Big Data, analytics, and behavioral analysis can help combat financial crime by: 1) Identifying hidden relationships and detecting anomalies across large volumes of structured and unstructured data. 2) Analyzing both financial and non-financial transactions to better understand customer behavior. 3) Using predictive models, social network analysis, and other techniques to surface emerging threats and reduce false positives.

1. Big Data, Big Analytics &
Bad Behaviour – Fighting
Financial Crime
Keith Swanson
Director, Financial Crimes, SAS South Asia
C o p y r i g h t © 2 0 1 3 , S A S I n s t i t u t e
I n c . A l l r i g h t s r e s e r v e d .

2. We hear much of the challenges that Big Data provides…
…Volume, Velocity, Variety…
…But how does Big Data impact our effort to combat Financial Crime?
Adhoc &
Regular More Formats
Sources
Volume Structured & Vision
Unstructured
BIG Velocity
Combatting
Veracity Financial
DATA Crime
More
Sources/
Variety Channels
Value
Faster Data
Internet of Things
Simply put, you are likely being tasked with receiving more, doing more, and doing it for less
Copyright © 2013 , SAS Institute Inc. All rights reserved.

3. Financial Crime is pervasive across industries and shares many common
means, opportunities and motives
Financial Services Government Utilities
Fraud
Financial Crime
Waste, Abuse
Banking
Taxation/Revenue Telecommunications
Wealth & Investments
Insurance Social Services Subscription Services
(TV, etc.)
AML/CTF
FATCA Electric, Water, Gas
Compliance
Compliance Heat
Health Insurance
Internal & Procurement Fraud
Copyright © 2013 , SAS Institute Inc. All rights reserved.

4. SO, WHAT DOES THE INTERNET SAY BIG DATA LOOKS
MAKING ‘CENTS’ OF LIKE? IF I WERE TO BELIEVE WHAT I SEE
BIG DATA
(BING.COM IMAGE SEARCH ON ‘BIG DATA’…)
should we infer that
source of light & big data may crush
direction through us?
stormy times?
slow and archaic
key to unlocking in dealing with
something? it?
something that
will bite us?
have strong belief and be
shelter from inspired?
perceived chaos?
Big Data is not about what it looks like…
…It is about what you make of it
Copyright © 2013 , SAS Institute Inc. All rights reserved.

5. MAKING ‘CENTS’ OF IN COMBATTING FINANCIAL CRIME, THE VARYING
BIG DATA NATURE OF BIG DATA SHOULD BE ADDRESSED
UNSTRUCTURED
In motion and at DATA
rest
SYSTEM
Fast and slowly DATA
changing
Big
Data
Multiple views of TRANSACTIONAL
the truth DATA
Central and INTERACTION
distributed DATA
Copyright © 2013 , SAS Institute Inc. All rights reserved.

6. BIG DATA IN MORE FINANCIAL CRIME FOUND BY LINKING ACROSS THE
FINANCIAL CRIME ENTERPRISE - WHICH ALSO CREATES MORE DATA
Across Channels and Products
Anti-Money Broker
Creditd Debitd Wire Cheque ATM Phone Online Mobile Sanctions Loans Internal
Laundering Surveillance
Across Brands and Business Lines
Personal/ SME/Business Wealth Insurance Affiliates Distribution
Retail Across Relationship Levels & Types
Customer Company Account Network Relationship Employee
Across Transaction types
Monetary Non-Monetary Inquiry
Breed Success! - It does not have to be a ‘big bang’ approach. Start with the areas of highest
losses, exposure and/or greatest ease of execution
Copyright © 2013 , SAS Institute Inc. All rights reserved.

7. GLOBAL COMBATTING FINANCIAL CRIME – ANALYSTS RECOMMEND A
PERSPECTIVES – LAYERED APPROACH THAT DICTATES DEALING WITH BIG
ENTERPRISE FRAUD DATA
MANAGEMENT
LAYER 5 Entity Link Analysis:
“There are two classes E Enables Analysis of Relationships
of EFM solutions —
one detects fraudulent F LAYER 4 Cross Channel Centric:
transactions or A
unauthorized activities Monitors Entity Behavior Across Channels
M N
as they occur, and
A
LAYER 3
one detects organized L Channel Centric:
crime and collusive Y Monitors Account Behavior for a Channel
activities using offline
entity link analysis”
T
I LAYER 2 Navigation Centric:
- Avivah Latan, Gartner C Analyzes Session Behavior
S
LAYER 1
SAS assessed as 1 of Endpoint Centric:
only 2 vendors who Authentication, Device ID, Geo Location
do layers 4 and 5
Copyright © 2013 , SAS Institute Inc. All rights reserved.

8. COMPLEXITIES OF THE UNDERLYING VALUE OF UNDERSTANDING BIG DATA –
FINANCIAL CRIME UNDERSTANDING BEHAVIOUR
Account
Application Internal Transaction First Party Insurance Card
Takeover/ ID
Fraud Fraud Fraud Fraud Fraud Skimming
Theft
Man in the …And
Brokerage/
Bust-out Procurement Multi-party Structured Browser/ many
Trading
Fraud Fraud Fraud Payments Middle more!
Fraud
Attack
And inherent
in people is
their
Behaviour
PEOPLE!
“The fraudulent act is a behavior that can be recognizable through advanced modeling
techniques because we can anticipate that the behavior is sufficiently inconsistent
with known normal behavior.” – John Geurts, Chief Security Officer, CBA
So…. Stop Looking Just for Fraud, Look for Changes in Behaviour!
Copyright © 2013 , SAS Institute Inc. All rights reserved.

9. ANALYTICS IN INCREASING VALUE OF USING ANALYTICS TO ASSESS
COMBATTING BIG DATA IN COMBATTING FINANCIAL CRIME
FINANCIAL CRIME
LOT Social
Little
Network
Analysis
Models,
Advanced
Fraud Detected
Addresses Analytics
False Positives
the Knowns
Anomaly
Detection
Addresses the
Business Unknowns
Rules
Traditional
Query and
Little
Analysis LOT
Limited Approaches Applied Robust
Low Maturity High
SIMPLY PUT, USING ANALYTICS FINDS MORE FRAUD AMONG BIG DATA. LOWER
FALSE POSITIVES. IMPROVED PRODUCTIVITY. ANALYTICS FINDS THE
EMERGING AND THE UNKNOWN
Copyright © 2013 , SAS Institute Inc. All rights reserved.

10. ANALYTICS IN USING A HYBRID APPROACH FOR DRIVING INSIGHTS
COMBATTING FROM BIG DATA
FINANCIAL CRIME
Text Social
Mining Network
Predictive
Analysis
Modeling
Anomaly
Detection
Automated Alert
Business Rules Generation
Process Database
Searches
and Watch
Lists
LEVERAGING SAS HYBRID APPROACH TO RISK ASSESS ACROSS
MULTIPLE ORGANIZATIONS
Copyright © 2013 , SAS Institute Inc. All rights reserved.

11. ANALYTICS IN
COMBATTING THE NEED FOR MULTIPLE ANALYTICAL MODELS
FINANCIAL CRIME
Copyright © 2013 , SAS Institute Inc. All rights reserved.

12. ANALYTICS IN
COMBATTING USING BIG ANALYTICS TO MAKE SENSE OF BIG DATA
FINANCIAL CRIME
Vision Vision Veracity
Approach
Predict Behaviour Surface Hidden Relationships Higher Quality Alerts
Models look at the Use machine learning and Determining what is real
behaviour of many to horsepower to identify and and what is false much
predict how individuals visualise relationships – overt easier when looking at a
may act and covert transaction in relation to
• 15-30% Higher fraud value • 32x more fraud rings than • Detection accuracy
detection rate previous approach improved by over 25x
Value
• 25% better performance • Automated analysis & the • 47% better detection
than rules alone identification/visualisation of
networks across millions
Copyright © 2013 , SAS Institute Inc. All rights reserved.

13. ANALYTICS IN
COMBATTING USING BIG ANALYTICS TO MAKE SENSE OF BIG DATA
FINANCIAL CRIME
Vision Vision Veracity
Approach
Look at the Full Picture Address Knowns and Decisioning and Alerting
Understanding financial & Unknowns
Operationalise Analytics -
non-financial transactions Multiple Analytic techniques Let the system find what is
adds big data, but helps target the known and important and when it is
give full view of behavior surface the unknown critical pushing ‘needles
out of a haystack’
Over 1 Billion Transactions • 35% Better than the 100% Real time in
analysed a day competitor, 57% Better than milliseconds –
Value
previous benchmarked to 3200+
• 8X ROI in the first 12 Transaction per second
months
Copyright © 2013 , SAS Institute Inc. All rights reserved.

14. ANALYTICS IN BIG ANALYTICS CAN PROVIDE INSIGHTS FROM BIG DATA
COMBATTING AT DIFFERENT LEVELS
FINANCIAL CRIME
VISION, VERACITY AND VALUE
Enterprise/Population Targeted Information Proactive Alerting &
Based Analysis Inquiries Decisioning
Looking across an identity and Using the identity and network Proactive alerting of
network view to qualify and view to query on specific concerning scenarios,
quantify certain measures situations or entities relationships and changes in
behaviour
Reporting Monitoring Alerting
Copyright © 2013 , SAS Institute Inc. All rights reserved.

15. ANALYTICS IN OPERATIONAL ANALYTICS IN PRACTICE
COMBATTING
FINANCIAL CRIME
FINANCIAL
TRANSACTIONS
Online transfer out
of $10,000
What looks more like a case of
Financial Crime?
FINANCIAL
TRANSACTIONS
Online transfer of $10,000,
unusual for that customer
NON-FINANCIAL
TRANSACTIONS
A couple errant Access from Change of Set up of new
password entries different device Account Details transfer account
Increasing levels of Data to Analyse
Copyright © 2013 , SAS Institute Inc. All rights reserved.

16. ANALYTICS USE SOCIAL NETWORK ANALYSIS TO UNDERSTAND
APPLIED UNKNOWN RELATIONSHIPs
Understanding relationships and links between customers,
employees, application information, device information, etc.
Using systems and processing of lots of data to identify
linkages that were otherwise often missed or manually
developed
Helps to quickly identify patterns of attempted fraud and
understand potential organised crime
16
Copyright © 2013 , SAS Institute Inc. All rights reserved.

17. ANALYTICS BEHAVIORAL ANALYSIS AND INSIGHT DRIVES BUSINESS
APPLIED VALUE
Data and Information
ANALYSIS
Behavioural Insight
Dark Side White Side
Fraud Risk Marketing
Reduced fraud losses More timely Credit Risk Scores More Relevant Offers
More fraud prevented & Reduced Credit Risk Losses Better Targeted Products
Business Benefits
detected in real time Sharper Product Pricing Higher product approval rates
Lower customer annoyance Better Targeted offers More higher quality and timely
Lower false positives Reduction in collections cases marketing leads
Better coverage against Increased customer satisfaction
emerging threats Increased product retention
SAS solutions can analyse behaviour across both monetary & non-monetary
transactions
Copyright © 2013 , SAS Institute Inc. All rights reserved.

18. SAS ENTERPRISE
SAS FINANCIAL CRIMES SUITE
FINANCIAL CRIMES
Suite approach with defined
capability modules addressing Customer Due Diligence and new modules
Fraud, Compliance & Security SAS Visual Analytics and BI
SAS Enterprise Case Management
Solutions can be consumed
independently
Leverages Enterprise Grade SAS Anti- SAS Fraud
SAS Fraud
Capabilities Money Network
Management
Laundering Analysis
Contextual user interfaces
Just received Highest rating from
SAS Enterprise Financial Crimes Suite
Forrester Wave Report, Feb ‘13
SAS Business Analytics Framework
Copyright © 2013 , SAS Institute Inc. All rights reserved.

19. SAS ENTERPRISE
FINANCIAL CRIMES SAS FINANCIAL CRIMES SUITE – BUSINESS ARCHITECTURE
Payment Currency Customer
Due Diligence /
Compliance Sanctions Transaction Screening/ AML / CTF
FATCA
Blocking Reporting Watch List
Other (Telco,
Banking
1st party/bust-out Health Care
Account Government Insurance
Credit card/debit Online/E-channel
Fraud Payments fraud Utilities)
fraud takeover card fraud /Transaction
Security/ Application
Rogue Trading Internal Fraud Insider Trading Cyber Intrusion
Fraud Fraud
Business Modules / IP Foundry
SAS® High-Performance Analytics
Security
Intelligence Detection & Alert Text Mining,
Foundation Generation Rule/Analyti SMA, Integrated Link
c Authoring Content Triage & Workflow
Real time and & Admin. Categorizati ECM Analysis
batch on
SAS Platform Data Management Search Analytics Dashboards & Reporting
Copyright© ©0 1 2 , S A S ISAS t e I n c . A l l r i g Inc.es er v erights reserved.
C op yr i g h t 2 2013, n s t i t u Institute h t s r All d . COMMERCIAL IN CONFIDENCE – for BBL Use Only

20. COMMONWEALTH
BANK OF BUSINESS BENEFITS FROM BIG DATA
AUSTRALIA
CHALLENGES Analytics in Action
• Stop fraudulent transactions in real time
Reliably predicts the
• Identify suspicious activity that requires submission of a SAR likelihood of fraud
• Streamline siloed, product-specific fraud detection platforms activity for any given
transaction before it is
SOLUTION authorized, at the
® ®
SAS Fraud Management and SAS Anti-Money Laundering average of 80-85
• Real-time processing for debit cards & actively adding more channels transactions per second
with a mean response
• Hundreds of millions transactions analysed for money-laundering time of 40 milliseconds.
detection
• Behavioral analytics and models applied
Analyses of up to 420
million transactions
• Application fraud and internal fraud also addressed every night, looking for
JOURNEY FORWARD fraud and money
laundering activity.
• Bank turning ‘enterprise fraud’ into reality as more channels actively
being added, reducing the number of fraud systems along the way
“We can do more – I have no doubt of that. While our primary role is to ensure the fraud
detection systems are optimized and applicable to the threats we face, we should take
every opportunity to leverage our investment in advanced systems to improve our return
on investment.” – John Geurts, Chief Security Officer, CBA
Copyright © 2013 , SAS Institute Inc. All rights reserved.

21. HSBC BUSINESS BENEFITS FROM BIG DATA
CHALLENGES Analytics in Action
HSBC was faced with implementing multiple scoring 87% increase in number
engines for fraud and credit. They also wanted a more of data items processed
while seeing 12%
contemporary approach to fraud detection that could decrease in mainframe
utilize new data sources such as mobile devices and processing overhead
web data in their solution
30 percent decrease in
SOLUTION computing resource costs
for processing card
SAS® Fraud Management transactions flagged as
potentially fraudulent
HSBC and SAS designed a new technical infrastructure
that could score any type of model in real time for 100% A 10 percent increase in
of transactions. This solution would allow HSBC to efficiency by agents
investigating potentially
conduct champion challenger, simulation of new
fraudulent cases when
models, integrated reporting, and a “state vector” compared to the prior
concept that would allow any type of data to be used proprietary case
management system.
Development partner for SAS Fraud Management
"SAS is committed to ensuring that we continue to have a leading-edge anti-fraud
solution. We are very pleased with the results. Our IT guys like it, the business
guys like it and the finance guys like it as well. Fraud analytics can often bring
significant benefits, and that's certainly been our experience with SAS.“ –
Derek Wylde, HSBC
Copyright © 2013 , SAS Institute Inc. All rights reserved.

22. BIG DATA AND BIG SUMMARY
ANALYTICS FOR
FRAUD
Combatting Financial Crime is a great applied business
Problem for Big Data, moreso Big & Operational Analytics
– speed, volume and financial impact
Analytics finds more financial crime - Analytics helps
make sense of the vast amounts of data - turning volume,
velocity variety into Vision, Veracity and Value
Focus on changes in Behaviour best made possible
through Big Data of Financial and Non-financial
transactions
SAS Solutions leverage best in class analytics, enterprise
class capabilities with customer proofpoints and analyst
rankings
Copyright © 2013 , SAS Institute Inc. All rights reserved.

23. Keith Swanson
Keith.Swanson@sas.com
C o p y r i g h t © 2 0 1 3 , S A S I n s t i t u t e
I Copyright l© 2010,gSAS s r e s Inc. v e rights reserved.
n c . A l r i h t Institute e r All d .

24. Day in the life of… Insurance Claims Handler
Old Approach
Very limited ‘red flag’ As workload permits, Very little claims to Manual review of
business rules in adhoc potential fraud investigate And no information – claim
Claims system identify claims received from information looking at looks OK and payment
limited number of assessors, investigated customer, claims and vehicle to customer proceeds as
suspicious claims one by one using data only history across brands scheduled
New Approach
Log on in the morning Quickly triage the Customer flagged for Further review identifies High potential for fraud,
to see prioritised list of alerts, having all excessive claims same smash repair investigator opens case
suspicious claims information needed history across brands. shop used in all claims, of which workflow flags
including clear view of presented within one Network diagram and injured occupant call to customer and
why claim was flagged set of screens shows VIN involved in 3 have previous claim at routes to SIU for repair
accidents in 12 mths same repair shop shop visit
Copyright © 2013 , SAS Institute Inc. All rights reserved.

25. ERROR: undefined
OFFENDING COMMAND: f‘~
STACK: