group may justify additional investigation.

9. Network analytics

Network analysis is particularly powerful in AML.

Instead of analysing:

Account A → Account B

the bank examines:

A → B → C → D → E

and relationships between numerous accounts.

For example:

Company A   ↓ Account B   ↓ Company C   ↓ Account D   ↓ Foreign Account E

If multiple apparently unrelated companies repeatedly transfer funds through the same accounts, addresses, directors or counterparties, network analytics may identify a potentially coordinated structure.

10. Mule-account detection

Behavioral analytics is frequently useful for identifying money-mule activity.

A mule account may exhibit:

• sudden high transaction volume;
• many unrelated incoming payments;
• rapid onward transfers;
• short holding periods;
• limited ordinary consumer spending;
• repeated transfers to particular beneficiaries.

The key behavioural signal can be:

money enters → money remains briefly → money leaves

This is sometimes called transaction velocity or rapid movement of funds.

11. Structuring / smurfing

Behavioral analytics can identify potential structuring.

Example:

Monday: €7,900
Tuesday: €8,200
Wednesday: €7,600
Thursday: €8,100

Each payment may individually fall below an internal alert threshold.

But behavioural analysis can detect:

• repeated amounts;
• short time intervals;
• common counterparties;
• common branches/devices;
• similar payment descriptions.

The bank therefore evaluates the aggregate behavioural pattern.

12. Dormant-account activation

A dormant or low-activity account suddenly becoming highly active can be a significant behavioural signal.

Example:

For 18 months:

almost no activity.

Then:

€300,000 received
€295,000 transferred out
multiple new beneficiaries
multiple foreign jurisdictions

The bank should investigate the reason for the change.

13. Behavioral analytics and KYC

Behavioral analytics should not operate independently from Know Your Customer (KYC).

The bank needs to know what behaviour it should reasonably expect.

For example:

A customer identified as:

"small domestic retail business"

would normally have a different expected transaction profile from:

"international commodities trader."

This is why AML compliance begins with understanding:

• customer;
• business;
• beneficial owner;
• source of wealth;
• source of funds;
• expected activity.

14. Beneficial ownership

Behavioral analytics can also identify discrepancies between the stated ownership structure and actual activity.

For example:

Company A formally has:

Director X

but transactions repeatedly involve:

Company B controlled by Person Y

and substantial payments are directed through entities associated with Y.

This does not automatically establish beneficial ownership or illicit activity, but it may justify enhanced investigation.

15. AI and machine learning

Modern AML systems increasingly use machine learning.

Supervised learning

The model learns from previously classified cases.

Example:

Historical suspicious cases → model → new transactions → risk prediction

Unsupervised learning

The system identifies unusual patterns without requiring every suspicious pattern to have been labelled beforehand.

Graph machine learning

The system examines relationships between:

• accounts;
• customers;
• businesses;
• beneficiaries;
• devices;
• addresses; and
• transactions.

16. Explainability problem

One of the greatest legal risks is the use of a black-box AML model.

Suppose a bank says:

"The customer's AML score is 97/100."

The customer may reasonably ask:

Why?

If the bank cannot explain the material factors behind the alert, problems can arise concerning:

• regulatory accountability;
• governance;
• model validation;
• discrimination;
• privacy;
• procedural fairness; and
• incorrect account closures.

Therefore, sophisticated AML programmes require model governance and explainability.

17. False positives

Behavioral systems can generate enormous numbers of alerts.

For example:

100,000 alerts

might produce only:

2,000 genuinely suspicious cases.

If the bank's system is badly calibrated, investigators may spend resources examining innocent customers while genuine threats receive insufficient attention.

This creates alert fatigue.

A good AML system therefore aims for:

high-quality alerts rather than simply high numbers of alerts.

18. Human investigation remains important

Behavioral analytics should normally function as a decision-support mechanism, not as an automatic declaration that someone is laundering money.

A typical workflow is:

Data → Model → Alert → Analyst → Investigation → Escalation → STR/SAR decision

The compliance analyst should consider:

• customer profile;
• transaction context;
• explanation provided;
• documentary evidence;
• beneficial ownership;
• source of funds;
• previous alerts; and
• relevant external information.

19. Suspicious Transaction Reports

If the institution forms the required level of suspicion under applicable law, it may need to file a suspicious transaction/activity report.

In the EU, AML reporting obligations operate under the relevant national and EU AML framework.

In the United States, suspicious activity reporting operates principally under the Bank Secrecy Act framework.

In the UK, reporting operates under the Proceeds of Crime Act 2002 framework.

The precise legal threshold differs by jurisdiction.

20. Important case law

1. R v Da Silva [2006] EWCA Crim 1654

This is a leading UK authority on the meaning of suspicion in the AML context.

The Court of Appeal explained that suspicion requires a degree of possibility rather than certainty, but there must be a genuine subjective suspicion based on facts known to the person.

Importance

Behavioral analytics may generate the information that causes a compliance officer to form suspicion.

But the algorithm itself does not necessarily replace the legal requirement for the relevant human/institutional decision.

21. Shah and Another v HSBC Private Bank (UK) Ltd [2010] EWCA Civ 31

This is one of the most important AML banking cases.

HSBC refused to execute transactions while considering its AML obligations and reporting position.

The Court of Appeal considered the relationship between:

• suspicious transaction reporting;
• the bank's obligations;
• customer instructions; and
• the statutory AML framework.

Behavioral analytics relevance

A bank may receive an automated alert because a customer's behaviour deviates from expected activity.

The bank may then need to investigate before processing transactions.

The case illustrates why AML monitoring can affect the ordinary banker-customer relationship.

22. NatWest Markets Plc v Bilta (UK) Ltd [2021] UKSC 23

The Supreme Court considered issues concerning dishonest assistance, fraud and corporate liability in the context of complex financial transactions.

Although not a pure AML-monitoring case, it demonstrates the importance of financial institutions understanding transaction structures rather than relying solely on formal documentation.

AML relevance

Behavioral and network analytics can be useful where apparently legitimate transactions form part of a larger fraudulent or circular structure.

23. Federal Republic of Nigeria v JP Morgan Chase Bank NA [2019] EWHC 347 (Comm)

This litigation involved allegations concerning banking transactions and the bank's handling of payments.

The case illustrates the broader legal importance of a bank's procedures when handling potentially problematic transactions.

AML lesson

Banks must have effective controls for identifying and escalating suspicious activity, particularly when transactions involve complex counterparties and high-risk circumstances.

24. Credit Suisse AG v Mozambique litigation

The Mozambique "tuna bonds" litigation involved complex financing arrangements, fraud allegations and questions surrounding banking conduct and due diligence.

Although not a conventional behavioral-analytics case, it is highly relevant to modern AML governance because it illustrates the risks arising when institutions fail to properly understand complex transaction structures and counterparties.

Lesson

A transaction-monitoring system should not operate only at the individual-payment level.

It should also identify:

relationships + counterparties + transaction purpose + unusual financial flows.

25. European human-rights considerations

Behavioral analytics involves extensive processing of financial and potentially personal information.

European banks therefore must consider:

• GDPR;
• data minimisation;
• purpose limitation;
• lawful processing;
• data accuracy;
• retention;
• security;
• automated decision-making rights; and
• proportionality.

A bank cannot simply collect every conceivable piece of behavioural information because it might someday be useful for AML.

There must be a lawful and proportionate basis.

26. SCHUFA Holding (C-634/21)

The CJEU's decision in SCHUFA Holding (C-634/21) is important for automated scoring and GDPR.

The case concerned automated credit scoring and the circumstances in which a score may constitute an automated decision with legal or similarly significant effects.

AML relevance

AML behavioural scores may influence:

• account restrictions;
• enhanced due diligence;
• transaction delays;
• account termination.

Therefore, banks need to carefully assess when automated profiling produces significant effects and what GDPR protections apply.

AML legal obligations can provide important grounds for processing, but they do not create an unrestricted exemption from data-protection law.

27. Ligue des droits humains v Conseil des ministres — C-817/19

The CJEU examined extensive processing of passenger data under EU law.

Although it was not an AML case, it is significant for understanding:

• large-scale data processing;
• proportionality;
• privacy;
• safeguards; and
• retention.

AML relevance

Financial institutions using behavioural analytics must ensure that surveillance remains proportionate to the legitimate AML objective.

28. Regulatory expectations

Financial regulators increasingly expect banks to demonstrate:

Governance

Who owns the AML model?

Validation

Does the model actually work?

Data quality

Are the underlying data accurate?

Explainability

Can investigators understand why an alert was generated?

Testing

Does the system detect known typologies?

Calibration

Are alert thresholds appropriately designed?

Human oversight

Can analysts override or investigate model output?

Documentation

Can the institution demonstrate why it reached a particular conclusion?

29. Example — behavioral AML investigation

Suppose a Spanish bank has a corporate customer classified as:

medium-sized domestic construction company.

Historical profile:

• €100,000–€250,000 monthly receipts;
• Spanish counterparties;
• normal payroll payments;
• limited international activity.

New behaviour:

• €4 million received from 80 unrelated companies;
• funds transferred abroad within hours;
• multiple new beneficiary accounts;
• payments involving high-risk jurisdictions;
• sudden cryptocurrency-related activity;
• little change in the company's reported business.

The behavioural system identifies:

Transaction velocity ↑

Counterparty diversity ↑

Geographic risk ↑

International activity ↑

Deviation from historical profile ↑

The account receives a high-risk alert.

The compliance analyst then investigates:

1. What is the commercial explanation?
2. Who owns the counterparties?
3. What is the source of funds?
4. Are invoices genuine?
5. Are the transactions circular?
6. Are beneficial owners connected?
7. Is there a legitimate business expansion?
8. Does the evidence justify an STR/SAR?

The model identifies the signal; the investigation establishes the context.

30. Behavioral analytics and crypto-assets

Behavioral analytics has become particularly important for crypto-related AML.

Banks and crypto platforms can examine:

• rapid fiat-to-crypto conversion;
• repeated transfers to newly created wallets;
• interaction with high-risk services;
• unusual wallet clusters;
• rapid movement between exchanges;
• mixing/tumbling indicators;
• transaction-chain patterns.

However, the presence of a cryptocurrency transaction alone should not automatically be treated as suspicious.

The correct approach remains:

risk-based analysis rather than blanket assumptions.

31. Main legal risks

32. Best-practice framework

A strong behavioral AML programme should contain:

1. Customer baseline

Understand normal behaviour.

2. Dynamic risk scoring

Update risk as behaviour changes.

3. Transaction analytics

Identify unusual payments.

4. Network analytics

Identify relationships and hidden connections.

5. Scenario/rule monitoring

Maintain traditional AML rules.

6. Machine learning

Detect previously unknown patterns.

7. Human investigation

Review meaningful alerts.

8. STR/SAR escalation

Report where the applicable legal threshold is met.

9. Model validation

Regularly test effectiveness.

10. Governance

Maintain documented accountability.

11. Privacy controls

Ensure lawful and proportionate processing.

12. Continuous improvement

Update typologies and models as criminal behaviour evolves.

33. Key legal principle

The most important principle is:

Behavioral analytics is an AML detection mechanism, not a legal finding of guilt.

A customer's unusual behaviour can justify investigation.

It does not, by itself, establish:

• money laundering;
• fraud;
• criminal liability; or
• beneficial ownership of another entity.

The bank must combine behavioural indicators with appropriate investigation and evidence.

Conclusion

Behavioral analytics has become a central component of modern AML compliance because sophisticated money laundering frequently cannot be detected through single-transaction thresholds. By establishing customer baselines and analysing deviations in transaction frequency, value, counterparties, geography, velocity and networks, banks can identify potentially suspicious activity earlier.

The legal framework nevertheless requires balance. Cases such as R v Da Silva and Shah v HSBC demonstrate the importance of genuine suspicion and the consequences of AML obligations for banking relationships, while SCHUFA and Ligue des droits humains illustrate the parallel importance of privacy, automated decision-making and proportionality in data-intensive monitoring.

The strongest legal and regulatory approach is therefore:

KYC → behavioural baseline → transaction/network analytics → risk alert → human investigation → documented decision → STR/SAR where legally required,

with continuous model validation, explainability, data governance and privacy controls throughout the process.