Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework

Emmanuel Nahimana; Yaé Ulrich Gaba

Source-linked AI summary

Detecting Money Laundering in Rwandan Mobile Money: A Machine Learning Framework

Emmanuel Nahimana, Yaé Ulrich Gaba

arXiv:2608.15447v1Aug 15, 2026cs.LGq-fin.RM

TL;DR

Mobile-money AML monitoring in Rwanda must handle massive transaction volumes, scarce delayed labels, extreme imbalance, and limited investigative capacity. The paper evaluates a governance-aware machine-learning framework on synthetic data, finding that late fusion slightly reduces alerts but does not improve calibrated recall over LightGBM.

Problem
Rwandan mobile-money AML monitoring must address massive transaction volumes, scarce delayed labels, adversarial adaptation, and approximately 0.1% laundering prevalence.
Method
The paper develops a Rwanda-aligned monitoring framework using SAML-D and late-fusion modeling to combine supervised and unsupervised transaction-risk evidence.
Results
Late fusion does not improve calibrated recall: it reduces alerts from 72 to 65 while reducing true positives from 64 to 59 and raising precision by two percentage points.
Takeaways & Limitations
The framework positions fusion as corroboration and audit narrative rather than incremental recall within Rwanda-relevant analyst workflows.
Takeaways & Limitations
The study does not report group-wise performance metrics because SAML-D lacks protected-attribute proxies.

Abstract

from arXiv · show

Mobile money has widened financial access across Sub-Saharan Africa and enlarged the surface for money-laundering and terrorism-financing (ML/TF) activity in ecosystems dominated by high-volume, low-value transactions. Rwanda is a case in point: several million active mobile-money users, telecom-led wallets on the MTN and Airtel networks, and a Financial Intelligence Centre (FIC) supervising transaction streams whose scale exceeds static rule-based monitoring. This paper develops and evaluates a transaction-monitoring framework aligned to the Rwandan AML/CFT regime under (i) extreme class imbalance (~0.1% prevalence), (ii) scarce and delayed labels, and (iii) bounded investigator capacity. Using SAML-D, a synthetic dataset of 9,504,852 transactions with 17 laundering typologies, we engineer account-centric behavioural features (rolling velocity, net-flow directionality, counterparty diversity, burstiness) and benchmark supervised classifiers (Logistic Regression, Random Forest, LightGBM), unsupervised anomaly detectors (Isolation Forest, Local Outlier Factor), a dense autoencoder, and a late-fusion meta-learner. Evaluation is operational: PR-AUC, recall at a calibrated ~90%-precision point, recall at top-K%, and alerts per 10,000. On the chronologically held-out test period, LightGBM attains PR-AUC = 0.0469, capturing 64 laundering cases at precision ~0.89 with 0.51 alerts per 10,000; the fusion stacker reaches PR-AUC = 0.0477 at precision ~0.91 and 0.46 alerts per 10,000, recovering 59 true positives. We map score bands to Rwanda-relevant analyst workflows and STR/SAR escalation, and outline a staged path from synthetic prototyping to real-data validation with the National Bank of Rwanda and FIC. The contribution is operational: a governance-aware pipeline and evaluation protocol calibrated to the constraints of an African mobile-money regulator, not a new algorithm.

1 Introduction

The paper frames Rwanda’s mobile-money expansion as both an inclusion success and an enlarged ML/TF-monitoring challenge. It proposes a Rwanda-aligned, governance-aware machine-learning pipeline designed for severe operational constraints, while explicitly limiting claims of algorithmic novelty and generalisation.

Motivation: Mobile money expands financial inclusion in Sub-Saharan Africa while increasing exposure to structuring, agent-network abuse, weak KYC, and cross-border illicit flows.
Rwanda context: Rwanda offers a relevant setting because millions of users, MTN and Airtel dominance, and FIC-supervised AML/CFT reporting coincide with coordination, visibility, and analytical-capacity gaps.
Monitoring problem: Fixed rule-based monitoring produces false positives, misses temporal and network structures, and adapts slowly, motivating machine learning as a complementary alert-prioritisation approach.
Operational constraints: Operational monitoring must handle massive transaction volumes, bounded alert budgets, scarce delayed labels, and approximately one-in-a-thousand laundering prevalence.
Contributions and scope: The paper contributes a Rwanda-aligned pipeline with causal account-centric behavioural features and an operational workflow focus, rather than a new algorithm.

2 Regulatory and operational context for Rwanda-style mobile money

Rwanda-style mobile-money AML/CFT monitoring operates within legislation, FIC intelligence functions, and National Bank supervision. Effective deployment must also accommodate constrained investigative capacity, continuous activity drift, and a staged pipeline from transaction capture through STR/SAR escalation.

Institutional and legal architecture: Rwanda’s AML/CFT regime combines national legislation, FIC STR intelligence functions, and National Bank supervision of banks, payment institutions, and mobile-money issuers.Legislation defines predicate offences, reporting obligations, and sanctions; the FIC receives STRs and disseminates intelligence to law enforcement.
Operational pipeline: The operational pipeline runs from MTN and Airtel transaction capture through provider monitoring and triage, compliance escalation, STR/SAR filing, and FIC dissemination.Bank-led wallets serve the higher-tier segment, while MTN Mobile Money and Airtel Money typically serve retail users.
Deployment constraints: Alert volume is a first-order design variable because investigation teams can review only a small fraction of daily activity.A system exceeding investigator capacity cannot be operated, regardless of its detection metrics.
Deployment constraints: Activity drift is continuous because product changes, seasonal patterns, and adversarial adaptation shift transaction distributions, causing static thresholds to degrade.ML models therefore require scheduled recalibration that supervisors can audit.
Monitoring design: These constraints motivate a portfolio combining supervised ranking, complementary anomaly detection under strict alert budgets, and conservative score fusion for corroboration and explainability.The fusion layer is intended for score corroboration and explainability rather than recall gains.

3 Related work

The related literature motivates a mixed AML-monitoring portfolio combining interpretable supervised models with anomaly and reconstruction methods, while emphasizing data-sharing, reproducibility, and mobile-money-specific constraints. It also highlights the limits of rule-based monitoring and the structural vulnerabilities that classifiers alone cannot resolve.

Rule-based monitoring: Rule-based AML monitoring is auditable and explainable but often produces production false-positive rates above 90–95%, overwhelming investigation queues.These systems use static thresholds and typology-driven scenarios involving amount, frequency, and counterparties.
Classifier portfolio: Supervised models provide the main alerting approach when labels exist, while anomaly detectors and autoencoders add complementary signals when labels are scarce or delayed.The literature identifies Logistic Regression as an interpretable baseline and tree ensembles as models for nonlinear interactions.
Advanced representations: Graph methods improve detection of multi-hop layering through account-level network features, whereas sequence models capture long-range temporal dependencies in account activity.Weber et al. demonstrated the graph contribution on a labelled subgraph of the Elliptic Bitcoin dataset.
Data governance: Federated learning addresses the tension between pooling cross-institutional data and protecting raw transaction information, making it relevant to Rwanda’s fragmented provider landscape.The approach trains collaboratively across data holders while keeping raw data local.
Data and reproducibility: Confidential transaction data and restricted STR ground truth create a reproducibility gap, while synthetic simulators partially support benchmarking.PaySim is identified as the first widely adopted mobile-money fraud simulator.
Mobile-money context: Sub-Saharan African mobile-money risks include SIM-swap takeover, agent collusion, weak KYC, and cross-border micro-transfers, reflecting structural problems beyond classifier design.The literature frames these vulnerabilities as structural rather than algorithmic, requiring more than improved detection models.

4 Data and feature engineering

The study uses the synthetic SAML-D dataset to develop causal, account-centric AML features under severe class imbalance and a deployment-like chronological evaluation design. Features capture activity, tempo, flow directionality, counterparty structure, temporal context, and amount shape, with training-only preprocessing and cost-sensitive learning.

Dataset: SAML-D contains 9,504,852 cleaned transactions, with binary laundering labels, 17 positive-case typologies, and approximately 0.1% laundering prevalence.The prevalence is intended to mirror imbalance observed in real AML systems.
Temporal design: The data are split chronologically into 6.65M training, 1.43M validation, and 1.43M test transactions to emulate deployment and prevent look-ahead bias.Validation supports hyperparameter tuning and threshold calibration, while the most recent test period is reserved for final evaluation.
Feature engineering: Additional features measure net flows, cash-in/cash-out asymmetry, counterparty diversity, concentration, off-hours timing, and unusual amount distributions.These groups target fan-in/fan-out, cycling, rings, mule dispersion, hub concentration, threshold gaming, and baseline-relative temporal anomalies.
Implementation: Preprocessing fits standardisation, one-hot encoding, and any real-deployment imputation on the training window, while imbalance is addressed with cost-sensitive learning instead of SMOTE-style oversampling.The stated rationale is to preserve temporal structure and avoid near-duplicates that could inflate optimistic test performance.

5 Methods

The methods implement a chronological, causally engineered monitoring pipeline that scores transactions with supervised classifiers, anomaly detectors, and calibrated alert bands. A validation-fitted late-fusion stacker combines six detector scores as corroborating evidence rather than an independent alert source.

The end-to-end pipeline performs chronological ingestion and splitting, causal feature engineering, portfolio scoring, late-fusion aggregation, and threshold-calibrated banding for analyst review.
Three supervised classifiers are benchmarked: Logistic Regression, Random Forest, and LightGBM, with LightGBM treated as the primary supervised detector.Logistic Regression also serves as the interpretable baseline and late-fusion meta-learner.
Random Forest and LightGBM hyperparameters are selected through 40-configuration random searches using validation PR-AUC, followed by one held-out test evaluation.
Isolation Forest, Local Outlier Factor, and a dense autoencoder provide unsupervised anomaly scores, with the autoencoder trained only on non-laundering transactions.The autoencoder uses a d = 8 latent bottleneck and thresholds reconstruction error at the 99.5th validation percentile.
The fusion score combines six base-model scores through a validation-fitted, class-weighted logistic-regression stacker designed for corroboration rather than independent alerting.At the calibrated high-precision point, unsupervised evidence lifts a transaction into the alert band only when its supervised score is already high.

6 Evaluation under extreme imbalance and alert budgets

At laundering prevalence π ≈0.001, ROC-AUC is operationally unreliable because false positives can overwhelm usable precision. The evaluation therefore prioritizes PR-AUC, recall at ∼90% precision, alerts per 10,000 transactions, and recall at top-K% under calibrated alerting rules.

Evaluation metrics: At laundering prevalence π ≈0.001, ROC-AUC can produce an unsupportable false-positive rate at usable precision.The framework evaluates four metrics aligned with AML operations.
Evaluation metrics: PR-AUC is the primary ranking metric because it is more informative than ROC-AUC in the rare-positive regime.The metric is Precision–Recall area under the curve.
Calibration rules: Recall at ∼90% precision uses the smallest validation-window threshold achieving Precision(τ) ≥ 0.90, then reports recall on the held-out test window.This operating point reflects supervisor-facing investigation in which each alert triggers an analyst-hour.
Capacity-based evaluation: Alerts per 10,000 transactions proxies investigator workload, while recall at top-K% measures cases captured within a capacity-based ranked queue.The framework reports primarily the high-precision regime; budgeted alerting constrains Alerts/10k(τ) ≤B and is used in ablation and sensitivity analysis.

7 Results

On synthetic SAML-D test data, LightGBM provided the strongest deployable high-precision ranking, while fusion marginally reduced alerts at a small true-positive cost. Supervised models dominated anomaly-only detectors, with remaining misses concentrated in mid-band transactions that blend into legitimate activity.

Evaluation scope: All reported results came from the SAML-D synthetic dataset and require recalibration on real transaction data before deployment decisions.The results provide evidence for the pipeline and evaluation protocol, not BNR- or FIC-observable performance.
Calibrated operating point: PR-AUC 0.0469 was LightGBM’s strongest single-model result, capturing 64 true laundering cases at precision 0.889 with 0.51 alerts per 10,000 transactions.The fusion stacker reached PR-AUC 0.0477 at precision approximately 0.91, recovering 59 true positives.
Anomaly detectors: Supervised models dominated the anomaly-only detectors at approximately 1 alert per 10,000 transactions, with the autoencoder strongest, LOF intermediate, and Isolation Forest uninformative.LOF and the autoencoder contributed meaningfully only at deeper triage budgets.
Top-K triage: 13.9% of laundering transactions were captured in LightGBM’s top 1%, rising to 34.2% in the top 5%; fusion was essentially indistinguishable at top 3–5%.Fusion lost recall at top 1%, while the autoencoder and LOF contributed meaningfully only at deeper triage budgets.
Fusion trade-off: 59 true positives versus 64 for LightGBM accompanied fusion’s reduction from 72 to 65 alerts and a two-percentage-point precision increase.The paper characterizes this as a marginal alert-volume saving rather than a genuine recall improvement.
Failure modes: False negatives concentrated in the 1,000–10,000 currency-unit band, whereas high-value cases were captured reliably and sub-1,000 structuring was detected primarily through rolling-count features.Mid-band transactions were neither anomalous in amount nor rare in tempo, blending into legitimate merchant and remittance activity.

8 Ablation and sensitivity

Ablation results show that behavioural features provide the largest operational contribution to LightGBM’s ranking performance, while performance remains similar across three short test sub-windows. This temporal consistency over roughly 10 simulated months does not establish robustness to multi-year drift.

Feature ablations: −33% PR-AUC follows removal of behavioural features, the largest ablation drop, indicating that temporal-behavioural structure drives operational lift.The behavioural group includes rolling aggregates, velocity, counterparty diversity, and net flows; raw amounts and channel metadata contribute less operationally.
Temporal sensitivity: PR-AUC values of 0.048, 0.046, and 0.045 across three equal-duration sub-windows show preserved ranking quality over SAML-D’s ∼10-month simulated horizon.This result is not evidence of robustness to multi-year drift.

9 Operational mapping for Rwanda-style mobile money

The proposed Rwanda-aligned deployment maps LightGBM scores into four illustrative risk bands that connect monitoring, triage, case escalation, and STR/SAR decisioning. At plausible transaction volumes, calibrated ML makes alert handling operationally feasible but surfaces only a small subset of laundering and requires human-governed safeguards.

Risk bands and workflow: LightGBM scores are partitioned into four illustrative bands: A monitors below 0.10, B triages below 0.60, C prioritizes below 0.95, and D fast-tracks escalation.Thresholds are fixed on validation data against workload and precision targets, then recalibrated using real deployment data.
Risk bands and workflow: Each alert includes top-three local SHAP contributions, 30-day account-baseline deviations, and corroborating anomaly-detector indicators for analyst review.The corroboration includes autoencoder reconstruction above the 99.5th validation percentile and Isolation Forest scores above threshold.
Operational workload: ≈3.8% recall at the high-precision operating point means ML surfaces the most likely laundering alerts rather than finding most laundering.Additional true positives are recovered through external STR tips, cross-institution intelligence sharing, and audit-driven review of top-K% activity.
Governance and safeguards: The workflow proceeds from provider scoring through band-based analyst triage and compliance escalation to STR/SAR filing with FIC, while documentation remains a compliance artefact.The workflow covers MTN Mobile Money, Airtel Money, and bank-led wallets, with supervisory coordination through BNR.
Governance and safeguards: Real-data deployment requires purpose limitation, access controls, human review of adverse actions, and stratified performance checks across customer segments and channels.Protected-attribute proxies are unavailable in SAML-D, so group-wise metrics are not reported and remain a stated limitation.

10 Limitations, threats to validity, and deployment path

The study supports a governance-aware monitoring pipeline rather than a production-calibrated national risk model, with important limits around realism, temporal drift, fairness, uncertainty, and generalisation. Deployment therefore requires controlled real-data validation, recalibration, and institutionally governed onboarding and shadow operation.

Limitations and threats to validity: SAML-D supports reproducible benchmarking but omits operational noise, label uncertainty, adversarial adaptation, and mobile-money attributes such as KYC, device, agent, and network identifiers.Results should be interpreted as evidence for a pipeline and evaluation protocol, not a production-calibrated national risk model.
Limitations and threats to validity: Approximately ten months of simulated time supports only short-horizon rank-stability evidence; real deployment requires rolling-window backtesting and scheduled recalibration for multi-year drift.Potential drift drivers include product changes, regulatory shifts, macroeconomic cycles, and adversarial adaptation.
Limitations and threats to validity: Group-wise disparities are not reported because SAML-D lacks population-representative protected-attribute proxies; real-data deployment should evaluate KYC tier, geographic zone, and customer type.The proposed minimum standard includes scheduled disparate-impact and equalised-odds monitoring.
Generalisability and contribution: The fusion conclusion is specific to SAML-D, while the contribution is operational rather than algorithmically novel, emphasizing calibrated monitoring and Rwandan institutional workflows.The stated contribution includes confusion-matrix analysis, recall-at-top-K% triage, and operational mapping to Rwandan institutions.
Limitations and threats to validity: Metrics are point estimates from one chronological split and one training seed, leaving test-set variance and other uncertainty unquantified.A paired bootstrap with B = 1,000 resamples would estimate 95% confidence intervals for PR-AUC, high-precision recall, alerts per 10,000, and confusion-matrix counts.
Deployment path: A five-stage transition path begins with privacy-compliant, BNR-controlled feature-store onboarding and proceeds to three-to-six-month shadow scoring beside existing rules.Shadow mode measures incremental true-positive lift and alert-rate impact without changing operational decisions.

11 Conclusion

The paper presents a Rwanda-focused machine-learning AML monitoring framework designed for extreme imbalance, bounded investigative capacity, delayed labels, and continuous drift. On SAML-D, LightGBM provides the strongest calibrated single-model ranking, while late fusion modestly reduces alert volume at a small true-positive cost.

Conclusion: The framework targets Rwanda’s mobile-money ecosystem under extreme class imbalance, capacity-bounded investigation, delayed labels, and continuous drift.It is presented as an AML transaction-monitoring framework developed against explicit operational constraints.
Conclusion: PR-AUC 0.0469 and 64 true positives at precision ≈0.89 identify LightGBM with causal behavioural features as the strongest calibrated single-model ranking on the test window.The result is reported on SAML-D.
Conclusion: 72 →65 alerts and 64 →59 true positives show that the logistic-regression late-fusion stacker reduces alert volume at a small true-positive cost.The stacker achieves this without adding [the supplied passage ends mid-sentence].