Kx Product Insights: Flow of Funds AML Alert

31 Jan 2019 | , , ,
Share on:

by Gerard Dickson

Kx has a broad list of products and solutions built on the time-series database platform kdb+ that capitalize on its high-performance capabilities when analyzing very large datasets.

Kx for Surveillance is a robust platform widely used by financial institutions for monitoring trades for regulatory compliance. The Surveillance platform instantly detects known trading violations like layering, spoofing or marking the close. Customers can calibrate their parameters in real time to improve their detection quality and accuracy. The flexibility of the historical database and replay engine eases retrospective investigation for new types of fraudulent behavior and suspicious activity.

In this series, we take a look at what makes Kx for Surveillance such a powerful tool for detecting market manipulation. This article discusses Flow of Funds AML Alerts.


Over the past decade, the need for effective anti-money laundering surveillance has become increasingly important. A recent study by the United Nations office on Drugs and Crime estimated that between 2-5% of the world’s GDP is being laundered each year – or between $800 billion and $2 trillion in dollar terms1. The introduction of new technologies and lightning forms of communication has made such activity even easier, making the need for AML regulation much greater. Several intergovernmental bodies have introduced new regulation to counter this growing crisis, such as the EU’s  5th Anti-Money Laundering Directive.

While organizational failure to meet such regulatory compliance has resulted in multi-billion dollar penalties for not properly tackling money laundering, the rise in the number of fines handed out to financial institutions is not the only reason for deploying an effective AML surveillance solution. The damage caused to the prestige, reputation and share price for these global institutions is just as severe as the economic sanctions levied against them. Despite this, however, the majority of financial institutions remain poorly equipped to tackle this problem. Many have siloed their customer’s personal information into gigantic data warehouses that make compliance and monitoring an impossible task for the outdated software still being used.

Kx has been consistently adding functionality to its Surveillance solutions to help banks address these issues. Its overarching goal has been to leverage the Kx platform to create lightweight, out-of-the-box AML and Surveillance functionality that can be deployed in a much quicker timeframe than competing solutions.  In this blog I will outline one such example, showing how Flow Through of Funds can be swiftly deployed and customized.

Flow Through of Funds Case Study

Flow Through of Funds aims at identifying customers whose deposit and withdrawal history is strikingly similar over a set date range. Detection requires the aggregation of all incoming transactions into the client’s accounts over the chosen time period. Aggregation is then done on all outgoing transactions from the same client’s accounts to determine the total net movement. The deposit sum total is divided by the withdrawal sum amount to derive a percentage measure of the variance between outgoing and incoming transactions. Suspicious activity for this model can be determined by how close the customer percentage lies to 100% (indicating near identical deposit and withdrawal behaviour). This percentage is then monitored against minimum and maximum threshold percentages in order to gauge whether a potential instance of Flow Through of Funds has occurred. See the below screenshot of the investigation dashboard as a reference. The sum total of deposits, when measured against the sum total of the client’s withdrawals, results in a percentage value of 102.38%, which rests between the maximum (105%) and minimum (95%) thresholds for that specific user.

Figure 1- Investigation Dashboard for Flow Through of Funds AML model.

Schemas for transactions, client reference data, trading summary details and FX rates underpin the surveillance solution. An easy to use AML Manager dashboard provides a configuration manager for the end user, allowing them to map their external data fields to the internal Kx Schema. Upon receiving these files, a file watcher process cleanses and normalizes the data from multiple transaction files into a standardized transaction schema that is the basis of the AML alerts. The AML Manager dashboard provides the ability to map missing records to pre-set values upon ingestion to ensure as many records as possible are preserved when only partially completed information can be provided.

 The Flow Through model, as with all AML models in Kx for Surveillance, has user-configurable thresholds that can be maintained via the Configuration Manager functionality of the Administration dashboard.  This functionality enables users to easily adjust and test thresholds before deploying live in order to prevent a high volume of false positive alerts being generated. A surveillance administrator can also configure thresholds to place a minimum transaction count, in order to disregard minimal transaction activity. The Configuration Manager also allows for multiple instances of the alert to be run with different filters so that only specific currencies are taken into consideration, or perhaps to filter datasets to only focus on specific clients or accounts.

In addition to AML alerts, Kx has also implemented a comprehensive range of MAR and MiFID II surveillance models (such as Momentum Ignition and Front Running) with further alerts being continually added. Kx has also being incorporating E-communication surveillance alert models into its surveillance solutions giving it the ability to process massive streams of email and chat messages to identify keywords, that may suggest potential market abuse or AML activity. The eComms surveillance functionality has been built as a separate self-contained solution within the Kx Platform, so it can run independently to the trade surveillance system if required, but likewise can run in parallel.  In both cases the results can be combined to provide surveillance analysts with a holistic view across both transactional and behavioral activity in investigating suspected trading violations




For more information on Kx for Surveillance and its functionality please click on the links below.