Network and Link Analysis Tools

Why This Topic Matters for the CAMS Exam

Modern money laundering rarely happens through a single account or a single transaction. Criminals deliberately spread activity across many accounts, entities, jurisdictions, and intermediaries to hide the connection between dirty money and its source. Traditional rule-based transaction monitoring looks at accounts one at a time and often misses these relationships. Network and link analysis tools exist to solve exactly this problem: they reveal hidden connections between people, companies, accounts, addresses, devices, and transactions.

In the CAMS curriculum, this topic sits within Monitoring, Investigation, and AI Technology. The examiners expect you to understand what these tools do, how they support investigations and suspicious activity reporting, how they relate to technologies such as machine learning and graph databases, and, crucially, what their limitations and risks are. Questions in this area tend to be scenario-based and test whether you can identify when link analysis is the right tool and how an investigator should use its output responsibly.

What Network and Link Analysis Is

Link analysis is an investigative technique that identifies and visualizes relationships between entities. In an AML context, an entity can be a customer, a legal person, a beneficial owner, a bank account, a transaction, a phone number, an email address, a physical address, an IP address, a device identifier, or a counterparty. A link is any relationship connecting two entities: shared ownership, a transfer of funds, a common address, a shared director, a joint account, or a common device.

Network analysis takes this further by studying the overall structure of the web of relationships. Instead of asking only "who is connected to whom," it asks questions such as: Which entity sits at the center of this network? Which accounts act as hubs or funnels? Are there clusters of accounts that behave as one coordinated group? Where does money enter and exit the network?

Key terms you should recognize:

Node - an entity in the network (a person, account, company, etc.).
Edge (or link) - a relationship or transaction connecting two nodes.
Graph - the complete set of nodes and edges, often stored in a graph database.
Centrality - a measure of how important or connected a node is within the network. A node with very high centrality may be a controller, a money mule hub, or a shell company used for layering.
Cluster or community - a group of nodes that are more densely connected to each other than to the rest of the network; this often exposes coordinated rings.
Degrees of separation - how many links lie between two entities; investigators often look at first-degree (direct) and second-degree (indirect) relationships.
Entity resolution - the process of recognizing that different records (e.g., "J. Smith," "John Smith," and "Jon Smyth" at the same address) refer to the same real-world entity. Good link analysis depends on good entity resolution.

How Network and Link Analysis Tools Work

1. Data aggregation. The tool pulls data from many sources: core banking systems, KYC and CDD records, beneficial ownership registers, transaction monitoring alerts, wire transfer data, sanctions and PEP screening results, negative news, corporate registries, and sometimes external data such as leaked documents or public records. Internal data is often combined with third-party data providers.

2. Entity resolution and data cleansing. Before relationships can be mapped, the tool must match and merge duplicate or inconsistent records. This step uses fuzzy matching, standardization of names and addresses, and increasingly machine learning. Poor data quality at this stage produces either missed links (false negatives) or spurious links (false positives).

3. Graph construction. Entities become nodes and relationships become edges. The relationships can be explicit (a documented transfer from Account A to Account B) or inferred (two accounts share the same phone number and login device).

4. Analysis and scoring. Algorithms examine the graph to detect patterns: circular flows of funds (round-tripping), rapid pass-through accounts, fan-in and fan-out patterns typical of money mule networks, concentration of funds in a single node, shared attributes among seemingly unrelated customers, and connections to known high-risk or sanctioned parties. Many tools apply risk scores to networks, not just individual customers, and can prioritize alerts accordingly.

5. Visualization. Results are presented as interactive diagrams where investigators can expand nodes, filter by time or amount, and follow the money visually. Visualization is one of the most valuable features because it allows a complex scheme to be understood and explained quickly, including to regulators, law enforcement, and senior management.

6. Investigation and documentation. The investigator uses the visual network to form a hypothesis, gather supporting evidence, document findings, and decide whether to file a suspicious activity report (SAR/STR). Link charts are often attached to or described in the SAR narrative to explain how parties are connected.

Typologies Where Link Analysis Is Especially Powerful

Money mule networks - many low-value accounts receiving funds and forwarding them to a small number of collection accounts.
Shell and front company structures - companies sharing registered agents, addresses, directors, or nominee shareholders.
Trade-based money laundering - repeated transactions among a closed group of importers, exporters, and intermediaries.
Human trafficking and smuggling - shared phone numbers, addresses, and funnel accounts across geographies.
Fraud rings and synthetic identities - multiple identities tied to the same device, IP address, or email domain.
Sanctions evasion - indirect ownership or control chains linking a customer to a designated party.
Corruption and PEP-related laundering - funds moving through relatives, associates, and layered corporate vehicles.

Relationship to Artificial Intelligence and Machine Learning

The CAMS syllabus groups this topic with AI technology for good reason. Modern link analysis platforms increasingly use machine learning for entity resolution, for detecting anomalous network structures, and for ranking which networks an investigator should review first. Graph analytics can also feed features into machine learning models used in transaction monitoring, so that a customer's risk score reflects not only their own behavior but the behavior of their connections.

However, you should remember the governance principles that apply to all AI in AML: models must be explainable, validated, tested for bias, documented, and subject to human oversight. Regulators expect a financial institution to be able to explain why a network was flagged and why a SAR was or was not filed. A "black box" that cannot be explained is a compliance risk in itself.

Benefits

Reveals relationships invisible to account-level monitoring.
Improves the quality and depth of SAR narratives.
Reduces investigation time by consolidating data from many systems into one view.
Helps prioritize alerts by focusing on networks with the highest aggregated risk.
Supports enterprise-wide risk assessment by exposing concentrations of risk.
Strengthens cooperation with law enforcement, who frequently use similar tools.

Limitations and Risks

Data quality dependence - incomplete or inconsistent data produces misleading networks.
False connections - two customers sharing a common address may simply live in the same apartment building. A link is not proof of wrongdoing; it is a lead that requires investigation.
Privacy and data protection - aggregating personal data across sources raises obligations under laws such as GDPR; access must be controlled and purpose-limited.
Information sharing constraints - links across institutions or borders may be limited by confidentiality, bank secrecy, and SAR tipping-off rules. Safe-harbor provisions such as Section 314(b) in the United States enable some sharing among financial institutions.
Over-reliance on technology - the tool supports human judgment; it does not replace it. Investigators must still verify, corroborate, and document.
Cost and complexity - implementation requires significant investment, integration, and skilled staff.
Model risk - algorithms must be validated and periodically tuned to avoid both missed activity and alert overload.

Best Practices for Using These Tools in Investigations

Start with a clear investigative question rather than browsing randomly.
Verify every significant link against source documents before relying on it.
Record the data sources, date ranges, and filters used so the analysis can be reproduced.
Distinguish clearly in the SAR narrative between confirmed facts and inferred relationships.
Respect need-to-know access and data protection requirements.
Escalate findings about related accounts so that the entire network, not just one account, is reviewed and, if appropriate, exited or reported.
Feed confirmed typologies back into monitoring rules and model training.

Exam Tips: Answering Questions on Network and Link Analysis Tools

Tip 1: Identify the core purpose. If a question asks what link analysis is primarily used for, the answer is almost always about identifying relationships or connections between entities that would not be obvious from reviewing a single account or transaction. Distractors will describe things like calculating a customer's risk score in isolation or screening names against a sanctions list, which are other tools.

Tip 2: Recognize the scenarios. When a scenario describes many accounts sending funds to one account, multiple companies sharing an address or director, or several customers using the same device, the exam is signaling that network or link analysis is the appropriate technique. Choose the answer that recommends mapping the relationships among the parties.

Tip 3: A link is a lead, not a conclusion. CAMS consistently rewards measured, risk-based judgment. If an answer option says an investigator should immediately file a SAR, close accounts, or treat a customer as a criminal solely because the tool shows a connection, it is usually wrong. The better answer involves investigating further, corroborating the link, and documenting the analysis before deciding.

Tip 4: Watch for data-quality and entity-resolution themes. Questions may describe inconsistent naming or duplicated customer records and ask about the first step or the main challenge. The answer typically relates to entity resolution or improving data integrity before relying on network output.

Tip 5: Connect to AI governance principles. If a question involves a machine-learning-driven network tool, remember explainability, model validation, documentation, bias testing, and human oversight. The regulator-friendly answer is never "trust the algorithm."

Tip 6: Remember privacy and information-sharing limits. When a scenario involves sharing network findings with another institution or across borders, consider tipping-off prohibitions, data protection law, and available safe harbors. The correct answer respects legal constraints while still pursuing the investigation.

Tip 7: Think about SAR quality. The exam may ask how link analysis improves reporting. The strongest answer is that it allows the institution to describe the full network of related parties and the flow of funds, producing a more complete and useful SAR narrative for law enforcement.

Tip 8: Eliminate absolutes. Options containing words like "always," "never," "guarantees," or "eliminates the need for" are usually distractors. Link analysis supports and enhances investigations; it does not eliminate the need for transaction monitoring, CDD, or human review.

Tip 9: Know the vocabulary. Be comfortable with nodes, edges, graph databases, centrality, clusters, fan-in/fan-out, pass-through, and degrees of separation. Questions may use these terms directly, and recognizing them quickly will help you understand the scenario.

Tip 10: Apply the "what would a prudent compliance officer do" test. Across all CAMS questions, the correct answer is the one a thoughtful, risk-based, well-governed compliance professional would choose: use the tool to gather and visualize evidence, verify it, document it, escalate appropriately, protect data, and report when suspicion is supported.

Quick Review Summary

Network and link analysis tools map relationships among entities to expose coordinated or layered illicit activity. They work by aggregating data, resolving entities, building a graph, applying analytics, and visualizing results for investigators. They are especially effective against mule networks, shell companies, trade-based laundering, and sanctions evasion. They increasingly rely on machine learning, which brings governance obligations. Their main risks are poor data quality, false connections, privacy concerns, and over-reliance. On the exam, choose answers that treat links as investigative leads requiring verification, that respect legal and privacy limits, and that use the tool to strengthen, not replace, human judgment and documented, risk-based decision-making.