Money laundering doesn't happen in isolation. It happens through networks: layered structures of bank accounts, shell companies, correspondent relationships, and intermediary actors spread across jurisdictions. A single suspicious transaction, viewed on its own, might look perfectly normal. It's only when you map how that transaction connects to hundreds of others that the laundering pattern becomes visible.
For decades, anti-money laundering (AML) systems have treated transactions as independent rows in a database. A wire transfer comes in. The system checks it against a set of rules: Is the amount above $10,000? Is the sender on a sanctions list? Does the transaction match a known typology? If a rule triggers, an alert fires and a human analyst investigates. This approach generates enormous volumes of false positives and misses sophisticated schemes entirely.
Graph analytics offers a fundamentally different approach. Instead of evaluating each transaction in isolation, graph models represent the entire web of accounts, entities, and money flows as a connected structure. Patterns that are invisible in tabular data become obvious when you can see the shape of the network.
What tabular models miss
Consider a simple example. Account A sends $9,500 to Account B. Account B splits the funds into three transfers of roughly $3,100 each, sending them to Accounts C, D, and E. Within 24 hours, all three accounts forward their balances to Account F. In a transaction-monitoring spreadsheet, each of these six transfers looks unremarkable. None exceeds reporting thresholds. None involves sanctioned parties. A rule-based system might flag none of them.
In a graph, the structure is immediately suspicious. The fan-out from B and the rapid convergence to F form a classic layering pattern. Community detection algorithms can identify this cluster automatically by measuring how densely interconnected a group of accounts is relative to their connections outside the group.
This isn't a hypothetical edge case. The Financial Action Task Force (FATF) has documented that layering through multiple intermediary accounts is the single most common money laundering technique across all jurisdictions surveyed. Rule-based systems were never designed to detect it because they don't model relationships at all.
Fraud ring detection
The first and most mature graph application in AML is fraud ring identification. Criminal organizations typically operate through clusters of accounts that transact heavily with each other, often in circular patterns designed to obscure the original source of funds.
Community detection algorithms, such as the Louvain method or label propagation, partition a transaction graph into groups of tightly connected nodes. When a community of 15 accounts shows that 90% of their transaction volume stays within the group, and the accounts were all opened within the same two-week period at different branches, that's a signal worth investigating.
The math behind community detection is straightforward. The Louvain algorithm maximizes modularity, which measures the density of connections within communities compared to what you'd expect from a random graph with the same degree distribution. High modularity means the network has genuine cluster structure rather than random connectivity.
Banks running graph-based community detection alongside traditional transaction monitoring have reported measurable reductions in false positive rates. Feedzai, which pioneered graph-based monitoring in traditional banking, processes more than 80 billion transactions per year across its client base. Their system builds transaction graphs in real time and applies both rule-based and ML-driven detection on the graph structure. The company reports that graph features improve detection rates by 40-60% compared to tabular-only models in published case studies.
Trade-based money laundering
Trade-based money laundering (TBML) uses international trade to move value across borders. The techniques include over-invoicing, under-invoicing, multiple invoicing for the same shipment, and phantom shipments where no goods change hands at all.
Graph analysis of trade networks can reveal these patterns. When Company X in Country A consistently sells goods to Company Y in Country B at prices three standard deviations above market rates, and Company Y is connected through shared ownership records to Company Z, which moves funds back to Country A through a different channel, the triangular structure becomes visible in the graph.
Customs and trade finance data form the basis for these graphs. Nodes represent companies, ports, and financial institutions. Edges represent trade documents, payments, and ownership relationships. Anomaly detection on this graph looks for pricing outliers, unusual trade corridors, and entity clusters with circular fund flows.
This area is less mature than transaction graph analysis. The data is harder to obtain, trade records are less standardized than bank transactions, and international cooperation adds friction. But several compliance technology vendors are building trade network analysis products, and FATF has specifically called out TBML as an area where advanced analytics should be applied.
Blockchain tracing
Public blockchains create a graph by default. Every Bitcoin or Ethereum transaction is a directed edge from one address (or set of addresses) to another, recorded permanently on a public ledger. This makes blockchain analytics a natural fit for graph-based investigation.
The challenge is attribution: linking pseudonymous blockchain addresses to real-world identities. Wallet clustering algorithms group addresses that are likely controlled by the same entity by analyzing transaction patterns such as co-spending (multiple inputs in a single transaction must come from the same controller) and change address detection.
Chainalysis is the dominant player in this space. Founded in 2014, the company's Reactor product lets investigators trace funds across chains, through mixing services and DeFi protocols, and into centralized exchanges where identity is known through KYC records. Chainalysis is used by the IRS Criminal Investigation division, the FBI, Europol, and over a thousand financial institutions. The company reports more than one million users across government and private sector clients.
Their attribution database, which maps blockchain addresses to known entities, is their primary competitive advantage. Building this database required years of investigative partnerships, law enforcement collaborations, and analysis of exchange deposit patterns. It's not something a new entrant can replicate quickly.
TRM Labs competes directly with Chainalysis in blockchain intelligence. TRM has raised more than $150 million in funding and provides multi-chain analytics covering Bitcoin, Ethereum, Tron, Solana, and dozens of other networks. Their client list includes Binance and Circle. TRM's approach emphasizes real-time monitoring and cross-chain tracing, which matters as laundering increasingly involves "chain hopping" between different blockchains to obscure fund flows.
Companies building graph-based compliance tools
Beyond Chainalysis and TRM Labs, several companies are applying graph techniques to financial crime detection across both traditional and crypto finance.
Feedzai was mentioned above for transaction monitoring. The company, founded in Portugal in 2011, applies graph neural networks and more traditional graph algorithms to detect fraud and money laundering in banking transactions. Their client base includes several of the world's largest banks. Feedzai's system ingests transaction data, builds entity-relationship graphs, and runs both supervised and unsupervised models on graph features. Processing 80 billion-plus transactions per year puts them among the highest-throughput compliance analytics platforms.
Hawk AI takes a hybrid approach combining machine learning with traditional rule-based AML monitoring. Based in Germany, Hawk AI serves European banks and payment providers. Their graph analysis module maps relationships between accounts, companies, and individuals, then applies anomaly detection to identify suspicious network structures. The hybrid model matters in regulated environments where supervisors expect to see explainable rules alongside ML outputs.
Sardine focuses on fraud detection through network analysis of device and behavioral signals. Rather than analyzing fund flows alone, Sardine builds graphs from device fingerprints, behavioral biometrics (typing patterns, mouse movements), and transaction data. This catches fraud rings that share devices or exhibit coordinated behavioral patterns even when individual transactions look normal.
For a broader view of companies in compliance and risk technology, the AIFI risk segment directory lists firms across the category. The graph analytics AI type page shows companies that specifically use graph-based methods.
The explainability problem
Regulators are on board with advanced analytics in principle. FATF's 2021 guidance explicitly encourages the use of AI and machine learning in AML systems. FinCEN has issued similar supportive statements. But regulatory acceptance comes with conditions, and the biggest one is explainability.
When a tabular model flags a transaction, explaining the decision is relatively simple: the amount exceeded a threshold, the counterparty matched a typology, the risk score was driven by three specific features. Model validation teams can audit feature importances and verify that the model behaves as expected.
Graph neural networks (GNNs) are harder to explain. A GNN might flag an account because of its structural position in the network: it sits between two suspicious communities, or its two-hop neighborhood contains an unusual concentration of recently opened accounts. Translating that into a suspicious activity report (SAR) narrative that a compliance officer can defend to an examiner is a real challenge.
Some vendors address this by using graph features as inputs to interpretable models rather than running end-to-end GNNs. You compute graph metrics like degree centrality, PageRank, community membership, and transaction velocity within a subgraph, then feed those as features into a gradient-boosted tree or logistic regression. The graph structure informs the features, but the final decision model is interpretable.
Others are developing graph-specific explanation methods that highlight the subgraph most responsible for a prediction. This is an active area of research, and production-ready explainability for GNNs is still limited.
Where this stands today
Only about seven companies in the AIFI directory list graph analytics as a primary AI type. That number is low relative to the technique's potential. Most compliance technology vendors still rely primarily on tabular models with rule-based overlays. Graph-based approaches are gaining adoption but remain a specialty.
The companies seeing the most traction are those where graph structure is inherent in the data: blockchain analytics firms (where every transaction is a graph edge) and large-scale transaction monitoring platforms (where entity relationships naturally form networks). For trade finance and cross-border payments, graph analytics is earlier-stage but promising.
Compliance teams evaluating graph-based tools should focus on three practical questions. First, can the system ingest your existing data formats without a year-long integration project? Second, does it produce alerts that your analysts can actually investigate and document for regulators? Third, does the vendor have validation evidence showing improved detection rates on data comparable to yours?
The technology works. The remaining barriers are integration complexity, regulatory model risk expectations, and the ongoing shortage of compliance analysts who understand both graph theory and AML regulations. Those barriers are real, but they're operational, not technical.