---
title: "GNN"
url: "https://mahouse.world/glossary/gnn"
type: "glossary term"
topic: "Artificial intelligence"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-06"
---

# GNN

A graph neural network (GNN) is a model that learns over data structured as a graph — entities as nodes, relationships as edges — by passing information along the edges so that each node's representation reflects its neighbours and their neighbours, and using that structure as a signal; a customer who shares a device with three accounts linked to a known fraudster is suspicious in a way no feature about the customer alone reveals. GNNs find fraud rings.

**Also known as:** Graph neural network, Graph neural networks, Graph learning, Network analytics

## Key facts

- **Used at:** fraud-ring and mule-network detection, transaction-monitoring alert prioritisation, KYB and beneficial-ownership resolution, collusion and merchant-fraud detection, credit risk with related-party structures, recommendation, and, outside finance, molecule and protein modelling, and social networks
- **Binding:** none for the method; the graph's data is personal data linked across customers, which needs a lawful basis and a data-protection assessment; explanations for decisions based on a customer's connections must be defensible (guilt by association is not a reason code a regulator accepts without the evidence)
- **Typical mechanics:** nodes (accounts, devices, addresses, companies, people) and edges (transactions, shared attributes, ownership) form the graph; message passing aggregates neighbours' features into each node's representation over several layers (each layer reaches one hop further); a task head classifies nodes (is this account a mule?), edges (is this transaction suspicious?) or subgraphs (is this cluster a ring?); training is supervised on labelled cases or self-supervised on the structure
- **Typical gains:** detection of coordinated fraud that per-account models miss — vendors and banks report lifts of 20–50% in ring and mule detection at constant false-positive rates; the gain comes from the structure, so the graph's completeness (which entities and links are captured) bounds it
- **Parties:** the fraud and financial-crime teams, the graph-database and network-analytics vendors (Quantexa, Linkurious, TigerGraph, Neo4j and the fraud platforms with graph modules), the data engineers who build the entity-resolution and graph pipelines, and the investigators who read the subgraphs

## How a graph neural network works in practice

A neobank has 4 million accounts and per-account fraud scores that miss a growing pattern: accounts opened with different identities that share devices, funding sources and payees, moving money in a chain. The team builds a graph — accounts, devices, IP addresses, phone numbers, payees, funding accounts as nodes; logins, transfers and shared attributes as edges — resolved from its own data, and trains a GNN on 6,000 confirmed mule accounts and their neighbourhoods. The model learns that an account two hops from a confirmed mule through a shared device and a common payee is very likely a mule; it scores every account nightly; and for each alert it produces the subgraph — the accounts, the links, the confirmed case at the centre — that an investigator reads in a minute. Detection of mule accounts rises from 44% to 78%; the alerts come as networks of 20–200 accounts rather than one at a time, and the bank closes rings rather than accounts.

The prerequisites are the reason it is a project. Entity resolution — knowing that two addresses, two device fingerprints or two company names are the same — decides the graph's quality, and it is most of the work. The graph must be stored and queried at scale, which means a graph database or a graph layer over the data platform. Explanations must be the subgraph, not a score, because the investigator, the SAR narrative and the regulator need to see the connections. And the data-protection assessment must cover linking customers to one another by attributes they share. The AML use is the strongest: transaction monitoring per account generates the false positives the industry knows; monitoring the network finds the structure that laundering has. For a buyer, a fintech's network analytics is diligenced on its entity resolution, its graph's coverage and its explanation design; a vendor's is diligenced on results at customers.

For a fintech, a GNN is the model for fraud that is organised, which is most fraud that matters; its value is the graph beneath it, and the graph is built from entity resolution the company must do itself.

## Example

An acquirer onboards 8,000 merchants a month and loses €6 million a year to bust-out and collusive-merchant fraud that per-merchant underwriting misses. It builds a merchant graph — legal entities, directors, beneficial owners, addresses, bank accounts, websites, devices, shared customers — resolved from applications, registers and transaction data, and trains a GNN on 400 confirmed collusive networks. At onboarding, each applicant is scored with its neighbourhood: an applicant whose director was a director of two terminated merchants and whose settlement account is shared with a third is flagged with the subgraph shown to the underwriter. Results in a year: collusive-merchant losses down 65%; 90 networks identified that the per-merchant process had approved; false-positive rate at review 30%. The entity-resolution pipeline took seven months; the model, six weeks.

## Common mistakes

- Building the model before the entity resolution; the graph's quality is the result.
- Alerts as scores without the subgraph that explains them.
- Linking customers by shared attributes without the data-protection assessment.
- A graph that omits the entities (devices, payees) where the structure lives.
- Reading a vendor's ring-detection lift without asking what graph it was measured on.

## Related terms

- [Transaction Monitoring](https://mahouse.world/glossary/transaction-monitoring.md)
- [Know Your Business](https://mahouse.world/glossary/know-your-business.md)
- [Deep Learning](https://mahouse.world/glossary/deep-learning.md)
- [Latent Space](https://mahouse.world/glossary/latent-space.md)
- [Unsupervised Learning](https://mahouse.world/glossary/unsupervised-learning.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov