Financial Crime & AML: Detecting Deceptive Language in Suspicious Activity Reports

What keyword screening gets wrong

AML compliance teams work with a limited vocabulary. Transaction monitoring systems trigger on specific patterns — rapid movement through multiple accounts, amounts just below reporting thresholds, unusual geographic routing. FinCEN SARs get filed when those thresholds are hit. But the narrative section of a SAR — the part where the filer explains what they observed — is text written by a human. And humans are capable of obscuring intent inside language that sounds plausible.

Consider what a sophisticated bad actor does before filing a SAR: they run the narrative through the same mental filter they'd apply to passing a polygraph. They choose words carefully. They avoid flagged terms. They construct explanations that sound consistent with each other. Keyword screening won't catch this. The deception isn't in the vocabulary — it's in the structure of the reasoning.

Three linguistic signals that matter in AML contexts

Research in applied psycholinguistics and deception detection has converged on a set of signals that reliably correlate with fabricated or strategically deceptive text in compliance settings. These aren't magic — they're statistical patterns that emerge at scale, and they apply specifically to the kind of deliberate, carefully-constructed language that appears in SAR narratives and CDD interview responses.

1. Pronoun distancing in beneficial ownership declarations

When describing actions they were personally involved in, honest people use first-person singular pronouns (I, my, me) at higher rates than people constructing alibi-like accounts. In beneficial ownership and KYC contexts, legitimate filers writing about their own decisions write close to the material — "I opened the account," "I routed the funds." Deceptive actors unconsciously create distance: "The decision was made to open the account," "Funds were routed through the account." This is the same pronoun-distancing effect documented in forensic psychology literature — it's not unique to AML, but it shows up clearly in suspicious filings.

2. Hedging in transaction explanations

Legitimate transaction explanations are specific: "Wire transfer for Q2 vendor invoice #4892." Deceptive explanations hedge against scrutiny without being obviously evasive: "The payment was processed in accordance with standard business protocols," "Funds were moved as part of routine operational activity." This hedging — modal verbs, passive voice, abstract nouns — is a deliberate attempt to make the explanation sound defensible if reviewed, rather than to accurately describe what happened. High hedging scores in transaction narratives are a reliable signal worth flagging for secondary review.

3. Cognitive complexity drops in fabricated account histories

This one is subtle. Honest account histories — explaining why an account was used in a particular way, what the business relationship looked like, how a transaction fits into a pattern — show natural variation in sentence complexity. Writers move between simple and compound sentences, include tangential context, drop in specifics. Fabricated or strategically edited histories show a different pattern: uniformly low complexity with high word count. The writer is maintaining the structure of a detailed explanation while stripping out the cognitive variation that natural language has. It's the writing equivalent of someone keeping their hands very still so they don't shake.

How Candor's API works in an AML context

The Candor API accepts any text input and returns a deception risk score (0-100) along with per-signal breakdowns. For AML teams, the integration point is straightforward: text from SAR narratives, CDD interview transcripts, or wire transfer justification fields gets passed to the API on ingestion or during a periodic review batch. Flagged items get routed to a senior reviewer.

The API response includes both an aggregate score and per-signal scores so investigators can understand why a filing was flagged. This matters for audit trails: a BSA officer needs to be able to explain to a regulator why a particular filing was escalated. Candor's signal-level breakdown provides that documentation.

Signal overview for AML teams

What this doesn't replace

Linguistic analysis is a prioritization tool, not a determination. It won't tell you whether a SAR is fraudulent — it tells you which SARs to look at first, and gives your BSA officers a structured basis for that selection. The judgment call on filing a SAR still belongs to the compliance officer.

Candor also doesn't replace transaction monitoring systems. Those catch the behavioral patterns — the amounts, velocities, and routing. Linguistic analysis catches the narrative layer: the text that explains those behavioral patterns. Using both together closes the gap that bad actors exploit when they write clean explanations for suspicious transactions.