Add AML/BSA Validation Rules for SBL Suspicious Activity Detection

[matheusybsen]

Problem:
The regtech-data-validator currently validates SBL (Small Business Lending) data for format compliance and data quality, but doesn't include validation rules for AML/BSA suspicious activity patterns that lenders must monitor under the Bank Secrecy Act.

FinCEN requires financial institutions to detect and report suspicious activity in small business lending, but there's no standardized validation framework for identifying these patterns in SBL data submissions.

Solution:
Add AML/BSA validation rules to the SBL schema that flag suspicious patterns:

1. Structuring Patterns:

   • Multiple loans to same beneficial owner just below CTR threshold ($10K)
   • Rapid sequential loan applications from related entities
   • Loan amounts that aggregate to suspicious thresholds

2. High-Risk Indicators:

   • Loans to shell companies (no employees, minimal operations)
   • Cash-intensive businesses (MSBs, check cashers, car washes)
   • High-risk jurisdictions (FATF high-risk countries)

3. Behavioral Red Flags:

   • Unusual loan purpose descriptions
   • Inconsistent business activity vs loan amount
   • Early payoff patterns (layering indicator)

Regulatory Drivers:

• Bank Secrecy Act: Requires detection and reporting of suspicious activity
• FinCEN Small Business Lending Guidance: Identifies SBL-specific ML typologies
• CFPB Section 1071: New SBL data collection expands AML monitoring scope

Implementation Approach:

# Example validation check
def check_structuring_pattern(df):
    """Flag multiple loans to same beneficial owner near reporting thresholds"""
    grouped = df.groupby('beneficial_owner_id')['loan_amount'].agg(['sum', 'count'])
    suspicious = grouped[(grouped['sum'] > 9000) & (grouped['sum'] < 10500) & (grouped['count'] > 1)]
    return suspicious

Use Cases:

• CFPB reviewers screening SBL submissions for quality
• Lenders validating their own data before submission
• Examiners identifying institutions with weak AML controls

I can help with:

• Defining AML red flags from FinCEN/CFPB guidance
• Mapping suspicious patterns to validation rules
• Testing against real SBL suspicious activity reports