aml-analytics
Open-source Python toolkit for AML detection and financial crime analytics — transaction graph analysis, anomaly scoring, SAR pattern matching, and SQL helpers for BSA/FinCEN compliance.
Built by a financial crimes analytics practitioner for compliance teams and data professionals working in anti-money laundering programs at financial institutions.
Why this exists
Smaller financial institutions often lack the analytics infrastructure to detect sophisticated money laundering patterns. This toolkit provides open, reusable building blocks — grounded in FATF typologies and FinCEN advisories — that any compliance or data team can use to strengthen their AML detection program.
AML typologies covered
| Typology | Module | Reference |
|---|---|---|
| Structuring (smurfing) | aml/patterns.py |
FinCEN Advisory FIN-2014-A005 |
| Layering | aml/graph.py |
FATF Typologies Report 2006 |
| Rapid fund movement | aml/velocity.py |
FATF Guidance on AML/CFT 2012 |
| Network-based laundering | aml/graph.py |
FinCEN Advisory FIN-2022-A001 |
| Anomalous transaction behavior | aml/anomaly.py |
FATF Risk-Based Approach 2014 |
Modules
| Module | Description |
|---|---|
aml/synthetic.py |
Synthetic AML transaction generator with labeled scenarios |
aml/graph.py |
Transaction network analysis — structuring rings, layering chains, centrality scoring |
aml/velocity.py |
Rolling-window velocity checks for burst activity detection |
aml/patterns.py |
Rules engine implementing FATF and FinCEN typologies |
aml/anomaly.py |
Unsupervised anomaly scoring using Isolation Forest and LOF |
aml/sql/ |
Oracle and PostgreSQL query templates for AML detection |
Quick start
from aml.synthetic import generate_transactions
from aml.graph import build_network, detect_structuring, detect_layering
# Generate synthetic transaction data
txns = generate_transactions(n=1000)
# Build a transaction network
G = build_network(txns)
# Detect structuring rings
rings = detect_structuring(G, threshold=9000)
# Detect layering chains
chains = detect_layering(G, min_hops=3)
print(f"Structuring alerts: {len(rings)}")
print(f"Layering alerts: {len(chains)}")
Installation
pip install aml-analytics
Or install from source:
git clone https://github.com/Bhavesh0205/aml-analytics.git
cd aml-analytics
pip install -e ".[dev]"
Demo notebooks
| Notebook | Description |
|---|---|
notebooks/01_graph_analysis.ipynb |
Transaction network analysis and layering detection |
notebooks/02_anomaly_detection.ipynb |
Unsupervised anomaly scoring on transaction data |
notebooks/03_sar_patterns.ipynb |
FATF typology rules and SAR pattern matching |
notebooks/04_end_to_end_pipeline.ipynb |
Full AML detection pipeline from raw transactions to alerts |
Who this is for
- Compliance analysts who want to explore analytics-driven AML detection
- Data engineers building transaction monitoring pipelines at financial institutions
- Researchers studying financial crime detection methodology
- FinTech developers building AML capabilities into financial products
Disclaimer
This toolkit is built entirely on synthetic data and public regulatory guidance (FATF, FinCEN). It does not contain any proprietary data, internal model logic, or confidential information from any financial institution. It is intended for educational and research purposes and does not constitute legal or compliance advice.
Citation
If you use this toolkit in your research or work, please cite it as:
@software{aml_analytics,
author = {Bhavesh Awalkar},
title = {aml-analytics: Open-source toolkit for AML detection and financial crime analytics},
year = {2024},
url = {https://github.com/Bhavesh0205/aml-analytics},
license = {MIT}
}
Contributing
Contributions are welcome — especially new typology rules, additional SQL patterns, or improvements to the anomaly scoring module. Please read CONTRIBUTING.md before submitting a pull request.
License
MIT — see LICENSE for details.
Metadata
Release files for aml-analytics 1.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| aml_analytics-1.0.1.tar.gz | 19.3 kB | Without provenance | Details for aml_analytics-1.0.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| aml_analytics-1.0.1-py3-none-any.whl | Python 3 | none | any | Details for aml_analytics-1.0.1-py3-none-any.whl |
Total release size: 36.7 kB
Release files / aml_analytics-1.0.1.tar.gz
| Download URL | aml_analytics-1.0.1.tar.gz |
|---|---|
| Size | 19.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
5d54693752e83e4870ec2b066d96609ce486de86f42db57959a9e907cf825407
|
|
BLAKE2b-256 checksum How to use checksums |
b93254e204130c18d526fac737ba4f6c49552130471161c124b93abd2fb25158
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.8.2
|
Release files / aml_analytics-1.0.1-py3-none-any.whl
| Download URL | aml_analytics-1.0.1-py3-none-any.whl |
|---|---|
| Size | 17.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6d84309cfa1818050ed3231da2ac5ebc6a17ba90b2d144aa533ff29ca45c1b3e
|
|
BLAKE2b-256 checksum How to use checksums |
3097f3334edb27008560a3e2fa2892bbac7bee897dc61ab7ec1ed2ddf2090c66
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.8.2
|
Security for aml-analytics 1.0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.