This is IBM anti-fraud solutoions in GCG.

1. IBM Financial Crime Management Solution Overview and Solution Demo

3. Fraud activities continue to rise 48% of fraud cases involve insiders 5% fraud activities cause 5% of pre-tax income for U.S. financial institutions $1,000,000 Average loss when a high-level executive is involved 400% When an insider is involved, loss increases by an average 400% A study in U.S. found:

4. Example: Common Types of Credit Card Fraud Fraudulent possession of card details (CNP Fraud) Counterfeit Lost or Stolen Mail non-receipt fraud Identity theft Detect at application, activation and account maintenance Detect at Activation Detect at trax authorization 14% 7% 30% 26% 23% Often organized crime Western Countries Detect at trax authorization Detect at trax authorization

5. Challenge #1 – Follow up instead of intercept Off-line Analysis and Investigation Asynchronous Monitoring and Confirmation Real-Time Automatic Decisioning and Approval Precise Rules and High Performance System

6. Challenge 2 – Traditional Technology Can’t Process Large Transaction Volume For example, a large international or regional bank’s credit card center will have to detect over 10M transactions a day = 623/second (99% confidence level) or 644/second (99.9%confidence level) or 663/second (99.99% confidence level)

7. Challenge 3 – Traditional Technology Only Monitor Single Transactions Multiple activities usually involve in a fraud event Many fraud patterns involve diverse systems and seemingly unrelated activities, e.g. multiple login attempts, followed by a combination of changes in PIN and contact information followed by an unusually large withdraw or transfer.

8. Challenge #4 – False Positive Rate Too High Event What is Happening? When to Act? What Action? Event Rules Business Rules Precise Event Rules and Business Rules Reduce False Positive Rate !

11. IBM’s Smarter Way of Fighting Financial Crime + + Instrumented Interconnected Intelligent

12. IBM’s Smarter Way of Fighting Financial Crime Attitudinal Data Interaction Data Behavioral Data Demographic Data Event Rules Profile Rules Management Console Transactional & Channel Systems Historical Data IBM Financial Crime Real-Time Detection & Prevention Solution Event Detector IBM Financial Crime Case Mgmt Solution IBM Financial Crime Analytics Solution

13. Effectively Prevent and Manage Financial Crime Case Analysts use IBM Financial Crime Analytics Solution to discover patterns Investigators use IBM Financial Crime Case Management Solution for investigation and collaboration with bank’s auditing department and law enforcement Financial Crime Cases Business Rules Analysts use IBM Financial Crime Real-Time Detection & Prevention Solution to turn patterns into rules that can be deployed for real-time detection and prevention

14. IBM’s Smarter Way for Real-Time Financial Crime Detection Events Score Actions 1000’s trax/sec Other Financial Crime-Related Activities Watch List Filtered financial crime Event Event Rules Profile Rules Rules that can be customized and continually optimized by banks Pre-filtering allows 100% potential events to pass through decisioning real-time without hurting performance Automatically generated watch lists are used to monitoring selected fraud activities Monitor any events relevant to financial crime activities Change Password Password Error Report of Lost Card Online Activation Change of Addr ------ ------ ------ ------ ------ ------ ------ ------ ------ ------ ------ ------

15. IBM Financial Crime Management Solution Architecture Banking Existing IT System Business event XML/JMS WBE Event association judgment Filtered event and type XML/JMS ILOG anti fraud rule Event score Case management Change Password Report of Lost Card Online Activation Change of Addr Payment Event rule Customer history behaviors Anti fraud database

18. WBE event process server overview Event cloud Protocol exchange Format exchange Events connector Actions WBE Runtime connector Database JMS Push History module Topics Dashboard SOAP RDBMS HTTP SMTP FTP File XSL JMS JDBC JDBC & SOAP SOAP RDBMS HTTP SMTP FTP File XSL JMS Topics WBE development Relativity cache Information based time sequence Event cloud WBE object store lab

19. Pre-Built Rules & Design Interface - WBE

20. Rule engine component view Design Maintain Share Deploy Line Of Business Production Development Rule Solutions for Office Rule Studio Rule Team Server Decision Validation Services Rule Repository Transparent Decision Services Rule Execution Server Rules for COBOL Custom Web Applications

21. Event rule sample case Condition A: Transaction occurs between 0:00am to 6:00am Condition B: Transaction ammount is lager then 2000 Condition C: 3+ times transactions in passed 1 hour and Potential transaction TM01 Condition A: Password was modified within today Condition B: 3+ times transactions in passed 1 hour Condition C: Accumulative total amount is larger than 8000 and Potential transaction TM02

22. Pre-Built Rules & Design Interface - iLog

23. Event rule implement sample

26. Data Model

27. Generate potential fraud case Input column ： First column ： potential fraud type Second column ： transaction score Output column ： First column ： final fraud type Second column ： description of fraud Generate potential fraud case based on event type and score

28. Management UI

29. Card Fraud Reference Deployment Model Credit Card System (IBM Z) ATM & Debit Card Internet Banking ACH etc Credit Card Authorization Module Other Systems Event Engine Watchlist Generation Rules Fraud Decisioning Rules Event engine detects and maintains dynamic watchlists using pre-defined event rules 1 Rules engine as a stage of the authorization process 2 Rules engine calls the dynamic watchlists and relevant CIF and historical data to make fraud scoring decision 3 Historical & Customer Data Rule Engine Essentis / Triad Event Engine supports high-performing detection on CICS Contact Center / CRM CIF Dynamic Watchlist Event Detectors supports all major platforms Transaction Systems Credit Card ------ ------ ------ ------ ------ ------ ------ ------ ------ ------ ------ ------

33. Demo 1: Card Fraud Detection

34. Demo 2: Online Banking Fraud Detection

35. Summary

36. IBM Solution is Uniquely Positioned ??? Powerful technical support from IBM. Implementaiton “ It depends”? Fully supporting IBM Z/OS and providing decisioning capability at high performance. Performance Single-purpose, point solution reduces ROI. Banks can utilize this platform for future AML, customer churn management and real-time cross-selling projects. Expandability Trade off between performance and effectiveness? IBM event engine produces real-time, dynamic watchlists for rules engine to make precide decisions. Capability of Real-Time Detection Mostly only for transaction decisioning with high false positive rates. IBM complex event engine uses event detector to monitor different systems to increase accuracy of decisioning Capability to monitor multiple systems “ Black box” Rules and models are owned and managed by bank Rules and Model Mgmt Legacy Solutions from ISVs IBM Financial Crime Management Solution