Exploring the In-Context Learning Capabilities of LLMs for Money Laundering Detection in Financial Graphs

In one sentence

Summary

The paper addresses the challenge of detecting complex money laundering schemes in financial knowledge graphs by leveraging Large Language Models (LLMs) as interpretable reasoning engines. It positions LLMs not just as text generators but as in-context learning agents capable of emulating analyst-style investigative logic. The core problem is the need for explainable, graph-structured reasoning in Anti-Money Laundering (AML) without the black-box nature of traditional Graph Neural Networks (GNNs). The study focuses on evaluating whether LLMs can identify suspicious transaction patterns by analyzing localized graph neighborhoods, thereby bridging the gap between structured financial data and natural language reasoning capabilities. The methodology involves a three-stage pipeline: extracting k-hop subgraphs around target transactions from the IBM AML Synthetic Dataset, serializing these subgraphs into structured text with node and edge metadata, and prompting an LLM (GPT-4o) using few-shot in-context learning. The prompt includes eight canonical laundering typologies (e.g., fan-out, gather-scatter) and non-suspicious examples as demonstrations. The experimental setup uses a balanced dataset of 2,000 transactions (1,000 suspicious, 1,000 clean) to evaluate binary classification and pattern recognition. Performance is assessed using bootstrap resampling to estimate confidence intervals for accuracy, precision, and recall, ensuring robustness despite the fixed test set. Results show the LLM achieves 63.7% overall accuracy, with higher performance on structured patterns like fan-out (80.3% recall) and lower performance on complex patterns like random or bipartite structures. The model successfully generates human-readable justifications aligned with investigative logic, highlighting its value for explainability. However, the study notes significant limitations, including the computational cost of LLM inference, which hinders scalability for large-scale production. The authors propose a hybrid approach where lightweight classifiers perform initial triage, escalating only borderline cases to the LLM for detailed reasoning. This work serves as a foundational exploration for language-driven financial crime analytics rather than a production-ready system.

Research problem

The paper investigates the feasibility of using Large Language Models (LLMs) as interpretable reasoning engines for Anti-Money Laundering (AML) detection over financial knowledge graphs. It addresses the need for explainable, graph-structured reasoning that can emulate human analyst logic without relying on black-box models like Graph Neural Networks (GNNs). The specific challenge is enabling LLMs to understand and classify complex, multi-hop transactional patterns inherent in money laundering schemes.

Core contributions

• Proposes a lightweight pipeline for LLM-based AML detection using in-context learning on serialized financial subgraphs.
• Demonstrates that LLMs can emulate analyst-style investigative reasoning and generate coherent, human-readable justifications for suspicious activity.
• Introduces a few-shot prompting framework conditioned on canonical money laundering typologies (e.g., fan-out, gather-scatter) to guide LLM reasoning.
• Evaluates LLM performance on the IBM AML Synthetic Dataset, providing a benchmark for graph-structured financial reasoning.
• Highlights the trade-off between interpretability and computational scalability, suggesting a hybrid triage system for practical deployment.

Method

• Subgraph Extraction: Retrieves k-hop neighborhoods around target transaction edges from the financial knowledge graph.
• Textual Serialization: Converts graph nodes and edges into structured text with metadata (type, amount, timestamp, relation).
• Few-Shot Prompting: Uses eight suspicious and four non-suspicious examples as demonstrations to guide LLM reasoning.
• Typology Conditioning: Prompts include canonical laundering patterns (fan-out, gather-scatter, etc.) to align with investigative logic.
• Classification Task: LLM outputs a binary decision (suspicious/not suspicious) and a natural language explanation.
• Pattern Recognition: LLM identifies the specific observed pattern (e.g., fan-out) relative to ground-truth labels.
• Evaluation: Uses bootstrap resampling (1,000 samples) to estimate confidence intervals for accuracy, precision, and recall.

Results & findings

• LLM achieves 63.7% overall accuracy (95% CI: ±3.3%) in classifying suspicious vs. non-suspicious transactions.
• Precision is 62.7% (±4.4%) and recall is 67.7% (±4.4%), indicating a slight bias towards identifying suspicious activity.
• Fan-out pattern detection achieves 80.3% recall, showing strong performance on structured, high-volume laundering tactics.
• Fan-in pattern detection achieves 81.5% recall, also demonstrating high effectiveness for this typology.
• Complex patterns like 'random' and 'bipartite' show lower performance (recall ~53-56%), reflecting difficulty in capturing less structured behaviors.
• The model generates coherent explanations that align with human investigative intuition, validating its interpretability.
• Bootstrap resampling confirms the stability of the results, though the fixed test set limits generalizability assessment.

Data & experiments

• Uses the IBM AML Synthetic Dataset, which models financial activities as a knowledge graph with accounts, banks, and transactions.
• Constructs a balanced evaluation set of 2,000 examples: 1,000 laundering transactions and 1,000 non-laundering transactions.
• Extracts k-hop subgraphs centered on target transactions to provide localized context for the LLM.
• Serializes subgraphs into structured text including node types, edge relations, amounts, and timestamps.
• Evaluates binary classification accuracy and pattern recognition precision/recall using bootstrap resampling for confidence intervals.
• Uses GPT-4o via OpenAI API with temperature=0 for deterministic inference.

Limitations & caveats

• The evaluation uses a balanced dataset, which does not reflect the class imbalance typical in real-world AML investigations.
• Computational cost of LLM inference is high, making it impractical as a standalone solution for large-scale production.
• Performance varies significantly across different laundering patterns, with complex structures being harder to detect.
• The study is exploratory and does not benchmark against state-of-the-art GNN or traditional ML baselines.
• Generalizability is limited by the use of synthetic data, which may not capture all real-world laundering nuances.
• The fixed test set and bootstrap resampling limit the assessment of robustness to different data distributions.

Curator notes

Discovery status: specific_domain_round3_promoted. Source links: FinDKG: Dynamic Knowledge Graphs with Large Language Models for Detecting Global Trends in Financial Markets