Building on my previous deep dive into the technical integration of IBM watsonx Orchestrate and Neo4j, it is time to put that architecture into practice. In this post, I am excited to present a specialized use case from the field of Anti-Money Laundering (AML): The Phantom Timber Network. In modern financial crime fighting, the greatest challenge isn’t a lack of data—it’s the inability to see the connections within it. Traditional systems often struggle with “siloed” information, which is exactly what money launderers exploit. In this case study, the fraud analyst sits at the heart of the investigative process who directs a powerful technological duo through natural language.
Please note that all entities featured in this case study are entirely fictional. The case is built exclusively on synthetic data. Therefore, any resemblance to real-world entities, past or present, is purely coincidental and unintentional.
Prologue: The Regulatory Climate
It is early 2026. Aurelius Meridian Bank in Frankfurt is operating under the strict EU-AMLR (Art. 26) and the latest EBA Guidelines. The focus has shifted from finding big transactions (transaction-focused) to understanding customer behavior (relationship-centric, ongoing monitoring). The bank uses an AI agent, integrated with an internal graph database (internal knowledge; Know Your Customer (KYC) and Beneficial Ownership (BO)) and Retrieval-Augmented Generation (RAG) (external knowledge from public available data) to ensure immediacy (German: “Unverzüglichkeit”) in reporting.
Chapter 1: The Behavioral Trigger
Based on the regulations above, the banks monitoring system does not flag a transaction because it is over a certain amount. Instead, it triggers an alert on Vandemar Logistics GmbH because of a profile deviation.
- Scenario: Vandemar Logistics GmbH, a long-time client in the timber industry, receives three payments totaling €155,000 from Zaffre Horizon Ventures LLC in the UAE.
- Conflict: The payments are labeled as consulting fees.
- Regulatory alignment: Based on EU-AMLR (Art. 26) (ongoing monitoring), the bank’s alerting system identifies that Consulting is inconsistent with the customer’s known business purpose (selling wood).
Now, Lukas, a Senior AML analyst at Aurelius Meridian Bank steps in. He receives the alert. He doesn’t just see a number. He sees a Red Flag for mismatch with business profile.
Chapter 2: Internal Data Fusion
Lukas needs to find the “hidden network”. He first prioritizes internal KYC/BO and relationship data which is stored in the banks graph database:
Lukas is asking the AI agent:
Retrieve the KYC profile for Vandemar Logistics GmbH and summarize the purpose of its last three incoming transactions, including their sender.
Result: Vandemar Logistics GmbH industry is Timber & Wood Processing. Transactions total €155,000 for Strategic Consulting, Brokerage Services and Market Analysis from a company called Zaffre Horizon Ventures LLC. This is a mismatch with the expected business profile.
Lukas dives deeper and performs an internal relationship discovery by asking the AI agent:
Check for Zaffre Horizon Ventures LLC. Are there any connections to sanctioned entities or shared addresses? Give me all details.
Result: Zaffre Horizon Ventures LLC shares a registered office (Obsidian Spire, Suite 99, Dubai) with Kinetix Circuitry while there is no direct ownership link.
Lukas is asking the AI agent:
Tell me more about Kinetix Circuitry and their status.
Result: The AI agent reveals that Kinetix Circuitry is already on the bank’s internal sanctions watchlist for dual-use goods.
Regulatory alignment: Lukas is performing Network Analysis and Entity Linkage, moving beyond the individual transaction to the Counterparty & Network layer following EBA Guidelines on Money Laundering/Terrorist Financing (ML/TF) risk factors.
Chapter 3: External Contextual Intelligence
Lukas has a suspicious link (the address). Now he needs actual indicators (German: Tatsächliche Anhaltspunkte) of a crime to avoid defensive reporting.
Lukas is now asking the AI agent:
Search external trade intelligence and adverse media for Zaffre Horizon Ventures LLC and Kinetix Circuitry regarding ‘Timber’ and ‘Sensors’.
The AI agent synthesizes three (fictive) publicly available external data sources and finds the following information:
- A trade blog reporting that Zaffre Horizon Ventures LLC is a known front for shipping high-tech sensors.
- Kinetix Circuitry is sanctioned for dual‑use sensors.
- A regulatory notice warning about Suite 99 in Dubai as a “Shell-in-Suite” hub.
Result: Vandemar Logistics GmbH is identified as an active, complicit participant, rather than a passive victim. Vandemar Logistics GmbH has moved from being a legitimate business to a professional enabler for sanctions evasion. Why is that the case?
- Since they are a sawmill, they know they are not providing consulting. By accepting these funds under a false label, they are actively participating in falsifying the transaction’s economic purpose.
- The external search found that Zaffre Horizon Ventures LLC 3x market rates for timber firms to sign these fake agreements. This suggests Vandemar Logistics GmbH made a conscious business decision to trade its reputation for high-margin “consulting” fees.”
Regulatory alignment with Wolfsberg principles on negative news (1) (2) – this step provides the Context and Public Risk Indicators required to build a solid case.
Chapter 4: The Synthesized Suspicious Activity Report (SAR)
Lukas must now report these findings to the Financial Intelligence Unit (FIU). Under the German Money Laundering Act (Geldwäschegesetz – GwG), overseen by Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), such reports must be filed without delay (German: Unverzüglichkeit) and must be complete (German: Vollständigkeit) (1) (2).
Lukas asks the AI agent:
Generate a SAR narrative for Vandemar Logistics GmbH. Explicitly link the profile mismatch to the shared address with Kinetix Circuitry and the trade intelligence findings as well as regulatory alignments.
The result: A SAR draft is generated by the AI agent for Lukas’s final review:
This workflow ensures regulatory alignment with BaFin and FIU guidance for immediate reporting (German: Unverzüglichkeit). By leveraging the AI agent to fuse internal and external information, Lukas transformed a six-hour manual investigation into a ten-minute process. He has moved beyond defensive reporting of isolated transactions. Instead, he can now validate the AI-generated draft and dive deeper into reporting a verified risk network.
Further resources
- AMLR: Regulation (EU) 2024/1624 – Art. 26 Ongoing Monitoring. (eur-lex.europa.eu)
- EBA: Guidelines on ML/TF risk factors (consolidated; 2021/2023; Updates 2024/2025). (eba.europa.eu)
- Travel Rule: Reg. (EU) 2023/1113 & EBA Travel Rule Guidelines (applicable as of Dec 30, 2024). (eur-lex.europa.eu, eba.europa.eu)
- BaFin: Interpretative and Application Guidance on the German Money Laundering Act (AuA GwG, Nov 2024); BaFin/FIU Guidance Note on the “Immediacy/Completeness” of Suspicious Activity Reports (SAR). (bafin.de, zoll.de)
- FATF: Recommendations (updated 10/2025); R.20 (STR filing obligation). (fatf-gafi.org, ablerconsulting.com)
- Wolfsberg Group: Monitoring for Suspicious Activity (MSA) 2024; AI/ML Principles 2022; Negative News FAQs 2022. (wolfsberg-group.org)
- Basel Committee: Sound management of ML/FT risks (rev. 2020). (bis.org)