#190 Peter Cousins: Fighting Financial Crimes with AI

0:00We find that, you know, classical techniques for AI are a thousand times cheaper and a thousand times faster than Gen. But when you get to the point where you might otherwise get a person involved, especially if the classical AI is right on the confidence bubble, where it's pretty sure it's not a problem, but it needs a second pair of eyes to be sure, Gen AI can provide that second pair of eyes. And certainly that's a good tiebreaker. It can take for some kinds of investigations when you talk about either anti-monitoring laundering investigations or fraud alerts or other types of compliance activity monitoring.

0:33The amount of work that people do and how manual it can be is just unbelievable. It saves a lot of effort simply to pull all this information from a wide variety of sources and put it into the form where it's actionable. Hi, I'm Craig Smith, and this is Eye on AI. In this episode, I speak with Peter Cousins, the CTO at WorkFusion, about the company's focus on intelligent automation and digital workers for anti-financial crime solutions. Peter talked about leveraging generative AI alongside classical AI for enhanced fraud detection and compliance, particularly in the realms of sanction screening, adverse media analysis, and know-your-customer processes within the financial services sector.

1:24Peter offered insights into the evolving landscape of AI technology and combating financial crime. I hope you find the conversation as interesting as I did. I start by having you introduce yourself and give a little of the background of how you got to WorkFusion, and then we'll talk about generative AI and financial services. So I'm Peter Cousins. I'm the CTO at WorkFusion. I have all the product functions in my team, from design and product management to engineering QA and cloud operations. I've been with the company for a couple of years now, almost three, actually. Before that, I was CTO of Bottom Line Technologies, which is a half a billion dollar a year SaaS banking software company.

2:16And before that, I was at IBM after the acquisition of Unica, where I was the CTO. And tell us about WorkFusion. What does WorkFusion do? So WorkFusion is an intelligent automation company that focuses specifically on what we call our digital workers, which is a series of AI solution technologies for anti-financial crime. So talking about things like sanction screening, entity screening like PEP and adverse media, KYC, and all different kinds of investigations and activity monitoring. Yeah, and because I've been talking to people about the use of generative AI in financial services, and what I've heard is that while it's being applied for productivity gains in the back office or in HR functions, A lot of financial services are not using it in fraud detection and that sort of thing for compliance issues.

3:28Is that right? And why is that? So I think people naturally are concerned about and we call this the middle office, this, you know, anti-financial crime units. They're always concerned about errors. They just can't afford really to make any mistakes at all. So they're willing to sacrifice a little bit of automation for certainty. And the way many people have tried to deal with that is just by avoiding generative AI, waiting for it to mature further. But we increasingly see people willing to use generative AI in a kind of triad with people and classic AI functions. And so that's where we think it's the best, because you can leverage it in a kind of panel model to get certainty and, you know, maybe not so much replace classic AI yet, but handle a lot of the things that otherwise would have gone to people without having to go to people or to go to people for just final approval.

4:28Can you give us a use case and describe when you say digital workers, I mean, everyone is talking right now about building agents. Are you talking about agents or are you talking about tools that humans use? So it's a combination of both. So as much as possible, when we say digital worker, we mean that it's capable of doing a complete job end to end. So that's every way you get the data. It's how you manipulate the data, analyze the data, how you make decisions or enforce rules and standards and practices. And how do you know what you don't know and get a person involved when it's necessary in order to ensure a 100 percent accurate outcome.

5:18But then how you write up the decision. It's got to be completely defensible and explainable and understandable. It can't be some kind of technical metric. It's got to be a narrative that colleagues could understand, the boss can understand, regulators can understand. And that explainability issue is a problem with generative AI because not even people that built it can explain how it works, really. When you can show the work, showing the work, I think, is the key. So if you're able to say, this is a fact that I used to determine that we could close this alert as a false positive, and I can show you where I pulled that fact from, and I can highlight the passage and show it in context so that the person can understand it.

6:07And it either is a great accelerator for them making the decision themselves, or it's a way of trusting an automated outcome. So can you walk us through a use case so that the audience has a better grasp of what we're talking about? So the simplest type of use case would be what we call sanction screening, right? So especially with the Ukraine war and all the sanctions that came out of it, there was a huge spike in the number of entities and the number of transactions that could be subject to sanction. And they need to be checked to make sure that they're not before the activity is allowed to continue.

6:44And the problem is there's a huge number of false positives in all these domains. There's a structural problem with the upstream alerting systems. They have a millisecond to make a decision. They have very little information to go on. They cast the widest net possible. Problem is it creates the needle in a haystack effect. So the primary purpose of our digital workers is to gather those alerts. And if it's easy to make the decision because the wide net that was cast, when looked at just a little bit more closely, you can tell that it was a false positive, to do so and close those alerts without any further scrutiny.

7:27A good example might be you have a name that's embedded in a street and the sanctioned entity is a company. So just because they share a word or two in common with a street name doesn't mean that this payment or entity can't proceed. So being able to look at that, know it's an address, know that it's a street name, know that it's not related to the company or entity in question, and lets you take other easy ones off the table, right? On top of that, then you have to start thinking about what does a person do? A person uses judgment and, you know, looks at names and says, yeah, there may be a number of words in this name that are in common with a sanctioned entity, but these words aren't important, right?

8:13They're common words like bank or, you know, LLC or corp or, you know, noise words, right? So doing that kind of stop-word analysis can also help you take easy ones off the table. When you're done with that, then you start doing investigation work, right? You start, you know, either using curated data sources like Thomson Reuters, LexisNexis, and the like, or you use open sources and use Google and Microsoft to search the broader web and gather facts to support the either approval or disapproval of a business activity. So having all that done by machine is certainly possible. And the important part is that at a point where there's an ambiguity that can't be resolved through any of these techniques, that it's time to get a person involved to take a second look at it.

9:02But at least all the digital paper chase has been completed before they're asked to make a decision. And the most important elements are highlighted in StackRank so that they can make the decision very quickly. There are a lot of other AI systems or flavors of AI before you use generative AI. Why generative AI? So we use a combination. We find that classical techniques for AI are a thousand times cheaper and a thousand times faster than gen AI. But when you get to the point where you might otherwise get a person involved, especially if the classical AI is right on the confidence bubble, where it's pretty sure it's not a problem, but it needs a second pair of eyes to be sure.

9:50Sometimes Gen AI can provide that second pair of eyes. And for certainly at least close calls, that's a good tiebreaker. And if it can't, then a person gets involved as the last. I was talking to a company the other day. Their product is called Argus. It maps relationships between entities and it's being used to track, for example, components and where they're being sold so that you know you're not selling through a front company to a sanctioned entity. Do you guys do anything like that? Sure. So one of the things that you do is you analyze what's called ultimate beneficial ownership to see who controls some of these entities, because who controls them is as important as who they are, at least on the surface.

10:41So, yeah, following that kind of UBL, you know, backward analysis to see who's really pulling the strings is one of the important elements. But also using things like the open search and the curated data sources to look for additional connections between entities is also really important. Yeah. But again, Gen AI is not necessarily the best tool for that. you know, it tends to hallucinate. They're more powerful kinds of search. Unless you, you know, I was talking to a company yesterday that's building its own index of the web outside of the big search engines that's very curated according to authority and accuracy and that sort of thing.

11:38So you can use their Gen AI model to search and be confident that the response that's coming back is grounded. How do you get around the hallucination problem if you're using Gen AI in this capacity? So one way is to just use the hybrid approach, right? And the hybrid approach is the triad I was talking about with people and classical AI and not just Gen AI, so that you have a panel essentially making a decision instead of just one element making a decision. But it's also not to just try to use it to replace all these types of functions, right? So another way in which we use Gen AI is, one thing that's very important for us is being able to extract structured data from unstructured, naturally unstuck.

12:35And so one way in which we use Gen.ai is for these types of documents, you need to train the models with supervised examples, labeled documents. And, you know, it's pretty good at actually creating the labeled documents from zero shot. But what we still do is we have people review the labeling to make sure that the labeling is accurate. And then the labeled documents are used to train the classical AI. And the classical AI is what's used for the heavy lifting of most of the activities of runtime. So really using Gen AI more to replace the manual labor involved with the supervised labeling than to replace it for doing the processing at runtime.

13:18And you are using agents. They break something into subtests and then act on the subtests and then bring all that back to the human for review. How are you building? Are you building those agents yourself or are you licensing agents that other companies have built? So the agents themselves are what we build. And most of these, like I said, the heart of them is not Gen.AI. It's classic AI. But what we do find is that there's other areas where the kind of interaction with the human experience is quite useful for Gen.AI. Right. So one way in which people might steer our product is by creating rules.

14:10Right. It's it's always better to use a rule when it's a directed decision that's based upon standards and procedures. And otherwise, you're trying to train a decision model to asymptotically approach the rule as opposed to be the rule. And and so knowing when to use, you know, an AI model and when to use a rule is an important part of what we do. But when you are trying to ingest these standards and practices, they're often in, you know, documents that are given to people for training. Likewise, if a person is trying to sit down, it may be quite easy to author a rule. It's kind of similar to entering formulas into an Excel spreadsheet.

14:48But it's still intimidating to defeat the blank page the first time you try it. So to be able to express in natural language the rule you're trying to give, something like, I want to escalate immediately all payments over a million dollars that are a real-time gross settlement payment where the payee is either in Russia or within 250 miles of the Russian border. Writing that rule might be intimidating for someone the first time they sit down. right? It's just like if you ever can remember back the first time you used Lotus 1-2-3 or Excel, it was probably a little intimidating, even if you're just trying to do something simple like create a P &L or a budget.

15:24So having the ability of talking to the generative AI and saying, that's my rule, and then seeing it appear in the structured form on the screen where you can just approve it and say, yes, I see how it's unambiguous now. And that's exactly what I meant. It's a great way of interacting with no-code features of a platform to steer its behavior. Yeah. And your clients are big financial institutions. Do you have a platform that they log into and use? Or are you more of a consulting company that's building bespoke solutions that then run on-prem. I mean, that's another issue with all of this kind of data is that a lot of companies for compliance reasons can't allow it to leave the premises.

16:18How do you work? So we put a lot of energy into building a platform and we call it WorkAI. And it's what all the digital workers are based upon. And it's what provides these primitives like getting data, rules, document extraction, machine learning models, building the UX for the human in the loop collaboration, and so on. All of these things are done using the WorkAI platform and the digital workers leverage all these primitives in order to do this end-to-end automation I'm talking about. And then some people use just the platform and they build their own custom digital worker, but still on the platform using these kind of no-code features.

16:57So we've actually got a number of customers that are not in financial services that are still important to us that use just the platform. But every bank that we deal with looks at the standard digital workers first because it's lower risk and faster time to value. And it's often an area where they have a lot of pain today, especially with the bump in sanctions that we had last year. Everyone was trying to deal with how do we handle this dramatic increase in sanctions alerts. And And they couldn't hire people fast enough, especially with the, you know, the great resignation and labor shortages.

17:30And the work of, you know, wading through the haystack looking for the needles, it's just not fun. Right. So a lot of people don't want to do the work. And as soon as they get good at it, they wind up moving on. So it's a perpetual problem trying to keep enough people on the problem. And that's where we start. But the heart of it is a platform. The second part of the thing that you asked was, what about the deployment topologies? So, you know, again, what we've done is we need to look at what these enterprise customers need. And we offer the product as a SaaS slash managed service type of offering.

18:06So, you know, smaller companies can be put into a multi-tenant environment, but larger institutions, if we are going to manage it for them, it's always with a dedicated virtual private cloud for them. We also allow people to put it into their own virtual private cloud just as easily. And we support people running it in a kind of classic data center on-prem. So we support all the deployment topologies for customers. Yeah. I just had a conversation before this with somebody at a consulting company that works on generative AI for financial services. And he was saying that they use Azure because Azure has all these built-in protections as opposed to, you know, using some other cloud intermediary to reach proprietary models like GPT-4.

19:02Is that the sort of thing that you're talking about when you say private virtual cloud? Yeah, so, you know, all the major cloud companies have virtual private cloud where it's a dedicated environment with very controlled network access and very controlled resources that are only for the entity that controls that virtual private cloud. So it's not commingled at any layer with anyone else's information. You know, so we can create a virtual private cloud on behalf of a single bank, but banks can also have their own virtual private cloud with a bunch of their systems in it. They're often running in some kind of hybrid model between classic data centers and these new virtual private clouds that are connected to them with, you know, point to point secure networks.

19:47You have a paper on fighting fraud with AI. Can you sort of walk us through the thesis of that paper? So essentially, the idea is that it's mostly in the curated experiences that are combining people and Gen.AI where the intersection becomes important. So and there's areas where the Gen.AI is going to even exceed some of the capabilities of the classic AI, even if it has other limitations and has other kinds of costs and performance constraints. So, you know, if you look at adverse media, for example, that's one of the problems that we also solve, right? And when a company is doing business with a new entity, they want to know, is there any dirt out there on this entity that means they want to do business with them?

20:39And this can take many forms. It can be things like arrest records and lawsuits. And it can be things like high profile departures. It can be, you know, personnel of the company being convicted of either a financial crime or a serious, you know, moral crime that disqualifies them as a potential customer, business partner, vendor, etc. And so it's a hard problem because, you know, as you can imagine, you know, if you Google your own name, you'll find many articles out there. And so you have to go through a process of, first of all, targeting the search so you're not picking up so much noise. Second, that you have to read through every article and understand, is this really the entity that we're concerned with?

21:25Or is it a similarly named entity or even the same named entity in a different jurisdiction? Right. And then it's how is this entity involved in this article? So there could be an article about a financial crime where you're the victim, not the perpetrator. And so obviously that shouldn't count against you. Or there could be an arrest report where you are arrested for disorderly conduct because you're at a political protest. And that's certainly not disqualifying either. So, you know, these these things take a lot of time. So our classic models use classic NLP in order to solve these problems.

22:05One way in which Gen.ai can be helpful is whenever there's an article that really can't be definitively ascertained, Gen.ai can take a crack at it and it can follow some transitive references across a document that are difficult for classic NLP to resolve. Right. So, you know, as a person, you have no problem following these transitive references across an entire document, the pronouns, the subtle illusions and so on. And sometimes these things even span documents that can refer back to an article that came out in the news yesterday, assuming you read it or you can click on the link and you can go read that.

22:43So Gen.ai tends to be very good at pulling that information together. it's also when used properly can show the work and that work that's shown can be passed through the classic model again to refine the results further. Which models do you guys use? We focus on three different models right now. We wind up having a lot of things in the platform where we have to make it pluggable because we have to accommodate our customers. So we don't just focus on Azure, for example. As we were saying earlier, we also support GCP, Google Cloud, and Amazon. It's just the cost of doing business because people are going to make strategic bets on one cloud provider versus another, and they don't want you bending their operation to your will.

23:31They want you to adapt to their operation. It's the same thing with LLMs. If someone's an Azure shop, they'd like to use the, you know, open AI technology, you know, as hosted through Azure. If they're a Google shop, they'd like to use the Google technologies, right? The Palm and the upcoming Gemini. Some customers are extremely conservative, as Valsa said, and they want a completely private large language model. And Mistral is the one that we're focused on for the private use cases. So yeah, it's got to be pluggable at every layer, at the cloud layer, employment topology layer, at the LLM layer.

24:10And with the open source, for example, Mistral, do you create an instance of the model and fine tune it on their data? Or are you just accessing the open source model through API? How do you do that? Well, first, there's a technology we use called LangChain. I don't know if you've heard of it, but the plugability layer. And then we don't just plug in the models, but we also curate different kinds of prompting and information pipelining into the models, depending upon the LLM in question. And yes, in some cases, you know, further training against the LLM or just providing more example data in the mix is a key to getting it to perform.

25:04What are some of the classes of financial crime that most of your customers are facing, are grappling with? There must be, you know, in the bell curve, sort of in the middle of it there. What kinds of crimes are they working on? So the first big ones and that are the easiest ones to get started with are the sanctions, PEP screening, adverse media screening, and the sanctions, whether it's transactions, whether it's entities that are being onboarded. That's the easy ones to do because there's a lot of volume. There's a lot of regulatory pressure that's increasing workloads. And it's very standardized in general compared to other types of financial crime fighting.

25:55The second one is KYC. So KYC is just it's an enormous problem. There's a lot of subtlety to the work that has to be done. And, you know, we we see there being a big pocket of spend within banks. We have some banks have thousands of people doing KYC in one form or another. so we're really proud of what we've been doing and what we call PKYC and PKYC stands for perpetual there's been talk about this in the past in the industry but it's actually there's been some pretty high profile failures on PKYC and the reason was that most of the energy went into acquiring the data the signal that would be a problem but not in actually automatically acting upon that data or signal.

26:50And as a result, they just created a huge backlog of casework that no one was ever getting to. And they would just revert to doing the periodic refreshes every few years, or more or less, depending upon the risk profile of the customer, just doing a complete case review. And it's actually terrible because you actually had data that showed you you had a problem. So you should have known and you should have acted kind of problem, even though you didn't have the capacity to do so. So what we've focused on is how can we actually look at the events and determine that an event has either been seen before and so therefore doesn't need to be looked at again, or it's a low risk signal.

27:32And with just some subtle analysis can be determined that it's not a problem and taken off the table so that all you're left with is high risk signals. And then And to be able to actually, when a high-risk signal is present, be able to completely run a straight-through process on the KYC itself, for a low-risk entity at least, and be able to take that off the table entirely unless there's something to see here. So, you know, KYC, it's an enormous problem, but if you can get the low-risk signals and entities off the table, you can reduce it by up to 80%. And that could be, you know, enormous savings.

28:11It also can allow you to fundamentally move the needle on risk because I think a lot of people feel like KYC is a bit of a check the box regulatory exercise and doesn't fundamentally move it. But when you're responding to things in real time, it actually can save you quite a lot of trouble. Can you give an example of success in the KYC space where something popped up and you prevented a bank from engaging with somebody that was a problem? Sure. I mean, it happens every day. Right. So it's finding out that someone actually has ties to a drug cartel or, you know, finding out that someone is actually a Russian oligarch, even though they presented a UK passport when they opened the account and stopping the bank from doing business with them.

29:04And, you know, not just, you know, one point for the good guys when those things happen, but it also, if the bank doesn't stop it, defines exposure as enormous. What's the throughput on the platform? Because they're dealing with hundreds, if not thousands of entities a day. And with this PKYC, it's a real time monitoring, I guess. So how does the bank, as the platform, they upload a bunch of documentation. And then what happens? The platform goes out, does a search, does an analysis, presents stuff to one of their compliance people who reviews it, but then is continually monitoring the keywords or whatever for that customer.

30:07And if something comes along, the compliance officer gets an alert. I mean, just how does that work? So one way it can work is simply doing what a person would do, but doing it very quickly, right? And doing it without a human touch and pulling the information, looking at the information, checking against the file, doing transaction analysis, doing, you know, a news analysis, etc. And then nothing to see here. It's done. You're done for the day. It can be more powerful when you have curated information providers that actually also have an event-driven capability. So, for example, when we work with Thomson Reuters, they have a continuous monitoring facility.

30:52And that continuous monitoring facility, rather than us having to repeat the entire cycle for all the entities in the population on a rapid but still somewhat periodic basis, even if you're saying periodic is a day, it's periodic. we're able to go to them and find only what's new over the last 24 hours, over the last eight hours, which is much more scalable than having to repeat the entire process. And like you say, some of these companies have millions, if not tens of millions, and reaching 100 million entities in their relationship portfolio. So it is important that it be as scalable as possible.