# #17: Anomaly Detection in Payment Systems: Findings and Implications

**3 Sept**  
Written By [Saiesha Pitroda](/content/all-fna-broadcasts?author=6825c3024b109a092cd591c8/index.html)

**7th November 2024**

**With:**  
\| Anneke Kosse (Bank for International Settlements)  
\| Ajit Desai (Bank of Canada)

---

Guests **Anneke Kosse** (BIS) and **Ajit Desai** (Bank of Canada) join FNA to discuss their landmark working paper, _"Finding a Needle in a Haystack."_ In a global financial system where high-value payments are settled within seconds, identifying a single malicious or erroneous transaction is a monumental challenge.

Our guests detail their novel **two-layer machine learning framework**. The first layer uses supervised learning to filter out "typical" payments with **93% accuracy**, while the second layer applies unsupervised learning to flag anomalies within the "unusual" pool. This approach allows central bank operators to detect signs of cyberattacks, liquidity stress, or operational failures before they cascade into systemic crises, offering a significant performance improvement over legacy econometric models.

**Key Discussion Points:**

- **The Layered Strategy:** Why a two-step process—separating "typical" from "unusual" before deep-scanning for anomalies—is the most efficient way to handle massive data volumes.
- **Beyond Rule-Based Systems:** How non-linear ML models identify complex patterns that traditional "if-then" rules and econometric models miss.
- **Cyber-Resilience:** Using the framework to detect "silent" cyber-attacks where an adversary might attempt to drain funds through a series of subtly unusual transactions.
- **Early Warning Signals:** Identifying the "first tremors" of financial stress at individual institutions by monitoring deviations from their historical payment behavior.
- **System-Wide vs. Siloed Monitoring:** The advantage of monitoring at the HVPS level, where the central bank can see the entire network’s "heartbeat" rather than just individual bank flows.
- **Framework Flexibility:** How the model can be adjusted for different payment system designs and extended to assist in AML and Counter-Terrorism Financing (CTF).

**Watch on Demand:**

Listen on: [Spotify](https://open.spotify.com/episode/1xFBXuc7WkfLu7MwnEMhdB?si=hNp4yqLUR0ClvpJ9gdWAQw) \| [Apple Podcasts](https://podcasts.apple.com/gb/podcast/payment-systems-broadcast-17-anomaly-detection-in-payment/id1772649634?i=1000676224426) \| [Amazon Music](https://music.amazon.co.uk/podcasts/93293cc8-fa9c-41a8-a3d7-86b413d78941/episodes/08b370ad-9132-4da4-8823-f4cb4af518a6/fna-broadcasts-payment-systems-broadcast-17---anomaly-detection-in-payment-systems-findings-and-implications)

---

### Missed our previous sessions?

You can catch up with The Payment Systems Broadcast on-demand. Or listen wherever you get your podcasts: [Spotify](https://open.spotify.com/episode/0wTNGVQvQMVWlCKqzXu5xx?si=b9d4fce15716478a) \| [Apple](https://podcasts.apple.com/gb/podcast/payment-systems-broadcast-23-project-meridian-fx-cyber/id1772649634?i=1000725546180) \| [Amazon Music](https://music.amazon.co.uk/podcasts/93293cc8-fa9c-41a8-a3d7-86b413d78941/episodes/f5c4b50e-b5a7-4104-b9a2-988a586fa42f/fna-broadcasts-payment-systems-broadcast-23---project-meridian-fx-cyber-resilience-insights-from-stress-testing)