preetisheoran/nfpc-parquet-dataset

AML Mule Account Detection Challenge

Data Format: All files are in Apache Parquet format (Snappy compression). Use pandas.read_parquet(), pyarrow.parquet, or any Parquet-compatible reader. Transaction files are split across batch-N/ subdirectories.

Primary Objective/Problem Statement

Identify mule accounts used for money laundering from banking transaction and account data. Given labelled training data and unlabelled test accounts, predict which test accounts are mules.

Evaluation

• —Exact Submission Guidelines will be provided shortly
• —Evaluation Criteria is listed below:
• —40% weightage for Model/Feature Ingenuity
• —Rewarded for creative and innovative ideas in types of models/features used, multiple models/algorithms in series/parallel may be used to generate final predictions
• —20% weightage for model performance scores
• —Rewarded for high accuracy/precision scores, calculated scores such as AUC-ROC and F1 scores
• —15% weightage for avoidance of red-herrings in data
• —Rewarded for succesfully avoiding several red-herrings injected in the training data
• —15% weightage for additional insights such as Temporal IOU scores, other insights
• —10% weightage for report quality
• —Rewarded for clear and concise insights presented in the report with data-driven logic.

Data Files

Provided to You

Total: 720 files, 16.2 GB

Note: transactions/ and transactions_additional/ are split into batch subdirectories (batch-1/, batch-2/, etc.) with up to 100 part files each. To read all parts:

import pandas as pd
from glob import glob

# Read all transaction parts
parts = sorted(glob("transactions/batch-*/part_*.parquet"))
df = pd.concat([pd.read_parquet(p) for p in parts], ignore_index=True)

Schema

customers.parquet

accounts.parquet

Note: customer_id is not in this file. Use customer_account_linkage.parquet to join accounts to customers.

transactions (partitioned)

Transaction channels: UPC (UPI Credit), UPD (UPI Debit), END (E-commerce/POS), IPM (IMPS), STD (Standing instruction debit), P2A (Pay-to-account), FTD (Fund transfer debit), NTD (NEFT debit), MCR (Mobile credit), FTC (Fund transfer credit), MAC (Mobile app), TPD (Third-party debit), APD (Auto-pay debit), CHQ (Cheque), ATW (ATM withdrawal), TPC (Third-party credit), STC (Standing instruction credit), OCD (Over-counter deposit), RCD (Recurring deposit credit), IFD (Internal fund debit), ETD (Electronic transfer debit), NWD (Network debit), CSD (Cash deposit), IFC (Internal fund credit), PCA (Payment card authorization), MAD (Mandate debit), CHD (Clearing house debit), RTD (Return debit), CCL (Credit card linked), OPI (Online payment initiation), CTC (Clearing transfer credit), SID (System-initiated debit), ASD (Auto-sweep debit), IAD (Inter-account debit), SCW (Smart card withdrawal).

customer_account_linkage.parquet

A single customer may hold multiple accounts.

product_details.parquet

train_labels.parquet

Note: Labels may contain noise/red-herrings. Not all labels are guaranteed to be correct.

test_accounts.parquet

demographics.parquet

accounts-additional.parquet

transactions_additional (partitioned)

branch.parquet

Known Mule Behavior Patterns

The following money laundering patterns are known to exist in real-world banking data. Mule accounts in this dataset may exhibit one or more of these behaviors:

1. 1.Dormant Activation — Long-inactive accounts suddenly showing high-value transaction bursts
2. 2.Structuring — Repeated transactions just below reporting thresholds (e.g., amounts near 50,000)
3. 3.Rapid Pass-Through — Large credits quickly followed by matching debits (funds barely rest in the account)
4. 4.Fan-In / Fan-Out — Many small inflows aggregated into one large outflow, or vice versa
5. 5.Geographic Anomaly — Transactions from locations inconsistent with the account holder's profile
6. 6.New Account High Value — Recently opened accounts with unusually high transaction volumes
7. 7.Income Mismatch — Transaction values disproportionate to account balance or customer profile
8. 8.Post-Mobile-Change Spike — Sudden transaction surge after a mobile number update (potential account takeover)
9. 9.Round Amount Patterns — Disproportionate use of exact round amounts (1K, 5K, 10K, 50K)
10. 10.Layered/Subtle — Weak signals from multiple patterns combined, no single strong indicator
11. 11.Salary Cycle Exploitation — Laundering disguised within natural salary credit and bill payment cycles at month boundaries
12. 12.Branch-Level Collusion — Clusters of suspicious accounts at the same branch with shared counterparties and coordinated timing
13. 13.MCC-Amount Anomaly — Transactions with amounts that are statistical outliers for their merchant category code

Relationships

customers ──(customer_id)──> customer_account_linkage ──(account_id)──> accounts
    |                                                                       |
(customer_id)                                                          (account_id)
    |                                                                       |
    v                                                                       v
demographics                                                          transactions
                                                                            |
                                                                     (transaction_id)
                                                                            |
                                                                            v
                                                                 transactions_additional

customers ──(customer_id)──> product_details
accounts  ──(account_id)──> train_labels / test_accounts
accounts  ──(account_id)──> accounts-additional
accounts  ──(branch_code)──> branch

Submission Format

account_id,is_mule,suspicious_start,suspicious_end
ACCT_000000,0.02,,
ACCT_000003,0.87,2023-11-15T09:30:00,2024-02-20T16:45:00
...

One row per account in test_accounts.parquet:

• —`is_mule`: Probability score between 0 and 1
• —`suspicious_start`: ISO timestamp of the beginning of the suspected suspicious activity window (empty if predicted legitimate)
• —`suspicious_end`: ISO timestamp of the end of the suspected suspicious activity window (empty if predicted legitimate)

The time window should capture when you believe the mule activity occurred. Primary scoring is on is_mule. Time window accuracy is scored separately as a bonus metric using temporal IoU (Intersection over Union) against the ground truth activity period.

Good luck.