Fraud Rings and Relational Alpha

So far this course has built the machinery: graphs, node and edge and graph-level tasks, message passing, the contagion dynamics that ripple through a network. Lovely theory. Now we point all of it at the two things that actually fund a quant desk and a compliance team: catching money that is being hidden and predicting money that is about to move.

Here is the unifying punchline, up front. Fraud detection and relational alpha are not new problems with new math — they are the exact node, edge, and graph tasks from the graph-tasks lesson, aimed at money instead of toy citation networks. The structure is the signal. A laundering ring is invisible one account at a time and obvious as a subgraph. A supplier’s earnings surprise is silent on the customer’s own price chart and loud along the supply-chain edge that connects them. Graph learning earns its keep exactly where the value lives between the nodes rather than inside them.

This lesson is the “point it at money” capstone before the honest audit. We will be witty about it, but the caveats are deadly serious — and the next lesson does nothing but stress-test them.

The unifying idea: same graph tasks, aimed at money

Analogy. You already own the toolbox. Earlier lessons sold you a hammer, a saw, and a drill and made you practice on scrap wood. This lesson hands you the actual house. Nothing about the tools changed — you are just hitting nails that are worth something.

Definition. Every problem in this lesson maps onto one of the canonical graph machine-learning tasks:

• Node classification / regression — label or score each node from its features and its neighbourhood $\mathcal{N}(v)$. Fraud: is this account illicit (a label)? Alpha: what return will this firm post (a number)?
• Subgraph / graph classification — label a whole pattern rather than a single node. Fraud: is this little cluster of accounts a laundering ring?
• Link prediction — score node pairs for a missing or hidden edge. Fraud: do these two pseudonymous wallets secretly share an owner? Alpha: is there an undisclosed supply relationship?

Worked example. Imagine a single account that sends fifty small payments to fifty distinct counterparties and receives none. A per-row tabular model sees fifty boring rows. A node classifier with one round of message passing sees a node whose out-degree is fifty and in-degree is zero — a fan-out hub — and that structural feature, computed by aggregating over $\mathcal{N}(v)$, is what tips the score. Same data; the graph framing surfaces a feature the flat table never had a column for.

Misconception. “Graph models replace the features and models I already have.” No — they augment them. The node’s own features (transaction size, firm fundamentals, price history) still matter; the graph adds the relational channel on top. Throwing away node features to go “pure graph” usually throws away signal.

When to use it

Frame a finance problem as graph learning when the value is relational — when an entity is suspicious or predictable because of who it is connected to, not just its own attributes. If a flat per-entity model with no neighbourhood information already nails it, you do not need a graph; the graph earns its complexity only when structure carries signal the table cannot.

AML ring detection on transaction graphs

Analogy. A laundering ring is a heist where every individual on camera is just buying groceries. One person buys flour, another buys yeast, a third buys a delivery van — all perfectly legal. Only when you draw the lines between them do you see a bakery being built to launder bread money. The crime is in the graph, not in any single frame.

Definition. Money laundering classically runs in three stages: placement (get dirty cash into the system), layering (shuffle it through many transactions to obscure its origin), and integration (bring it back looking clean). Anti-money- laundering (AML) is the work of detecting this. A transaction graph models it directly: nodes are accounts or wallets, directed weighted edges are transfers (direction = who paid whom, weight = amount and/or count, often timestamped). A graph neural network labels a node by aggregating its neighbourhood, so an account can “look guilty by association and by pattern” even when its own transactions are dull.

Why per-account rules miss it. Threshold rules (“flag any transfer above ten thousand”) are trivially defeated by design. Launderers deliberately structure activity below thresholds and spread it across many accounts. The three structural escapes:

• Fan-in (smurfing): many small inbound transfers converge on a collector.
• Fan-out: one source sprays funds to many mules.
• Layering chains / cycles: long directed paths or loops that recycle funds to blur their origin.

Worked example — the fan-in that beats a threshold. Ten “smurf” accounts each send 9000 units into one collector account. Each transfer is below the 10000 reporting threshold, so a per-transaction rule fires zero alerts. But aggregate the collector’s neighbourhood:

$\text{inflow}(c) = \sum_{u \in \mathcal{N}^{-}(c)} w_{u \to c} = 10 \times 9000 = 90{,}000,$

where $\mathcal{N}^{-}(c)$ is the set of accounts sending into collector $c$. The collector’s in-degree is ten and its total inflow is ninety thousand units — comfortably into reporting territory — and it then forwards roughly that whole sum onward in one or two hops. A node classifier whose message-passing step computes neighbourhood aggregates (degree, summed inflow, count of distinct senders) reads those features and scores the collector as suspicious. Each edge was legal; the node’s aggregated structure is not. That gap is the entire reason graphs beat flat rules here.

When to use it

Use graph AML when laundering is structured — deliberately fragmented to slip under per-entity rules — which is most of the serious cases. Treat the model as an alert prioritiser feeding human investigators, not an autonomous judge: it raises the most structurally suspicious nodes to the top of a queue, and people (with legal standards of proof) decide. If your laundering is just one giant obvious transfer, a threshold rule already catches it and you do not need the graph.

Typologies and motifs: matching crimes to shapes

Analogy. Detectives keep a catalogue of modus operandi — the safecracker who always drills the same spot, the forger who reuses one watermark. AML has the same playbook, except the “MO” is a shape in the graph. Learn the shapes and you learn the crimes.

Definition. A typology is a recognised laundering pattern; a motif is the small recurring subgraph that encodes it. Detecting them is subgraph / motif counting (how many times does this shape appear around a node?) feeding into a graph- or node-level classifier. The staple typologies:

Worked example — counting the loop. Round-tripping hides in a directed cycle. Take account $A \to B \to C \to A$. A per-account rule sees three accounts that each sent and received one transfer — utterly normal. A motif counter searches for directed 3-cycles and finds exactly one passing through $A$. If $A$ sits on, say, seven distinct short directed cycles when a typical account sits on zero, that cycle-count feature ($7$ versus a baseline near $0$) is a strong structural flag. The arithmetic is just counting closed directed paths — but it is a count the flat table has no column for.

Misconception / pitfall. “Hub shape equals guilt.” Emphatically no. A payroll processor is a giant fan-out. A popular exchange is a giant fan-in. A merchant acquirer is a dense many-to-many cluster. If your model keys on degree or motif counts alone, it will rank every legitimate hub as a top suspect and drown your investigators in false positives — the exact failure the pretest described. The fix is to learn the finer distinctions (timing, velocity, counterparty mix, known-entity labels) that separate a laundering cluster from a Tuesday at a payment processor.

When to use it

Reach for motif and typology features when you have a known catalogue of laundering shapes and want interpretable, auditable flags (“this account sits on seven cycles”). They pair well with a GNN: hand-crafted motif counts give a regulator-friendly explanation, while the learned message passing catches variants the catalogue missed. Do not deploy motif counts naked against the false-positive problem — always combine with features that exonerate legitimate hubs.

Relational / peer-firm alpha

Analogy. A supplier’s bad quarter is the cough before the customer’s flu. If the factory that makes your only engine part just warned on demand, you do not need to wait for the carmaker’s own report to update your view — the symptom already travelled down the supply chain. Relational alpha is listening to the cough.

Definition. Relational (peer-firm) alpha propagates a signal — an earnings surprise, a news-sentiment shock, an analyst revision — from one firm along economic edges (supplier-customer links, same-sector co-movement, shared ownership) to predict a connected firm’s return. In graph terms it is node regression where each node’s target (forward return) is informed by messages aggregated from $\mathcal{N}(v)$. This is message passing used as alpha: the same aggregate-from-neighbours operation that flags a laundering hub, repurposed to forecast a price.

Worked example — weighted propagation of a surprise. A supplier $S$ posts an earnings surprise of $+8\%$. It has three customers, and we weight the propagated signal by each customer’s revenue share sourced from $S$ (how exposed each is):

The one-hop message into customer $v$ is a weighted sum over its supplier neighbourhood,

$m_v = \alpha \sum_{u \in \mathcal{N}(v)} w_{u \to v} \, s_u,$

where $s_u$ is the source firm’s surprise, $w_{u \to v}$ the edge weight (dependence), and $\alpha$ a global decay capturing how much of a supplier’s news actually transmits. Customer $A$, half-dependent on $S$, inherits a $2\%$ expected nudge; the barely-exposed $C$ inherits $0.4\%$. The same surprise, fanned out and scaled by the edge, becomes a cross-sectional return forecast.

Tie to the deep-learning course. A sequence model (RNN, TCN, attention) captures one firm’s own history — its price path, its seasonality, its momentum. The GNN adds the cross-firm channel the sequence model is blind to: information that lives in other firms and reaches this one along an edge. The two compose naturally — sequence model per node for the temporal signal, graph layer across nodes for the relational signal.

When to use it

Use relational alpha when (1) you have a defensible economic edge — a real, reasonably current supply or ownership link, not a guessed correlation — and (2) the signal plausibly leads, i.e. the source firm’s news arrives before the target’s price has absorbed it. It is strongest right after a discrete event (an earnings surprise, a guidance cut, an M&A headline) on a well-mapped network. It is weakest, and most dangerous, when the edge data is stale or the lead-lag is actually the other way round.

On-chain analytics on wallet graphs

Analogy. Imagine if every bank transaction on Earth were posted to a public bulletin board, forever, under nicknames instead of names. You could not immediately read “Alice paid Bob,” but you could watch the nicknames, see which ones always move together, and slowly deduce who is who. That bulletin board is a public blockchain, and the deduction is on-chain analytics.

Definition. On-chain analytics builds a wallet / address graph from raw blockchain data — nodes are addresses, edges are transfers — and runs graph tasks on it:

• Entity clustering — which addresses share one owner? (Node clustering / link prediction.)
• Illicit-flow tracing — connect an address to a known hack, scam, sanctioned entity, or mixer. (Labelled-source propagation / path tracing.)
• Exchange / mixer / service classification — label an address by behaviour (node classification).

Worked / illustrative example — clustering by common input. In a UTXO-model chain (think of coins as discrete bills, where a transaction spends specific bills), a single transaction often spends inputs from several addresses at once. The common-input heuristic says: if addresses $X$, $Y$, and $Z$ all appear as inputs to the same transaction, they are almost certainly controlled by one wallet — you generally need all the private keys to sign such a spend. So a transaction with inputs $\{X, Y, Z\}$ collapses those three nodes into one entity. A GNN then refines the heuristic: it learns from address behaviour (timing, amounts, counterparties) to merge clusters the naive rule split apart, and to avoid merging when the heuristic over-reaches. Account-model chains (one persistent balance per address, no discrete coins) break the common-input heuristic entirely, so the clustering tactics differ by chain model — a loose tie to the UTXO-versus-account distinction from earlier.

When to use it

Use on-chain graph analytics for compliance screening (is this counterparty wallet tied to a sanctioned entity or a hack?), forensic tracing of stolen funds, and labelling exchange or service addresses. It is at its best where the heuristics hold — common-input clustering on UTXO chains, propagation from a few high-confidence labels. It is at its worst, and you should be loudest about uncertainty, when funds have passed through a mixer or hopped chains, or when your only labels are a noisy public blocklist.

The common honest caveat (bridge to next lesson)

Step back and the two halves of this lesson rhyme. Whether you are hunting laundering rings or harvesting peer-firm alpha, the same four gremlins are waiting. Labels are scarce and noisy — confirmed laundering cases and clean supply-chain maps are both rare and error-prone. Classes are imbalanced — fraud is a needle in a haystack, and naive accuracy lies about it. The world fights back — the launderer adapts to your last model and the alpha edge decays as it crowds. And the big one, the gremlin that quietly invalidates more graph papers than any other: these models leak badly if you split carelessly. Connected nodes that should be on the same side of the train/test line end up on both; future edges sneak into past training; a “test” node has already whispered its label to a training neighbour through one hop of message passing. Your backtest glows, and live performance faceplants.

Recap

You took the whole graph-learning toolbox and aimed it at money. Fraud detection turned out to be node and subgraph classification on a transaction graph, where structured laundering hides under per-account thresholds and only the fan-in, chain, cycle, and cluster motifs give it away — while legitimate hubs threaten to bury you in false positives. Relational alpha turned out to be node regression with message passing as the engine, propagating a supplier’s surprise along weighted economic edges to forecast a customer’s return, adding the cross-firm channel a single-firm sequence model never sees. On-chain analytics turned out to be the same transaction-graph game on a public, pseudonymous ledger, where clustering and tracing recover structure until a mixer or a chain hop fights back. And all of it shares one set of honest caveats — scarce labels, imbalance, an adapting adversary or decaying edge, and the leakage trap that the next lesson exists to expose.