Wise Data Science
Scaling Fincrime Operations: Lessons in Building LLM-powered Automations at Wise
Authors: Volodymyr Panov, Data Scientist and Kristjan Erik Liive, Data Scientist
Introduction
Growth is a double-edged sword. Platform convenience and speed and other qualities that attract millions of new users, inevitably draw the attention of risky actors. At Wise, managing such risk creates a distinct operational challenge: scaling our defenses without compromising the user experience.
Every financial institution operates within a risk appetite, which dictates when and how automated systems flag suspicious activity. When a system triggers an alert, it enters a manual queue for a human review. If the volume of these alerts outpaces human capacity, an operational backlog forms. Backlogs delay legitimate false-positive transfers - hurting the customer experience - and limit organization's ability to produce additional alerts to tackle incremental risks.
To balance demand and supply loops, organizations traditionally face a choice: hire more line operations specialists or increase the efficiency of the existing team. Wise does both: the team is growing and by integrating LLMs directly into financial crime prevention workflows, we increase human throughput while maintaining strict risk tolerances.
LLMs and Financial Crime prevention
To understand where LLMs fit into a compliance operations framework, it helps to review the mechanics of modern financial crime. Consider a classic fraud scenario: a scam actor manipulates a victim to pay them £500 for non-existent concert tickets in London. The illicit funds must then be laundered through the financial system via a traditional three-stage process:
Placement: The criminal introduces the illicit cash or digital payments into the formal financial system.
Layering: The money moves rapidly through various banks, entities, and cross-borders to distance it from the original crime and obscure the crime trail.
Integration: The laundered funds re-enter the economy as seemingly legitimate assets, completing the cycle.
At Wise we screen every transfer, the typical operational workflow starts when a user initiates a transfer. Machine learning models score the transfer and user attributes. If an anomaly is detected, an alert creates a manual investigation case to study the suspicion. If the risk is confirmed, an external regulatory report is filed.
We integrate LLM-powered solutions into this pipeline to support various stages of case processing - from improving model-decision explainability to scanning for complex relationships and narratives in transfer histories.
LLM Applications in Compliance Operations
Translating Context
One of the valuable roles for LLMs in our stack is acting as a translator between complex tabular ML algorithms and human investigators. Wise utilizes a mathematical framework called SHAP to interpret machine learning model outputs. SHAP is excellent for quantifying the precise incremental influence of individual features on model score output but its outputs are strictly mathematical and produce no explicit narrative.
By feeding raw transaction features and SHAP values into an LLM, we automatically translate these complex calculations into natural, conversational language. This gives compliance agents a clear, immediate explanation of exactly why an alert was generated.
This translation capability also solves the "cold start" problem for investigators. When an operational case lands on an agent's screen, they parse through historical raw data before they can make a decision on the alert. To bypass this friction, we use LLMs to perform pre-case summarization. By combining customer profiles, raw transactional histories, and internal risk appetite guidelines, the LLM provides agents with a concise operational summary.
The system uses human feedback to measure success and optimize prompt instructions on good cases only.
Detecting Transactional Anomalies
Beyond alert summarization, LLMs are among the tools we use to actively scan account and transaction history characteristics for structural and behavioral patterns called "red flags". It is important to emphasize that a red flag is a suggestion of risk, not definitive proof.
Examples of red flags:
Pass-Through Activity: Funds are routed through an intermediate account, entering and exiting in nearly identical amounts to act purely as a temporary bridge that obscures the link between the original sender and ultimate recipient.
High Velocity: Funds received into an account are moved out almost immediately, characterized by rapid turnover, concentrated bursts of speed, or fast multi-party transfers regardless of total volume.
Structuring: A single large sum is intentionally split into smaller, sequential transactions specifically designed to stay below monitoring or regulatory reporting thresholds.
When our LLM detects these red flags, it surfaces them to the human investigator, who confirms the finding or marks it as a false positive. This continuous loop generates real-time feedback that allows us to continuously optimize our underlying data structures and prompts.
Augmenting Regulatory Reporting
Once an investigator confirms suspicious activity, they face a mandatory legal obligation: filing a Suspicious Activity Report (SAR). Writing these reports is traditionally a time-consuming manual analytical task. Every SAR must comprehensively answer six core questions:
Who is involved? (Identifying primary targets, beneficial owners, and transacting accomplices).
What happened? (Detailing the exact volumes, instruments, and movement of money).
When did it occur? (Specifying exact operational timeframes and dates of detection).
Where did it take place? (Mapping customer nationalities, locations, branch sites, and bank account jurisdictions).
Why is it suspicious? (Articulating the specific red flags, profile deviations, and patterns of potential illegality).
How was it executed? (Describing the precise step-by-step mechanism, money flow, and illicit typologies used to carry out the activity).
Our automation platform ingests the investigator’s core notes alongside enriched transactional data, account details, and information national registries. The LLM synthesizes this information into a structured, regulatory-compliant SAR draft. The human investigator reviews the draft, makes adjustments, and finalizes the submission.
Engineering Realities and Practical Takeaways
Transitioning LLM-powered systems from experimental scripts to a production-grade compliance engine revealed several crucial engineering and operational lessons:
Start Simple and Avoid Over-Engineering
Data scientists, being technical enthusiasts at heart, often have an urge to implement highly complex, cutting-edge architectures right out of the gate. When we first tackled automated report writing, we built a multi-layered multi-agent system. It performed poorly, ran slowly, introduced excessive token costs, and was incredibly difficult to debug. Errors compound so we quickly learned that a simplified, well-structured LLM pipeline is far superior to an over-engineered multi-agent framework.
Human Judgment is Not a Perfect Ground Truth
While human-in-the-loop validation is vital, human judgment can introduce its own complications. When reviewing automated SAR drafts, investigators frequently make minor, stylistic changes based on personal writing style rather than only necessary factual corrections. This introduces unnecessary noise to the optimisation objective. Additionally, when regulatory compliance guidelines change, human teams require significant retraining and adjustment periods. Automated systems can adapt to new prompts or guidelines near-instantly. By tracking agent edit rates and differentiating between minor synonym adjustments and high-importance factual corrections, we keep text-generation aligned.
Prioritize a "Golden Data Set" Early
A golden data set is a human-reviewed, high-quality collection of sample cases that serves as an optimization ground truth. In financial operations, a true ground truth dataset is rarely available out of the box because historical event logs and outcomes are often incomplete or split across disparate data silos. Hand-picking cases manually is slow and rarely yields more than a few hundred samples. The most effective strategy is to gather such data directly from production by capturing the workflows of your most experienced, highly qualified teams as they complete tasks in real-time.
Fixing Gaps or Finding Rules? The Optimizer Dilemma
Model prompting serves to align a model's outcome conditional probability distribution with some business objective. These target outcomes are typically defined by a singular performance metric or qualitative rubric. Prioritizing the refinement of prompts and evaluation frameworks is the most efficient strategy for organizations to enhance performance before investing in the infrastructure required for complex fine-tuning.
Consider a standard text classification objective. While basic prompting provides a sufficient heuristic to cover most common clean-cut samples, you will inevitably reach a plateau where manual prompt iterations yield only marginal gains. This is precisely where frameworks like DSPy GEPA shine. By employing a "teacher" LLM, these systems utilize scalar metrics and qualitative business feedback to evolve prompt candidates based on the underlying “student” model's performance on a holdout set. Integrating automated optimization allows bypassing the most repetitive prompt development struggles, such as initial drafting and routine adjustments.
Conclusion & Takeaways
Deploying production-grade LLM applications within a regulated framework is a continuous development loop that requires:
Rigid Schema Mapping: Comprehensive planning of data inputs and outputs to reduce the risk of unexpected generations.
Intentional System Architecture: Design choices that prioritize specific task coverage and operational efficiency over architectural complexity.
Clean Ground Truth: Datasets that capture not just final but also intermittent human-reviewed labels and outcomes.
Statistical Validation: Rigorous performance backtesting against human-reviewed ground truth to ensure consistent statistically significant results across time.
Process Guardrails: Strict operational boundaries and deterministic rules that limit LLM actions to authorized, policy-compliant workflows.
Ultimately, LLM-powered applications serve as a force multiplier for operational throughput under professional oversight. By systematically automating repetitive analytical burdens, we empower human investigators to pivot toward more complex, higher-risk investigations. This synthesis of machine intelligence and human expertise is what transforms scaling challenges into a more robust, resilient, and safer global cross-border financial system.
More Data Science projects
Related blogs
Teaser
People profileContent Type
BlogPublish date
03/02/2026
Summary
"When you join, you’ll see your own growth mirrored by the growth of the company. You won't just be watching change happen; you’ll be a direct part of it." Ataro Shoji (He/Him) Payment
by
Verona Hasani
Teaser
People profileContent Type
BlogPublish date
06/27/2025
Summary
We sat down with SK Saraogi, Head of Expansion APAC, to discuss our strategic expansion into Hyderabad, India 🇮🇳Read more to discover why Hyderabad is the perfect location for our second glo
by
Verona Hasani
Teaser
People profileContent Type
BlogPublish date
06/06/2025
Summary
Driven by a passion for growth and team development, discover how Anna Pavlics advanced from Agent to Team Lead in Wise's Fraud Prevention team 🚀 "We put tremendous effort into bui
by
Verona Hasani
Teaser
People profileContent Type
BlogPublish date
02/18/2025
Summary
Head of Servicing Scale and Experience, Ian Rynne, discusses his journey from starting as a Customer Support agent to becoming the Head of Servicing Scale and Experience at Wise.
by
Verona Hasani
Teaser
Our cultureContent Type
BlogPublish date
05/15/2024
Summary
My name is Cynthia. I'm a fraud agent at Wise, based in the Austin office. We strive to prevent fraudulent activity on the Wise platform. It can be tricky, as Wise supports many diff
Content Type
BlogPublish date
01/24/2024
Summary
Wise’s volunteer day is not just a perk; it’s a celebration of community, camaraderie, and making a difference.Meet Claire Adelman, Customer Support Training Specialist, and Javier Perdo
Teaser
People profileContent Type
BlogPublish date
11/24/2022
Summary
Hi! My name is Delis and I’m a Due Diligence Agent (CDD) in our Tallinn team, focusing on business verification. What this means is that I onboard high risk businesses by assessing their r
Teaser
People profileContent Type
BlogPublish date
11/24/2022
Summary
Hi! My name is Rza Mustafayev and I’m a Due Diligence Agent in our Latin America & Middle-East and Africa Region, focusing on personal and business customers. What this means is that I:Rev