An end-to-end financial-crime intelligence project using Python, SQL, Tableau, and Streamlit to combine AML, fraud, sanctions, KYC/customer-risk, transaction, geographic, product, and counterparty signals into an explainable customer-level risk and investigation-prioritization view.
Portfolio scope: All data is synthetic and created for educational and portfolio demonstration. Risk scores, prioritization rules, alerts, cases, and investigation outcomes are illustrative.
Financial-crime teams often investigate risk across separate alert types and systems. This project brings those signals together into a broader intelligence layer so an analyst can identify repeat activity, multiple risk categories, elevated geographic exposure, counterparty concentration, and customers requiring focused investigation.
The project contains:
- 1,200 synthetic customers
- 30,000 transactions
- 1,800 financial-crime alerts
- 420 investigation cases
- 6,440 counterparties in the derived network summary
- Product and regional risk summary layers
- A customer-level financial-crime intelligence dataset with engineered risk features
The analytical workflow moves from operational records to enriched alerts, customer intelligence, risk prioritization, and executive reporting.
This project answers questions such as:
- Which customers have multiple financial-crime indicators?
- Which customers repeatedly generate alerts?
- Which High/Critical customers should be prioritized?
- Which risk categories and drivers generate the most alerts?
- Where is financial-crime activity geographically concentrated?
- Which products or channels carry the greatest high-risk exposure?
- Which counterparties connect multiple customers?
- Which counterparties warrant network review?
- How do alerts progress into escalations and investigations?
- How can customer, alert, transaction, counterparty, product, and regional signals be combined into an investigation queue?
The project uses an interconnected financial-crime data model spanning customers, transactions, alerts, investigations, counterparties, products, and geographic risk.
| Dataset | Rows | Purpose |
|---|---|---|
| Customer Reference | 1,200 | Customer profiles and KYC-risk context |
| Transactions | 30,000 | Customer and counterparty transaction activity |
| Financial Crime Alerts | 1,800 | Alert-level risk indicators and investigation signals |
| Investigation Cases | 420 | Case-level financial-crime investigations and outcomes |
| Counterparty Network Summary | 6,440 | Counterparty relationships and concentration analysis |
| Customer Financial Crime Intelligence | 1,200 | Analytics-ready customer financial-crime risk layer |
| Product Exposure Summary | 6 | Product and transaction-channel risk exposure |
| Regional Risk Summary | 10 | Geographic risk concentration and regional exposure |
Data model scope: The datasets support end-to-end analysis from customer and transaction activity through alert generation, case investigation, counterparty-network analysis, and portfolio-level financial-crime intelligence.
See docs/data_dictionary.md for the
field-level definitions and dataset relationships.
The notebook preserves the original project analysis and adds a straightforward, recruiter-friendly EDA workflow:
- Dataset and schema review
- Missing-value analysis
- Duplicate validation
- Datatype and range review
- Summary statistics
- IQR-based outlier review
- Business-rule validation
- KPI validation
- Final analytical-dataset validation
Unusual financial activity is reviewed as a potential investigation signal rather than automatically deleted as an outlier.
The customer intelligence layer contains explainable analytical features including:
total_alertsescalated_alertstotal_alerted_amountavg_alert_riskunique_risk_categoriesunique_risk_driverstotal_transactionstotal_transaction_amounthigh_risk_geo_transactionsunique_counterpartieshigh_risk_geo_ratiofinancial_crime_risk_scorefinancial_crime_risk_level
The notebook explicitly demonstrates three simple engineered features:
multi_risk_flag--- identifies customers associated with multiple financial-crime risk categories.repeat_alert_flag--- identifies customers with repeated alert activity.risk_score_band--- converts the existing financial-crime risk score into explainable Lower, Medium, and Higher analytical bands.
These features are intentionally simple and interpretable for investigation prioritization.
The project contains 12 focused SQL analyses, including:
- Multi-risk customers
- Repeat-alert customers
- High-risk customer queue
- Alerts by financial-crime category
- Top risk drivers
- Escalation rate by category
- High-risk geographic exposure
- Common counterparties
- Network-review candidates
- Customers with repeated alert behavior
- Monthly financial-crime trends
- Customer-segment risk concentration
See sql/ for the complete queries.
The following KPIs were recalculated from the current processed datasets to validate the portfolio's financial-crime risk, alert, investigation, and exposure metrics.
| KPI | Current Result |
|---|---|
| Total Customers | 1,200 |
| Financial Crime Alerts | 1,800 |
| Investigation Cases | 420 |
| Alert-Level Escalations | 648 |
| High / Critical Customers | 159 |
| Repeat-Alert Customers | 230 |
| Multi-Risk Customers | 420 |
| Total Alerted Amount | $82.0M |
| Product-Level High-Risk Exposure | $210.2M |
| Network Review Candidates | 2,457 |
Portfolio insight: The KPI profile highlights financial-crime exposure across customer risk, repeat-alert activity, multi-risk behavior, investigations, product exposure, and counterparty-network review candidates.
- 230 customers are flagged for repeat-alert behavior, helping investigators focus on recurring activity.
- 420 customers show multiple financial-crime risk signals and are candidates for cross-risk review.
- The largest alert category is Transaction Monitoring (763 alerts).
- The leading alert driver is Unusual Volume (202 alerts).
- The regional summary identifies United States as the largest alert concentration with 895 alerts.
- 2,457 counterparties are flagged as network-review candidates in the derived network layer.
- Product-level high-risk exposure totals approximately $210.2M across the six summarized product/channel groups.
These findings are designed to support investigation prioritization and cross-risk intelligence rather than automatic customer disposition.
The Streamlit application applies portfolio filters across the customer and alert populations.
- Date / Month
- Customer Segment
- Product Type
- Risk Rating
- Region
The Product Type logic normalizes activity into:
- Wire Transfer
- ACH
- ATM
- P2P
- Cash
- Trade Finance
The application summarizes the selected population as:
- Generally Stable
- Targeted Review Recommended
- Heightened Financial Crime Risk
The assessment considers High/Critical concentration, repeat-alert activity, multi-risk customers, and escalations.
At customer level, the application provides:
- Risk level
- Risk score
- Total alerts
- Alerted exposure
- Escalated alerts
- Repeat-alert behavior
- Multi-risk behavior
- Main risk category
- Leading risk driver
It then produces an explainable portfolio decision:
- Priority Investigation
- Enhanced Review
- Targeted Review
- Routine Monitoring
The application includes:
- Risk Queue
- Multi-Risk Analysis
- Counterparty Intelligence
- Tableau Gallery
- Interactive Story Walkthrough
The Tableau Gallery intentionally displays only the Executive Dashboard. The Story Walkthrough uses filtered Streamlit analysis rather than repeating static dashboard images.
The executive dashboard brings the portfolio into one visual decision-support view.
- Financial Crime Activity Trend
- Alerts by Risk Category
- Alerts by Region
- Customer Risk Activity Heatmap
- Investigation Funnel
- Crime Exposure by Product Type
Dashboard status: The Executive Dashboard is synchronized to the current processed-data KPIs used throughout this README and the Streamlit application.
Customer Profile
↓
Transactions
↓
Financial Crime Alerts
↓
Investigation Cases
↓
EDA + Feature Engineering
↓
Customer Risk Intelligence
↓
Counterparty / Product / Regional Analysis
↓
Risk & Investigation Prioritization
↓
Tableau + Streamlit Decision Support
| Technology | Application in This Project |
|---|---|
| Python / Pandas | EDA, data validation, feature engineering, and financial-crime intelligence analysis |
| SQL | Risk-queue analysis, alert trends, exposure analysis, counterparty analysis, and investigation support |
| Tableau | Executive financial-crime dashboard, KPI monitoring, and risk visualization |
| Streamlit | Interactive investigation workflow, portfolio filtering, and decision support |
| Jupyter Notebook | Reproducible EDA, feature-engineering, validation, and analytical workflow |
| Git / GitHub | Version control, project documentation, and portfolio presentation |
Financial-Crime/
├── app/ # Streamlit application
├── data/ # Synthetic source and processed datasets
├── docs/ # Data dictionary / supporting documentation
├── images/ # Executive dashboard
├── notebooks/ # EDA, feature engineering and intelligence analysis
├── sql/ # Financial-crime analytical queries
├── src/ # Supporting project logic
├── tableau/ # Tableau workbook / assets
├── .gitignore
├── .python-version
├── main.py
├── pyproject.toml
├── requirements.txt
├── uv.lock
└── README.md
git clone https://github.com/Denis0242/Financial-Crime.git
cd Financial-Crime
pip install -r requirements.txt
streamlit run app/streamlit_app.py- Financial Crime Intelligence
- AML Investigation Analytics
- Transaction Monitoring Analytics
- Fraud Risk Analysis
- Sanctions Risk Analysis
- KYC / Customer Risk
- Alert & Case Analysis
- Repeat-Alert Analysis
- Multi-Risk Analysis
- Counterparty / Network Intelligence
- Geographic Risk Analysis
- Product / Channel Exposure
- Investigation Prioritization
- Exploratory Data Analysis
- Feature Engineering
- Data Quality Validation
- SQL
- Python / Pandas
- Risk Scoring
- KPI Development
- Trend Analysis
- Segmentation
- Business-Rule Validation
- Tableau
- Streamlit
- Executive Dashboards
- Interactive Filtering
- Customer-Level Investigation Views
- Risk Queues
- Data Storytelling
This project uses synthetic data created for educational and portfolio purposes. No real customer, account, transaction, alert, case, counterparty, SAR, or confidential financial-institution data is included.
Financial-crime risk scores, alert categories, engineered features, prioritization logic, investigation outcomes, exposure measures, and decision-support labels are illustrative and should not be interpreted as actual financial-institution policies, regulatory determinations, or production monitoring rules.