Planted indicators
40
Loading the book.
Labelled scenarios
What the planted book can and cannot say
Recall here is the share of planted scenario indicators that produced an alert. It measures whether the engine rediscovered patterns the generator inserted. Alerts outside those labels are unlabelled activity — background retail, or an extra indicator the scenario did not list. They are not adjudicated false positives and they are not a measure of money laundering.
Detected
35
Missed
5
Recall
88%
39 alerts sit outside the planted labels, out of 97. Those are unlabelled. They are the queue a reviewer would sample. They are not a false-positive rate.
| Rule | Expected | Detected | Missed | Outside the label | Recall |
|---|---|---|---|---|---|
AML-VC-012 24-hour aggregated receipts reached the reporting threshold | 6 | 5 | 1 | 2 | 83% |
AML-FI-001 Large cash receipts reached the reporting threshold | 3 | 3 | 0 | 0 | 100% |
AML-VC-010 Fan-in - many unrelated sending wallets into one customer | 3 | 3 | 0 | 0 | 100% |
AML-VC-008 Beneficiary shared across apparently unrelated customers | 2 | 1 | 1 | 5 | 50% |
AML-FI-002 International electronic funds transfers reached the reporting threshold | 2 | 2 | 0 | 0 | 100% |
AML-SC-001 Name resembles an entry on the sample sanctions list | 2 | 2 | 0 | 0 | 100% |
AML-VC-003 Rapid pass-through of received virtual currency | 2 | 2 | 0 | 0 | 100% |
AML-VC-014 Receipts concentrated in newly observed addresses | 1 | 1 | 0 | 17 | 100% |
AML-VC-007 One wallet used by multiple customers | 1 | 1 | 0 | 4 | 100% |
AML-VC-002 Repeated receipts accumulating just below the reporting threshold | 1 | 1 | 0 | 3 | 100% |
AML-VC-004 Receipt volume far above the customer's own baseline | 1 | 0 | 1 | 3 | 0% |
AML-VC-015 Activity inconsistent with the customer's stated expected volume | 1 | 0 | 1 | 3 | 0% |
AML-VC-005 Exposure to a high-risk counterparty wallet | 1 | 1 | 0 | 1 | 100% |
AML-VC-013 Rapid switching between virtual currencies (chain hopping) | 1 | 1 | 0 | 1 | 100% |
AML-FI-003 Cash receipts structured below the large-cash threshold | 1 | 1 | 0 | 0 | 100% |
AML-FI-004 Rapid movement of funds from one rail to another | 1 | 1 | 0 | 0 | 100% |
AML-FI-005 Several customers place sub-threshold cash with one beneficiary | 1 | 1 | 0 | 0 | 100% |
AML-SC-002 Name resembles an entry on the sample PEP list | 1 | 1 | 0 | 0 | 100% |
AML-TB-001 Trade payment diverges from the declared goods value | 1 | 1 | 0 | 0 | 100% |
AML-TB-002 MSB cash-in followed by payouts to several beneficiaries | 1 | 1 | 0 | 0 | 100% |
AML-TB-003 Casino chips purchased and largely redeemed with minimal play | 1 | 1 | 0 | 0 | 100% |
AML-TF-001 Sample terrorist-property list matched a party on the transaction | 1 | 1 | 0 | 0 | 100% |
AML-TR-001 International EFT is missing travel-rule originator or beneficiary fields | 1 | 1 | 0 | 0 | 100% |
AML-VC-001 Rapid inbound activity from multiple distinct wallets | 1 | 1 | 0 | 0 | 100% |
AML-VC-006 Dormant relationship suddenly active | 1 | 0 | 1 | 0 | 0% |
AML-VC-009 Counterparty exposure to a higher-risk jurisdiction | 1 | 1 | 0 | 0 | 100% |
AML-VC-011 Circular movement of funds | 1 | 1 | 0 | 0 | 100% |
Anomaly scores
The anomaly score is unsupervised. The split below compares customers the generator marked alert_expected with everyone else. A higher median on the planted side is a sanity check, not an ROC and not a precision claim.
Planted alert customersn 26 · median 0.5513
Everyone elsen 13 · median 0.4359
Missed labels
- AML-VC-006 · Quentin Chen · dormant_spike
- AML-VC-008 · Xiomara Vasquez · aggregation_beneficiary
- AML-VC-012 · Xiomara Vasquez · aggregation_beneficiary
- AML-VC-004 · Maple Digital Imports Ltd. · demo_maple
- AML-VC-015 · Maple Digital Imports Ltd. · demo_maple