Cross-border AML transaction monitoring with FinomMaking Transaction Forensics part of their AML compliance engine allowed ambitious fintech Finom to counter unique types of financial crimes and to expand rapidly—without replacing their existing transaction monitoring system.
Finom: Monitoring transactions in a pan-European context
Finom is an innovation-driven fintech whose mission is to simplify the lives of small and medium businesses and freelancers who are the economic backbone of Europe. Since its founding in 2019, Finom’s financial services—which include payments, electronic invoicing, expense management, and accounting integrations—have facilitated over €4 billion in annual transactions in Germany, France, Italy, Belgium, and the Netherlands. Finom’s goal: to offer best-in-class financial services in every country within the EU.
These past successes and future ambitions rely on aggregating myriad data streams in a single tailor-made transaction monitoring system. Finom built theirs from scratch to provide a familiar, unified workspace where the company's AML analysts can efficiently conduct investigations into the diverse AML challenges unique to each country where Finom operates.
Encountering the limitations of rule-based systems
But it's precisely when entering new operating environments that new threats arise. "As a new kid on the block, we are particularly exposed to various types of fraudsters and other scammers trying to exploit our systems, trying to find how they can use us for their benefit," said Kseniia Kutyreva, Head of Risk and Compliance at Finom. "So the early days in every country where we launch is when our risk engine in the CDD domain—and our detectors and alerts in transaction monitoring—are really put to the test."
The main challenge proved to be an existing system that couldn't keep up with unique activity patterns. Concerning behavior in one country may be normal in another, yet the rules-based system generated an alert whenever a transaction filled a specific condition. As a result, the Finom team struggled to cope with false positives—95% of the time—versus genuinely unusual activities worth investigating. Analysts ended up spending most of their efforts where they weren't needed.
This also risked wasting the time and patience of customers who unwittingly triggered alerts in the course of normal activities, resulting in requests for information where they were not in fact needed.
"One case could potentially take a week to resolve end-to-end, could be longer. It's at least one or two days, which is already too long if you're a regular person who just sent a big payment," continued Kseniia.
Reviewing these rules to improve output was time-consuming and wasn't effectively countering the unique local AML typologies Finom was encountering across Europe. Tackling increasingly complex customer behaviors with rules alone was leading to an unwieldy system that still produced sub-optimal results. For Kseniia, "There's only so much you can do with if–then logic: it doesn't take context into account."
She described the difficult question Finom faced: "When do we stop hiring more people to review these rule-based alerts and implement a smart solution to provide more targeted monitoring?" An added complication: Could such a solution work within their bespoke transaction monitoring system? That's when they turned to Resistant AI for help.
New detections put new risks into context
"For years I was speaking with different providers and [none] ever truly aligned with what we were searching for," said Kseniia. But in a chance demonstration of Resistant AI's Transaction Forensics, she found "a scientific, methodological approach to detecting suspicious activity in transaction monitoring." Better yet, she added, "The fact that we could use our alert management system was a huge advantage."
As an overlay onto Finom's existing transaction monitoring tool rather than an entirely new system, Resistant AI began digesting Finom's data streams in mid-2022 after only a few weeks of implementation. Rather than trying to tinker with inflexible rules, the ensembles of models that make up each Transaction Forensics detector use statistical anomalies to uncover previously unseen relationships and behaviors that are out of the ordinary for certain customers. Not only do Resistant's detectors bring truly unusual behavior to the fore, they do so along with detailed descriptions and priority indicators that contribute to swift investigations. All the while, analysts maintain a single workspace—and a single source of trust.
These insights contributed to better and faster investigations straight away: "When analysts have a clear idea of what they're looking for, when they have sufficient context and clear explanations of why an alert was triggered, they won't waste their time where it's not necessary," Kseniia explained.
Higher-quality investigations also serve a purpose when it comes to oversight, she continued: "The Resistant team does an excellent job of describing how their detectors work to non-technical people, which is crucial when developing an internal risk management framework and communicating it to third parties such as auditors and regulators."
But the Finom–Resistant collaboration didn't stop at first implementation. Kseniia appreciates ongoing "direct access to the tech team and regular meetings with data analysts throughout our relationship. The Resistant team continuously comes up with new detectors and are happy to explain how things work and adjust to Finom's needs as necessary." In the two months following the deployment of Transaction Forensics, findings from Finom customer transactions and new developments at Resistant grew the number of deployed detectors from 16 to 28.
This combination of explainability and rapid adaptability is a crucial edge for an ambitious financial services provider like Finom. "When we launched in the Netherlands, we were able to identify one of our first unusual customers thanks to a Resistant alert, which was an exciting milestone for us!" said Kseniia. For her and her team, this is just the beginning: "When we think about geo-expansion we always talk with Resistant, because the ability to request new detectors is comforting and means we don't have to wait for months to detect new trends in a particular country. It will take just a few weeks to have a new method to detect a new pattern that we haven't seen yet."