Sometimes one transaction is not enough

Digital payments have become part of everyday life. They are fast, convenient and easy to use. But behind that simplicity, payment service providers face a much more complex challenge: identifying suspicious activity without disrupting legitimate transactions.

This is particularly important in the fight against Anti-Money Laundering (AML). A single payment may look completely normal, while the real warning signs may only emerge when that payment is connected to other transactions, accounts or users over time.

Money laundering schemes are often deliberately designed to avoid obvious patterns. Funds may be split into smaller payments, moved through different accounts or transferred through several stages to make their origin harder to trace.

This is the challenge being explored through CyberAId Pilot #2, led by OTE, which investigates how advanced AI-driven cybersecurity capabilities can support AML detection in payment service provider environments.

Looking beyond individual transactions

A key area of the OTE pilot is transaction network analysis. Rather than examining each payment in isolation, the approach looks at the relationships between transactions, accounts and other relevant entities.

A single transfer may not appear unusual. However, when it forms part of a larger network involving repeated movements of funds, multiple accounts or transactions occurring within a short period of time, the wider picture can reveal patterns that are much harder to detect through individual transaction analysis.

The OTE pilot explores patterns such as structuring, where larger amounts are divided into smaller transactions; smurfing, where multiple accounts or participants are used; and layering, where funds are moved through multiple transactions or accounts to make their origin harder to trace.

The key insight is that the suspicious behaviour may not be visible in any individual payment. It is often the relationship between transactions that provides the stronger signal.

From heterogeneous data to contextualised intelligence

For OTE, the pilot goes beyond identifying suspicious patterns. It investigates how AI-driven analytics and CyberAId cybersecurity capabilities can transform heterogeneous information into contextualised intelligence that can assist financial-sector analysts.

AML analysts already have to deal with large volumes of alerts and information. Simply generating more alerts does not necessarily improve the investigation process. The objective is therefore to provide analysts with a clearer picture of the context surrounding a suspicious case.

By bringing together relationships between accounts, transactions, merchants and other relevant entities, AI-assisted analytics can help analysts understand why activity has been highlighted, identify potentially relevant connections and determine where further investigation may be appropriate.

This human-centred approach is particularly important in regulated environments. The technology is intended to support analysts rather than replace them. Explainability, traceability and auditability remain essential, while the final assessment and decision-making remain under appropriate human control.

OTE’s role: turning AI and cybersecurity innovation into operational practice

As the leader of the AML pilot, OTE contributes its experience in telecommunications, information technology, cybersecurity and innovation management to investigate how emerging AI capabilities can be integrated into realistic operational environments.

The pilot is also intended to generate knowledge that extends beyond the individual use case. Through the work carried out in CyberAId, OTE aims to explore and develop integration methodologies, AI-assisted AML investigation workflows, validation approaches and operational know-how that can support the introduction of advanced AI and cybersecurity technologies into regulated environments.

This is an important aspect of the OTE participation in CyberAId. The objective is not only to demonstrate that a technological approach can detect suspicious patterns, but also to understand how such capabilities can be responsibly integrated into real-world processes, taking into account operational constraints, data requirements, privacy and governance considerations.

Testing the approach safely

Working with financial information means working with highly sensitive data. For this reason, the way the technology is validated is just as important as the technology itself.

The OTE pilot considers factors such as data availability, privacy requirements, internal approvals and technical feasibility. Depending on the final validation setup, realistic scenarios may be tested using anonymised, synthetic, pseudonymised or simulated information, together with controlled environments that allow advanced technologies to be evaluated without unnecessarily exposing sensitive production systems or data.

This provides a practical basis for investigating AI and cybersecurity capabilities while respecting confidentiality, privacy and operational requirements.

What do we want to learn?

As the OTE pilot progresses, the key question is not simply whether the technology works, but whether it can deliver meaningful operational value.

Can suspicious relationships be identified more clearly? Can analysts better understand why a case has been highlighted? Can investigations become more focused? Can unnecessary alerts be reduced? And can the results remain understandable, traceable and auditable?

These are among the questions that will guide the validation of the pilot.

Reusable knowledge and future exploitation

OTE’s participation in CyberAId is also expected to generate reusable knowledge and exploitation opportunities.

The experience gained through the AML pilot can contribute to broader methodologies for integrating AI-driven analytics and cybersecurity technologies into regulated and data-intensive environments. The lessons learned around data handling, AI-assisted investigation workflows, system integration, validation and human oversight can provide a foundation for future applications beyond the specific pilot scenario.

Through its participation, OTE aims to contribute its technology integration and innovation expertise to the development of practical, trustworthy and AI-enabled approaches for financial-sector cybersecurity.

The longer-term value therefore lies not only in the results of the pilot itself, but also in the knowledge, methods and operational experience that can be reused in future cybersecurity and AI-enabled services.

Seeing the bigger picture

What is already clear is that money laundering is not always visible in one payment, one account or one event. Sometimes, the most important information is found in the relationships between them.

Through CyberAId, OTE is exploring how AI-driven analytics, transaction network analysis and cybersecurity technologies can help reveal that bigger picture while keeping people, explainability and responsible deployment at the centre of the process.