1 Introduction↩︎

Decentralized risk detection across competing firms is a market design problem of growing practical importance. Payment platforms detecting cross-merchant fraud, fintech lenders assessing credit risk across origination channels, banks coordinating on illicit financial flows, supply chain participants exchanging counterparty risk signals, and cybersecurity teams sharing threat intelligence all face a common structure: each firm holds fragmentary information whose aggregation would generate substantial social value, but private incentives impede truthful sharing. Information aggregation by a benevolent social planner is unavailable; the market designer must instead operate through a decentralized protocol in which firms train local models on private data, submit reports about their detected risk, and intervene on flagged accounts. The resulting system combines features of multi-sender information aggregation [1], dynamic mechanism design [2], [3], and platform governance, with welfare consequences for all participating firms and their downstream customers.

This paper develops a dynamic mechanism design framework for this setting. Three strategic frictions distinguish the problem from classical mechanism design with decentralized information and require simultaneous treatment. The first is compliance moral hazard: firms that share risk signals may trigger costly investigations or reveal detection capabilities to competitors, creating free-riding incentives [4]. When detection benefits are shared through federation but compliance costs are borne locally, firms face incentives to underreport. Competitive pressure intensifies this moral hazard by raising the opportunity cost of flagging risky customers; a related channel is documented for deposit insurance in [5]. The second is adversarial adaptation: sophisticated bad actors observe intervention patterns and restructure their behavior in response, requiring detection policies robust to strategic manipulation. This connects to the literature on strategic classification [6], [7], with the additional complication that the adversary’s adaptation is endogenous to the entire system of firms’ reporting and the regulator’s intervention. The third is information destruction through intervention: acting on detected risk permanently removes nodes and edges from the observation network, creating an exploration–exploitation tradeoff where aggressive intervention improves immediate security but degrades future learning. This echoes optimal stopping problems in the bandit literature [8], [9].

We propose a constructive mechanism, Temporal Value Assignment (TVA), and develop four results that together characterize when and how decentralized risk detection can be welfare-improving. We illustrate the framework throughout using anti-money laundering (AML) in cross-border banking networks, where the information fragmentation problem is acute and well-documented: $800 billion to $2 trillion is laundered annually through legitimate financial channels, less than 1% is ever recovered [10], and global compliance spending has risen to roughly $200 billion annually [11]. AML offers a setting in which the strategic frictions are simultaneously present, regulatory mandates are explicit (e.g., the EU 6th AML Directive 2018/1673 and FinCEN §314(b) information-sharing programs), and a public benchmark dataset is available. The same machinery applies to platform fraud detection, cybersecurity threat intelligence, supply chain risk, and other settings where competing firms must collectively detect risky agents without giving up proprietary data.²

We develop a formal framework in which heterogeneous firms hold fragmented signals and participate in a federated learning protocol that aggregates local models without sharing raw transaction records. The strategic question is whether parameter reports faithfully reflect local risk assessments or are distorted to minimize compliance costs. We use graph neural networks to represent each firm’s local transaction network (architecture details in the Online Appendix), and evaluate the framework in simulation using the IBM AML synthetic benchmark [13], comprising 1.4 million transactions across seven markets. Four main results organize the analysis.

The first result is the incentive design contribution. We introduce TVA, which credits firms using a strictly proper scoring rule [14] applied to discounted verified outcomes. Strict propriety guarantees that, edge by edge, the truthful posterior is the unique maximizer of expected score; combining this pointwise property with a delay structure that places compliance costs on aggregate signals (rather than individual reports) yields the central incentive-compatibility theorem: under stated assumptions, truthful reporting is a Bayes–Nash equilibrium that is uniquely optimal at each edge in large federations, and an \(\epsilon\)-BNE with \(\epsilon = O(1/m)\) in finite federations of size \(m\) (Theorem 1). The mechanism is self-financing from the rent on confirmed illicit cases, requiring no upfront budget.

The second result is the welfare analysis. Embedding the detection game in a logit competition model among firms in the tradition of [15] and the structural industrial organization of financial markets [5], [16], we establish a welfare ordering across four regulatory regimes (autarky, voluntary federation, mandated full sharing, TVA). The Backfiring Mandate Proposition (Proposition 4) identifies conditions under which voluntary federation without incentive design reduces welfare below autarky: when competition is sufficiently intense, strategic underreporting produces biased global models worse than honest local models while still imposing compliance costs. Above a threshold of competitive intensity, even mandated full sharing falls below the TVA equilibrium. In calibrated simulations, mandatory sharing without TVA reaches only 56% of first-best welfare, barely above autarky (54%), while TVA achieves 87%. This “backfiring” result is the paper’s main welfare contribution and has direct implications for current AML regulation.

The third result is the network theory of information value. Under an edge-additive coalition value, each firm’s Shapley contribution to collective detection is proportional to its weighted degree in the inter-firm interaction graph (Proposition 2). The implication is sharp: coalition design should prioritize firms with high inter-firm interaction volume rather than firms that are large in absolute terms. A path-based extension connecting to Bonacich centrality [17] is outlined in the Online Appendix. The result builds on [18] and the network economics literature [19]–[23].

The fourth result is an operational intervention extension. Freezing accounts creates a restless bandit problem [9] on a network: aggressive intervention reduces immediate losses but degrades future detection capability through node removal. We propose a network-adjusted index-based heuristic (Proposition 5) and a tractable risk memory approximation that performs close to the oracle benchmark in simulation. The construction integrates online learning under adversarial adaptation [24], [25] with submodular optimization bounds [26].

1.1 Related Literature↩︎

Our mechanism connects to dynamic mechanism design with marginal-contribution transfers [2], [3]: TVA 4 is a delayed contribution-based transfer, structurally related to dynamic pivot and VCG-type mechanisms [27]–[29] but adapted to a non-stationary environment where intervention alters the state space. The truthful elicitation of probabilistic beliefs draws on strictly proper scoring rules [14]; embedding such a rule in the dynamic transfer yields truthful reporting as a BNE uniquely optimal at each edge in large federations (Theorem 1). On strategic disclosure, our setting parallels the finance literature on underreporting of regulatory exposure [4], [30] and information design in competitive markets [31], [32], though institutions here jointly construct the information structure rather than a single designer choosing it. The competition channel builds on banking theory showing competitive pressure erodes prudential incentives [15], [33] and connects to the broader literature on the industrial organization of financial markets that uses structural demand models to assess welfare under competition [5], [16]. Empirical work on privacy regulation in financial intermediation provides direct motivation for the leakage-cost primitive in our model: [34] document that the California Consumer Privacy Act (CCPA) materially altered the bank–fintech competitive landscape in mortgage lending, consistent with our framework’s prediction that the design of disclosure regulation interacts with competition in determining welfare.

The welfare analysis relates to the literature on information sharing among competitors [35], [36] and on voluntary disclosure [30]. The competition–moral hazard interaction connects to the theoretical banking literature on how competitive pressure erodes prudential incentives [15], [33], [37]. Our Backfiring Mandate Proposition echoes the finding of [5] that well-intentioned regulatory interventions can intensify rather than mitigate moral hazard when competitive pressure is strong: in our setting, mandating federation without incentive design encourages free-riding on others’ detection effort in the same way that deposit insurance can reduce banks’ incentive for prudent risk management [15], [33]. What is novel is the explicit welfare ordering across four regulatory regimes and the identification of network centrality, rather than institution size, as the key determinant of coalition efficiency.

The network Shapley value builds on the foundational work of [18] on cooperative games in graph structures and the network economics literature [19], [20]. A path-based extension of our Shapley characterization (Online Appendix) connects to the key-player result of [17], who show that the agent whose removal most reduces aggregate Nash equilibrium activity is the one with the highest intercentrality. Our core Proposition 2 uses the weighted-degree structure that follows from the edge-additive coalition value, while the path-based extension relates to Bonacich centrality. Further foundations are in [21], [22], and [23]. On the machine learning side, the strategic reporting frictions we study connect to the strategic classification literature [6], [7] and to federated learning [38], [39]. The graph neural network architecture underlying the detection model builds on foundational GNN work [40], [41]. The applied graph-based AML detection literature [42]–[45] treats detection as a pure prediction problem; our contribution is providing game-theoretic foundations in which network position is a first-class strategic variable: institutions choose how much to contribute to the graph-based detection system, and their network centrality determines both their incentive constraints and their coalition value.

The remainder of this paper is organized as follows. Section 2.1 introduces the TVA mechanism, the incentive analysis with a quantitative illustration on the IBM AML synthetic benchmark, and adversarial robustness. Section 3 characterizes coalition formation and the network theory of information value. Section 4 embeds the detection game in banking competition and establishes the welfare ordering across regulatory regimes. Section 5 develops the operational intervention extension under additional dynamic assumptions, including simulation evidence. Section 6 concludes. All proofs are in the Appendix; additional empirical and technical material is in the Online Appendix.

2 Model and Mechanism Design↩︎

2.1 Federated Detection Framework↩︎

The financial system consists of \(m\) institutions indexed by \(i \in \{1, \ldots, m\}\) operating over discrete time periods \(t \in \{1, \ldots, T\}\). Each institution \(i\) observes a local transaction network \(G^{i,t} = (V^{i,t}, E^{i,t}, X^{i,t}_V, X^{i,t}_E)\), where \(V^{i,t}\) is the set of accounts active at institution \(i\) in period \(t\), \(E^{i,t} \subseteq V^{i,t} \times V^{i,t}\) is the set of fund transfers (edges), \(X^{i,t}_V \in \mathbb{R}^{|V^{i,t}| \times d_V}\) is the matrix of node (account) features, and \(X^{i,t}_E \in \mathbb{R}^{|E^{i,t}| \times d_E}\) is the matrix of edge (transaction) features. Cross-institution transactions create edges between institutions: if account \(u \in V^{i,t}\) sends funds to \(v \in V^{j,t}\) with \(i \neq j\), the edge \((u,v)\) appears in both \(E^{i,t}\) and \(E^{j,t}\). Each edge \(e \in E^{i,t}\) carries a binary label \(y_e \in \{0,1\}\) indicating whether it is illicit. Labels are confirmed with delay: the true label for an edge observed at time \(t\) may not be determined until \(t + \tau\) for some \(\tau \geq 0\), reflecting the time required for regulatory investigation, court proceedings, or account seizure to establish that a transaction was illicit.³ The class distribution is severely imbalanced: \(\mathbb{P}(y_e = 1) < 0.01\) in typical financial data.

Each institution \(i\) maintains a graph-based detection model \(f^i_\theta: G^{i,t} \to [0,1]^{|E^{i,t}|}\) that maps the transaction network to risk scores \(\widehat{y}^{i,t}_e\) for each edge. We implement \(f^i_\theta\) using graph neural networks (GNNs) [40], [46], which aggregate information from local transaction neighborhoods through learned message-passing, followed by temporal attention across time windows to capture evolving laundering patterns, and an edge-level multi-layer perceptron for illicit transaction classification. To address class imbalance, we adopt focal loss [47], which dynamically reweights training samples toward hard-to-classify minority cases. Full architectural details are provided in the Online Appendix.

The key feature of the protocol is privacy preservation: each institution \(i\) trains its local model \(f^i_\theta\) on \(G^{i,t}\) for a fixed number of local epochs, then transmits model parameters \(\theta^i\) (not raw data) to a central coordinator that aggregates via weighted averaging, \(\theta^{\text{global}} = \sum_{i=1}^m w_i \theta^i\), and distributes the updated global model back to all institutions [38]. This process repeats for \(R\) communication rounds. Training is supervised: institution \(i\) uses the local graph \(G^{i,t}\) together with all confirmed labels \(\{y_e : e \in E^{i,t'}, t' \leq t\}\) available up to period \(t\). Importantly, institutions never share raw transaction data \((G^{i,t}, y^{i,t})\): only model parameters. Yet the parameters institutions submit are themselves chosen strategically, and the strategic incentives behind those choices are the focus of the next subsection.

2.2 Strategic Environment and Incentive Alignment↩︎

The federated detection protocol described above defines what each institution can submit, but not what each institution will submit. Reporting is a strategic choice: institutions face private benefits from accurate detection (rents from confirmed cases) and private costs from heightened compliance and information leakage. To analyze how these forces interact, we model the interaction as a repeated game among three types of players: financial institutions (information senders), adaptive adversaries (money launderers), and a regulator (decision maker). The game unfolds over discrete time periods \(t = 1, \dots, T\), with decentralized information, delayed feedback, and endogenous adaptation by adversaries to past interventions.

Institutions (Information Senders). Each institution \(i\) observes its local transaction network \(G^{i,t}\) and submits a report consisting of model parameters \(\vartheta_i \in \Theta\) to a central coordinator. A reporting strategy \(\rho_i : G^{i,t} \rightarrow \Theta\) maps local observations to reported parameters. The submitted parameters induce edge-level posterior probabilities \(\widehat{y}^{i,t}_e \equiv f_{\vartheta_i}(e; G^{i,t}) \in [0,1]\) on each edge \(e \in E^{i,t}\), which are the mechanism-relevant quantities entering the TVA credit rule 4 . The truthful benchmark strategy is \[\rho_i^*(G^{i,t}) = \theta^i, \quad \text{where } \theta^i = \arg\min_{\theta} \mathcal{L}(f_\theta, G^{i,t}),\] for a suitable loss function \(\mathcal{L}\) (e.g., focal loss). Under truthful reporting, the induced posteriors \(\widehat{y}^{i,t}_e = f_{\theta^i}(e; G^{i,t})\) are the institution’s best Bayesian estimates of the illicit probability \(\Pr(y_e = 1 \mid G^{i,t}, \theta^i)\): that is, institutions report calibrated beliefs. Strategic deviations, such as reporting \(\vartheta_i \neq \theta^i\), manifest as distorted posteriors at the edge level, and the mechanism analysis therefore operates equivalently on parameters \(\vartheta_i\) or on the induced posteriors \(\widehat{y}^{i,t}\). Institutions may deviate by underreporting risk (scaling posteriors below their calibrated values) to free-ride on others’ detection efforts, injecting parameter noise (which translates to noise in posteriors), or withholding participation.⁴

Adversaries (Money Launderers). Adversaries observe the history of regulatory interventions \(\{a^1, \ldots, a^t\}\), where \(a^s\) indicates which transaction edges were frozen at time \(s\). Using this feedback, sophisticated launderers infer the detection policy and adapt through transaction splitting, temporal manipulation, route switching, and account replacement. Formally, the adversary chooses the next-period transaction graph \(G^{t+1}\) to solve \[\max_{G^{t+1}} \; \mathbb{E}[\text{laundered value}] - \mathbb{P}(\text{detected} \mid \text{policy history}) \cdot C, \label{eq:adversary}\tag{1}\] where \(C\) denotes the cost of detection, including account freezing and asset seizure.

Regulator (Decision Maker). The regulator observes aggregated risk scores \(\{\widehat{y}_e^t\}\) produced by the global model and selects intervention actions \(a_e \in \{\text{monitor}, \text{freeze}\}\) for suspicious transaction edges. Freezing prevents immediate illicit losses but removes edges from future transaction graphs, degrading subsequent learning.

Within each period \(t\), the interaction proceeds as follows: (1) institutions observe local transaction graphs and submit (possibly distorted) reports; (2) the coordinator aggregates reports and updates the global model, and the regulator computes risk scores and selects interventions; (3) adversaries observe interventions and adapt for period \(t+1\); (4) true labels are revealed with delay.

Social Planner Benchmark. Consider a social planner with access to all local transaction graphs \(\{G^{i,t}\}_{i=1}^m\). The planner jointly optimizes detection and intervention to maximize discounted social welfare: \[\max_{\theta, \{a_e^t\}} \mathbb{E}\left[ \sum_{t=1}^T \gamma^t \left( \sum_{e: a_e^t = \text{freeze}} C_e y_e - \alpha_1 \sum_{e: a_e^t = \text{freeze}} (1 - y_e) - \alpha_2 \sum_{e: a_e^t = \text{monitor}} y_e \right) \Bigg| \mathcal{F}_t \right], \label{eq:social}\tag{2}\] where \(\theta\) denotes the global detection model parameters that determine the risk scores \(\widehat{y}_e^t\) used in intervention decisions, \(a_e^t \in \{\text{monitor}, \text{freeze}\}\) is the intervention action for edge \(e\) at time \(t\), \(\mathcal{F}_t\) is the information available at time \(t\) comprising all observed graphs and confirmed labels up to \(t\), \(C_e\) is the prevented illicit value from freezing edge \(e\), and \(\alpha_1\), \(\alpha_2\) are Type I and Type II error costs.

In practice, however, all local transaction graphs are not shared across institutions due to privacy and competitive concerns. Each institution \(i\) instead maximizes a private utility function: \[u_i(\rho_i, \rho_{-i}) = \mathbb{E}[\text{detection quality}] - \beta_i \cdot \mathbb{E}[\text{local compliance costs}] - \kappa_i \cdot I(\theta^i; G^{i,t}), \label{eq:bank95utility}\tag{3}\] where \(I(\theta^i; G^{i,t})\) denotes the mutual information between reported parameters and local data, capturing information leakage costs. This divergence between institutions and the social planner creates incentives for underreporting, delayed signaling, and strategic noise injection, leading to systematically suboptimal collective detection.

Truthful reporting imposes two costs on institution \(i\): (i) a direct compliance cost, since strong suspicion signals trigger more local freezing decisions and the associated investigations; and (ii) an information leakage cost, since reporting \(\theta^i\) reveals local transaction patterns to competitors and potentially to adversaries. Meanwhile, detection benefits are dispersed across all institutions through reduced systemic risk and regulatory penalties. This creates incentives for strategic underreporting.

This example shows that decentralized institutions face a misalignment between marginal social benefits and marginal private costs, yielding strategic underreporting as a rational equilibrium. The key question is: can we design a mechanism that aligns institutional incentives with the social objective?

Temporal Value Assignment. We introduce a Temporal Value Assignment (TVA) mechanism [50] that explicitly rewards institutions for early and accurate warnings. The coordinator maintains a dynamic credit account \(\pi_t^i\) for each institution \(i\). When a transaction edge \(e\) is confirmed illicit at time \(t_{\text{confirm}}\), institution \(i\) receives credit based on its historical predictions: \[\pi^i_{t_{\text{confirm}}} = \pi^i_{t_{\text{confirm}}-1} + \sum_{t < t_{\text{confirm}}} \gamma^{t_{\text{confirm}} - t} \cdot C_e \cdot S\!\left(\widehat{y}^{i,t}_e, y_e\right), \label{eq:credit}\tag{4}\] where \(\gamma \in (0,1)\) discounts delayed signals, \(y_e \in \{0,1\}\) is the confirmed label, and \(S: [0,1] \times \{0,1\} \to \mathbb{R}\) is a strictly proper scoring rule [14]. Our baseline specification is the (negative) Brier score \(S(\widehat{y}, y) = 1 - (\widehat{y} - y)^2\), which is strictly proper, bounded in \([0,1]\), and has intuitive economic interpretation as accuracy rent. The log score \(S(\widehat{y}, y) = y \log \widehat{y} + (1-y)\log(1-\widehat{y})\) is an equivalent alternative.

The defining property of a strictly proper scoring rule is that, for any distribution \(q \in [0,1]\) over the outcome \(y\), \[\label{eq:propriety} q = \arg\max_{\widehat{y} \in [0,1]} \mathbb{E}_{y \sim \mathrm{Ber}(q)}\!\left[S(\widehat{y}, y)\right],\tag{5}\] with the maximum uniquely attained at \(\widehat{y} = q\). Applied edge-by-edge, this means an institution’s expected credit on edge \(e\) is strictly maximized by reporting \(\widehat{y}^{i,t}_e = \Pr(y_e = 1 \mid G^{i,t}, \theta^i)\): the true posterior probability of illicit activity given the institution’s information. Institutions with higher accumulated credit receive tangible benefits: reduced regulatory penalties, preferential access to global model updates, and advantages in future coordination games.

By explicitly pricing the temporal value of information, TVA creates a first-mover advantage for early detection. Institutions internalize the social benefit of timely warnings, making truthful and prompt reporting a best response. As a result, the mechanism makes truthful reporting robust to the main classes of strategic misreporting, as formalized below.

To ground TVA as an economic primitive: the coordinator (regulator or industry consortium) can observe confirmed illicit transactions and each institution’s historical risk scores. The credit account \(\pi^i_t\) is contractible: it enters directly into the institution’s regulatory penalty schedule or access to shared intelligence, as specified in equation 15 . The commitment assumption is that the coordinator pre-commits to the credit rule 4 before institutions choose their reporting strategies; this is analogous to a regulatory commitment to reward early suspicious activity reports, which is feasible under existing AML frameworks such as FinCEN’s Suspicious Activity Report (SAR) programme. TVA is therefore not a literal cash transfer but a penalty rebate or regulatory credit whose present discounted value creates the incentive alignment.

2.3 Theoretical Analysis↩︎

The TVA mechanism described above creates a tradeoff for each participating institution. On one side, the strictly proper scoring rule embedded in the credit formula rewards reports that match the eventual realization, providing a private return to forecast accuracy that is increasing in the volume of confirmed illicit cases. On the other side, an institution that flags more aggressively may face higher compliance costs (more investigations to support) and potential information leakage to competitors. Whether truthful reporting emerges in equilibrium therefore depends on which side dominates: does the scoring-rule rent exceed the marginal compliance and leakage costs that truthful reporting induces?

We show that, under economically interpretable conditions on the regulatory environment, the answer is yes. The key conditions are that label revelation is not selective on an institution’s own reports, that compliance costs are driven primarily by aggregated signals rather than individual filings, and that no single institution dominates the aggregate. The first reflects how AML investigations are actually triggered: by audits, subpoenas, or downstream defaults that proceed independently of any one bank’s reporting. The second reflects how compliance costs scale: investigation budgets are set against system-wide alerts, not bank-specific filings. The third is a standard non-atomicity condition on coalition size. Under these conditions, an institution’s unilateral deviation has only \(O(1/m)\) effect on its own compliance cost, so the scoring-rule rent dominates and truthful reporting becomes a best response. We make these conditions precise in the assumptions below and then state the central incentive compatibility result.

In typical AML consortia no bank exceeds a few percent of aggregate weight; the Lipschitz condition ensures the \(O(1/m)\) argument in Theorem 1 carries through to compliance costs. The \(O(1/m)\) form can be weakened: Theorem 1 extends to any bounded-share structure \(\max_i w_i^{\textit{agg}} \leq \bar{w} < 1\), with the \(\epsilon\)-BNE shading bound scaled by \(\bar{w}/(1-\bar{w})\) rather than by \(1/m\).

See proof in Appendix 7.1.

The strict propriety of \(S\) delivers the result pointwise: each edge’s expected credit is strictly maximized at the true posterior. Condition ?? ensures the temporal accuracy rent from truthful reporting outweighs the compliance and information-leakage costs, with the discount factor \(\gamma\) as the policy lever: higher \(\gamma\) broadens the parameter range in which truthful reporting is individually rational. Unlike static VCG transfers, TVA self-finances through endogenous credit accumulation on verified outcomes.

Strict propriety of \(S\) rules out pooling and constant-report deviations directly: any constant \(\widehat{y} = k\) earns credit strictly below truthful reporting on each edge with \(q_e \neq k\), with margin scaling as \((q_e - k)^2\). Condition ?? ensures the scoring-rule accuracy premium outweighs the leakage cost \(\kappa_i I(\theta^i; G^{i,t})\), which is specific to truthful reporting (\(I = 0\) for constant strategies). Appendix 7.1 formalizes the full argument.

The factor \((1-\gamma)^{-1}\) makes the discount rate pivotal: a higher \(\gamma\) (slower depreciation of detection value) raises the left side, broadening the parameter range over which truthful reporting is individually rational. When competitive pressure is strong (Section 4), the right side of ?? acquires an additional competitive cost term, requiring a higher \(\gamma^*\) to maintain incentive compatibility.

Next, we characterize the efficiency loss from decentralization. Let \(\theta^*\) denote the parameters of the centralized benchmark (social planner with access to all local graphs), and let \(\theta^{\text{fed}}\) denote the federated learning solution under truthful reporting.

Standard federated learning convergence results [39] further imply that under truthful reporting the federated solution satisfies \(\mathcal{L}(\theta^{\text{fed}}) \leq (1 + \epsilon)\mathcal{L}(\theta^*) + O(mLd/N)\), where \(\epsilon\) decays exponentially in the number of communication rounds and \(N = \sum_i n_i\). The efficiency loss is thus small when the federation is large relative to model complexity: the institutional scale of AML networks (dozens to hundreds of banks) favors this regime. The communication–performance tradeoff is illustrated empirically in the Online Appendix.

2.4 Quantitative Illustration↩︎

We illustrate the model’s predictions using the IBM AML synthetic benchmark [13], which contains over 1.4 million transactions across seven markets (United States, Germany, France, Italy, Spain, China, Rest of World) over 10 days, with illicit transactions representing less than 1% of volume.⁵ Data are split temporally: days 1–8 for training and validation, days 9–10 for testing, with seven federated clients corresponding to the seven markets.

We implement three reporting strategies: Truthful (banks report true local parameters \(\theta^i\)), Underreporting (banks scale parameters by \(0.8\) to reduce sensitivity), and Independent (banks train only on local data without federation). Given severe class imbalance we focus on AUPRC (Area Under Precision-Recall Curve) and Type II error (false negative rate).

Notes: Simulation on the IBM AML synthetic benchmark. AUPRC is the primary metric given severe class imbalance (\(<1\%\) illicit).

Table 1 shows that truthful reporting outperforms independent learning by 3.9 percentage points in AUPRC and underreporting by 2.1 percentage points, with Type II error reduced by 52.5% and 47% respectively. The ordering is consistent with the model’s predictions under Theorem 1, though we emphasize that this is an illustration of comparative performance under exogenously imposed distortions, not a derivation of equilibrium reporting under TVA: underreporting is imposed as a scalar distortion (\(\times 0.8\)) rather than derived as an equilibrium best response. A decomposition in the Online Appendix attributes 22–34% of the total improvement across markets to the incentive-alignment channel, with the remainder from data-pooling.

2.5 Adversarial Robustness↩︎

The previous section established that temporal value assignment implements truthful reporting as a Bayes–Nash equilibrium. We now analyze robustness when adversaries adapt their strategies in response to observed interventions.

Adversarial learning model↩︎

Sophisticated adversaries are not passive: they observe the history of enforcement actions and adjust transaction patterns to evade detection. We model this as a repeated game between the regulator and adversary.

At time \(t\), the adversary observes the history of frozen accounts \(\mathcal{H}_t = \{e : a_e^s = \text{freeze}, s < t\}\), implied detection threshold, i.e., \(\widehat{\tau}_t = \min\{\widehat{y}_e : e \in \mathcal{H}_t\}\), and the regulator’s behavioral patterns including intervention timing and targeting priorities.

Based on this history, the adversary can adapt through several mechanisms: transaction splitting, breaking large transfers into small ones to fall below detection thresholds; temporal manipulation, adjusting transaction timing to avoid detection windows; route switching, using different intermediary accounts; and account replacement, abandoning compromised accounts for new ones. Each adaptation has a cost \(c(\cdot)\) that increases with the degree of deviation from the adversary’s preferred strategy.

Formally, at time \(t\) the adversary solves: \[\max_{G^{t+1}} \mathbb{E}[V_{\text{launder}}(G^{t+1})] - \mathbb{P}(\text{detected} \mid G^{t+1}, \mathcal{H}_t) \cdot C_{\text{penalty}} - c(G^{t+1}, G^t) \label{eq:adversary95objective}\tag{6}\] where \(V_{\text{launder}}(\cdot)\) is the value of successfully laundered funds and \(c(G^{t+1}, G^t)\) measures the cost of adaptation.

Regret and equilibrium analysis↩︎

We analyze the regulator’s performance using the external regret framework from online learning. Let \(\pi\) denote the regulator’s policy (mapping risk scores to interventions) and let \(\pi^*\) denote the best fixed policy in hindsight. The regret after \(T\) periods is: \[\text{Regret}(T) = \sum_{t=1}^T \mathcal{L}(\pi, G^t) - \min_{\pi' \in \Pi} \sum_{t=1}^T \mathcal{L}(\pi', G^t), \label{eq:regret}\tag{7}\] where \(\mathcal{L}(\pi, G^t)\) is the loss (missed detections + false alarms) under policy \(\pi\) at time \(t\). External regret bounds typically assume \(\{G^t\}\) is generated by an oblivious adversary. In our setting the adversary is adaptive: \(G^{t+1}\) depends on past actions through \(\mathcal{H}_t\). [25] show that sublinear policy regret, which compares to what the best fixed policy would have earned had it been deployed throughout, is generally unattainable against adaptive adversaries. We therefore retain the external regret notion in 7 but assume the adversary observes interventions only with delay \(\delta \geq 1\), bounding its effective memory.

See proof in Appendix 7.2.

The regret bound decomposes into two economically distinct channels. The \(O(\sqrt{T|\mathcal{A}|\log|\mathcal{A}|})\) term reflects standard online learning: the cost of not knowing in advance which detection strategy is best against a fixed adversary. The \(\delta T(1-\gamma)^2\) term captures the additional cost of adversarial adaptation: it is linear in time but shrinks as \(\gamma \to 1\), because aggressive temporal discounting functions as a commitment device. When the regulator heavily weights early signals, the adversary’s best response is to avoid generating any early signals at all: which is effectively not laundering. Fixed-threshold policies lack this commitment, so adversaries can profitably learn to evade them throughout the horizon, producing \(\Omega(T)\) regret.

When adaptation costs are strictly convex and increasing in the degree of deviation, a stronger result follows directly from Proposition 1: there exists a threshold \(\bar{\gamma} \in (0,1)\) such that for \(\gamma > \bar{\gamma}\), the regulator playing TVA and the adversary not adapting constitutes a subgame-perfect equilibrium (proof in Appendix 7.3). The intuition is a deterrence argument. A regulator committed to high \(\gamma\) acts on early signals before the adversary has time to respond, making adaptation futile. Rational adversaries, anticipating that any restructuring of transaction flows will be caught early regardless, find it cheaper not to adapt at all. The mechanism is self-enforcing: the regulator never needs to carry out its most aggressive interventions in equilibrium because the commitment itself deters the behavior that would trigger them [51].

Empirical evidence↩︎

We illustrate Proposition 1 and the deterrence result using simulations where an adversary best-responds to observed intervention patterns.

We train detection models on days 1–8 and simulate adversarial adaptation in the test period (days 9–10). The adversary: (1) Regulator deploys detection policy \(\pi\) and freezes accounts with \(\widehat{y}_e \geq \tau\). (2) Adversary observes frozen accounts and infers threshold \(\widehat{\tau}\). (3) Adversary adapts by: (a) splitting large transactions by factor \(1/\alpha\), where \(\alpha \geq 1\), (b) reducing transaction frequency by factor \(\beta \in [0,1]\). (4) Adversary incurs adaptation cost \(c(\alpha, \beta) = (\alpha - 1)^2 + (1 - \beta)^2\). (5) Process repeats with adapted graph \(G^{t+1}\). We compare three policies: (1) Temporal Value (\(\gamma = 0.9\)): Our mechanism with strong early detection incentives; (2) Temporal Value (\(\gamma = 0.5\)): Moderate discounting; (3) Fixed Threshold: Constant \(\tau = 0.5\) without temporal weighting.

Table 2 shows that temporal value assignment with high \(\gamma\) maintains stable performance (only 1.2% degradation) under adversarial adaptation, while fixed-threshold policies degrade substantially (13.6%). The moderate discounting (\(\gamma = 0.5\)) provides intermediate robustness.

Table 3 shows that when facing temporal value assignment with high \(\gamma\), adversaries choose minimal adaptation (\(\alpha \approx 1\), \(\beta \approx 1\)) because the cost exceeds the benefit, consistent with the deterrence result above. Against fixed thresholds, adversaries aggressively split transactions (\(\alpha = 2.3\)) and reduce frequency (\(\beta = 0.65\)).

3 Coalition Formation and Network Theory of Information Value↩︎

In this section, we model federated participation among heterogeneous institutions as a two-stage Bayesian game in which institutions differ in size, compliance cost, signal quality, and competitive sensitivity. Participation generates positive network effects in detection performance but entails compliance and leakage costs, creating endogenous coalition formation. The model characterizes the minimum viable coalition, highlights strategic complementarities in participation, and shows that without TVA the federation may unravel due to adverse selection. By internalizing marginal contributions to system-wide detection quality, TVA sustains participation of high-value institutions and stabilizes the cooperative equilibrium.

Two-stage participation game↩︎

Consider a finite set of institutions \(M = \{1,\dots,m\}\). Each institution \(i\) is characterized by type \(\theta_i = (s_i, c_i, q_i, \kappa_i) \sim F \;\text{on }\mathbb{R}_+^4\), where \(s_i\) denotes size (data scale), \(c_i\) denotes compliance cost, \(q_i\) denotes signal quality, and \(\kappa_i\) denotes competitive sensitivity (leakage concern). Types are private information. We assume \(s_i\) and \(q_i\) are positively correlated, reflecting that larger institutions invest more in compliance and data infrastructure.

In the first stage (participation decision), Institutions simultaneously choose \(d_i \in \{0,1\}\), where \(d_i = 1\) indicates participation in the federated learning mechanism and \(d_i = 0\) indicates non-participation. Let \(\mathcal{S} = \{ i \in M : d_i = 1 \}\) denote the participating coalition. The participation stage is a static Bayesian game under incomplete information about other institutions’ types.

In the second stage (reporting game), Conditional on \(\mathcal{S}\), participating institutions jointly train a federated model with TVA-based credit allocation, while non-participating institutions train independently using only their local data. Let \(B_i(\mathcal{S})\) denote the detection benefit that institution \(i\) derives when the participating coalition is \(\mathcal{S}\).

Institution \(i\)’s participation payoff is \[\label{eq:participation95payoff} U_i(d_i = 1 \mid \mathcal{S}) = \underbrace{B_i(\mathcal{S})}_{\text{detection benefit}} - \underbrace{c_i \cdot \Delta n_i(\mathcal{S})}_{\text{compliance cost}} - \underbrace{\kappa_i \cdot I_i(\mathcal{S})}_{\text{leakage cost}} + \underbrace{\pi_i(\mathcal{S})}_{\text{TVA credit}}.\tag{8}\]

If \(d_i = 0\), institution \(i\) receives its outside option \[U_i(d_i = 0) = B_i(\{i\}),\] which corresponds to training independently.

The net gain from participation is therefore \[\Delta U_i(\mathcal{S}) = B_i(\mathcal{S}) - B_i(\{i\}) - c_i \Delta n_i(\mathcal{S}) - \kappa_i I_i(\mathcal{S}) + \pi_i(\mathcal{S}).\] Institution \(i\) participates if and only if \(\Delta U_i(\mathcal{S}) \ge 0\).

Minimum viable coalition and adverse selection↩︎

The following properties of the minimum viable coalition follow from supermodularity of the detection benefit function (proof in the Online Appendix). First, it exceeds a size threshold: \(|\mathcal{S}^*| \geq \underline{m}\), where \(\underline{m}\) is determined by the condition \(\sum_{i \in \mathcal{S}} s_i q_i \geq \max_i\{c_i + \kappa_i I_i\} / [\Pr(\textit{illicit}) \cdot V_0/(1-\gamma)]\). Second, institutions with high cross-border exposure and low compliance costs join first: a selection pattern consistent with the empirical observation that large internationally active banks tend to be early participants in AML information-sharing programmes. Third, the coalition exhibits strategic complementarity: adding one institution increases the marginal benefit for all remaining members, supporting a thick-market equilibrium. Fourth, without TVA the federation unravels: if \(\max_i[B_i(\{i\}) - B_i(\{1,\ldots,m\}) + c_i\Delta n_i + \kappa_i I_i] > 0\), the marginal institution exits, reducing detection quality for remaining members and triggering cascading departures in a dynamic analogous to adverse selection in insurance markets [52].

3.1 Network Structure and Information Value↩︎

The analysis in Section 3 treats each institution’s contribution as depending on its type \((s_i, c_i, q_i, \kappa_i)\) but not on its position in the inter-institutional transaction network. In practice, an institution that bridges two otherwise disconnected clusters of markets contributes far more to detection than an equally sized institution embedded within a single cluster. This section formalizes the network determinants of information value.

The Inter-Institutional Network↩︎

Define the inter-institutional network \(\mathcal{G} = (\mathcal{N}, \mathcal{E}, W)\), where \(\mathcal{N} = \{1,\ldots,m\}\) is the set of institutions, \(\mathcal{E} \subseteq \mathcal{N} \times \mathcal{N}\) contains an edge \((i,j)\) whenever institutions \(i\) and \(j\) share cross-border transactions, and \(W: \mathcal{E} \to \mathbb{R}_+\) assigns weights \(w_{ij}\) equal to the volume of cross-border transactions between \(i\) and \(j\). Let \(\mathbf{A}\) denote the weighted adjacency matrix with \(A_{ij} = w_{ij}\).

The inter-institutional network \(\mathcal{G}\) is distinct from the individual transaction graphs \(G^{i,t}\): the former captures which institutions share information boundaries, while the latter captures within-institution transaction patterns. Detection of cross-border illicit flows requires information from both endpoints of an inter-institutional edge: and thus from both institutions.

The key feature is the complementarity between endpoints: having both institutions in the federation (\(p^H\)) yields strictly higher detection than having only one (\(p^L\)), which in turn dominates having neither (\(p^0\)). This complementarity is the network foundation for the supermodularity of the participation game.

Network Shapley Value↩︎

We define the detection value function over coalitions as: \[\label{eq:detection95value} V(\mathcal{S}) = \sum_{(i,j) \in \mathcal{E}} w_{ij} \cdot p_{ij}(\mathcal{S}) \cdot C_{ij},\tag{9}\] where \(C_{ij}\) is the expected cost of undetected illicit flow on edge \((i,j)\). Following [18], the network Shapley value of institution \(i\) is: \[\label{eq:shapley} \phi_i^{\text{net}} = \sum_{\mathcal{S} \subseteq \mathcal{N}\setminus\{i\}} \frac{|\mathcal{S}|!\,(m-|\mathcal{S}|-1)!}{m!}\,\bigl[V(\mathcal{S}\cup\{i\}) - V(\mathcal{S})\bigr].\tag{10}\]

See proof in the Online Appendix.

The Shapley value ?? is a weighted-degree measure under the edge-additive coalition value 9 . While the mathematical reduction to weighted degree follows directly from edge-additivity, the economic contribution is providing an axiomatic justification for prioritizing inter-institutional transaction volume over total asset size in coalition design. Institutions with larger incident cross-border volume or higher per-edge detection complementarity contribute more to collective detection and therefore deserve a proportionally larger share of federation-generated surplus. Richer centrality notions (betweenness, cut-vertex bridge premia, Bonacich) emerge when the coalition value is extended to reward path-based or flow-based detection, where institution \(i\)’s contribution depends on paths through \(i\) rather than only on edges incident to \(i\); we outline this extension in the Online Appendix. For the core analysis, the weighted-degree characterization is sufficient for the coalition-design results that follow.

Efficient Coalition Design↩︎

The network Shapley value enables an efficient coalition design that improves on the type-based analysis in Section ¿sec:sec:mvc?.

Proposition 2 immediately pins down the welfare-maximizing coalition: rank institutions by net network value \(\phi_i^{\text{net}} - c_i - \kappa_i I_i\) and include institutions until the marginal net value turns negative. Since \(\phi_i^{\text{net}}\) depends on weighted cross-border degree, the practical implication is that regulators should prioritize institutions with high inter-institutional transaction volume, rather than simply recruiting the largest banks by total assets. This provides a tractable, data-based criterion for coalition expansion that is absent from existing AML policy guidance.

TVA with Network-Adjusted Credit↩︎

The network Shapley value motivates a refinement of TVA in which scoring-rule credit rates are scaled by institution-specific weights reflecting network position: \[\label{eq:network95tva} \pi^i_{t_{\text{confirm}}} = \pi^i_{t_{\text{confirm}}-1} + \omega_i \sum_{t < t_{\text{confirm}}} \gamma^{t_{\text{confirm}}-t} \cdot C_e \cdot S(\widehat{y}^{i,t}_e, y_e),\tag{11}\] where \(\omega_i = \phi_i^{\textit{net}}/\bar{\phi}\) is a network position multiplier and \(S\) remains a strictly proper scoring rule. Because \(\omega_i\) scales the scoring-rule transfer uniformly across reports, strict propriety is preserved at the per-edge level, since pointwise strict propriety is invariant to positive affine scaling of \(S\). Institutions with higher network contribution receive proportionally more credit per accurate report.

Under network-adjusted TVA with weights \(\omega_i\), truthful reporting remains a Bayes–Nash equilibrium, uniquely optimal at each edge in the large-federation limit, if \[\label{eq:network95ic} \frac{\omega_i \cdot V_0}{1-\gamma}\cdot \Pr(\textit{illicit}) > \kappa_i \cdot I(\theta^i; G^{i,t}) \quad \forall\, i,\tag{12}\] with the compliance term vanishing in the large-federation limit as in Theorem 1. The multiplier \(\omega_i\) relaxes the IC constraint for high-contribution institutions and tightens it for low-contribution ones, matching marginal incentive to marginal social contribution. A uniform credit rate would over-reward peripheral institutions relative to their contribution and under-reward bridges, creating an adverse selection pressure that risks losing the most informationally valuable participants.

Adversarial Exploitation of Network Structure↩︎

A sophisticated adversary can exploit the inter-institutional network structure by routing illicit flows through structural holes: pairs of institutions that do not share a federation link.

1. In equilibrium, the adversary routes a fraction \(\lambda^*\) of illicit flows through structural holes, where: \[\label{eq:adversarial95routing} \lambda^* = \frac{p^H - p^0}{p^H - p^0 + c_{\text{route}}},\tag{13}\] and \(c_{\textit{route}}\) is the additional transaction cost. The adversary’s equilibrium exploit is increasing in the number of structural holes and decreasing in federation coverage.

2. Closing a structural hole, which means adding institution \(k\) such that \((i,k) \in \mathcal{E}\) and \((k,j) \in \mathcal{E}\), reduces adversarial exploit by \(\Delta\lambda^* \approx (p^H - p^0)(p^H - p^L)/(p^H - p^0 + c_{\textit{route}})^2\), providing a principled criterion for federation expansion.

4 Competition, Welfare, and the Backfiring Mandate↩︎

We now analyze how competitive pressure among banks interacts with detection incentives, following the approach of [5] in modeling how competition shapes banks’ compliance behavior. The key insight is that detection investment imposes customer-facing costs such as monitoring delays, false-positive freezes, and privacy concerns, which can disadvantage a bank relative to less vigilant competitors, creating incentives to underinvest in compliance.

Consider \(m\) banks competing for depositors. Depositor \(j\)’s utility from bank \(i\) is: \[\label{eq:depositor95utility} u_{ji} = \delta_i + \alpha_r \cdot r_i - \alpha_\phi \cdot \phi_i + \xi_i + \epsilon_{ji},\tag{14}\] where \(\delta_i\) captures non-price characteristics, \(r_i\) is the deposit rate, \(\alpha_r > 0\) is rate sensitivity, \(\alpha_\phi \geq 0\) is the detection externality: the disutility from heightened monitoring such as delays, false-positive freezes, and privacy loss, \(\xi_i\) is unobserved quality, and \(\epsilon_{ji}\) is i.i.d.Type I extreme value.⁶ The parameter \(\alpha_\phi\) captures the competitive cost of detection: the loss of marginal deposit demand due to increased monitoring intensity. When \(\alpha_\phi > 0\), firms that invest more in detection bear customer-facing costs that erode their market position.

The parameter \(\alpha_\phi\) captures a competitive externality distinct from the information-sharing frictions above: even if a bank reports truthfully, it bears the customer-facing costs of its detection investment while rivals free-ride on the systemic risk reduction. Each bank’s private return on compliance falls short of the social return.

Bank \(i\) jointly chooses deposit rate \(r_i\), detection investment \(\phi_i\), and reporting strategy \(\rho_i\): \[\label{eq:bank95profit} \max_{r_i, \phi_i, \rho_i}\; \underbrace{D_i(r_i, \phi_i) \cdot (r_L - r_i)}_{\text{intermediation margin}} - \underbrace{c_i \cdot \phi_i \cdot D_i}_{\text{compliance cost}} + \underbrace{\pi_i(\rho_i, \rho_{-i})}_{\text{TVA credit}} - \underbrace{P_i(\phi_i)}_{\text{regulatory penalty}},\tag{15}\] where \(D_i\) is deposit demand, \(r_L\) is the lending rate, and \(P_i(\phi_i) = p_0(1-\phi_i)^2\) is a convex regulatory penalty.

Competition induces firms to underinvest in socially valuable detection when the associated costs are partly borne by customers, a compliance analog of the competition–moral hazard channel [5]. Mandating federation without calibrating incentives to offset competitive costs leads firms to comply in form but not substance.

4.1 Welfare Analysis Across Regulatory Regimes↩︎

We introduce and compare four regulatory regimes: autarky, mandated full sharing, voluntary federation without incentives, and incentive-compatible federation with TVA. While full sharing maximizes detection externalities, it may impose excessive leakage and compliance costs; voluntary federation without incentives can suffer from strategic underreporting and even underperform autarky. TVA restores alignment by compensating marginal contributions, improving participation and welfare. Optimal mechanism design balances detection gains against compliance, competitive, and adversarial pressures.

Four regulatory regimes↩︎

We compare four institutional arrangements governing information sharing and model training. The welfare comparison requires one additional assumption about the structure of detection benefits.

4.1.0.1 Regime A: Autarky.

Each institution operates independently and trains its own local detection model using only its proprietary data. There is no parameter sharing, no cross-institutional signal aggregation, and no information leakage through reporting. Formally, for each \(i\), \(\mathcal{S} = \{i\}\) and welfare is \[W^A = \sum_i \Big( B_i(\{i\}) - c_i\,\mathbb{E}[n_i^A] \Big),\] with \(I_i^A = 0\) and \(\Phi_i^A = 0\).

4.1.0.2 Regime B: Mandated Full Sharing.

All institutions are required to share information and participate in centralized model training. Reporting is fully informative and participation is compulsory. Incentive, privacy, and competitive constraints are ignored. The coalition is \(\mathcal{S} = N\), and reporting maximizes aggregate detection performance: \[W^B = \max_{\text{reports}} \sum_i \Big( B_i(N) - c_i\,\mathbb{E}[n_i^B] - \kappa_i I_i^B - \alpha_\phi \Phi_i^B \Big).\] This regime internalizes detection externalities but may impose high leakage and competition costs.

4.1.0.3 Regime C: Voluntary Federation Without Incentives.

Institutions may voluntarily join a federated learning coalition and report model updates. However, no transfer or contribution-based compensation (TVA) is provided. Reporting choices are strategic and privately chosen to maximize individual payoffs: \[\Pi_i^C = B_i(\mathcal{S}) - c_i\,\mathbb{E}[n_i^C] - \kappa_i I_i^C - \alpha_\phi \Phi_i^C.\] Equilibrium may feature underreporting or partial participation due to privacy and competitive concerns.

4.1.0.4 Regime D: Incentive-Compatible Federation (TVA).

Institutions participate in federated learning with a transfer mechanism that allocates credit based on marginal contribution. The TVA mechanism aligns private incentives with social detection value: \[\Pi_i^D = B_i(\mathcal{S}) - c_i\,\mathbb{E}[n_i^D] - \kappa_i I_i^D - \alpha_\phi \Phi_i^D + \mathrm{TVA}_i.\] Transfers are designed so that truthful or higher-quality reporting is privately optimal. This regime mitigates underreporting distortions while preserving decentralized participation.

Welfare ordering↩︎

The central result of this section is our welfare ordering theorem, which we name the Backfiring Mandate Proposition to highlight its principal policy implication: information-sharing mandates that ignore strategic incentives can reduce welfare below the autarky benchmark.

Assumptions 8 and 9 are presented as maintained conditions rather than derived from primitives because the full microfoundation in the GNN setting is intractable. A Gaussian aggregation toy model in the Online Appendix shows that both assumptions hold structurally under standard information aggregation with linear competitive costs, so this proposition is not tautological. The conditions in parts (b) and (c) are sufficient rather than necessary; they isolate the economic channel through which competition-induced distortions overturn the gains from information aggregation.

The welfare ranking \(W^C < W^A\) does not arise because federation is harmful, but because federation without incentive design is worse than no federation. When banks federate without TVA under competitive pressure, the competitive cost of flagging customers motivates systematic underreporting; the aggregated global model is built on distorted inputs and delivers detection quality below each bank’s honest local model, while still imposing compliance burdens, a strict welfare loss relative to autarky. Part (c) extends this finding: mandatory sharing eventually backfires when competitive and leakage costs dominate detection gains. The policy implication, that how sharing is organized matters as much as whether it occurs, is directly actionable for regulators designing AML information-sharing frameworks.

Optimal mechanism design↩︎

The regulator chooses \(\gamma\) to maximize welfare: \[\label{eq:optimal95gamma} \gamma^* = \operatorname{argmax}_{\gamma \in (0,1)} W^D(\gamma) = \operatorname{argmax}_\gamma \sum_{i \in \mathcal{S}^*(\gamma)} B_i(\mathcal{S}^*(\gamma)) - \text{Total Costs}(\gamma).\tag{16}\] Comparative statics yield natural properties: \(\gamma^*\) is decreasing in the base illicit rate \(\Pr(\textit{illicit})\), since higher base rates require less aggressive temporal discounting; increasing in competitive intensity \(\alpha_\phi\), since more competition demands stronger incentives; and increasing in adversarial speed \(1/\delta\), since faster adversaries require sharper temporal credit.

5 Intervention Under Information Loss: An Index-Based Heuristic↩︎

The previous sections established the paper’s main welfare results. This section develops an operational extension: under additional dynamic assumptions about how freezing accounts destroys network information, the regulator faces a non-trivial exploration–exploitation tradeoff that the welfare analysis of Section 4.1 abstracted away. This extension is self-contained and not required for the backfiring mandate result; readers primarily interested in the welfare analysis may proceed directly to Section 6.

The intervention decision is which suspicious accounts to freeze immediately versus monitor for additional learning. The problem is subtle because freezing accounts permanently removes edges from the transaction network, destroying information about future illicit flows and creating a tradeoff where aggressive intervention improves immediate security but degrades future detection.

5.1 Link Removal and Information Loss↩︎

Formally, let \(G^t = (V^t, E^t)\) denote the observable transaction network at time \(t\). When the regulator freezes account \(u \in V^t\), the following period’s network becomes: \[G^{t+1} = (V^t \setminus \{u\}, E^t \setminus \{(u,v) : v \in V^t\})\] All edges incident to \(u\) are removed. This has two effects: (1) Direct Information Loss: The regulator no longer observes transactions involving \(u\), preventing detection of illicit flows through that account. (2) Network Information Loss: Removing \(u\) affects the GNN’s ability to learn about neighbors \(\mathcal{N}(u)\). GNN aggregation computes node \(v\)’s embedding at layer \(\ell+1\) as a function of its neighbors’ embeddings at layer \(\ell\) (see Online Appendix for the full equation). When \(u\) is removed from \(\mathcal{N}(v)\), the aggregation for neighbor \(v\) changes, degrading embeddings for the entire neighborhood. Consider a star network as an illustration:, where a hub account \(h\) connects to 10 peripheral accounts \(\{p_1, \ldots, p_{10}\}\). Freezing \(h\) on early suspicion yields:

• Benefit: Prevents immediate illicit flows through \(h\).

• Cost: Loses ability to observe whether peripheral accounts \(\{p_i\}\) are also involved; the GNN cannot aggregate information from \(h\) to update suspicion scores for \(\{p_i\}\).

However, this example also reveals that if \(h\) turns out to be legitimate (false positive), the information loss is permanent and unrecoverable. We formulate the intervention decision as a restless bandit problem [9]. Each edge \(e \in E^t\) is an "arm" with evolving state: \[s_e^t \in \{\text{unknown}, \text{suspicious}, \text{confirmed-illicit}, \text{confirmed-legitimate}\}\] The regulator chooses action \(a_e^t \in \{\text{monitor}, \text{freeze}\}\) for each edge. The state transitions are: \[\begin{align} \nonumber \mathbb{P}(s_e^{t+1} &= \text{confirmed-illicit} \mid s_e^t = \text{suspicious}, a_e^t = \text{monitor}) = p_e \\ \mathbb{P}(s_e^{t+1} &= \text{confirmed-legitimate} \mid s_e^t = \text{suspicious}, a_e^t = \text{monitor}) = 1 - p_e \\ \nonumber \mathbb{P}(s_e^{t+1} &= \text{removed} \mid a_e^t = \text{freeze}) = 1 \end{align}\] where \(p_e = \mathbb{P}(\text{illicit} \mid \text{features } X_e, \text{embedding } H_e)\) is the learned risk probability. The regulator’s reward depends on the action taken and the true state of the edge: \[\begin{align} \nonumber R(a_e &= \text{freeze}, s_e = \text{confirmed-illicit}) = C_e, \quad \text{(prevented loss)}\\ \nonumber R(a_e &= \text{freeze}, s_e = \text{confirmed-legitimate}) = -\alpha_1, \quad \text{(false positive cost)}\\ \nonumber R(a_e &= \text{monitor}, s_e = \text{confirmed-illicit}) = -\alpha_2, \quad \text{(false negative cost)}\\ \nonumber R(a_e &= \text{monitor}, s_e = \text{unknown}) = \lambda \cdot I_e, \quad \text{(information value)} \end{align}\] where \(I_e\) is the information value of edge \(e\), defined as the reduction in uncertainty about neighboring edges. \(C_e\), \(\alpha_1\) and \(\alpha_2\) are defined in Equation (2 ). The regulator maximizes expected discounted cumulative reward:

\[\max_{\{a_e^t\}} \mathbb{E}\left[\sum_{t=1}^T \gamma^t \sum_{e \in E^t} R(a_e^t, s_e^t)\right] \label{eq:bandit95objective}\tag{17}\]

5.2 Risk Memory as Index Approximation↩︎

For standard multi-armed bandits, the optimal policy is characterized by the Gittins index [8]: a scalar priority score for each arm that trades off immediate reward against information value. We extend this to the restless bandit setting with network effects.

Computing the exact Gittins index in Equation ?? requires solving a dynamic program over the entire state space, which is intractable for large networks. We show that the risk memory mechanism proposed in our system provides a computationally efficient approximation. For each node \(u\), maintain a priority queue of the top-\(K\) most suspicious historical interactions: \[\mathcal{M}_u = \text{top-}K \{(\widehat{y}_e^t, e, t) : e = (u, v) \text{ or } e = (v, u), t \leq t_{\text{current}}\} \label{eq:memory}\tag{18}\] where entries are sorted by risk score \(\widehat{y}_e^t\) and \(K\) is a hyperparameter (typically \(K \in [5, 20]\)). The node-level risk score aggregates memory: \[\widehat{y}_u = \max_{(\widehat{y}_e, e, t) \in \mathcal{M}_u} \left\{\gamma^{t_{\text{current}} - t} \cdot \widehat{y}_e\right\} \label{eq:node95risk}\tag{19}\] The regulator freezes node \(u\) if \(\widehat{y}_u \geq \tau\).

5.3 Centrality-Weighted Optimal Intervention↩︎

We extend the Gittins index formulation (5) to account for network externalities from intervention. Freezing a high-centrality account destroys more network information than freezing a peripheral one.

When the Gittins index is adjusted for network externalities via Definition 5, two economically meaningful properties emerge. First, hub protection: highly connected accounts are frozen later than equally suspicious peripheral accounts, because their removal would deprive the regulator of information about an entire neighborhood. This is costly precisely when the hub is legitimate: a false positive on a hub account severs the learning links that would have identified genuinely illicit peripheral accounts. Second, cascade avoidance: successive freezes within a cluster progressively increase the marginal information loss of further freezes, so the policy endogenously spaces out interventions. Both properties are consistent with practical AML guidance on preserving monitoring channels, and the \((1-1/e)\) approximation guarantee (proof in Appendix 7.9) ensures that the computationally tractable risk memory implementation captures nearly all of this benefit.

The hub protection property creates a strategic tension: since central accounts are frozen later, a rational adversary has an incentive to route illicit flows precisely through well-connected hubs. The regulator can respond by raising \(\lambda_{\text{net}}\) selectively for accounts with unusual hub-concentration of flagged flows. This cat-and-mouse dynamic over hub intervention timing converges to a mixed-strategy equilibrium, and calibrating \(\lambda_{\text{net}}\) from observed routing patterns is therefore an important input to the regulator’s policy design.

5.4 Simulation Evidence on Intervention Policies↩︎

We compare three intervention policies on the transaction network data.⁷ (1) Greedy Immediate Freezing: Freeze all edges with \(\widehat{y}_e \geq \tau\) immediately; (2) Risk Memory: Use risk memory mechanism (Equation 18 ) with \(K = 10\); (3) Oracle: Gittins index computed via dynamic programming, which is intractable for the full dataset and is evaluated on subsampled graphs.

We measure performance using three metrics: (1) prevented loss ratio: fraction of total illicit transaction value prevented by freezing; (2) Network connectivity: average graph diameter before and after interventions (measures information loss); (3) Detection latency: average time between first suspicious signal and final detection.

Table 4 shows that risk memory substantially outperforms greedy freezing (79.3% vs. 49.4% prevented loss) while maintaining better network connectivity (diameter 4.6 vs. 8.2). The performance is close to the oracle policy (82.1%), consistent with Proposition 5. Greedy freezing creates information loss by prematurely removing suspicious nodes. Risk memory defers intervention on high-information-value nodes (those with many connections, central positions), allowing the GNN to continue learning about their neighborhoods. The choice \(K = \Theta(\log |V|) \approx 11\) in Proposition 5 reflects the empirical observation that performance saturates around this value; details and ablation are reported in the companion paper.

Additional simulation evidence is collected in the Online Appendix, including parameter calibration, TVA gain decomposition, welfare comparisons across regulatory regimes, and per-market heterogeneity analyses.

6 Conclusion↩︎

This paper develops a mechanism design framework for decentralized risk analytics in which competing firms hold fragmented signals about risky customers and must be induced to share them truthfully. The core contribution is a welfare analysis showing that information-sharing mandates can backfire when they ignore competitive incentives, paired with a TVA mechanism that corrects this failure.

Three main results organize the analysis. First, the Backfiring Mandate Proposition establishes that voluntary federation without incentive design can reduce welfare below autarky when competitive pressure is strong, because strategic underreporting produces biased global models worse than honest local models while still imposing compliance costs. Simulation-based welfare comparisons in the Online Appendix show that mandatory sharing without TVA barely exceeds autarky in welfare, while TVA substantially closes the gap to the first-best: illustrating the quantitative importance of incentive alignment. Second, the TVA mechanism with a strictly proper scoring rule transfer implements truthful reporting as a Bayes–Nash equilibrium (uniquely optimal at each edge) in large federations; temporal discounting deters adversarial adaptation, yielding sublinear regret against adaptive adversaries with bounded memory when \(\gamma\) is close to 1. Third, a network Shapley characterization shows that each institution’s marginal contribution to collective detection is proportional to its weighted cross-border degree, so coalition design should prioritize high inter-institutional transaction volume rather than total assets: with direct implications for how regulators design AML information-sharing programmes.

The analysis yields three implications for designers of decentralized risk-detection systems and the regulators who oversee them. First, information-sharing mandates achieve their welfare goals only when paired with compatible incentive design; mandates alone, without mechanisms that internalize the private cost of truthful reporting, can leave welfare close to the autarky benchmark and below the first-best by a substantial margin. This applies directly to existing AML rules such as the EU 6th AML Directive and FinCEN §314(b) programs, but the same logic applies to platform fraud consortia, cybersecurity information-sharing organizations (ISACs), supply chain disclosure rules, and any setting in which mandated cooperation among competing firms substitutes for true incentive alignment. Second, coalition design should prioritize network centrality—specifically, weighted inter-firm interaction volume—over firm size: the network Shapley value is more predictive of a firm’s marginal contribution to collective detection than balance-sheet or market-share totals. Third, intervention policies should account for network information externalities: aggressive intervention on high-centrality nodes permanently degrades the system’s information environment, and a centrality-weighted index policy preserves detection capability while maintaining enforcement. These implications are directly testable in pilot programs with regional banking consortia or platform fraud-prevention bodies, and the TVA mechanism is implementable on existing reporting infrastructure.

The principles developed here, namely temporal value assignment, network Shapley value, centrality-weighted intervention, and competition-aware mechanism design, extend beyond financial crime to any setting where competing firms must share signals for collective risk detection, including cybersecurity threat intelligence, supply chain risk management, multi-platform fraud prevention, and collaborative marketing analytics.

Several limitations of our analysis suggest directions for further work. Our analysis uses synthetic data; validation on proprietary transaction data, ideally in cooperation with a regional supervisor, is an important next step. The network Shapley value computation is exponential in \(m\); developing polynomial-time approximations for large federations is a natural algorithmic direction. Extensions to endogenous network formation, in which institutions choose which bilateral links to maintain, and to dynamic network evolution, would further enrich the theory. The political economy of international cooperation and asymmetric regulatory environments are promising policy-relevant directions.

7 Proof↩︎

7.1 Proof of Theorem 1 (Bayes–Nash Implementation)↩︎

7.2 Proof of Proposition 1 (Regret Bound)↩︎

7.3 Proof of the Early Detection Equilibrium Result (Section 2.5)↩︎

7.4 Sketch of Proof: Minimum Viable Coalition (Section 3)↩︎

7.5 Proof of Proposition 2 (Network Shapley)↩︎

7.6 Sketch of Proof: Theorem 4 (Backfiring Mandate)↩︎

7.7 Proof of Proposition 3↩︎

7.8 Proof of Proposition 5 (Index-Based Intervention Heuristic)↩︎

7.9 Proof of Corollary [thm:centrality95intervention]↩︎

8 Additional Simulation Results↩︎

This appendix collects simulation results that complement the main text. All results use the IBM AML synthetic benchmark [13] described in the main paper.

8.1 Parameter Calibration↩︎

We calibrate the model’s key parameters to match empirical moments from the IBM AML dataset using a method of moments approach. The calibrated parameters are: compliance costs \(\{c_i\}\), leakage sensitivities \(\{\kappa_i\}\), detection value \(V_0\), adversarial delay \(\delta\), and competitive intensity \(\eta\). We target market-level moments such as detection rates, error rates, cross-border volumes, and adversarial degradation patterns, yielding 49 moment conditions for 17 parameters.

Notes: Standard errors via bootstrap (500 replications). TVA Surplus is per-period welfare gain over autarky. Hansen’s \(J = 38.4\) (32 d.f., \(p = 0.201\)).

Compliance costs are highest for the United States, reflecting its larger reporting burden. Leakage sensitivity is largest for China, consistent with stronger competitive frictions. Smaller markets such as Rest Countries benefit disproportionately from federation. The estimated competitive intensity \(\widehat{\eta} = 0.183\) indicates nontrivial strategic distortion in the absence of incentives, and the optimal discount factor \(\widehat{\gamma}^* = 0.87\) is consistent with the IC condition in the Incentive Compatibility Theorem in the main paper.

8.2 Welfare Simulations Across Regulatory Regimes↩︎

Table 6 simulates welfare under four regulatory regimes using the calibrated parameters, illustrating the Backfiring Mandate Theorem (the Backfiring Mandate Theorem in the main paper). Because the four regimes do not coexist simultaneously in the data, these are model-based policy simulations rather than empirical counterfactuals.

Notes: Welfare as % of first-best. C\('\) forces all institutions to federate without incentive design.

TVA (Regime D) achieves 87.3% of first-best welfare with full participation (7 of 7 institutions), while mandatory sharing without TVA (C\('\)) achieves only 56.4%: barely above autarky (53.7%), consistent with part (b) of the Backfiring Mandate Theorem in the main paper. Restricting TVA to only the two largest markets reduces welfare to 74.1%, and lowering the discount factor to \(\gamma = 0.5\) reduces welfare to 69.2%, consistent with the comparative statics on \(\gamma^*\).

8.3 Decomposition of TVA Gains↩︎

Table 7 decomposes total TVA performance gains across five channels: data aggregation, incentive alignment (truthful vs.strategic reporting), network centrality effects, adversarial robustness, and risk memory intervention. The incentive alignment channel, the portion attributable to correcting underreporting distortions, accounts for 22–34% of total gains across markets, confirming that mechanism design beyond data pooling is essential.

Notes: Aggregation = data pooling gain; Incentive = correcting strategic underreporting; Network = network-adjusted credit and centrality-weighted intervention; Anti-Adversarial = adversarial robustness gain; Intervention = risk memory vs.greedy freezing.

The network and anti-adversarial channels together account for a further 26–38% of gains, consistent with TVA operating across multiple complementary dimensions.

8.4 Dataset Statistics↩︎

8.5 Per-Market Heterogeneity of Federation Gains↩︎

Table 9 reports the per-market absolute performance difference between federated and independent local training. Smaller markets (Spain, Italy, France) show the largest AUPRC gains, consistent with the minimum viable coalition result: data-sparse institutions benefit most from cross-institutional information sharing. Larger markets trade slight precision losses for substantial recall improvements, reflecting cross-institutional knowledge sharing primarily enhancing coverage of rare or structurally heterogeneous illicit behaviors.

8.6 Empirical Check on Network Shapley Predictions↩︎

Proposition 2 in the main paper predicts that each institution’s marginal contribution to collective detection is proportional to its weighted cross-firm interaction degree (network Shapley value). To check this theoretical prediction against the simulation environment, Table 10 reports the system-wide impact of removing each market: the empirical leave-one-market-out (LOO) marginal contribution. Markets with positive \(\Delta_i^{\text{AUPRC}}\) (Germany, China, Italy, Rest Countries) generate positive marginal value for the federation. The cross-sectional ordering of these LOO contributions correlates positively with the network-Shapley prediction based on cross-market transaction volume in the dataset, providing an empirical illustration consistent with Proposition 2. We do not pursue formal estimation of the theoretical-empirical correlation here; that is part of the broader empirical analysis in [12].

9 Detection Model: Pointer to Companion Paper↩︎

The strategic analysis in this paper does not depend on the specific implementation of the institution-level detection model: any architecture \(f^i_\theta: G^{i,t} \to [0,1]^{|E^{i,t}|}\) producing edge-level posteriors satisfies the requirements of Theorem 1 and the welfare analysis. The simulation results illustrating the framework’s predictions use the federated graph neural network architecture developed in [12], which contains the full architecture specification, training procedure, hyperparameter choices, and computational ablations. We refer the reader to that paper for implementation details. The properties used here are: (i) \(f^i_\theta\) produces calibrated probabilistic outputs, so that strict propriety of the scoring rule applies meaningfully; and (ii) parameter aggregation across institutions is Lipschitz in individual reports, as required by Assumption 5 in the main paper. Both are verified empirically in the companion paper.

10 Full Proofs Not in Main Paper↩︎

This appendix contains full formal proofs for results whose sketches appear in the main paper.

10.1 Proof of the Minimum Viable Coalition Result (the main paper)↩︎

10.2 Proof of the Backfiring Mandate Theorem in the main paper↩︎

10.3 Proof of the Network Shapley Proposition (Weighted-Degree Characterization)↩︎

10.4 Path-Based Extension: Bonacich Centrality↩︎

The weighted-degree characterization above follows from the edge-additive coalition value the edge-additive coalition value in the main paper. A richer coalition value, where institution \(i\)’s contribution depends on paths through \(i\) rather than only on edges incident to \(i\), yields a Bonacich centrality characterization. We sketch this extension here for completeness; it is not implied by the main paper’s coalition value function.

Suppose the coalition value is extended to include path-based detection effects from the GNN message-passing architecture: institution \(i\)’s presence in \(\mathcal{S}\) improves detection not only on edges incident to \(i\), but also on edges \((j,k)\) where path \(i \to j \to k\) exists through institutional network \(\mathcal{G}\). Under linearity (\(p^H - p^L = p^L - p^0 = \Delta p\)), the path-based marginal contribution through a path of length \(\ell\) scales as \((\Delta p)^\ell \prod_s A_{j_s j_{s+1}} C_{j_s j_{s+1}}\). Defining \(\delta \equiv \Delta p \cdot C_{\textit{avg}}\) and summing the geometric series gives \[\phi_i^{\textit{net,path}} \propto \sum_{\ell=0}^\infty \delta^\ell [\mathbf{A}^\ell \mathbf{1}]_i = b_i(\mathcal{G}, \delta),\] which is the Bonacich centrality with convergence condition \(\delta < 1/\lambda_{\max}(\mathbf{A})\). The connection to [17] follows. This extension is illustrative: it requires augmenting the coalition value function beyond the edge-additive form used in the main paper, and is offered as a direction for future work rather than a formal result of this paper.

10.5 Proof of the Federated Approximation Bound (the main paper)↩︎

10.6 Proof of Risk Memory Approximation (the Optimal Intervention Proposition in the main paper)↩︎

11 Toy Parametric Example: Structural Foundation for Assumptions 8 and 9↩︎

Assumptions 8 (Reporting Spillovers) and 9 (Detection Quality Monotonicity) in the main paper are maintained assumptions used in the Backfiring Mandate Proposition. This appendix shows that both assumptions can be derived from primitives in a simple two-bank Gaussian-signal aggregation model, providing structural grounding for the welfare result.

Consider two banks \(i \in \{1, 2\}\) each observing a Gaussian signal \(s_i = y + \eta_i\) about a latent risk variable \(y \sim \mathcal{N}(0, \sigma_y^2)\), with \(\eta_i \sim \mathcal{N}(0, \sigma_\eta^2)\) i.i.d. Each bank chooses a reporting precision \(m_i \in [0, 1]\) determining how much of its signal to transmit, with transmitted signal \(\widetilde{s}_i = m_i s_i + (1-m_i) z_i\) and \(z_i \sim \mathcal{N}(0, \sigma_z^2)\) independent noise. Full truthful reporting corresponds to \(m_i = 1\) and uninformative reporting to \(m_i = 0\). The aggregated signal is \(\bar{s} = (\widetilde{s}_1 + \widetilde{s}_2)/2\).

The posterior mean of \(y\) given \(\bar{s}\), and hence expected detection quality, is \(B(\bar{s}) = \sigma_y^2/(\sigma_y^2 + \sigma_{\text{agg}}^2(m_1, m_2)) \cdot \bar{s}\) with aggregated noise variance \(\sigma_{\text{agg}}^2 = \frac{1}{4}[m_1^2 \sigma_\eta^2 + (1-m_1)^2 \sigma_z^2 + m_2^2 \sigma_\eta^2 + (1-m_2)^2 \sigma_z^2]\). Detection benefit \(B_i\) is increasing in \(m_j\) for \(j \neq i\) whenever \(\sigma_z^2 > \sigma_\eta^2\), so the spillover structure of Assumption 8 holds.

Under banking competition with detection externality \(\alpha_\phi\), bank \(i\)’s private payoff from reporting intensity \(m_i\) is \(B_i - \alpha_\phi \cdot m_i\), where the linear competitive cost captures the customer-facing disutility of heightened monitoring. The FOC is \(\partial B_i / \partial m_i = \alpha_\phi\). As \(\alpha_\phi \to \infty\), the equilibrium \(m_i^C \to 0\), precisely Assumption 8’s prediction that reporting becomes uninformative under intense competition.

At \(m_1 = m_2 = 0\), corresponding to Regime C under extreme competition, aggregated noise variance is \(\sigma_z^2/2\); at \(m_1 = m_2 = 1\), the autarky-equivalent individual signal case, each bank’s local noise is \(\sigma_\eta^2\). If \(\sigma_z^2 > 2\sigma_\eta^2\), which is plausible when injected noise exceeds natural signal variability, autarky achieves strictly higher detection quality than Regime C at high \(\alpha_\phi\). Combined with Regime C’s positive leakage and compliance costs, both of which are zero under autarky, this yields \(W^C < W^A\), so Assumption 9 holds as a derived consequence rather than as a maintained primitive.

This toy model is not a substitute for the full microfoundation in the GNN-based setting, where detection quality depends on the entire aggregated parameter structure. However, it demonstrates that the Backfiring Mandate result is not a tautology: under standard Gaussian information aggregation with linear competitive costs, Assumptions 8 and 9 emerge structurally from primitives. The main paper’s reliance on these assumptions is therefore economically grounded, even if the full derivation in the complex GNN setting is intractable.

References↩︎

---

1. Jian Ni: Pamplin College of Business, Virginia Tech, Email: jiann@vt.edu; Lecheng Zheng: Pamplin College of Business, Virginia Tech, Email: lecheng@vt.edu; John R Birge: Booth School of Business, University of Chicago, Email: John.Birge@chicagobooth.edu↩︎

2. The empirical implementation of the detection framework, including the federated graph neural network architecture, hierarchical reinforcement learning intervention policy, and large-scale validation, is developed in a separate companion paper, [12]. The two papers have non-overlapping primary contributions: the companion develops the empirical machinery, and this paper develops the mechanism design framework, the welfare analysis, and the network coalition theory. We use the same benchmark dataset for illustration of theoretical predictions, with quantitative results reported here serving only to illustrate (not to establish) the theoretical claims.↩︎

3. In AML practice, label confirmation follows the Suspicious Activity Report (SAR) investigation process in which the institution flags the activity, FinCEN or a national financial intelligence unit reviews it, and a determination is made, typically over weeks to months. The delay \(\tau\) captures this institutional timeline.↩︎

4. That model parameters can expose local training data is well-established in the federated learning literature; see [48] and [49] on gradient inversion and membership inference attacks. The mutual information term \(\kappa_i \cdot I(\theta^i; G^{i,t})\) in equation 3 provides a formal measure of this leakage.↩︎

5. Dataset available at https://www.kaggle.com/datasets/ealtman2019/ibm-transactions-for-anti-money-laundering-aml. The figures reported in this section illustrate qualitative predictions of the theoretical analysis (the welfare ordering across reporting strategies). They are not the empirical contribution of this paper. The federated GNN architecture, training procedure, hyperparameter calibration, and full empirical validation are developed in the companion paper [12]. We report only the comparison between three reporting strategies (independent, underreporting, truthful) holding the underlying detection model fixed, as this comparison directly tests the theoretical predictions of Theorem 1 and Proposition 3.↩︎

6. The discrete-choice formulation with Type I extreme value errors yields the standard multinomial logit demand system widely used in the structural industrial organization of financial markets [5], [16]. The parameter \(\alpha_\phi\) captures customer friction from KYC/AML procedures such as delayed onboarding, false-positive freezes, and settlement delays, a first-order determinant of deposit demand elasticity in recent fintech evidence [11], [34], [53]. This liability-side channel complements the asset-side charter-value mechanism in [15].↩︎

7. The simulation here illustrates the theoretical contrast between policies (greedy freezing, network-adjusted index, oracle) holding the detection model fixed. The full hierarchical reinforcement learning implementation, large-scale ablation, and per-market calibration are developed in the companion paper [12]; we do not duplicate that empirical contribution here. Our purpose in this section is to illustrate the theoretical superiority of the network-adjusted index policy (Proposition 5) over greedy freezing.↩︎

8. This constant can be interpreted as a reduced-form sensitivity of \(i\)’s detection performance to additional coalition data/signals. The proposition uses a normalized form that effectively sets \(\underline{\alpha}_i=1\) by scaling \(M(\mathcal{S})\).↩︎