Money Laundering Checks: Verify GNN Recall Claims Before You Flag or Freeze

This guide delivers a verify-before-you-commit method for checking any reported graph neural network recall figure before relying on it. The grounding provided here does not contain a Lazarus Group cross-exchange recall result, so no such figure is asserted; instead, the guide sets out the checks to run before committing to one.

It requires comparing like-for-like totals and terms before committing to any reported result.

How It Works

At its most basic level, money laundering is the process of concealing the identity, source, or destination of illegally gained money by moving it through financial transactions to make it appear legitimate, as described by Wikipedia. This is the broader act of obscuring funds, not the act of obscuring a single payment itself. The key distinction is what is being hidden: the money, or the transaction.

The mechanism for transaction laundering works differently. According to Unit21, it occurs when one merchant processes payment card transactions on behalf of another merchant, misrepresenting who the true seller is. As LegitScript points out, while money laundering obscures the source of funds, transaction laundering obscures the source of a payments transaction. This is why, as Protiviti Global notes, the complexity of the payments network makes it difficult to detect without looking beyond the face value of a payment.

To properly identify these setups, there are a few key terms to define. A front merchant is the merchant account shown to the acquirer, while a proxy merchant is used to route transactions between parties. A shell merchant is an account with little to no legitimate commercial activity. As Onlayer explains, these roles are often used together, and they are not always obvious from a single transaction alone.

One example of related trade activity comes from Global Trade Review (GTR), which reports the United States alleges American Express processed US$13bn in trade-based money laundering transactions. While this is an allegation, it shows how large payment channels can be involved in obscured trade activity. With that in mind, the mechanism for detection is a relationship-based one: instead of looking at one payment in isolation, the path between the merchant of record and the actual seller must be examined.

For the purpose of measuring connections, this is where a graph-based approach comes in. By mapping merchants, accounts, and transaction links together, the structure of these relationships can be viewed as a network. The check is not to assume a link exists, but to confirm the true seller relationship from available metadata before treating any connection as verified. Without that confirmation, the obscured path remains unproven.

Key Factors to Consider

The second decision criterion is label integrity. The ground truth must be traceable to confirmed case files for the exact flow type being measured, not inferred activity. As pointed out by Onlayer, transaction laundering relies on obscuring the source of a payments transaction through front, proxy, or shell merchants, which can create false groupings if labels are assigned by surface similarity. Because of this, the check is not how many labels exist, but whether each label can be tied to a verifiable case file for that exact flow type. Without that traceability, recall becomes untestable against the stated target.

The third decision criterion is definition parity. The definition of "recall" used for the graph neural network must match the definition used for any benchmark it is measured against. LegitScript notes that transaction laundering is distinct from obscuring the source of funds, so a benchmark built for general money laundering detection may not be measuring the same event class. Before committing, confirm the exact event definition in writing, and do not assume parity between two reports that both use the word "recall".

As for the numbers that matter, the only verifiable reported total from the provided grounding is the allegation by Global Trade Review that Amex processed US$13bn in trade-based money laundering transactions. That figure is not tied to any specific cross-exchange flow set, so it cannot be used as a target for this measurement. Instead, the numbers to demand are the live totals for the exact evaluation set: the count of confirmed flow instances of the type being measured, the count of those instances present in the dataset, and the count used to calculate recall. If any of those three totals cannot be produced in full for the same dataset snapshot, the arithmetic cannot be verified, and no reported recall should be committed to.

Common Mistakes

This section alone covers the pitfalls with concrete examples. The first pitfall is scope bleed, where the category being measured is not matched to the category being reported. As Wikipedia states, money laundering is the process of concealing the origin of illegally gained money, but as LegitScript points out, transaction laundering is about obscuring the source of a payments transaction itself. For example, if a reported recall is meant to reflect cross-exchange flows, but the test set only contains direct account transfers with no merchant payments, the totals are not like-for-like. The check is to split by transaction class and confirm the exact class being claimed before committing to any comparison.

The second pitfall is ground truth exclusion by merchant identity. According to Onlayer, front, proxy, and shell merchants are used to misrepresent the true seller in order to hide the source of a payments transaction. A concrete example of this is an evaluation that only labels merchants from a pre-approved flag list, while leaving unlisted merchant chains out of the ground truth entirely. In that case, the model is not being tested against the full set of merchant-based paths, so the reported recall cannot be verified against the same population. The rule here is to demand the full merchant inclusion list for the ground truth and confirm it matches the laundering type being measured, not just the exchange endpoints.

Beyond those two, a necessary verification is to not confuse the object of detection. G2 Risk Solutions describes transaction laundering detection as revealing hidden connections between merchants and networks selling violating content. With that in mind, before committing to a reported recall, confirm whether the count is for the full cross-exchange path, or only for identifying a single merchant node. If the definition of a "hit" is not made explicit and matched to the path being measured, the comparison cannot be treated as complete.

Insider Tactics

One non-obvious strategy is to treat the graph edge set as a permission list that must be proven, not assumed. When testing recall against cross-exchange links, do not accept a single merged export as the full join. Instead, force the build to show the exact merchant-to-merchant linkage used for the test, since G2 Risk Solutions points to hidden connections between merchants as the very thing that must be revealed. The check is provenance: for the batch you are about to commit to, you need to know which feeds were joined, not just how many nodes were loaded.

For a timing tip, do not lock into a recall claim off of an old snapshot. The link set for cross-exchange activity can shift between pulls without any obvious change to the file name. Before committing, verify the snapshot state used for the graph build against the snapshot state used for the AML transaction dataset, and only compare like-for-like totals and terms. If those two states cannot be matched at the moment of review, the option is not live and complete enough to commit to.

Another practical move is to isolate a small, verifiably linked subgraph of cross-exchange hops and run a dry pass against it first. This is not a shortcut to a global score, but a way to catch a partial join before scaling to the full 2024–2026 set. Pay extra attention to paths that fall under transaction laundering, as Unit21 describes it as one merchant processing on behalf of another, which is the type of linkage that can be dropped if the join keys are mismatched.

Finally, when the evaluator cannot produce the exclusion list for the test split on demand, treat that as a block to commitment. Do not trade that missing list for a single recall figure. The goal of these tactics is not to chase the highest reported recall, but to only commit to one that can be fully verified at the exact moment you are asked to do so.

Comparison

To force that like-for-like test, one verified scale anchor can be used: Global Trade Review (GTR) reports the US alleges Amex processed US$13bn in trade-based money laundering transactions. This single figure does not provide a recall rate, but it does show that trade-based flows can reach a multi-billion scale in an allegation. With only that figure from grounding, no option can be allowed to blend unrelated merchant categories into its denominator and still claim coverage of trade-based or cross-exchange laundering flows. The totals must be reconciled to that class, or the option must be rejected on scope alone.

Side by side, the vendor option can win only if it provides a fully disclosed test set with every flow restricted to the exact class being measured, with no mixing from other categories. The in-house option can win only if it can enforce that same restriction and audit the link between flagged nodes and the trade-based class. Between the two, the in-house option is the stronger choice for a verify-before-you-commit decision, because it has the ability to refuse mismatched flows at the time of measurement. However, that advantage is conditional: if the in-house option cannot produce same-class totals to match against, it loses that advantage and must not be committed to either.

As the final comparison rule, do not average or split the US$13bn across the two options. Treat it strictly as a scope anchor for the trade-based class, and only commit to the option that can prove like-for-like totals and terms. Any option that cannot do that fails the comparison, no matter how large its unverified recall appears.

What to do next

Frequently Asked Questions

What is the exact amount of the trade-based money laundering allegation against Amex?

The US alleges Amex processed US$13bn in trade-based money laundering transactions.

According to Unit21, what defines transaction laundering?

Unit21 defines transaction laundering as one merchant processing payment card transactions on behalf of another merchant.

What specific connections must transaction laundering detection expose per G2 Risk Solutions?

G2 Risk Solutions states transaction laundering detection must reveal hidden connections between merchants and networks selling violating content.

Which merchant categories does Onlayer say must be identified?

Onlayer calls for identifying front, proxy, and shell merchants while watching for technical metadata signals.

Is there a Lazarus Group cross-exchange recall result available in this guide?

The grounding provided here does not contain a Lazarus Group cross-exchange recall result, so no such figure is asserted.

What must be done before committing to any reported graph neural network recall figure?

It requires comparing like-for-like totals and terms before committing to any reported result.

Quick answers

Also worth reading: Measuring Real Business Value from AI Investments: Measuring Real Business Value from · Upgrading PHP and Python Projects with Enterprise AI in 2026: Upgrading PHP and Python Projects · Secure Enterprise AI: PHP vs. Python Code Examples for 2026-2027: Secure Enterprise AI: PHP vs.