Loraine Lawson
Good day and welcome to The Buzz, a Bank Automation News podcast. I’m Deputy Editor Loraine Lawson. I recently spoke with Yaron Hazan,the vice president of Regulatory Affairs at ThetaRay. ThetaRay is cyber security and big data analytics company based in Israel. The AI and machine learning-based solution was recently used by a bank to identify and break up a child trafficking ring. I asked Mr. Hazan to explain how the bank used Thetaray to recognize that some cross-border transactions might be related to child trafficking.Yaron Hazan
So Thetaray initially was designed to find anomalies in large sets of data. If you ask the two math professors that started all this journey 25 years ago, they actually had the vision to cure cancer and to anticipate severe cyber attacks on a problematic events or processes in large sets of data, eventually in the last five Seven years, five to seven years, that array started and now is very heavily involved in working with the financial system with the banking industry and our payment service providers and regulators. And we found, even before I arrived, the company found, but definitely since I’m involved, we found that we really kind of got the right key to the hole that was missing. Because no matter how you look at it, the banking industry is not the police is not intelligence organization, they should not have originally, those specific skill sets and types of data sources that police unit should have, or FBI is of the world should have, they should have maximized the data they own, to identify what is unusual and potentially suspicious, combined, and connect the dots, and therefore report suspicious activity reports to those Financial Intelligence Unit that support those criminal investigations. So fulfilling their role as a gatekeeper for humanity. They needed to have the right approach and the right tools. the right approach was not there until maybe the second decade of the century. Where I think following HSBC case in 2012, or banks, changed their the approach to the fight against financial crime, to be more proactive and to really try to do it the best way they can. And since then, the tools that they use are evolving. But now, as I said, finally, there is the key to the whole, because it’s exactly what was expected from them not to find the bad guys in the criminals, but to find those unusual financial activities to potentially indicate that there is a crime going on.Loraine Lawson
And this key will be you said there was a key, the three machine learning. So how do you? And part of the challenge, I guess, is that are the opportunities that these patterns emerge more with cross border payments, is that correct? completely correct. And even more complex? Can you explain that a little

Yaron Hazan
Of course. And through the explanation, I will give you the case that you asked at the beginning about the child trafficking that was detected a certain branch of a global bank, in Eastern European country had customers to ladies, if I remember correctly, and additional few men, that opened an account for a small business that was defined as providing medical services that are related to children in some way. Okay. I don’t remember exactly what was the business. But this was the description that we received from the bank after we detected the case. So they open bank accounts in a certain year Eastern European country, and they start receiving and sending certain amounts of money that are usually not too large. I’m not talking about 100 1000s of euros, I’m talking about sometimes few 1000s of euros, sometimes a bit more, sometimes even a bit less. How is this being received, let’s say at a large bank, no matter which one, let’s say just for example, because I went there, HSBC, how is this received at HSBC, in New York, for example. First of all, since the funds have been transferred in US dollars, HSBC in New York or any other American bank can be the one who closed the dollars for those banks that are on the on the chain of banks that are involved in this transfer. So it started in a in an Eastern European country, in a certain branch of a global bank moved through Europe, to this certain bank headquarters moved to HSBC in New York, because it has to be cleared in dollars, then goes to another bank in New York because this is the other bank that is clearing dollars for the destination account. Bank. So we see that we have at least five to six banks involved in the payment. We’re the only one who could potentially know who is the originator was this branch in in Eastern European country. All the rest have no visibility about who is the entity So, this what makes it so complex lack of visibility, the complexity of each transfer due to the clearing mechanism, because in certain currencies, transfers have to go through from several stations and countries. And each bank has only limited activity in the past even perceived as limited responsibility. Now, they understand that they are responsible, even as the intermediary bank for all this all the thing, all the traffic that goes to them. And most of them find it very challenging to understand each and every activity that goes through them, the volumes are gone, much bigger, digitalization, COVID-19, all these phenomena has made the fact that we’re not we don’t go to the branches anymore, everything is online, there is much more online cross border activity, and bank just feel that they are working in the dark. And this is why, by the way, we call it our new solution. So now, because it helps you see in the areas that were not visible to you in the past.

Loraine Lawson
And this is an automated solution, like does it operate on the cloud? Or does it require you, your company to have some intervention with the data? Or does it automatically tell banks, hey, we’ve got a weird case, how does that work?

Yaron Hazan
For cross border activity, we have a fully automated solution that can be implemented either on premise or on the cloud depends on the customer’s requirements needs, environment, whatever. And now, I think cloud is even, in some cases more secured than on premise in several cases. And since we get away, we don’t need to know anything about the data anyway. So most of the data is usually anonymous. And we still identify, or the system identifies what is potentially suspicious, very easily.

Loraine Lawson
Um, so I know, you know, obviously, there’s a proprietary component here. And I don’t, you know, I’m not asking about that, really, but, I mean, unless you want to reveal that, I probably wouldn’t understand it. But I do wonder how you train models to do this sort of work? How is that Dino? The history of how it’s been trained to do that, or?

Yaron Hazan
So most of it, by the way, is not only that is not confidential? It’s even published, if you are a math professor, you will understand it perfectly. I don’t, in terms of the math behind it, I understand the the logic or the process very well, I don’t understand the formulas of the math why it’s so accurate. But the principle is like it goes like that historical data has been served for training, as you already started to understand anticipate there is some kind of training involved, historical data is served for training the algorithms learn through the historical data, what is the normal behavior, this is why we work so different from anything that was a used for financial context, in the past, in the past, like, like you started thinking at the beginning of the call, you had experts like me, defining what could be suspicious, and then you try to find this thing that is potentially suspicious, tether works the other way around. Firstly, scans all the data learns normality in the data, because most people are not criminals, and most activity is normal. And then start to highlight in different parameters of the data, what is unusual compared to the history of the entity, and compared to the population for the same period. This what makes it so accurate, because it’s, it’s all the time, it’s not too much a exposed to trends, like in COVID-19, many people change their financial behavior. But since many did it as a trend, setter, I saw it as a trend. So everything that was normal for me was normal for other customers of the bank. So it didn’t impact the result too much. It came back but not too much. So it goes like learning from the past learning from the population and then highlighting all the unusual points in the data and then connecting it to the entities that are involved and finding the patterns and risk indicators.

Loraine Lawson
And the case with the potential child trafficking. Yes. Has that been resolved yet or was that just asked you it was turned over?

Yaron Hazan
Yeah, we received feedback within few months that the system detected the case. That was a we detected it on July 2019 data We’re in October or November 2019, four months later, a, I guess through law enforcement inquiries. The headquarters of the bank approached this branch and asked him about this activity because it’s related to child trafficking. And the response was command that we discovered four months ago, we already stopped the activity, we already reported to the regulators. And we saw that something is very, very suspicious there. Because it was supposed to be a business that is related to medical services. There was no clear website that was related to that. There were no licenses or any kind of connections between these accounts, and any other medical service providers, any other companies that are in the medical industry. And one of the things that really helped it detected is that we are not limited by any thresholds. This is why we detect also terrorist funding. So even if they’re Mansouri relatively low, but activity is really unusual category will detect it.

Loraine Lawson
And have they been arrested in that? Or do you know, I don’t know, outcomes by their regulators, or law enforcement? And so they iterated? Did you become involved as a vendor? I mean, is that always what happens? Do you always know what your software is used to find these things? Or did you just happen to find out about this case, like, I’m wondering many

Yaron Hazan
cases, in many cases, since our funding of finding are so unique, and result in very interesting and relevant investigations. So in many cases, we received feedback, for example, we have a case, that was actually a suspicion for tourists funding in a park. And the banking eventually came back to us, and told us that it was illegal gambling network, which is in some characteristics similar to terrorist funding, because you have certain a centers that collect or donate funds to many into many small amounts, or from many small amounts. And the same goes for a mocking of gambling, illegal gambling. So they told us that they thought it was terrorist funding, but eventually they have enough information to summarize, to conclude that it was illegal gambling. We had a case that was confirmed, confirmed as terrorist funding in Spain in the past. Because the regulator came to the bank, and told him that there was a case that, that we actually found that was related to terrorist funding. And in some cases, were invited to conduct an investigation because there are some open source media publications have a large scheme. And then a bank tells us okay, let’s test my data and tell me if I was exposed to it. And then we have it’s not like fully blinded, it’s not fully unsupervised, we have some clues about some parameters or characteristics of the scheme. But then we run the system. And we found the network of people that are related. If you remember the Russian laundromat few years ago, we found for certain bank in the UK, I believe, all the 51 shell companies that were opened and operated through this bank in the UK, for example. And they had information only about three or four days before that.

Loraine Lawson
So it sounds like a lot of your cases do involve cross border payments. Do you detect anomalies within countries too?

Yaron Hazan
Yes. We already have production and this was also published, so I can say it in Santander group for all the cross border activity. But for that bank and some other banks, we implemented a detection mechanism for retail banking, which is mostly domestic. We’ve presented it for SEPA payments, the original European payments on the one hand, but on the other hand, even within Spain or within Italy, SEPA mechanism or SEPA method is valid for for local domestic payments. So we also run it on domestic payments.

Loraine Lawson
Who were the mathematicians, by the way? Do you know there? Yes,

Yaron Hazan
Professor Arnold Kaufman, a part of the Dow pa and was awarded by Bill Clinton is from Yale University. And Professor Minato, both from Columbia University and Tel Aviv University until today, he’s our CTO and still working on a day to day basis in the company.

Loraine Lawson
Well, and speaking of technology CTO, you run in the cloud, correct? Not on premise, but we cloud both. Okay, what what, what’s some of the technological underpinnings that people will need to know that to assess your solution? Ie, are you on AWS? Are you both?

Yaron Hazan
AWS? Yeah, we’re already in the last three years, we we had to adjust to several cloud environments. So we’re fit with all the leading ones. In terms of connectivity, and ETL, and API, and all those functionalities that can make the difference between the length of implementation, the effort that needs to be done during an implementation, we’ve done a huge progress in the last 18 months. So if 18 months ago, implementing our cross border solution would have taken six months. A few weeks ago, we have run it, in fact, in four or five days, to a bank, in the Arab Emirates on the cloud. And we represented the results within four or five days. But what changed, automatically dealing the structure of the data of swift and other cross border and set by another cross border mechanisms is quite structured. So you know what to expect in terms of structure of the data. And it’s consistent. So we automated the entire process, from importing the data, and connecting directly to the swift connector and gateway. So we don’t need any ETL any preparation, anything at all? We can, the system automatically can take the data, run it through the data frame of category, include the algorithms and the features, train the system, and extract results within a few days.
I would say one thing, after 25 years of career of chasing bad guys, feeling that I’m one step ahead of them is a very good feeling. And that allows that, and in terms of the industry, and even humanity, when we think about child trafficking, terrorist funding, and all these worst phenomenas that we think that are impossible to manage to detect to fight against. I say it’s possible. Of course, there is a lot to be done, not only on the financial industry and technology perspective, but also on the public sector perspective, cooperation between countries, all the things that are so hard to achieve. But still, it’s possible. And I think we’re going to make a big progress in the next few years on these terms.

Loraine Lawson:
You’ve been listening to the Buzz, a Bank Automation News podcast. Thank you for your time and be sure to visit us at BankAutomationNews.com for more automation news. You can also follow us on Twitter and LinkedIn. Please don’t hesitate to rate this podcast on your podcast platform of choice.