The Scale of the AML Challenge

AML investigations today face extreme data pressure. Globally, over 1.3 billion cashless transactions are processed daily. One of our clients alone ingests over 600 million transactions per month, a scale where manual review and static rule-based systems are no longer feasible.

For investigators and law enforcement, the difficulty is compounded by the fragmented nature of the data. Records are scattered across banks, registries, and cross-jurisdictional lists that must be normalized, linked, and made queryable. Traditional visualization tools can display connections but rarely explain them. As a result, teams spend days manually traversing networks, often missing multi-hop relationships or misinterpreting suspicious patterns.

We are excited to launch 221b’s new feature, the 221b AI Co-Investigator (AICI), built to close this computational and analytical gap. Embedded directly inside the visualization whiteboard, AICI acts as a digital co-investigator, a specialized AI chatbot that helps investigators explore and analyze massive graph networks in seconds. It reduces days of manual work into minutes of trusted results, allowing investigators to focus on decisions, not data.

• Instant insights: Move from 400,000+ records to a clear suspect list in seconds.
• Data-grounded explanations: Each suspicious activity comes with context on why it matters.
• Massive scale: Millions of transactions and entities processed without performance loss.
• Structured reporting: Generates regulator-ready AML analysis reports across multiple accounts.

 

System Architecture: From Data to Explanation

AICI is built on a structured pipeline that transforms raw transaction data into explainable outputs. It begins with data ingestion and normalization, where transaction records such as deposits, withdrawals, and cash flows are combined with entity metadata. This normalization process ensures consistency across heterogeneous sources, allowing downstream analysis to operate on a unified schema. The entities and transactions are then organized into a connected graph database, which supports traversal queries such as shortest paths, multi-hop fund flows, and neighborhood expansions.

On top of this graph layer, the system integrates a lightweight LLM layer that interprets investigator queries expressed in natural language. These models are domain-specific, resource-efficient, and deliberately constrained to prevent over-generation or fabricated results. For example, a query such as “Trace the fund flow from Account-A to Account-Z” is translated directly into a deterministic graph traversal operation. This translation occurs through query-to-analysis mapping, in which natural language inputs are aligned with pre-defined investigation templates such as account summaries, suspicious activity lookups, fund flow traces, or entity comparisons, each tied to deterministic functions in the detection engine.

The analytical backbone consists of detection and scoring methodologies that blend rule-based triggers, statistical anomaly detection (frequency, volume, and layering irregularities), and multi-hop path analysis to surface indirect relationships across accounts. Finally, the system produces outputs through response generation, presenting results as structured tables, narrative explanations, and visual transaction paths. Crucially, every explanation is directly grounded in the underlying dataset, ensuring that nothing is inferred beyond the available evidence.

 

221b AICI: Functional Use Cases

AICI is designed around real-world investigative workflows. Key use cases include

• Dataset Overview: Quickly generate an overall summary of a large transaction dataset to establish baselines and detect anomalies.
• Suspicious Activity Detection: Surface and prioritize accounts or transactions that exhibit unusual behaviors such as structuring, layering, or abnormal flow patterns.
• Activity Explanation: Drill down into why a transaction or account was flagged, with explanations tied to underlying thresholds, frequency, or volume.
• Account Profiling: Retrieve detailed indicators and behavioral patterns for a specific account to assess its risk posture.
• Fund Flow Tracing: Trace deposits and withdrawals for an account, or follow multi-hop transaction paths between two or more accounts.
• Entity and Relationship Analysis: Expand and map relationships across entities, identifying hidden links or indirect connections.
• Comparative Analysis: Compare two accounts side by side to highlight differences in activity type, frequency, or counterparties.
• Case-Ready Reporting: Generate structured AML analysis reports that consolidate findings into regulator-ready documentation.

Guided Example: How to Interact with AICI

When starting with AICI, investigators can use natural language to ask targeted questions about accounts, transactions, or suspicious activity. The system extracts intent and maps queries to structured analysis functions.

AICI: Welcome to the 221b AI Co-Investigator. How can I assist your investigation today?

Typical queries include:

• Provide an overview of suspicious activities in the dataset.
• Explain the types of unusual activity detected.
• Generate a full AML analysis report.
• Trace transactions associated with a specific account.
• Compare two accounts to highlight behavioral differences.

User query: What is the relationship between Account-17 and Account-27?

AICI response (interpreted as graph traversal and scoring):

• Direct transactions: None found.
• Shortest path: Account-17 → Account-20 → Account-27 (2 layers).
• Additional paths: 4 more, up to 4 layers deep.
• Common counterparties: Accounts 10, 20, 23, 99.
• Common suspicious activities: mirror transactions, mule activity, high-frequency transfers, and structuring with round sums.
• Shared attributes: Organization FFC, no registered jurisdiction.

Other useful questions to try:

• “Trace all withdrawals for Account-45 over the past 90 days.”
• “Are there any transaction paths connecting Account-88 to Account-142?”
• “Which accounts share counterparties with Account-11?”
• “Compare the behavior of Account-5 and Account-6.”

Each suspected detected by the AICI is identified by the AML tactic code resourced by AMLtrix

Differentiators and Trust

The 221b AI Co-Investigator is unlike a generic chatbot layered onto an AML platform; it is a purpose-built investigative assistant embedded directly in the visualization Whiteboard Page. with Chatbot interface, powered by lightweight LLM models and advanced detection methodologies, ensures that every response is grounded in the underlying dataset rather than assumptions or generated text.

221b AICI never fabricates, summarizes beyond the data, or “hallucinates.” It extracts intent from investigator queries and delivers precise, structured outputs, clean tables, highlighted essentials, and explainable insights that can be traced back to source records.

The system is engineered to handle scale, supporting investigations across hundreds of thousands of entities and millions of transactions without performance degradation. By design, it keeps investigators in control of the process: the AI surfaces evidence, but the interpretation and judgment remain firmly in human hands. This combination of explainability, scale-readiness, and trust-by-design makes the Co-Investigator a reliable partner in high-stakes AML investigations.

How to Access It

The 221b AI Co-Investigator is a built-in feature of the 221b AML Network Analytics Platform. Enterprise users gain access through the platform’s Enterprise Edition (see all 221b edition ), which is fully integrated into the visualization and investigation environment.

To explore deployment options or request a demonstration, contact us directly.