How much data does an AML model need to catch financial crime?
Every bank that builds a machine learning model to catch money laundering runs into the same wall: there are not enough examples. Genuine cases of laundering, fraud, or sanctions evasion are rare, and that’s the whole point of catching them, which means the very thing a model needs to learn from is in short supply.
And the examples that do exist are scattered across the market. One institution sees one variation of a laundering scheme, another sees something different, and a third may have no confirmed cases at all. Customer and transaction data cannot simply be pooled into one giant training set.
That sounds like a technical detail. Together, those two constraints put a hard ceiling on how quickly financial-crime models can learn, whether you are a community bank or one of the largest institutions.
It isn’t. It’s the single biggest thing standing between a bank and a genuinely good detection model, and it applies whether you’re a community bank or one of the largest institutions. We wanted to put real numbers on the problem first to test whether synthetic data could close the gap, and examine what happens when that capability can also learn from experience across a wider network.
Read on to see what we found.
| Key findings Detection models across 12 financial crime typologies keep improving up to roughly 3,500–5,000 labeled examples, then level off. Only the largest US banks come close to that volume, and only for their single most common crime type. For the highest-risk typologies such as trade-based laundering, corruption, sanctions evasion (real examples stay scarce at every bank, regardless of size). Models trained entirely on synthetic data, with no real customer data included, ranked a real bank’s confirmed suspicious accounts 10 to 15 times better than random chance. Layering those synthetic scores on top of a bank’s existing model lifted detection further, and the improvement passed a formal test for statistical reliability. Federation addresses the other half of the problem: it allows detection capability to learn from experience distributed across participating institutions without pooling the underlying customer data. |
The experiment: Testing AML models across 12 crime typologies
We picked 12 different types of financial crime, including cash structuring, money mule networks, trade-based laundering, sanctions evasion, corruption, and more, spanning the same categories our High-Risk Typology models are built to catch. For each one, we trained a series of models on a growing number of past examples: starting at just 250 and working up to 10,000. Every model in that series was then tested against the exact same held-out sample, so the only thing changing was how much the model had learned from.
You can think of it like teaching someone to recognize a rare bird. Show them 250 photos, and they’ll get the obvious cases right and miss the subtle ones. Show them 10,000, and they’ll catch details a beginner never would. What we wanted to find out was where that improvement starts to level off, and how it compares to what a real bank has to work with.
How much training data a bank generates each year
Across all 12 crime types, the results showed that models improve steeply from 250 examples up to around 3,500 to 5,000. Past that point, each additional thousand examples still helps, but only a little, and the model is approaching the ceiling of what that data can teach it.
We then compared that threshold against roughly how many real examples of a single crime type a bank generates in a year, based on typical filing volumes at U.S. institutions:
- 🟣A community bank sees a few dozen examples a year, for its single most common crime type.
- 🟣A mid-size regional bank sees a few hundred.
- 🟣A large regional bank gets to roughly 3,000 a year, enough to just about approach the point where a model’s learning curve starts to flatten, but only for its single most common crime type.
- 🟣Even a money-center bank, one of the very largest in the country, only clears that bar for its most frequent crime types. It still comes nowhere near that for the dozens of rarer ones it also has to watch for.
And this isn’t something that goes away once a bank is big enough. It changes shape. A money-center bank isn’t short of data across the board. It’s short of data on the long tail of typologies it sees only occasionally, which today includes some of the highest-risk ones: corruption, sanctions evasion, complex trade-based schemes. No bank, at any size, walks into this with enough real examples on every crime type it’s responsible for catching.
It’s also worth flagging that these volumes are calibrated to U.S. banks, which operate at a scale most banking systems elsewhere don’t match. A regional bank in many other markets processes a fraction of the transaction and filing volume of its U.S. counterpart. If the shortfall looks serious using American filing volumes as the benchmark, it is materially worse almost everywhere else.
And that shortage isn’t evenly distributed across crime types either. Banks tend to have decent volumes of examples for cash-related activity, because it’s common and well understood. But for the crime types getting the most regulatory attention right now, trade-based laundering, corruption, sanctions evasion, organized laundering networks, real examples are genuinely scarce, everywhere, at every bank, regardless of size. The shortfall is worst exactly where the risk conversation is heading.
If scarcity and fragmentation are the problem, the first thing firms need to know is whether synthetic data can supply useful examples at all.
Synthetic data on a real bank
Of course, knowing the size of the shortfall is one thing. Closing it is another. So we ran a more demanding test: we took a real bank’s real transaction data, through a partner, roughly 105,000 accounts, several hundred of them already flagged as genuinely suspicious by the bank’s own investigators, and built a set of crime-detection models trained on nothing but synthetic data. Not one real transaction, not one real customer, from that bank or any other, went into training these models.
Then we pointed those models at the real bank’s accounts and asked if a model that has never seen this bank, or any real customer’s data, could still find the accounts that the bank’s own investigators had already identified as genuinely suspicious.
The answer was yes. On their own, with no real data and no help from the bank’s existing systems or rules, these synthetic models ranked the bank’s confirmed suspicious accounts 10 to 15 times better than random chance.
Just as important is where it worked and where it didn’t. Crime types that matched what this bank’s customers do, including cash activity, laundering networks, and trade-based schemes, transferred well. Crime types that had little to do with this bank’s actual customer behavior barely beat random chance. That’s exactly what an honest result should look like. The model is genuinely picking up on real, transferable behavior, and it’s honest about where that behavior doesn’t apply.
When we added those synthetic model scores on top of the bank’s own existing model, the one already using every real input available to it, detection quality improved further still, and the improvement passed a formal statistical test. (It wasn’t a one-off.)
Federation turns synthetic data into a learning system
The experiment shows that synthetic data can fill an important gap: knowledge about a financial-crime risk can be turned into examples that a model can learn from, even when the institution itself does not hold enough confirmed cases.
But no synthetic dataset should be treated as a finished picture of the world. Financial crime changes, institutions see different variations, and legitimate customer behavior differs from one bank to another.
That is where federation becomes essential.
A system designed to learn from participating institutions, while their underlying customer and transaction data remains local, can fold new behaviors, legitimate variations, and confirmed cases encountered across the network into subsequent learning, without requiring those records to be pooled centrally.
Synthetic data therefore supplies what no individual institution has enough of. Federation brings in what no individual institution can see on its own.
What this means for AML programs
No institution, regardless of size, has enough real-world examples of every crime type it’s responsible for catching. The largest banks come closer than most, but even they carry real shortfalls on the typologies drawing the most attention right now. Smaller institutions, and banks operating outside the U.S. where transaction volumes are typically lower still, face the same shortage in a more acute form.
This isn’t a failure of any individual compliance program, and no single institution can close it alone.
Synthetic data, built without touching any single customer’s real records, can supply the training volume that’s missing at any institution. This is exactly what Consilient’s Federated Synthetic Data is built to do, validated across 24 typologies and roughly 110M labelled transactions, tested for behavioral plausibility and leakage before it ever reaches a live program. Our testing shows models trained purely on it carry over well to real-world detection, and stay honest under scrutiny: strong where the behavior genuinely applies, and appropriately weak where it doesn’t.
If you want to see where your own institution sits against these thresholds, talk to our team about what Federated Synthetic Data could add on top of what you already run. It’s the first of three federated products we’re bringing to market this year.
Full methodology and companion data available on request.
You may also like:
