Trade-based money laundering solutions: a 10-week plan to go live

Trade-based money laundering solutions for banks come in three kinds: trade rules added to the transaction monitoring system the bank already runs, data services that supply prices and vessel movements to its investigators, and agent-based systems that read the trade documents, check price, route and parties, and draft the case for a person to decide. Whichever kind a bank buys, the way to put it live is the same, and it takes roughly ten weeks: three to connect the bank's own data and history, three to run the solution in shadow over alerts the bank has already closed, and four to go live with every decision signed by a named person. Botminds' Trade-Based Money Laundering Detection is built to go live that way on a bank's own trade book, and this page sets out the plan, the evidence each step produces, and the places where the solution does not fit.

Examples come from a fictional sample bank, Corvane National Bank, and its sample data in the solution. The ten-week plan is our proposal, not a regulatory timetable.

What trade-based money laundering solutions exist for banks?

Three kinds exist, and they solve different parts of the problem. Rule modules in the bank's monitoring system flag trade payments against thresholds; they are cheap to add and see only what reaches the payment system. Data services give investigators prices, bill-of-lading records and vessel positions; GAO heard that "some banks also rely on commercially available products that, for example, track maritime ships and publicly available bill-of-lading data to better understand patterns of shipping, the markets and prices for certain products" (GAO-22-447). Agent-based systems read the documents themselves, use the same kinds of data, and assemble the case.

The industry standard's 2019 caution applies to the first and third kinds alike. For documentary trade, pattern-based recognition systems "are still under development, are unproven and represent investment requirements that will be attainable only to larger banks" (Wolfsberg Group, ICC and BAFT, 2019). Seven years later the public evidence has not much improved; we found no regulator or peer-reviewed evaluation of AI for TBML at a bank. The answer a buyer should demand is therefore not a vendor's accuracy figure but a plan that measures the solution on the bank's own book before anyone relies on it. That is what the ten weeks are for.

What data do you need on day one?

On day one a bank needs six feeds and two histories. The feeds are the trade finance system (credits, amendments, presentations and documentary collections), the payments hub (reimbursements and wires, with the ordering customer), public trade statistics for price bands, vessel voyage and port records, the customer due diligence system, and case management. The histories are 18 months of the bank's own credits, collections and wires, which the Party agent links and the Pricing agent uses for each customer's own prices, and 12 months of closed alerts and filed reports for the shadow run.

The histories matter more than the feeds. A price 5.1 times the market band is striking; a price six times anything the customer has paid in 18 months is a case. On the sample alert the market band for polyester filament yarn ran from USD 2.10 to USD 3.60 a kilogram, and the customer's own nine shipments of the same code had run from USD 2.35 to USD 3.05. Without the bank's history, only the first comparison is possible.

Weeks 1 to 3: connect the data, load the rules, set the roles

The first three weeks build the solution around the bank's own policy, not the vendor's defaults. Feeds are connected and checked for completeness, the red flags are loaded with their sources, and every setting is chosen and approved by a named person: the band window, the minimum observations before a band is used, the price multiple that raises a flag and the one that recommends escalation, the transshipment days over a direct service, the party look-back, the confidence floor, and the day by which a case must be with the BSA Officer.

The roles are set in the same weeks, because separation of duties is a configuration, not a promise. At the sample bank the analyst triages and recommends but cannot decide; the investigator closes or proposes escalation but cannot approve her own; the BSA Officer approves every escalation and decides every report; internal audit reads everything and acts on nothing; and trade operations can open a shipment and see the credit, the documents and its own clock, never a case.

Weeks 4 to 6: how do you run a TBML solution in shadow mode?

You run it over trades the bank has already decided and compare its findings with what the investigators found, without anyone acting on its output. Twelve months of closed alerts and filed reports are the test set. For each alert, the solution's findings and its proposed outcome are set beside the investigator's actual decision, and every difference is examined: a case the agents would have cleared that the bank escalated, a clearance the agents could not support, a flag nobody raised at the time.

The exit test is the one a validator will ask about. The solution should raise every escalation from the test year that became a case, and every difference between its output and the bank's decisions should have a written explanation. A threshold question answered in the shadow run at the sample bank shows the shape: moving the price rule from 2.0 to 3.0 times the band top would have removed 388 flags over 12 months and missed 2 of the 61 escalations that became cases. That is a decision for the BSA Officer, with the two cases attached, not for the vendor. The model risk view of a TBML tool covers the validation questions in full.

Weeks 7 to 10: live, with people signing every decision

Going live means the agents read tonight's trade and people decide on it tomorrow. Nothing in the solution closes, escalates or files on its own: the Challenger agent can clear an alert only with a written explanation and the document that proves it, and those clearances are visible to the investigator, the BSA Officer and internal audit. In the first weeks live, a sensible bank has a person read every agent clearance as well; the share that person disagrees with is the number that decides how long that review continues.

One trail for agents and people, and a pack for each reader

Who signs off before go-live?

Five sign-offs close the shadow phase, and each belongs to a different person because each answers a different question. None of them is the vendor's.

Can you pilot a TBML solution without supervisory risk?

Supervisors have said that piloting is not in itself a failure. In a December 2018 joint statement the Federal Reserve, FDIC, FinCEN, NCUA and OCC told banks that pilot programs should not in themselves draw supervisory criticism even if they prove unsuccessful, and that finding activity a new system catches would not automatically be taken to mean the bank's existing processes were deficient (Joint Statement on Innovative Efforts, SR 18-10). A bank should confirm the statement still stands when it plans its pilot; a SAR narrative drafting pilot on fifty filed SARs works through how the statement applies to a pilot of that kind.

The one bank pilot GAO described shows what supervisors watch. The bank was digitising trade documents and applying machine learning to them, and GAO added in a footnote: "Officials from the bank's regulator said they continue to engage with the bank concerning the pilot program to ensure that the bank deploys appropriate risk governance around these initiatives" (GAO-20-314R). Engagement on governance is the expectation, and a shadow run with written differences, named sign-offs and an audit trail is the governance a supervisor can read.

There is also a reason to expect that a new system will find things. FATF and the Egmont Group report that most financial institutions they surveyed consider TBML the hardest kind of laundering to detect, which means a bank's past decisions are not a perfect answer key. When the shadow run raises a flag on a trade the bank cleared, the right response is to look at the trade again under the bank's procedures, not to tune the flag away (FATF and Egmont, 2020).

What goes live is the evidence: a case with an exhibit on every sentence

Where the solution does not fit

The solution fits banks that issue, confirm or negotiate letters of credit or handle documentary collections, and it fits less well elsewhere. A bank whose trade business is almost entirely open account payments has few documents to read; its party and payment links still work, but most of what the Document, Pricing and Route agents do needs paper. A bank with no access to vessel voyage records gets route checks marked unconfirmed, and the solution will not close an alert on a route flag it could not check.

Three jobs belong to other controls. Sanctions screening of names, vessels and ports is its own process, with its own blocking rules. Deciding whether a goods line needs an export licence is an export control question; the industry's trade principles say banks are generally not placed to make that call. And goods with no market, such as obscure part numbers, cannot be priced: the Pricing agent refuses any goods code with fewer than 40 observations in 12 months and asks for an analyst. The FFIEC asks for monitoring adequate to "the bank's size, complexity, location, and types of customer relationships" (FFIEC, Trade Finance Activities, Examination Procedures); a bank with a small documentary book may decide that well-documented manual review is adequate.

For a bank that wants to see the plan on its own data, the solution can be run on a sample of the bank's past presentations and alerts; start from Trade-Based Money Laundering Detection, and see how technology divides a trade alert's tasks for what the agents do and do not take.

Questions people ask

How long does a TBML system take to implement?

Our proposed plan is about ten weeks for a bank with a documentary trade book: three for data and settings, three for a shadow run on closed alerts, and four live with people deciding every alert. The time depends most on how quickly the trade finance and payments feeds and 18 months of history can be connected.

Are TBML pattern tools only for large banks?

The Wolfsberg Group, ICC and BAFT said so of pattern-based systems in 2019, when they called them unproven and an investment attainable only to larger banks. A smaller bank should weigh any tool against the FFIEC's proportionality: monitoring adequate to its size, complexity and customer relationships, which for a small book may be careful manual review.

Do we have to replace our transaction monitoring system?

No. The solution reads the same trade finance and payment feeds and sits beside the existing system; the rules in the existing system can keep running. What changes is how a trade alert is researched, decided and recorded.

Who owns the thresholds after go-live?

The bank. At the sample bank every threshold change, closure above USD 1,000,000 and role change needs a second named person, and a proposed change sits on the trail as proposed until the BSA Officer approves it.

What should a shadow run report?

For each closed alert in the test year, the solution's findings and proposed outcome against the bank's decision, with every difference explained in writing; the escalations that became cases and whether each was raised; and how each threshold would have changed the flag count and the cases caught.