In the previous post, What is an Alert in SAS Anti Money Laundering?, you learned that SAS Visual Investigator scenarios, or rules, contain the logic for detecting suspicious activity. Using SAS Visual Investigator, you can create three different types of scenarios.
- Record-level scenarios look at individual transactions for all records in the data.
- You would use a record-level scenario to detect a single cash transaction over $10,000 for a currency transaction report.
- Aggregation scenarios look at data at an aggregated level, by one or more columns in the data.
- You could use an aggregation scenario to detect aggregated cash withdrawals in excess of $10,000 over a period of five days.
- DATA-step scenarios enable you to have more flexibility and is dependent on SAS DATA step code.
- You would use a DATA-step scenario to detect a deposit made the same day as an ATM withdrawal in another state.
The user-friendly interface makes it easy for a scenario designer to identify the required fields. The screen is broken out into several tabs with dropdown fields. The tabs displayed are dependent on the type of scenario you are creating. Regardless of the type of scenario some of the basic information you will need to select includes:
Name: A scenario name must be unique within the flow
Active: This check box indicates whether the scenario is active in the flow. You can deactivate scenarios you don’t want to include when the flow is run.
Actionable Entity: This is the entity for which you want to gather suspicious activity, and then review via an alert. This entity correlates to a person that you can investigate, for example a bank customer or an insurance poly holder.
Scenario-Fired Entity: This is the entity that you want to surveil for suspicious activity. For example, a bank account or an insurance claim.
Include Records: This check box specifies whether to include records in the scenario context with each alerting event that a flow generates.
*If you enable, you can also choose to replicate the scenario contact records. This means, these records will be displayed to the end user to review as part of their investigation.
Include These Records: You can select one of the below options
-
- All contributing records: For the scenario-fired entity object, includes all the records that exist within the time frame that is defined for the scenario. This includes both the records that caused the scenario to fire and those that did not.
- All contributing records (flag triggering records): For the scenario-fired entity object, includes all the records that exist within the time frame that is defined for the scenario.
- Only triggering records: For the scenario-fired entity object, includes only the records that triggered the scenario-fired event.
Parameters: Parameters enable you to manage the value that is assigned to one or more scenario fields using an object that holds a value, as opposed to an actual value. Each parameter requires an ID, a Description, a Type and a Default Value.
Depending on your monitoring needs, you may need to transform the data with Expressions and/or Aggregations.
Expressions: Using data source columns, you can create a mathematical expression
Aggregations: Using a or a scenario expression, you can define a metric (such as sum, count, or mean) with a lookback unit to define if you are aggregating by day, month, or year. There is also an option to define an Offset to the Lookback value, which will be described in more detail in a future post, Using a Lookback in Scenarios: Lookback Basics.
Once you have all the information for detection selected, you will need to define a rule to categorize the outcome of the scenario.
- the conditions that must be matched in the source data to generate a scenario-fired event
- a score, value, and message to scenario-fired events
- a recommended queue in which to route alerting events
To learn more about writing scenarios in SAS Visual Investigator or using the out of the box scenarios in SAS Anti-Money Laundering, the courses Building an Interface with SAS® Visual Investigator and Administering SAS® Anti-Money Laundering in SAS® Viya® are available as eLearning.
Find more articles from SAS Global Enablement and Learning here.
