Financial Crime Mitigation with MongoDB Atlas

Transaction Monitoring and Risk Scoring Engine

Purpose: Semantic fraud pattern detection with Vector Search

• Use MongoDB Atlas Vector Search to identify transactions that behave like known fraud patterns, even when they do not match an explicit rule.

• Generate embeddings from the qualitative and behavioral aspects of each transaction, such as:

  • Merchant category and description

  • Channel and device fingerprints

  • IP ranges and ASN information

  • Temporal patterns, such as time‑of‑day sequences or session behavior

  • Narrative fields or free‑text notes, if applicable

• Store these 1536‑dimensional embeddings in the same transaction documents that hold your operational data.

• Keep high‑signal numeric features—such as raw amount, balance changes, and simple velocity counters—outside the embeddings and evaluate them with rule‑based or scorecard models. This separation lets you:

  • Use Vector Search to surface semantically similar behaviors that cross simple thresholds or rules.

  • Use deterministic rules and risk models to enforce numeric limits and regulatory constraints.

• When screening a new transaction, generate an embedding and query MongoDB Atlas with $vectorSearch.

  • The system returns semantically similar transactions, including ones that evade static rules but resemble prior fraud in behavior.

  • Combine vector similarity scores with numeric risk scores to create a unified risk decision pipeline.

Risk Model Management

Purpose: Real-Time Risk Intelligence with Change Streams

Use MongoDB change streams to receive instant notifications when risk models, compliance rules, or watchlists change. Stream updates directly into your fraud detection and case management services instead of polling or relying on ad‑hoc cache invalidation.

When analysts activate a new risk model, all transaction screening engines receive the change within milliseconds and apply updated rules to incoming traffic. This removes batch delays that allow fraudulent transactions to clear before detection.

Open a change stream cursor on your risk models or configuration collections, and MongoDB pushes every insert, update, or replace operation to your application. Use resume tokens to restart processing from the exact point of interruption after service restarts or network failures, so you do not miss any updates.

click to enlarge

Figure 2. Real‑time fraud detection pipeline with Change Streams, Vector Search, and Risk Models

Entity Onboarding and Case Management

This module has two main purposes:

Purpose: AI-Powered Entity Resolution with Hybrid Search

Use MongoDB’s $rankFusion operator to combine multiple search strategies during entity onboarding or investigation. Run Atlas Search for fuzzy text matching and Atlas Vector Search for semantic similarity in parallel. $rankFusion merges the result sets and ranks entities by combined relevance from text similarity and embeddings.

For the top candidates, traverse relationship and transaction networks using $graphLookup. MongoDB returns network context including entity connections, transaction patterns, shared identifiers, and risk indicators in a single aggregation pipeline. This avoids querying multiple systems or performing expensive joins.

Feed entity data, search results, and network analysis into an LLM such as AWS Bedrock Claude‑3 Sonnet for AI‑assisted risk classification. The model evaluates compliance flags, relationship patterns, behavioral indicators, and watchlist matches to generate risk assessments with confidence scores and recommended actions.

Create case documents automatically in MongoDB with LLM‑generated investigation summaries. This reduces manual report writing and improves the consistency of compliance documentation.

Purpose: Network Discovery with Graph Traversal

Investigators often need to trace money‑laundering networks and hidden connections between entities. Use MongoDB’s $graphLookup aggregation stage to perform this network analysis directly in your operational database—no separate graph store required.

• Start with a suspicious entity and recursively traverse relationships through business associates, shared addresses, transaction counterparties, or corporate structures. Each traversal returns complete entity documents with embedded behavioral analytics, risk scores, and compliance flags.

• Filter relationships by confidence score, relationship type, or risk thresholds during traversal.

• Discover networks across multiple hops in milliseconds, then combine graph results with standard aggregation operations such as filtering, sorting, and grouping.

// Multi-hop relationship traversal with MongoDB $graphLookup
db.entities.aggregate([
   {
      $match: { entityId: 'ENT_12345' },
   },
   {
      $graphLookup: {
         from: 'entity_relationships',
         startWith: '$entityId',
         connectFromField: 'target_entity_id',
         connectToField: 'source_entity_id',
         as: 'relationship_network',
         maxDepth: 2,
         restrictSearchWithMatch: {
            confidence_score: { $gte: 0.7 },
            relationship_type: {
               $in: [
                  'BUSINESS_ASSOCIATE',
                  'SHARED_ADDRESS',
                  'TRANSACTION_COUNTERPARTY',
               ],
            },
         },
      },
   },
   {
      $lookup: {
         from: 'entities',
         localField: 'relationship_network.target_entity_id',
         foreignField: 'entityId',
         as: 'connected_entities',
      },
   },
   {
      $project: {
         entityId: 1,
         name: 1,
         riskAssessment: 1,
         networkDepth: { $size: '$relationship_network' },
         connectedEntities: {
            $map: {
               input: '$connected_entities',
               as: 'entity',
               in: {
                  id: '$$entity.entityId',
                  name: '$$entity.name.full',
                  riskLevel: '$$entity.riskAssessment.level',
               },
            },
         },
      },
   },
]);

click to enlarge

Figure 3. Entity resolution with MongoDB Search and $graphLookup and Case Management with LLM

Relationships Between Collections

The design models relationships through a mix of embedded references and a dedicated relationships collection:

• Entity documents can embed references to related entities in connected_entities arrays.

• Transaction documents store customer_id fields that link to entities.

• The entity_relationships collection stores explicit relationships with confidence scores, relationship types, and audit trails.

This pattern enables efficient graph traversal with $graphLookup while keeping the schema flexible as new relationship types emerge.

Indexing Strategy for Performance

Use Atlas Search indexes to support entity resolution and investigative workflows:

• Configure autocomplete on name.full with edge n‑grams (2–15 characters) for real‑time name suggestions.

• Configure string facets on entityType, nationality, residency, and riskAssessment.overall.level to filter search results.

Use Atlas Vector Search indexes on embedding fields to enable semantic similarity matching by configuring cosine similarity with 1536‑dimensional vectors for entity and behavioral pattern matching. You can create separate embeddings for identifier data and behavioral patterns to target specific use cases.

Use standard indexes for operational workloads:

• Use single‑field indexes on entityId, customer_id, and timestamp for lookups and range queries.

• Use 2dsphere indexes on location coordinates for radius‑based fraud rules.

• Use compound indexes on risk level and entity type for common investigative filters.

Example Document

{
   "_id": ObjectId("674a83b654c7f1b869cb1c2"),
   "customer_id": "CUST_67890",
   "transaction_id": "TXN_54321",
   "timestamp": ISODate("2024-11-15T14:22:36Z"),
   "amount": 2500.75,
   "currency": "USD",
   "merchant": {
      "name": "Global Electronics",
      "category": "electronics",
      "id": "MERCH_123"
   },
   "location": {
      "city": "San Francisco",
      "state": "California",
      "country": "US",
      "coordinates": {
         "type": "Point",
         "coordinates": [
            -122.4194,
            37.7749
         ]
      }
   },
   "device_info": {
      "device_id": "device_abc123",
      "type": "desktop",
      "os": "macOS",
      "browser": "Chrome",
      "ip": "203.0.113.45"
   },
   "transaction_type": "purchase",
   "payment_method": "credit_card",
   "status": "completed",
   "risk_assessment": {
      "score": 78.5,
      "level": "high",
      "flags": [
         "unusual_amount",
         "unexpected_location",
         "velocity_alert"
      ],
      "transaction_type": "suspicious",
      "diagnostics": {
         "customer_base_risk": 35.0,
         "transaction_factors": {
            "amount": 85.0,
            "location": 90.0,
            "device": 0,
            "velocity": 75.0,
            "pattern": 60.0
         }
      }
   },
   "vector_embedding": [
      0.234,
      -0.567,
      0.890, ...
   ]
}