Modeling Criminal Networks and Financial Intelligence
Hands-on workshop — 3 hours — FastAnalytics / MileInvestiga
FastAnalytics S.A.S · Sponsor of the 2nd International Statistics Workshop 2026 — UNAL, Manizales Campus · November 5–6
This repository turns scattered information —suspicious activity reports— into a structured network that reveals the hidden connections of organized crime.
Each row of transactions_map.csv is a Suspicious Activity Report (SAR), not a transaction confirmed as illicit. These are reports that banks themselves filed with the FinCEN (Financial Crimes Enforcement Network, U.S. Department of the Treasury) between 2000 and 2017 because they considered their clients’ movements suspicious, and that the ICIJ (International Consortium of Investigative Journalists) leaked in 2020 as the FinCEN Files.
Implications for the analysis:
- Suspicion ≠ crime: a bank in this network is not guilty; it appears because it reported (or was flagged in) movements that triggered its anti-money-laundering controls.
- Reporting bias: the network shows where banks detected suspicious activity, not necessarily where all laundering occurs.
- Sensitive data: leaked from documents given to journalists. Academic/training use only; do not redistribute.
Workshop objectives
By the end, participants will be able to:
- Explore the data — load, clean and understand the SAR dataset (module 1).
- Build the chronological network — chronnet: how movements follow one another in time (module 2).
- Characterize the structure —density, transitivity, reciprocity and power laws: is it scale-free? (module 3).
- Study the topology — communities, hierarchy and concealment subgroups (module 4).
- Identify key actors — leaders, intermediaries and structural nodes (module 5).
- Define disruption — which nodes to break, which flows to cut, whom to prioritize (module 6).
The full analysis is also exported as structured JSON (outputs/agente/) so that an AI agent —MileInvestiga— can consume it to support investigations (schema in AGENTE_IA.md).
Modules
| # | Report | Content |
|---|---|---|
| 1 | Data | Loading, cleaning and exploration of the SAR dataset |
| 2 | Chronnet | Chronnet construction, step by step, with accounting check |
| 3 | Characterization | Density, weighted transitivity and reciprocity, power laws, shortest paths |
| 4 | Communities | Algorithm comparison, configuration null model, block bootstrap, dendrogram |
| 5 | Key players | Centrality measures and the key-player subnetwork |
| 6 | Disruption | 5 strategies × 2 protocols, AUC, Wilcoxon, priority targets, maps |
How to run
# Full pipeline (from the repo root)
Rscript main.R
# Render the reports
quarto render informes/Intermediate results are saved in outputs/ and the bank geocoding in data/bancos_geo.csv.