1. Learning Objectives

By the end of this lesson, you will be able to:

• Understand the operational risk framework under Basel III, including the loss distribution approach (LDA) and the advanced measurement approach (AMA).

• Model operational risk using extreme value theory (EVT), including the peaks-over-threshold (POT) method and generalized Pareto distribution (GPD).

• Apply AI techniques (autoencoders, graph neural networks, isolation forests) for anomaly detection and fraud identification.

• Design a real-time fraud detection system using supervised and unsupervised learning, handling class imbalance and concept drift.

• Implement network-based fraud detection using graph analytics and link prediction.

• Evaluate fraud detection models using precision, recall, F1, and cost-sensitive metrics (e.g., false positive cost, false negative cost).

2. Operational Risk: Framework and Mathematical Foundations

2.1 Definition and Regulatory Context

Operational risk is defined by the Basel Committee as “the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.” This includes legal risk but excludes strategic and reputational risk.

The Basel III framework provides three approaches for calculating operational risk capital:

1. Basic Indicator Approach (BIA): Capital is a fixed percentage (15%) of the average gross income over the last three years.

2. Standardized Approach (SA): Capital is based on business line-specific indicators and regulatory coefficients.

3. Advanced Measurement Approach (AMA): Banks use their own internal models (e.g., LDA) to calculate capital. The AMA is being phased out under Basel III revisions, replaced by the new Standardized Approach.

2.2 The Loss Distribution Approach (LDA)

The LDA models the frequency and severity of operational loss events separately and then combines them. The total loss over a horizon is:

L_total = ∑_{i=1}^{N} X_i

where N is the number of loss events (frequency), and X_i are the loss amounts (severity). The frequency and severity distributions are estimated from historical loss data.

Frequency distribution: Typically modeled as a Poisson process with rate λ:

P(N = n) = e^{-λ} * λ^n / n!

The Poisson distribution assumes that events are independent and occur at a constant rate. Overdispersion (variance > mean) is common; the Negative Binomial distribution is an alternative:

P(N = n) = (n + r - 1 choose n) * p^r * (1-p)^n

Severity distribution: Loss amounts are typically heavy-tailed. The lognormal distribution is often used:

X ~ Lognormal(μ, σ): P(X ≤ x) = Φ( (ln(x) - μ) / σ )

However, the lognormal may not capture extreme tails adequately. This leads to Extreme Value Theory.

2.3 Extreme Value Theory (EVT) for Operational Risk

EVT focuses on the distribution of extreme events, which are the primary concern for operational risk.

The Peaks-Over-Threshold (POT) Method:

Choose a high threshold u. The excesses Y = X - u (for losses > u) follow a Generalized Pareto Distribution (GPD):

G(y; ξ, σ_u) = 1 - (1 + ξ * y / σ_u)^{-1/ξ} for ξ ≠ 0
G(y; ξ, σ_u) = 1 - exp(-y / σ_u) for ξ = 0

where:

• ξ is the shape parameter (tail index). ξ > 0 indicates a heavy tail (Pareto-type); ξ = 0 is exponential; ξ < 0 is bounded.

• σ_u is the scale parameter, which depends on the threshold u.

The unconditional distribution of losses (for all values) is:

F(x) = 1 - N_u/N * (1 + ξ * (x - u) / σ_u)^{-1/ξ} for x > u

where N_u is the number of exceedances above u, and N is the total number of observations.

Parameter estimation: The threshold u must be high enough to satisfy the asymptotic conditions but low enough to have sufficient data. We use the mean excess plot: plot the mean excess e(u) = E[X - u | X > u] against u. The point where the plot becomes roughly linear is a good choice. Parameters are estimated via maximum likelihood.

VaR and ES under EVT: The VaR at confidence level α is:

VaR_α = u + (σ_u / ξ) * [ (N * (1-α) / N_u)^{-ξ} - 1 ] (for ξ ≠ 0)

The ES is:

ES_α = VaR_α / (1 - ξ) + (σ_u - ξ * u) / (1 - ξ)

These formulas provide robust estimates of extreme tail risks.

2.4 AI for Operational Risk

AI can improve several aspects of operational risk modeling:

• Loss event classification: Use NLP to classify loss events into business lines and event types from text descriptions (see Module 6). This reduces manual effort and improves consistency.

• Frequency forecasting: Use time series models (e.g., LSTM) to forecast the frequency of loss events based on macro indicators and internal control metrics.

• Severity modeling: Use neural networks to estimate the parameters of the severity distribution (e.g., the μ and σ of the lognormal) conditional on covariates (e.g., business line, region). This is conditional severity modeling, which captures heterogeneity.

• Scenario analysis: Use generative models (GANs) to simulate plausible extreme loss scenarios for stress testing.

3. Fraud Detection: Problem Formulation

Fraud detection is the identification of fraudulent activities (e.g., unauthorized transactions, identity theft, insurance fraud) in a financial system.

3.1 Types of Financial Fraud

3.2 The Challenges

• Extreme class imbalance: Fraud is rare (e.g., 0.01% of transactions). Standard classifiers perform poorly.

• Concept drift: Fraud patterns evolve over time as criminals adapt to detection systems.

• Cost-sensitive errors: A false negative (missed fraud) can be very costly; a false positive (blocked legitimate transaction) can harm customer experience.

• Data privacy: Transaction data is sensitive; we must ensure privacy-preserving techniques.

• Real-time requirements: Fraud detection must operate at sub-second latency for payment systems.

3.3 Problem Formulation

We model fraud detection as a binary classification problem: for each transaction, we predict Y_t ∈ {0, 1} (1 = fraud). The features include:

• Transaction features: Amount, currency, channel, merchant category.

• User features: Historical transaction patterns, average amount, frequency.

• Contextual features: Time of day, location, device information.

4. Supervised Learning for Fraud Detection

4.1 Handling Class Imbalance

As in credit risk, we use:

• Resampling: SMOTE (Synthetic Minority Over-sampling) creates synthetic fraud examples by interpolating between existing fraud instances. However, SMOTE can generate unrealistic data points; variants like ADASYN or Borderline-SMOTE are better.

• Cost-sensitive learning: Assign a higher penalty to false negatives. For XGBoost, we set scale_pos_weight = n_non_fraud / n_fraud.

• Ensemble methods: Use bagging or boosting with resampled data (e.g., RUSBoost, SMOTEBoost).

4.2 Addressing Concept Drift

Fraud patterns change over time. We need:

• Online learning: Models that update continuously as new data arrives (e.g., online gradient descent, Hoeffding trees).

• Periodic retraining: Retrain the model daily or weekly on the most recent data (e.g., the last 6 months).

• Drift detection: Monitor model performance (AUC, precision) over time and trigger retraining when performance drops (e.g., using Page-Hinkley test or CUSUM).

4.3 Feature Engineering for Fraud Detection

• Velocity features: Transaction count, total amount, and standard deviation in the last hour/day/week.

• Ratio features: Amount / average amount, amount / user balance.

• Recency features: Time since last transaction, time since account creation.

• Geospatial features: Distance from the user’s usual location, whether the location is a known hotspot.

• Device features: Whether the device ID is new, whether the user has used this device before.

These features can be computed in a sliding window over the transaction history.

5. Unsupervised Anomaly Detection

Unsupervised methods are useful when labeled fraud data is scarce or when we want to detect novel fraud types.

5.1 Isolation Forest

Isolation Forest isolates anomalies by randomly partitioning the feature space. Anomalies are “isolated” with fewer splits (i.e., they have shorter path lengths in the tree ensemble).

The anomaly score for an instance x is:

s(x) = 2^{-E[h(x)] / c(n)}

where:

• h(x) is the path length (number of splits) to isolate x.

• E[h(x)] is the average over trees.

• c(n) is the average path length for a random forest of n instances.

Scores close to 1 indicate anomalies; scores close to 0 indicate normal instances.

5.2 Autoencoders for Anomaly Detection

Autoencoders learn a low-dimensional representation of the data. For fraud detection, we train the autoencoder on the normal (non-fraud) transactions only. The reconstruction error is used as an anomaly score:

RE(x) = || x - dec(enc(x)) ||_2^2

If a transaction has a high reconstruction error, it is an anomaly (potential fraud). The threshold is set as the 99th percentile of the reconstruction errors on the training set.

Variational Autoencoders (VAEs): VAEs add a regularization term (KL divergence) to the loss, ensuring a smooth latent space. The reconstruction probability (the probability that x was generated from the latent distribution) is used as the anomaly score. VAEs often outperform standard autoencoders for anomaly detection.

5.3 Density-Based Methods

• Local Outlier Factor (LOF): Measures the local density deviation of an instance relative to its neighbors. A low local density indicates an anomaly.

• One-Class SVM: Finds a hyperplane that separates the data from the origin in a high-dimensional feature space. It is sensitive to the choice of kernel and the nu parameter.

5.4 Clustering-Based Methods

Cluster the data (e.g., using K-means or DBSCAN). Instances that are far from any cluster centroid, or belong to small clusters, are flagged as anomalies.

6. Graph-Based Fraud Detection

Fraud often involves networks of entities (e.g., money laundering, organized fraud rings). Graph-based methods use the relational structure to detect fraud.

6.1 Graph Representation

Construct a graph where nodes represent entities (accounts, individuals, merchants) and edges represent transactions (or relationships). Edge attributes can include amount, time, and type.

Community detection: Identify connected components of accounts that are suspiciously interconnected. Money laundering rings often form dense subgraphs.

6.2 Graph Neural Networks (GNNs) for Fraud Detection

GNNs can learn node representations by aggregating information from neighbors. This is powerful for fraud detection because fraudulent nodes may have similar neighbors or be connected to known fraudsters.

Architecture:

1. Input: Node features (transaction history, account age, balance) and the adjacency matrix.

2. GCN/GAT layers: Propagate information across the graph.

3. Output: A binary classification (fraud/not fraud) for each node.

The loss function includes a classification loss and possibly a regularization term that encourages similar predictions for connected nodes (smoothness).

Example (using PyTorch Geometric):

import torch
import torch.nn.functional as F
from torch_geometric.nn import GCNConv

class FraudGCN(torch.nn.Module):
    def __init__(self, in_channels, hidden_channels, out_channels):
        super(FraudGCN, self).__init__()
        self.conv1 = GCNConv(in_channels, hidden_channels)
        self.conv2 = GCNConv(hidden_channels, out_channels)

    def forward(self, x, edge_index):
        x = self.conv1(x, edge_index)
        x = F.relu(x)
        x = F.dropout(x, training=self.training)
        x = self.conv2(x, edge_index)
        return x

6.3 Link Prediction

Predict future fraudulent links (e.g., whether a transaction is likely to be fraudulent based on the relationship between the sender and receiver). Link prediction uses node embeddings to compute a score for each edge:

score_{uv} = f(h_u, h_v)

where f is a function (e.g., dot product, MLP). The model is trained on known fraudulent and legitimate transactions.

7. Evaluating Fraud Detection Models

7.1 Standard Metrics

• Precision: TP / (TP + FP). A high precision minimizes false positives.

• Recall: TP / (TP + FN). A high recall minimizes false negatives.

• F1-score: Harmonic mean of precision and recall.

• AUC: The area under the ROC curve (true positive rate vs. false positive rate). ROC ignores the absolute number of false positives, which can be misleading with imbalanced data.

• Precision-Recall AUC: Better for imbalanced data; it focuses on the positive (fraud) class.

7.2 Cost-Sensitive Metrics

Because false negatives and false positives have different costs, we can use:

• Cost of model: Cost = C_FN * FN + C_FP * FP, where C_FN is the cost of a missed fraud and C_FP is the cost of a false positive (e.g., customer service cost).

• Profit curve: Plot the net profit of the model as a function of the threshold (accounting for transaction fees, chargeback losses, and false positive costs).

7.3 Real-Time Performance

For real-time systems, we must measure:

• Latency: The time from receiving a transaction to producing a decision.

• Throughput: The number of transactions processed per second.

The model must be optimized for inference speed (e.g., using lightweight models, quantized neural networks, or dedicated hardware).

8. Summary for the AI Practitioner

• Operational risk is modeled using frequency and severity distributions; EVT (POT/GPD) is the standard for extreme tails.

• AI can improve operational risk modeling through conditional severity models, scenario generation, and NLP for loss classification.

• Fraud detection is a highly imbalanced, cost-sensitive classification problem with concept drift.

• Supervised methods (XGBoost, neural networks) are effective if labeled data is available, but require careful handling of imbalance and drift.

• Unsupervised methods (isolation forest, autoencoders) are useful for detecting novel fraud patterns.

• Graph-based methods (GNNs, link prediction) capture relational information and are powerful for detecting organized fraud.

• Evaluation must consider cost-sensitive metrics and real-time performance requirements.