Explainable deep learning model for predicting money laundering transactions

Despite the concerted efforts to combat the money laundering by intergovernmental organizations, national government agencies, and law and enforcement, regulatory, financial institutions, the global financial system is still being exploited for money laundering. Financial institutions, which are the first line of defense to identify suspicious transactional behavior, hold authoritative positions to contribute effectively. This study has identified the following challenges for financial institutions in the money laundering domain.

Hence, the objectives of this study are to address these challenges by designing an effective deep learning technique to detect suspicious money laundering transactions with minimal FPs and FNs and to develop an effective explainable AI technique to produce human interpretable explanations.

To address these objectives, a novel method to detect suspicious transactions using a Conv1D convolutional neural network (CNN) was implemented and explained the CNN predictions using the state-of-the-art SHapley Additive exPlanations (SHAP) XAI method, which is based on the approach outlined by Kute [21]. The CNN results were compared with three other most commonly used ML methods for detecting money laundering: random forest (RF) [22], extreme gradient boosting (XGBoost) [23], and support vector machine (SVM) [24]. This study chose Conv1D CNN model for detecting suspicious transactions because of its suitability for sequential financial time-series data and tabular dataset. A model called agnostic method SHAP was chosen to explain the predictions made by CNN primarily due to its ability to provide an individual feature importance score for each input feature value, indicating contribution to prediction. All classifiers used in this study were trained, validated, and tested on synthetic data generated by the authors.

A bank or any regulated financial institution can potentially consider the methodology explained in this study to detect suspicious customer transactional behavior. The explainability part of the methodology can help the investigator interpret the decisions made by opaque models. Detecting and preventing money laundering brings several benefits to society which include mitigating the harmful effects of criminal activity, reducing terrorism financing, maintaining the integrity of financial systems, and protecting the economy. Money laundering is often associated with criminal activities such as drug trafficking, human trafficking, organized crimes, and corruption. Therefore, the detection of money laundering can assist law enforcement agencies in identifying criminal organizations, disrupting organized crimes, preventing illicit activities, and ultimately contributing to the safety and security of society.

The remaining paper is organized as follows: Section 2 describes the related work from the literature; Section 3 describes the methodology, including synthetic data generation, deep learning method, and XAI method; Section 4 provides the results; Section 5 discusses the results and provides a viewpoint; and finally, Section 6 concludes the paper by providing key findings and future research directions.

This research requires financial transaction data together with labeled money laundering transactions. Banks consider financial transaction data, including customer, accounts, history, balance, and products, as highly sensitive and protected data, which makes it difficult to obtain the same for research purposes. It is also important to note that, even in real banking transaction data, no one knows for sure if the transactions are legitimate or money laundering transactions until it is proved in the court; hence, the labeled data for training the ML models is also a challenge for banks. The decision points to determine if the identified transactions are indeed suspicious or legitimate are spread across several entities such as banks, FIU, law and enforcement, and court.

To our knowledge, real financial transaction dataset of a bank does not exist on public domain that provides labeled transaction data for research purposes (and it should not be as a responsible bank). Considering the challenges surrounding the availability of financial transaction data for research, it was decided to produce synthetic data that would be as close as possible to the regular transactions of retail customers of a bank. The following key data entities were considered: customers, accounts, and transactions for data creation. Figure 2 illustrates the synthetic data creation process.

Figure 2:

The attributes for the data entities were chosen based on the real banking customer transactions dataset and the attributes used by other researchers [25] in the same domain. Each data attribute was carefully chosen, considering its potential contribution to determine whether the transaction is suspicious or legitimate. Additionally, these attributes were validated by AML subject matter experts (SMEs) to ensure that the correct data were fed into the model for improved decision making.

The key attributes considered for customer include customer ID, customer type, gender, date of birth, age, marital status, residence country, state, city, postcode, tax resident country, birth country, nationality country, profession, income category, know your customer (KYC) update date, KYC state, risk rating, and account number.

The attributes for account entity are chosen as account number, customer ID, bank state branch (BSB) number, account creation date, account type, daily transaction limit, tax file number (TFN) number, and account statement delivery method.

The attributes for transaction entity are chosen as transaction date, transaction number, source account number, amount, credit, debit, transaction type, subtype, description, currency, transaction location type, transaction location code, target account number, target country code, target bank code, and is suspicious flag.

Demographic information from the Australian Bureau of Statistics [38] was used to maintain a realistic balance between customer profiles, age, city, profession, gender, and income. Customer profiles were created by limiting a country of residence to Australia, 12 cities, age group between 25 years and 60 years containing males and females; standard occupations such as managers, technicians, and trade workers, community and personal service workers, clerical and administrative workers, sales workers, machinery operators and drivers, laborers, and students; and an annual income range between AU $40,000 and $150,000.

Each customer profile was associated with one savings account. Transactions on the savings account were generated by meticulously defining the ranges of transaction dates and transaction amounts based on customer profiles, and the purpose of the transaction to keep the data as close as possible to real transactions. Credit transactions on the account include salary, cash deposits, and incoming transfers. Debit transactions include rent, home loan EMI, energy bills, phone bills, vehicle loan EMI, health insurance, vehicle registration, green slip, vehicle insurance, school fees, cash withdrawal, payment at counters, money transfer, bills, and shopping. To maintain a realistic number of transactions per customer, we used a combination of a fixed set of transactions and a few random transactions such as shopping and restaurant expenses. Transaction consistency and integrity is maintained by ensuring that the account balance does not go negative. Financial transaction data are inherently unbalanced, with most transactions being legitimate and a minor number of transactions being suspicious. In practice, this ratio is typically approximately 99:1 with slight variations. To balance the synthetic data, we chose to label 95.64% of transactions as legitimate and 4.36% as suspicious. Money laundering transactions were created based on the suspicious money laundering scenarios listed in Table 1. In the banking sector, suspicious transaction data originate from alerts generated by rule-based AML systems, cases prepared post-alert cases, and SMRs submitted to regulatory authorities.

Table 2 shows some legitimate transaction scenarios that look like suspicious money laundering transactions, which are also called overlapping transactions. Such transactions are also used to train and verify whether the model can identify true money laundering transactions.

CNN is one of the methods of deep learning [39] that is widely and successfully used in the computer vision domain [40] for image analysis [41], classification and identification, speech recognition [42], and natural language processing [43]. CNN is also one of the most studied algorithms to address the challenges surrounding computing needs, which has helped refine the algorithm further. The automatic feature extraction capability of CNN is another attractive feature for researchers with complex data [44].

This study proposes Conv1D CNN classifier to identify suspicious transactions from financial transaction data. The CNN model captures patterns in the temporal order of the data. Conv1D has fewer parameters than Conv2D, which aids in faster training times and reduces the risk of overfitting. Owing to the limited receptive field of each neuron, the network focuses well on recognizing local patterns in the data, which are beneficial for the detection of suspicious transactions. Conv1D layers help reduce the dimensionality of the data by retaining important features and require fewer computations considering the large-scale nature of finance data. Figure 3 shows the architecture of the proposed CNN classifier, which includes the following layers: Conv1D, normalization, flattening, dropout, and a dense layer. The proposed CNN architecture used five different types of layers from the Sequential class, as provided in the Keras library [45], which was built on top of TensorFlow [46]. The layers are described as follows.

Figure 3:

At this juncture in AI/ML adoption, when it comes to selecting the classifiers for prediction, there is always a trade-off between accuracy and interpretability. Interpretability refers to how accurately a model associates a cause with an effect. Improved interpretability leads to better model explainability. Explainability refers to the extent to which interpretability can justify predictions. While in some domains such as weather prediction, accuracy may be valued more than model interpretability, in domains where the post-decision stakes are high, model interpretability is valued more to enable adoption. Domains such as medicine [53], regulatory compliance [54, 55] and criminal investigations [56] require the model to be interpretable or explainable. AML is one such domain in which model interpretability is critical [57].

In the banking sector, suspicious transactions detected by the AML system always go through investigation by the AML officer; hence, interpretability can help the officer investigate suspicious transactions more effectively. To reap the benefits of deep learning models, which are black boxes in nature, it is important to understand how such models make decisions. Recently, several post hoc methods (such as SHAP [58] and LIME [59]) have been developed to explain the predictions made by opaque or black box models, which apply yet another model on top of the black-box model and tweak the input to see the impact on output values. This helps gain an understanding of the feature importance considered by black-box models for making decisions. Some researchers have a different view that when the decision stakes are high, interpretable methods should be preferred over a post hoc approach for interpretability, and future research should focus on creating interpretable models [60].

This study chose a model named agnostic XAI method SHAP [58] to explain the predictions made by the CNN classifier. SHAP is based on the coalitional game theory [61], where feature values are considered team players, the dataset is considered a team, and the game result is considered a prediction. Each feature contributes to the prediction of the results. The SHAP quantifies the contribution of each feature value to the prediction made by the model. Each feature value represents one value within a single record. The core idea of SHAP is to reverse-engineer and calculate the impact of each feature value on the predicted target value.

The Shapley value explanation is represented as a linear model and additive feature attribution method [62]. SHAP [58] uses the earlier proposed explanation methods, DeepLIFT [63] and LIME [59], to explain the prediction for the original model f(z), as shown in Eq. (1). (1) fz=gz′=∅0+∑j=1M∅jZj′ f\left( z \right) = g\left( {{z^\prime}} \right) = {\emptyset _0} + \sum\limits_{j = 1}^M {{\emptyset _j}Z_j^\prime} where f(z) represents the CNN model in this case, z is the input parameter, g(z′) represents the explanation model, z′ ∈ 0, 1 M is the coalition vector, M is the maximum coalition size, and ∅ j ∈ R is a feature j attribution.

SHAP provides multiple explainers such as tree, gradient, deep, and kernel explainers [64]. DeepExplainer, which is an enhanced version of the DeepLIFT [63] algorithm from the SHAP library [64], was used to generate the Shapley values for the CNN classifier and then interpret the predictions using various plots supported by the library.

To measure the performance of classifiers used to detect suspicious transactions, we considered the following metrics.

TP and true negatives (TNs) are the transactions that are correctly classified [65, 66]. FPs and FNs are transactions that are incorrectly classified [67, 68]. With respect to the money laundering domain, FPs and FNs have specific importance. A FP indicates that the model has predicted the legitimate transaction as money laundering transaction, and this results in the AML officer manually reviewing it and eventually closing it, which increases the operational cost for the organization. On the contrary, a FN indicates that the model has predicted money laundering transactions as legitimate, which results in missing the actual money laundering transaction, thereby allowing money launderers to use the financial system, which is far more severe and costly than the operational cost of efforts spent on reviewing FPs. More FNs are an indication that the system is not effective and can lead the organization into noncompliance with effective controls, risks of a heavy penalty by regulatory, damage to brand, and corporate citizenship.

Accuracy is the percentage of correctly classified transactions [69] as defined in Eq. (2). Accuracy is one of the best metrics for understanding and measuring model performance, but it is not suitable when the data are highly imbalanced. In financial transaction data and fraud scenarios, the TNs are much higher than the FPs and FNs together, and it undermines the impact of FPs and FNs. Hence, we considered accuracy as a measure to determine the overall model performance, but this was not a key measurement criterion. (2) Accuracy=TP+TNTP+TN+FP+FN {\rm{Accuracy}} = {{{\rm{TP}} + {\rm{TN}}} \over {{\rm{TP}} + {\rm{TN}} + {\rm{FP}} + {\rm{FN}}}}

Precision is the percentage of predicted positives that are correctly classified [70, 71] as defined in Eq. (3). Usually, if the cost of FPs is higher than that of FNs, then precision is a better metric for measuring the performance of the model. In the money laundering scenario, this is an important metric, as it deals with the operational cost of the effort required for reviewing FPs. (3) Precision=TPTP+FP {\rm{Precision}} = {{{\rm{TP}}} \over {{\rm{TP}} + {\rm{FP}}}}

Recall is the percentage of actual positives that are correctly classified [71, 72] as defined in Eq. (4). Usually, if the cost of FNs is higher than that of FPs, recall is a better metric. In the money laundering scenario, this is a highly important metric because it involves a high risk of noncompliance, penalties, and brand image due to FNs or missing out on true money laundering transactions. (4) Recall=TPTP+FN {\rm{Recall}} = {{{\rm{TP}}} \over {{\rm{TP}} + {\rm{FN}}}}

F1 score combines the precision and recall metrics and determines the harmonic mean to measure the performance of the classifier [73] as defined in Eq. (5). For the money laundering detection scenario, to give higher weightage to recall, we have used the following formula to calculate the f_β score with β = 3. (5) fβ score=1+β2×precision×recallβ2×precision+recall {f_\beta }\;{\rm{score}} = \left( {1 + {\beta ^2}} \right) \times {{{\rm{precision}} \times {\rm{recall}}} \over {\left( {{\beta ^2} \times {\rm{precision}}} \right) + {\rm{recall}}}}

AUC score is used to identify the model’s capability to distinguish between legitimate and suspicious transaction classes [74, 75]. The AUC score represents the area under the curve plotted using the TP and FP rates, as defined in Eq. (6). The greater the area under the curve, the better the model. (6) AUC score=121+TPTP+FN−FPFP+TN {\rm{AUC}}\;{\rm{score}} = {1 \over 2}\left( {1 + {{{\rm{TP}}} \over {{\rm{TP}} + {\rm{FN}}}} - {{{\rm{FP}}} \over {{\rm{FP}} + {\rm{TN}}}}} \right)

The key input data for detecting suspicious transactions in banks include customer details, account details, and transactions. Table 3 provides the specifications of the data produced and used for training and testing the models. Transactions are classified into two classes: legitimate and suspicious. By nature, transaction data is highly imbalanced, where the majority class comprises legitimate transactions and the minority class comprises suspicious transactions. In line with this, highly imbalanced data was produced with a ratio of 95.64%–4.36%. The data were validated by an AML expert from the industry.

The CNN model underwent multiple rounds of training and testing to verify the results by tweaking the hyperparameters. Unlike weights and biases, which are learned by model during the training, the hyperparameters are set prior to training process and are crucial to determine the architecture and behavior of CNN model. We trained and tested the CNN model several times by changing the hyperparameters, including epochs (10–500) that define the number of iterations of passing the entire training data through training process, batch size (16–128) that defines the number of samples used in each iteration of the optimization algorithm, layers (2–6 Conv1D layers; combination of Conv1D, Batch, Dropout, Flatten, and Dense layers) that define the architecture of CNN, dropouts (by dropping and adding after each Conv1D layer)—a regularization technique that randomly drops certain percentage of neurons during training to prevent overfitting, number of units (64–2,048), activation function (ReLU, Softmax, Sigmoid) that introduces nonlinearity in data, allows it to learn complex relationships in the data, and finalizes the parameters. After analyzing various configurations, we finalized the parameters as shown in Table 4, which yielded optimal results with 100 epochs and a batch size of 32. The model was compiled using the Adam optimizer [76] and binary cross entropy loss function [45].

To compare the results of the CNN model, traditional ML models, namely, RF, XGBoost, and SVM, were developed. The hyperparameters of these models are shown in Table 5.

All classifiers considered 70% data for training and 30% data for testing the model. The split data were normally distributed with a feature column mean of 0 and standard deviation of 1 using a standard scaler. This made it easier to apply weights and train the model. Table 6 presents the performance metrics of the predictions made by the CNN, RF, XGBoost, and SVM classifiers. The metrics include confusion matrix (TNs, FNs, FPs, TPs), recall, precision, accuracy, AUC score, f_β score with β = 3, and training time.

The confusion matrix represents the performance and errors of the classifiers for classification. Type-I errors are shown as FPs, and type-II errors are shown as FNs. The error importance depends on the domain of the classification problem. In the case of AML, we assigned higher importance to type-II error after consulting with AML experts in the industry. Type-I error means more alerts and more operational efforts to investigate the alerts. Type-II error indicates that the system is not effective in identifying true suspicious transactions, which is a bigger risk from the compliance point of view and allows the launderers to exploit the financial system for their benefits. Hence, the model should have as few FNs as possible to improve suspicious transaction detection. Type-II error with high importance implies that recall metric is more important than precision; hence, we have considered f_β score metric calculation with β = 3 to reflect higher importance of recall metric. The results showed that CNN model outperformed other models considering FN identified, recall, and f_β score. The key characteristics of deep learning models are as follows: the accuracy improves with the increase in data size and, in the case of financial domain, millions of transactions are generated every day. This provides a good indication of the application of CNN model in the financial domain.

A FP represents a legitimate transaction reported as a suspicious money laundering transaction by the model. From a domain perspective, each FP transaction alert goes through manual investigation. The impact is that it requires the investigation time of the AML compliance officer, which is widely accepted in banks. Although the aim is to have as less FP as possible, there is a chance of missing out on TPs. Achieving the right balance is crucial, and this balance may come at the cost of the investigation.

FN represents a true money laundering transaction considered by the model as a legitimate transaction, which is a huge risk. The risk lies in the bank’s failure to detect the actual money laundering transaction, which results in noncompliance with regulatory policies. If the regulatory authority uncovers such missed transactions later, it may lead to substantial penalties to the bank.

The FN produced by the CNN model is far less than that of other ML models, which indicates that the model can address the risk relatively better than other models. To build trust in the decisions, the XAI model is applied, which shows the rationale behind the decisions, and the compliance officer can quickly take a call by seeing the rationale of the decision to determine whether it is a FP or TP.

From a practical perspective, financial institutions employ several approaches to detect suspicious money laundering transactions. It includes a transaction monitoring system, a rule-based AML system, identifying the topologies by employing different focused approaches, such as detecting anomalies and then investigating from a money laundering perspective, detecting money launderer gangs by detecting patterns using link analysis, graph learning, and social network analysis, and detecting suspicious transactions by applying natural language processing to read through the transaction remarks. AI-based systems often combine multiple classifiers to improve the results. This research presents an approach using one classifier that can be clubbed together while building an AI-based AML system and further enhances the reduction of FPs and FNs. Having FPs is not a “major” concern, as AML officers can still investigate it. FN is riskier as it goes undetected and should be minimized as much as possible. Hence, we believe that this CNN method would help in reducing the number of FNs, and the XAI technique would help the AML Compliance Officer to efficiently investigate the identified suspicious transactions. Figure 4 shows the AUC curves for CNN, RF, XGBoost, and SVM. The AUC measures the ability of the classifier to distinguish between transactions as suspicious or legitimate. The higher the curve, the better the model’s ability to distinguish between classification categories.

Figure 4:

The models are interpreted at both local and global levels. Local interpretation focuses on determining the reasoning behind the individual prediction, whereas global interpretation focuses on how the model behaves in general. This section describes the local interpretation using the SHAP. After training and testing the CNN classifier, we applied SHAP to interpret the feature importance considered by the CNN while making predictions. A DeepExplainer class from the SHAP library was used to generate the Shapley values for test data containing 24,410 rows and 40 columns, which took approximately 20 min to generate the Shapley values for each data value in the test dataset. The availability of Shapley values for each data element on a record makes it possible to explain the individual record prediction by applying these values to provide a view of the highly contributing features leading to a decision.

Figure 5 shows a force plot representing the interpretation of two individual record predictions made by the CNN classifier. The base value shown in the plot is the average value of the target variable across the dataset that was passed to the DeepExplainer class. Each arrow strip shows the impact of its associated feature on pushing the target variable away from or close to the base value. Red strips show that their associated feature pushes the value on the higher side (indicating a transaction as suspicious) with respect to the base value, whereas the blue strips show that the associated feature pushes the value on the lower side (indicating a transaction as legitimate).

Figure 5:

Figure 5A presents the interpretation of one record predicted as a suspicious transaction by the CNN classifier. The key features contributing to the prediction are credit, transaction amount, transaction description, KYC state, and transaction currency. Table 7 shows the details of an original transaction record that is predicted as a suspicious transaction. The table shows the values prior to converting them to numerical and categorical values that are submitted to model. The inference from the force plot is shown in Figure 5A and original transaction record is shown in Table 7. In the “Suspicious Transaction” column, where the customer associated with the transaction account appears to be a student, transaction is done in cash with decent large amount, and the cash is deposited into an account from ATM deposit machine, the account balance appears to be high. This showed a positive correlation with the transaction being suspicious. However, KYC state showed a negative correlation with the prediction because KYC review is complete and status is good; hence, it contributes negatively to the overall prediction. This inference makes the transaction suspicious and worthy of further investigation.

The suspicious transactions reported by financial institutions go through multiple levels of investigation (first by financial institution themselves, then FIUs, investigation agency, and court) before being qualified as a true money laundering transaction. The real value addition by the SHAP explanation for investigation is the identification of key contributing features for a prediction made by the CNN classifier.

Figure 5B represents the interpretation of a record that was predicted as a legitimate transaction by the CNN classifier. The key features that contribute to the prediction are transaction description, transaction location code, transaction location type, transaction currency, and transaction subtype. The “Legitimate Transaction” column in Table 7 shows the details of an original transaction record that is predicted as a legitimate transaction in Figure 5B. The inference from the force plot and original transaction record is that the customer associated with the transaction is a married woman aged 55 years, and the identified transaction is an auto-debit transaction that is paid online for health insurance in the local currency of her birth country, which concludes that the transaction is legitimate. Practically, legitimate transactions in banks will not be screened; however, they are presented here to demonstrate the interpretation to validate the reasoning by SHAP for the prediction made by CNN.

Figure 6 shows the global interpretation or the feature importance graphs for the RF, XGBoost, and SVM classifiers used in comparison with the CNN classifier. Each feature contributed differently to all three models. These are also opaque models, and SHAP can explain individual predictions, which is not considered in the scope of this paper.

Figure 6:

We conducted a study to apply the LIME XAI method to the Conv1D model, but this study found that LIME does not support the Conv1D classifier. LIME supports Conv2D. LIME requires data in a three-dimensional format, which is taken as an input by the Conv2D classifier, whereas the input data for Conv1D are two dimensional.

Banks have established several AML controls to combat money laundering, such as KYC, customer due diligence (CDD), enhanced CDD, risk profiling, watch list screening, sanctions, politically exposed person (PEP) screening, employee training programs, and transaction monitoring for suspicious activities. Considering the continuous increase in transactions, evolving fraud patterns, and changing regulatory requirements, any method that can help identify suspicious transactions is of great value to banks. Primarily, rule-based AML systems (usually bought from established software product companies that are specialized in financial crime) are used by banks for transaction monitoring, which have both advantages and disadvantages. However, the rule-based system is an essential and important system when it comes to detecting transactions for reporting as per the thresholds defined by regulations (e.g., cash transactions and IFTIs). On the positive side, rule-based systems are configured according to regulatory rules and historical money laundering scenarios, ensuring compliance with reporting thresholds (e.g., IFTIs). However, banks face several challenges in keeping these systems up to date along with the constantly changing regulatory landscape and money laundering patterns. Banks are involved in analyzing AI/ML technology to assist them in detecting suspicious transactions and reducing the compliance risk.

The outcome of this research, a novel method of detecting suspicious transactions using the CNN method, could be highly beneficial for banks. The recommendation for using this model is to ensure that the data attributes and data are in the required format, normalize the data, ingest the actual money laundering transactions as per the historical records available in banks as labeled training data, and train and test the model. It is important to note that the identification of suspicious transactions using CNN should be one of the components in the “to-be” AI-based AML system. The CNN method should be used together with other components to further improve the effectiveness of the outcome, including customer segmentation, risk profiling, social network analysis, customer screening, and sanctions screening, to establish adequate ground to define the suspiciousness of the transactions and report SMRs for compliance. The authors believe that the CNN method can improve the effectiveness of detecting suspicious money laundering transactions, leading to a reduction in compliance risk and operational cost required for the screening and investigation of FP alerts [77].

Furthermore, a bank’s future AI-AML system can be enhanced by incorporating the novel method of “explaining CNN predictions using the SHAP XAI framework,” as implemented in this research. The explanations generated by post hoc SHAP methods for CNN predictions would help AML officers view the reasoning behind the predictions and gather relevant evidence to enhance the investigation and report suspicious transactions with high confidence. An explainable AML system would help build trust [16] and drive the adoption of AI/ML technologies in the AML domain. This adoption can help manage compliance risks, maintain brand reputation, and avoid hefty penalties for noncompliance.

Banks offer a wide range of products, including accounts, loans, credit cards, insurance, securities, mobile transfers, checks, and money drafts. They serve various types of customers, including retail customers, small businesses, business banking, institutional banking, and investment banking. Additionally, regulatory requirements vary based on the country in which banks operate. Therefore, it is essential to comprehensively test the model while considering all diverse scenarios and data in stages. In this study, the model is tested on a limited set of data, whereas in a real banking scenario there would be millions of transactions per day; hence, the model’s performance considering the continuous flood of transactions must be tested. We believe that suspicious transaction detection depends heavily on the availability of historical money laundering transaction data for training.

A limitation of this study is that the models were not trained and tested on real transaction data. All experiments were performed on synthetic data that had limited types of customers, products owned by customers, and types of transactions, whereas in banks there would be a much more complex transaction dataset and access to external data sources such as PEP screening, world checklists, and social network datasets. Hence, the method proposed in this study should be validated on real data before it is considered for actual use.

This section illustrates the future research directions in continuation with this study. (1) Deep learning models are primarily designed to work with image type of data; hence, the recommendation is to convert the tabular dataset into images and apply the Conv2D CNN model to check the outcome for suspicious transaction detection. (2) Most state-of-the-art XAI techniques, such as SHAP [58] and LIME [59], support image data to explain the predictions made by deep learning models on image data; hence, converting the tabular data into images and then predicting suspicious transactions using the Conv2D CNN models can open up several XAI options to interpret the predictions. (3) From a data perspective, an optimization study can be performed to eliminate correlated features; for example, the Aquila optimizing technique [78] can be used to reduce the number of features before feeding the CNN model. (4) Attention Mechanism [79] on the CNN model can be used to further reduce FPs. (5) The use of long short-term memory (LSTM) or gated recurrent unit (GRU) model can be explored for predicting suspicious transactions. (6) The research on reinforcement learning methods can be enhanced by leveraging human decision-making knowledge to detect suspicious transactions.