--- title: "Knowledge Graph Use Cases for Fraud Detection and Financial Crime" url: "https://atlan.com/know/ai-agent/ontology/knowledge-graph-use-cases-for-fraud-detection-and-financial-crime/" description: "Knowledge graph use cases for fraud detection and financial crime, from fraud rings and money mules to beneficial ownership, and what regulators expect." author: "Emily Winks" author_role: "Data Governance Expert" published: "2026-11-01" updated: "2026-11-01T00:00:00.000Z" --- ## What are the knowledge graph use cases for fraud detection and financial crime? The main knowledge graph use cases for fraud detection and financial crime are fraud ring detection, money mule tracing, synthetic identity detection, beneficial ownership mapping for anti-money laundering (AML), and explainable alerts for investigators. Each works because the graph stores customers, accounts, devices, companies and payments as connected entities. A scheme that hides across thousands of separate records shows up as one shape. ## Key takeaways - One stolen identity, one mule account or one shell company looks ordinary in isolation. - AML suits a knowledge graph because the rules themselves are written in terms of relationships. - Treat the graph as a source of features and explanations for existing models. - Entity resolution depends on clean identifiers. --- The main [knowledge graph](https://atlan.com/know/what-is-a-knowledge-graph/) use cases for fraud detection and financial crime are fraud ring detection, money mule tracing, synthetic identity detection, beneficial ownership mapping for anti-money laundering (AML), and explainable alerts for investigators. Each works because the graph stores customers, accounts, devices, companies and payments as [connected entities](https://atlan.com/know/what-is-a-data-graph/). A scheme that hides across thousands of separate records shows up as one shape. ### Map Your AML Rules to Data Controls Give it the regulations in scope, AML and KYC included, and the controls you run today. It maps each regulation to the data controls it leans on and ranks the gaps by what an examiner finds first. [Read the skill](/skills/bank-data-compliance-gap-map.md). *Paste into a new chat* ``` Use the skill at https://atlan.com/skills/bank-data-compliance-gap-map.md to map our financial crime regulations to data controls. Ask me for whatever it needs. ``` *Run once in a terminal* ``` curl -fsSL --create-dirs \ -o ~/.agents/skills/bank-data-compliance-gap-map/SKILL.md \ https://atlan.com/skills/bank-data-compliance-gap-map.md ``` *For an agent* ``` curl -fsSL https://atlan.com/skills/bank-data-compliance-gap-map.md ``` Human Agent ClaudeChatGPTGeminiCursorOther Copy --- ## What makes a knowledge graph useful for fraud detection and financial crime? A knowledge graph [models the business](https://atlan.com/know/business-context-layer/) as entities and the relationships between them. [In a bank](https://atlan.com/know/context-layer-for-financial-services/), the entities include people, legal entities, accounts, devices, merchants and payments. The relationships are "owns", "controls", "logged in from", "paid" and "shares an address with". [An ontology](https://atlan.com/know/what-is-ontology-in-ai/) fixes what each type means, so "beneficial owner" and "account holder" never blur into one field. One stolen identity, one mule account or one shell company looks ordinary in isolation. The signal is in the connections: five loan applications that share a device, or money that leaves an account and returns three hops later through two companies with the same director. A 2021 review of [graph computing for financial crime and fraud detection](https://arxiv.org/abs/2103.01854) by Kurshan, Shen and Yu argues that rule-based engines "have largely become ineffective" as digital payments grew, and that graph neural networks and other graph methods offer compelling opportunities for the field. The same review warns of real deployment obstacles in live transaction systems. Two capabilities separate a knowledge graph from a plain graph store. The first is [entity resolution](https://atlan.com/know/ai-agent/knowledge-graph/knowledge-graph-construction-for-ai/): deciding that "J. Smith, 12 High St" and "John Smith, 12 High Street" are the same person, so their links merge. The second is meaning: [typed entities and relationships](https://atlan.com/know/ai-agent/knowledge-graph/ontology-vs-knowledge-graph/) that an analyst, a model or an [AI agent](https://atlan.com/know/ai-agent/what-is-an-ai-agent/) can read without a data dictionary. See [knowledge graph vs graph database](https://atlan.com/know/ai-agent/knowledge-graph/knowledge-graph-vs-graph-database/). --- ## Which fraud detection use cases does a knowledge graph handle best? | Use case | What the fraud looks like | Graph pattern that exposes it | |---|---|---| | Fraud rings | Many applications or claims from people who seem unrelated | Clusters of accounts that share devices, phones, emails or addresses | | Synthetic identity fraud | A fabricated person built from real and fake PII | One identifier (a phone, an SSN, an email) linked to many "different" people | | Money mule networks | Stolen funds moved fast through recruited accounts | Fan-in then fan-out paths, short dwell times, chains of new accounts | | Authorised push payment (APP) scams | A victim is tricked into paying a criminal | The receiving account's links to known mules, devices or flagged payees | | Insider and collusion fraud | Staff or brokers working with outside actors | Unusual links between employee records and customer accounts or claims | The Federal Reserve defines [synthetic identity fraud](https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/) as using a combination of [personally identifiable information](https://atlan.com/know/ai-agent/data-for-ai/how-to-handle-pii-in-ai-pipelines/) "to fabricate a person or entity", and notes it is reported to be the fastest-growing type of financial crime in the United States. A graph finds them because the fabricated people share fragments. Mule networks matter because so much other crime runs through them. [Europol reports](https://www.europol.europa.eu/operations-services-and-innovation/public-awareness-and-prevention-guides/money-muling) that more than 90% of money mule transactions identified through its European Money Mule Actions are linked to cybercrime. In the UK, the [Payment Systems Regulator](https://www.psr.org.uk/our-work/app-scams/) cites GBP 459.7 million lost to APP scams in 2023 and requires sending and receiving firms to split reimbursement 50:50. That gives the receiving bank a reason to score inbound payments against known mule links. --- ## How do knowledge graphs support anti-money laundering and beneficial ownership checks? AML suits a knowledge graph because the rules themselves are written in terms of relationships. In the United States, FinCEN's [Customer Due Diligence rule](https://www.fincen.gov/resources/statutes-and-regulations/cdd-final-rule) requires covered institutions to identify and verify any individual who owns 25 percent or more of a legal entity customer, plus one individual who controls it. When ownership runs through layers of holding companies, the 25% test is a path calculation: multiply ownership shares along every route from the person to the customer and add them up. A graph runs that calculation natively. Globally, the FATF [amended Recommendation 24 in March 2022](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/R24-statement-march-2022.html) to require a multi-pronged approach to beneficial ownership information, combining information held by companies, a registry or an alternative mechanism, and supplementary measures such as information held by regulated financial institutions. Each source becomes another set of edges to reconcile in the graph. The ICIJ [Offshore Leaks database](https://offshoreleaks.icij.org/) links more than 810,000 offshore companies, foundations and trusts from five leak investigations, including the Panama Papers, to people and companies in more than 200 countries and territories. Screening a customer against that data is a graph question: is this person within two or three hops of an offshore entity that needs a closer look? ICIJ notes that appearing in the database does not by itself imply wrongdoing. Most AML graph work hunts for the same shapes. Circular flows return money to its origin through intermediaries, and cycle detection finds them. Layering chains are long paths of quick transfers through new accounts, found by path search with time limits. Hidden control, where one person directs many entities through nominees, shows up as shared directors, addresses and agents. The same network analysis feeds suspicious activity reports. The linked accounts, counterparties and paths that an investigator finds in the graph are what the bank writes up when it files a suspicious activity report (SAR), whose narrative [FinCEN says](https://www.fincen.gov/resources/statutes-regulations/guidance/suggestions-addressing-common-errors-noted-suspicious) should identify who, what, when, where and why. --- ## Which graph techniques power these use cases? - **Community detection** (for example the [Louvain method](https://arxiv.org/abs/0803.0476) of Blondel and co-authors) groups densely connected accounts. A tight cluster of accounts with shared devices and few links to the rest of the bank is a candidate fraud ring. - **Centrality scores** rank how important a node is inside the network. A mule recruiter or a collector account often sits at the centre. - **Cycle and path search** finds circular money flows and layering chains, usually limited by hop count and time window. - **Multi-hop neighbourhood queries** start from a known bad entity and expand outward to find what else it touches. - **Graph features for machine learning** turn structure into [model inputs](https://atlan.com/know/ai-agent/data-for-ai/feature-store-for-ml/): degree, shared-identifier counts, distance to a known fraud case. - **Graph neural networks** learn directly from the node and edge structure. The research evidence on that last point is mixed. In the [Elliptic data set study](https://arxiv.org/abs/1908.02591), Weber and co-authors tested methods on more than 200,000 Bitcoin transactions and 234,000 payment flows. Random Forest performed best of the methods compared, ahead of graph convolutional networks. Adding the network's node embeddings to the Random Forest's inputs lifted its illicit-class F1 score only slightly, from 0.788 to 0.796. Treat the graph as a source of features and explanations for existing models. Start with resolved entities and a few strong patterns, measure the drop in false positives, then add learned methods. --- ## What does a fraud knowledge graph need from the data underneath it? Entity resolution depends on [clean identifiers](https://atlan.com/know/data-for-ai/data-quality-for-ai-agent/). If one source stores phone numbers with country codes and another without, the graph misses the shared phone that links a ring. Every input needs a known owner, a [known meaning](https://atlan.com/know/ai-agent/data-for-ai/systems-of-semantics/) and a [known freshness](https://atlan.com/know/ai-agent/context-freshness/). Supervisors expect banks to [trace that data](https://atlan.com/know/ai-agent/data-for-ai/data-lineage-for-ai/). The Basel Committee's [principles for effective risk data aggregation and risk reporting](https://www.bis.org/publications/201301-guidelines-principles-effective-risk-data-aggregation-and-risk-reporting), published in January 2013, came from the finding that many banks could not aggregate risk exposures fully, quickly or accurately in the financial crisis that began in 2007. A fraud or AML team that cannot trace the [pipelines behind its models](https://atlan.com/know/data-for-ai/data-pipeline-for-ai/) has the same gap. The EU's [Anti-Money Laundering Authority](https://www.amla.europa.eu/about-amla_en), based in Frankfurt, plans to select 40 obliged entities for direct supervision in 2027 and to start that supervision in 2028. In the UK, the [FCA's financial crime pages](https://www.fca.org.uk/firms/financial-crime) point firms to its Financial Crime Guide and to its Senior Management Arrangements, Systems and Controls (SYSC) sourcebook. Alerts must also be explainable. An investigator, and later an examiner, needs to see why an account was flagged: which shared device, which path, which source tables. That means knowing [where each attribute came from](https://atlan.com/know/ai-readiness/ai-ready-data-lineage/), which transformations touched it, and whether it was [classified as personal data](https://atlan.com/know/data-privacy-for-ai-agents/). --- ## How does Atlan support teams building fraud and financial crime knowledge graphs? Atlan is not a fraud detection graph. It does not score transactions or find rings. Atlan is the [context layer for AI](https://atlan.com/context-layer/). Its [Enterprise Data Graph](https://atlan.com/know/enterprise-data-graph/) describes the [data assets](https://atlan.com/know/ai-agent/data-for-ai/metadata-management-for-ai/) a fraud team depends on, not the customers in them. The guide to the [metadata knowledge graph](https://atlan.com/know/metadata-knowledge-graph/) describes what that graph holds: data assets, [business concepts](https://atlan.com/know/business-context-for-ai/), systems, processes and people. For fraud and AML teams, that layer answers four questions an examiner asks about every attribute behind an alert. - **Where did this attribute come from?** Atlan [lineage](https://docs.atlan.com/product/capabilities/lineage/concepts/what-is-lineage) captures how data moves across the data landscape, [parsing SQL](https://atlan.com/know/ai-agent/data-for-ai/automated-sql-lineage-vs-manual-lineage-mapping/) from sources such as Snowflake and BigQuery and reading lineage from APIs for others. Impact analysis shows what breaks downstream if a source table changes. - **Is this column personal data?** With [tag propagation](https://docs.atlan.com/product/integrations/automation/always-on/references/tag-propagation) enabled (it is off by default), a `PII` tag on a column flows to its downstream columns. - **Who owns it, and is it certified?** The [Metadata Propagator app](https://docs.atlan.com/product/capabilities/lineage/how-tos/propagate-metadata-through-lineage) pushes owners, certificates, tags and [custom metadata](https://atlan.com/know/ai-agent/data-for-ai/types-of-metadata-for-ai-agents/) along existing lineage. - **Can an agent use it?** [Atlan MCP](https://docs.atlan.com/product/capabilities/atlan-ai/how-tos/atlan-mcp-overview) is a hosted server that [gives AI clients this context](https://atlan.com/know/mcp-delivers-business-context/), and every action respects the [permissions already set in Atlan](https://atlan.com/know/ai-agent/context-layer/context-layer-role-based-access-control/). Mastercard runs AI-driven fraud detection on more than 160 billion transactions a year, according to its [Re:Govern 2025 session page](https://atlan.com/regovern-watch-center/mastercard-context-by-design/). Atlan's role at Mastercard is metadata and context for its data products, not fraud scoring. In a [recap of Mastercard's data products work](https://atlan.com/customers/mastercard-databricks-summit-2026/), Vivek Radhakrishnan, SVP of Data & Analytics, described the result of [AI enrichment](https://atlan.com/know/context-agents/) in Atlan: "So that's 30,000-plus assets enriched and metadata-ready, compliant for usage." --- ## FAQs about knowledge graphs for fraud detection and financial crime ### Is a knowledge graph the same as a graph database? No. A graph database is the storage and query engine. A knowledge graph is the model on top: resolved entities, typed relationships and an ontology that defines what each type means. Many fraud knowledge graphs run on a graph database, but a graph database full of unresolved duplicate customers will miss the connections that expose a fraud ring. ### Can a knowledge graph replace a transaction monitoring system? Usually not. Most banks keep their transaction monitoring rules and models and add the graph alongside them. The graph supplies network features, such as distance to a known mule, and context for investigators. Research on public AML data shows graph methods working best as inputs to existing models rather than as a full replacement for them. ### What data do you need to build a fraud knowledge graph? Start with customer and legal entity records, accounts, cards, payments, devices, IP addresses, phone numbers, emails and addresses. Add beneficial ownership data, sanctions and watchlists, and past case outcomes. The hard part is consistent identifiers across sources, because entity resolution decides whether two records become one node or stay apart. ### How do graph neural networks fit into fraud detection? Graph neural networks learn patterns from the structure of the graph, such as how an account connects to merchants and devices. They suit complex, multi-layer schemes. They also cost more to run and are harder to explain, so many teams start with simpler graph features and community detection before adding them. ### How do you explain a graph-based fraud alert to a regulator? Show the subgraph behind the alert: the entities, the shared identifiers and the paths that triggered it. Then show where each attribute came from, through lineage back to source systems. An alert that names the shared device, the linked closed accounts and the source tables is far easier to defend than a single unexplained risk score. --- ## Sources 1. [Financial Crime and Fraud Detection Using Graph Computing: Application Considerations and Outlook, arXiv](https://arxiv.org/abs/2103.01854) 2. [Synthetic Identity Fraud, Federal Reserve FedPayments Improvement](https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/) 3. [Money Muling, Europol](https://www.europol.europa.eu/operations-services-and-innovation/public-awareness-and-prevention-guides/money-muling) 4. [APP Scams, Payment Systems Regulator](https://www.psr.org.uk/our-work/app-scams/) 5. [CDD Final Rule, FinCEN](https://www.fincen.gov/resources/statutes-and-regulations/cdd-final-rule) 6. [Public Statement on Revisions to Recommendation 24, FATF](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/R24-statement-march-2022.html) 7. [Offshore Leaks Database, ICIJ](https://offshoreleaks.icij.org/) 8. [Suggestions for Addressing Common Errors Noted in Suspicious Activity Reporting, FinCEN](https://www.fincen.gov/resources/statutes-regulations/guidance/suggestions-addressing-common-errors-noted-suspicious) 9. [Fast Unfolding of Communities in Large Networks, arXiv](https://arxiv.org/abs/0803.0476) 10. [Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics, arXiv](https://arxiv.org/abs/1908.02591) 11. [Principles for Effective Risk Data Aggregation and Risk Reporting, Bank for International Settlements](https://www.bis.org/publications/201301-guidelines-principles-effective-risk-data-aggregation-and-risk-reporting) 12. [About AMLA, Authority for Anti-Money Laundering and Countering the Financing of Terrorism](https://www.amla.europa.eu/about-amla_en) 13. [Financial Crime, Financial Conduct Authority](https://www.fca.org.uk/firms/financial-crime)