Executive Summary

India's banking system processes hundreds of millions of UPI transactions every day. As digital payments have scaled, so has the sophistication of financial crime. Mule accounts — ordinary bank accounts co-opted by fraud networks to receive and rapidly forward stolen money — represent one of the most challenging and damaging fraud typologies facing Indian banks today. The Reserve Bank of India (RBI) has escalated enforcement action, yet detection rates remain low because fraudsters deliberately route funds across bank boundaries, exploiting the critical blind spot that each bank can only see transactions within its own walls.

This white paper presents the Privacy-First Mule Hunter Network, a Proof of Concept (PoC) for a Decentralised Fraud Defence System. The system combines Federated Learning (FL) and Graph Neural Networks (GNNs) to enable three virtual banks to collaboratively detect mule accounts across their combined transaction graph — without ever sharing a single byte of raw customer data. The architecture is designed to comply fully with India's Digital Personal Data Protection (DPDP) Act and RBI guidelines. The entire pipeline was built and executed using Terno AI, an agentic data science platform.

Key Results:

• 300 synthetic accounts and 5,358 transactions were generated to mimic Indian UPI patterns across 3 virtual banks, including smurfing chains, camouflage transactions, and second-hop mule contamination.

• A 2-layer Graph Convolutional Network (GCN) was trained in two scenarios: isolated (each bank trains alone) and federated (FedAvg and FedProx collaboration).

• Bank 1 achieved its best F1-score of 0.857 under FedAvg — a 50% improvement over isolated training (F1: 0.571), with perfect precision (1.000) and zero false positives.

• FedProx (best config: mu=0.001, 30 rounds, 15 local epochs) improved Banks 2 and 3 from F1=0.000 under FedAvg to F1=0.333 and F1=0.400 respectively, partially resolving the Non-IID degradation.

• False Positive Rates were reduced to 0.000 for Banks 1 and 2 under federation — fewer innocent customers are incorrectly flagged.

• The experiment demonstrates that collaborative cross-bank mule defence is technically feasible in a privacy-preserving architecture aligned with DPDP Act principles — without any raw customer data leaving its originating institution.

Target Audience: RBI regulators, bank CROs, CTOs and compliance officers, financial crime teams, data science practitioners, and policymakers.

1. Introduction

The RBI has identified mule accounts as one of the most critical fraud vectors in Indian banking. Fraudsters co-opt ordinary accounts to receive stolen funds and rapidly relay them across multiple institutions — a process designed to exploit the fundamental limitation that no individual bank can see beyond its own transaction walls.

This project was conceived to answer a single question: Can banks collaborate to detect cross-bank mule networks without sharing any customer data? The answer, demonstrated through this PoC, is yes — using Federated Learning and Graph Neural Networks.

The scope of this document covers: the business problem, the proposed federated architecture, synthetic data design, exploratory data analysis, GNN model training, federated learning results (FedAvg and FedProx), privacy analysis, real-world deployment considerations, diagnostic analysis of bank-level underperformance, and comparisons with prior published work.

2. Problem Statement

2.1 The Mule Account Crisis in Indian Banking

A mule account functions as a relay node in a fraud network. Stolen funds — from phishing, vishing, account takeover, or investment scams — are deposited into mule accounts, rapidly broken into smaller amounts (smurfing), and forwarded to other accounts or converted to crypto assets before the victim can report the fraud.

The cross-bank nature of these networks makes them invisible to any individual bank's fraud detection system. Bank A sees money arrive and leave quickly. Without knowing that the money originated from fraud at Bank B, Bank A has no signal to act on. By the time detection occurs — typically after victim complaint — the money has already moved through multiple relay accounts across multiple institutions.

2.2 Why Current Systems Fail

• Single-institution visibility: Each bank's fraud model only sees its own data. Smurfing chains crossing 3–4 banks are invisible to any single node in the chain.

• Reactive detection: Fraud is typically identified after a victim complaint, by which time the money has already cleared the mule network.

• Data privacy barriers: Centralising transaction data from multiple banks for joint model training is prohibited under the DPDP Act and would create catastrophic privacy risks.

• False positive cost: Overly sensitive single-bank models incorrectly flag legitimate high-velocity accounts, causing customer friction and operational cost.

2.3 The Regulatory Context

India's Digital Personal Data Protection (DPDP) Act, 2023, mandates strict data minimisation and purpose limitation. Banks cannot legally share raw customer transaction data with third parties, including other banks, for fraud detection purposes. Federated Learning is the resolution to this constraint: it enables collaborative model training without any raw data leaving the institution that owns it.

3. Existing Approaches and Limitations

3.1 Traditional Rule-Based Systems

Many banks — particularly in markets with large volumes of small-value digital transactions such as India's UPI ecosystem — continue to rely on rule based transaction monitoring that flags accounts based on fixed thresholds (RBI Annual Report, 2023–24; NPCI Annual Report, 2023–24). These systems suffer from high false positive rates and are easily circumvented by fraud networks that deliberately keep individual transaction patterns below detection thresholds.

3.2 Single-Bank ML Models

Some larger banks have deployed machine learning models trained on their own transaction history. These models improve on rule-based systems but are fundamentally limited by their single-institution view — they cannot detect cross-bank smurfing chains and are prone to missing mule accounts that maintain a low-suspicion profile within any individual bank.

3.3 Centralised Data Sharing

A centralised approach — pooling all transaction data for joint model training — would theoretically provide the most complete picture. However, this is legally prohibited under the DPDP Act, operationally impractical, and creates a single catastrophic point of failure if breached.

3.4 Prior Federated Learning Work and This PoC's Novelty

Published research has explored federated learning for financial crime detection across multiple peer-reviewed venues. Key verified performance gains include: Yang et al. (2019) [4] demonstrated that a federated fraud detection system achieves approximately 10% higher AUC than traditional centralised models on real-world credit card transaction data; Suzumura et al. (2022) [6] showed a federated graph learning model outperforms a purely local model by 20% on the UK FCA TechSprint AML dataset; and Dupont et al. (2026) [8] confirm in a systematic review that FL-based approaches achieve detection accuracy improvements of up to 20% compared to isolated institutional models. Kumar (2025) [9] further reports 15–30% increases in fraud detection rates over stand-alone bank models in a cross-bank FL architecture with secure aggregation.

However, none of the published PoCs combine all three of:
(1) mule-specific targeting,
(2) GNN + Federated Learning in the same architecture, and
(3) an Indian UPI and DPDP Act regulatory framing.

This project addresses that gap with additional novelty in four areas:

• Honest Non-IID reporting: The PoC does not conceal the Non-IID degradation problem. It diagnoses, quantifies, and proposes systematic remediation (FedProx sweep across 5 configurations).

• Synthetic data designed to be hard: Smurfing chains, camouflage transactions, and second-hop mule contamination ensure the dataset cannot be solved by trivial single-feature thresholds.

• Per-bank feature separability analysis: A diagnostic layer identifies which features distinguish mules from legitimate accounts in each bank, explaining why performance differs.

• End-to-end Terno AI execution: The entire pipeline was implemented and validated using English-language prompts in an agentic data science environment.

4. Proposed Solution

4.1 The Neighbourhood Watch Analogy

The system operates like a neighbourhood watch programme for banks. Each bank learns to identify suspicious behaviour in its own data. Instead of sharing the identities of suspicious customers (raw data), banks share the characteristics of suspicious behaviour — what patterns in the transaction graph are associated with mule activity. By combining these insights, every bank becomes smarter without any customer records ever leaving their institution.

4.2 Architecture Overview

• Local Graph Construction: Each bank builds a transaction graph where accounts are nodes and transactions are directed edges. Node features capture both account attributes and graph-structural properties derived from the transaction history.

• Local GNN Training: Each bank trains a 2-layer Graph Convolutional Network (GCN) on its own graph using its own labelled data, classifying nodes as mule or legitimate.

• Federated Aggregation: At regular intervals, each bank sends model weights (not data) to a central aggregator. The aggregator computes a weighted average (FedAvg) and returns the global model to each bank for continued local training.

5. System Architecture

5.1 Node Feature Engineering (12 Features)

5.2 Graph Construction

Each transaction becomes a directed edge (sender → receiver). Full graph: 300 nodes, 5,358 edges. Per-bank edges: Bank 1 = 1,815; Bank 2 = 1,823; Bank 3 = 1,720. Cross-bank edges (73.6% of all transactions) confirm the cross-institutional nature of the mule patterns.

5.3 MuleGNN Model

• Layer 1: GCNConv(12 → 32), ReLU, Dropout(0.3)

• Layer 2: GCNConv(32 → 2) — binary classification: mule vs legitimate

• Optimiser: Adam, lr=0.01, weight_decay=5e-4; Loss: CrossEntropyLoss

5.4 Federated Aggregation
FedAvg: After each local training phase, model state dicts are aggregated as a weighted average (weighted by number of training nodes per bank). FedProx extends FedAvg by adding a proximal regularisation term to local loss — (mu/2) * sum of squared L2 distances between local and global parameters — preventing local drift in Non-IID settings.

6. Implementation Details

6.1 Synthetic Dataset Design

• 300 accounts (238 legitimate, 62 mules — 20.7% mule rate) across 3 virtual banks, 100 accounts per bank.

• 5,358 transactions over June 2024 mimicking Indian UPI patterns including P2P and merchant transactions.

• Smurfing chains crossing bank boundaries; camouflage transactions; second-hop mule contamination; legitimate busy accounts as false positive noise.

6.2 Train/Test Split

Stratified 80/20 split per bank (random_seed=42): 80 training nodes and 20 test nodes per bank. Test set mule counts: Bank 1 (4), Bank 2 (5), Bank 3 (4).

6.3 Execution Environment

All steps executed using Terno AI via English-language prompts. Libraries: pandas, numpy, scikit-learn, torch, torch_geometric (v2.8.0), plotly.

• Session 1: https://supriya.app.terno.ai/chat/share/6278deb8-0753-4806-9a4d-cb718edc012f?ui_version=v2

• Session 2: https://supriya.app.terno.ai/chat/share/85daa8f4-e9e4-4c5c-8882-9974f005f9c2?ui_version=v2

7. Use Case Walkthrough

7.1 Account Distribution

7.2 Transaction Patterns

7.3 Mule Behaviour Deep Dive

The mule behaviour table across all 62 mule accounts confirmed the classic fan-in / fan-out relay pattern: high unique_senders (up to 80), high in_degree, large total_received_amount forwarded to a smaller set of receivers — consistent with known smurfing typology.

8. Results and Evaluation

8.1 Before Scenario: Isolated Bank Training (200 epochs)

Bank 3's F1=0.000 in isolation means the model defaulted to classifying all accounts as legitimate — achieving high accuracy only because 80% of the test set is legitimate. This demonstrates why accuracy alone is a misleading metric for imbalanced fraud detection tasks.

8.2 After Scenario: FedAvg (10 rounds)

Bank 1 improves dramatically (F1: 0.571 → 0.857, FPR: 0.063 → 0.000). Banks 2 and 3 degrade to F1=0.000 — the Non-IID problem: FedAvg's simple weight averaging converges to a representation that serves the majority distribution at the expense of banks with different local mule patterns.

8.3 FedProx Hyperparameter Sweep

Best configuration: Run D — mu=0.001, 30 rounds, 15 local epochs. Average F1 across banks: 0.530. A very strong mu (0.1 or 0.5) collapses local learning; the optimal proximal term is small enough to guide without restricting.

8.4 Final Results: FedProx Best Configuration vs All Scenarios

FedProx partially addressed Non-IID degradation for Bank 2 (0.000 → 0.333) and Bank 3 (0.000 → 0.400). Note: neither bank reached the F1=0.5 minimum acceptable threshold, consistent with the known challenge that FedProx reduces but does not fully resolve Non-IID divergence [Tulasi et al., 2025; Sahu et al., 2018].

9. Comparison with Alternatives

10. Diagnostic Analysis: Why Banks 2 and 3 Underperform

10.1 Feature Separability per Bank

For each bank, the absolute mean difference between mule and legitimate account features was computed across all features. Banks differ in which features best distinguish mules — explaining why a single global FedAvg model cannot optimally serve all three simultaneously.

10.2 Recommendations per Bank

• Bank 1: Increase test set size or use cross-validation for more stable F1 estimates.

• Bank 2: Increase federation rounds or adopt an attention-based GNN (GAT) to capture cross-bank patterns more effectively.

• Bank 3: Oversample mule accounts in training or engineer additional transaction time-pattern features.

11. Privacy Analysis and DPDP Act Alignment

11.1 What Was and Was Not Shared

No raw transaction data, account attributes, or customer identifiers were shared between virtual banks at any point. The only information exchanged was model weight tensors — floating-point arrays representing learned parameters. These weights substantially reduce the risk of direct data
exposure compared to sharing raw transaction records. However, it is important to note that shared model weights are not inherently immune to privacy attacks: research has shown that gradient inversion and data reconstruction attacks can extract information from model parameters under certain conditions (Geiping et al., 2020 [18]; Zhao et al., 2023). In this PoC, no additional protections such as differential privacy or secure aggregation were applied, which means the current implementation does not provide full production-grade privacy guarantees. These mitigations are explicitly identified as required steps before any real-world deployment (see Section 13).

11.2 DPDP Act Compliance

India's DPDP Act, 2023, mandates data minimisation, purpose limitation, and restricts cross-entity data transfers. The federated learning architecture, in its design intent, is aligned with all three principles: only model weights travel rather than raw records (minimisation), the system is used exclusively for fraud detection (purpose), and no customer data crosses institutional boundaries (transfer restriction). However, full regulatory compliance in production would additionally require differential privacy applied to weight updates, cryptographic secure aggregation, and formal audit trails for all model exchanges — none of which were implemented in this PoC. The architecture establishes the correct privacy-preserving foundation; production deployment would need these additional layers to satisfy the DPDP Act's requirements completely.

11.3 Known Risks and Mitigations

11.4 Gaps vs Production Deployment

• Secure aggregation (homomorphic encryption / secure multiparty computation) not implemented — required for production.

• Differential privacy on weight updates not applied — strongly recommended for production.

• Formal audit trails for model updates not generated — required for RBI regulatory compliance.

11.5 RBI Regulatory Stance

If all privacy protocols are followed — no raw data sharing, encrypted and auditable model weight exchange, bank-level data sovereignty, explainability mechanisms, and a regulatory sandbox trial — the RBI would likely view federated learning as a privacy-preserving and proactively compliant
approach to collaborative fraud defence. The architecture directly addresses the RBI's concern that banks must improve cross-institution mule detection without violating data privacy obligations.

12. Real-World Impact and Deployment

12.1 Business Impact on Indian Banking

Indian banks lose significant sums annually to mule-facilitated fraud. The structural problem is not a lack of analytical capability within individual banks — it is the cross-institutional blind spot. This PoC demonstrates that blind spot is technically eliminable without any change to data privacy law. Illustrative ROI: For a bank losing INR 10 crore per year to mule fraud, a 10% improvement in detection accuracy — consistent with published federated fraud detection results [Yang et al., 2019; 4] — would save INR 1 crore per year. Peer-reviewed evidence indicates federated learning approaches can achieve improvements of up to 20% in detection accuracy over isolated bank
models [Dupont et al., 2026; 8], and 15–30% increases in fraud detection rates over stand-alone models in cross-bank FL deployments with secure aggregation [Kumar, 2025; 9]. These gains are context-dependent and reflect results from credit card and generic financial fraud datasets, not specifically from mule account detection on Indian UPI data, and should be treated as directional benchmarks rather than guaranteed outcomes.

12.2 Data Sharing Agreements Required

12.3 Deployment Recommendations

• Integrate the GNN mule detector as a decision-support tool alongside existing rule-based systems, not as a sole arbiter.

• Implement secure aggregation for all model weight exchanges.

• Add differential privacy to local weight updates before sharing.

• Build explainability (SHAP values) into model output to support compliance reporting.

• Conduct a RBI regulatory sandbox trial before production deployment.

• Monitor for concept drift and retrain the federated model on a rolling schedule.

13. Limitations and Considerations

• Synthetic data: All results are on synthetic data. Real-world validation on actual bank data is required before any production claim can be made.

• Small test sets: With 4–5 mules per bank in the test set, F1 scores have high variance. Results should be interpreted as directional.

• No secure aggregation: The PoC does not implement cryptographic secure aggregation.

• No differential privacy: Weight updates are not protected against gradient inversion attacks.

• Non-IID partially unresolved: FedProx improves Banks 2 and 3, but neither exceeds F1=0.5. Attention-based GNNs or personalised FL may be required.

• Static graph: The transaction graph used for training is a one-month snapshot. Production requires dynamic graph updates.

• Binary classification only: Severity scoring and mule ring network detection are not implemented.

14. Future Work

• Secure aggregation: Implement homomorphic encryption or secure multiparty computation for FedAvg.

• Differential privacy: Add calibrated Gaussian noise to weight updates before sharing.

• Attention-based GNN: Replace GCNConv with Graph Attention Network (GAT) layers to improve Bank 2's cross-bank pattern capture.

• Personalised Federated Learning: Explore per-Cluster FedAvg or pFedMe, maintaining bank-specific model heads with a shared global feature extractor.

• Real data validation: Partner with a banking institution to validate on actual anonymised transaction data.

• Dynamic graph integration: Implement Temporal GNN (TGNN) for streaming transaction data in near-real-time.

• Explainability layer: Add SHAP-based feature attribution for compliance reporting.

15. Conclusion

Indian banks face a structurally difficult problem with their current architecture: mule networks route money across institutions, while privacy law prevents the data sharing that would make cross-bank detection possible. This PoC demonstrates a technically viable path through that constraint- one that does not require resolving the legal tension, but sidesteps it through privacy-preserving architecture.

The Privacy-First Mule Hunter Network demonstrates through end-to-end implementation and measurement that federated learning combined with graph neural networks enables collaborative mule detection without any raw customer data leaving the originating institution. Bank 1's F1 improves from 0.571 to 0.857 under FedAvg. FedProx, with optimal hyperparameters, partially mitigates the Non-IID degradation for Banks 2 and 3, improving their F1 from 0.000 to 0.333 and 0.400 respectively — though further work is required to bring all banks above the F1=0.5 acceptable threshold. False Positive Rates are reduced to zero or near-zero under the best federated configurations. The architecture is aligned with India's DPDP Act in design intent; full production compliance would additionally require differential privacy and secure aggregation, as documented in the Limitations section.

As privacy laws tighten and the RBI continues to escalate enforcement on mule fraud, the window for centralised data-sharing approaches will continue to narrow. This project provides evidence that the alternative — decentralised, privacy-preserving, graph-intelligent collaborative defence —
is not only theoretically sound but computationally achievable on synthetic data today, with a clear, documented path to production readiness.

The next step is a regulatory sandbox pilot with real banking data.

References

The following references were reviewed and verified via Consensus (consensus.app), a peer-reviewed academic search engine covering over 200 million papers.

[1] McMahan, H.B. et al. (2016). Communication-Efficient Learning of Deep Networks from Decentralized Data. arXiv:1602.05629. [The original FedAvg paper — 24,650+ citations]
Available: https://consensus.app/papers/details/141069ba39d8508da29354e980429754/

[2] Sahu, A.K. et al. (2018). Federated Optimization in Heterogeneous Networks. arXiv:1812.06127. [The original FedProx paper — 7,919+ citations]
Available: https://consensus.app/papers/details/735d880c421a5ff1894a5f5d0fedd260/

[3] Awosika, T. et al. (2023). Transparency and Privacy: The Role of Explainable AI and Federated Learning in Financial Fraud Detection. IEEE Access, 119 citations.
Available: https://consensus.app/papers/details/552cb183331953e19e5ddc90053be429/

[4] Yang, W. et al. (2019). FFD: A Federated Learning Based Method for Credit Card Fraud Detection. [Federated FL for fraud detection — 227 citations. Demonstrates federated FDS achieves AUC of 95.5%, approximately 10% higher than traditional centralised models.]
Available: https://consensus.app/papers/details/0c936b22151859c4a71838f4d957ae1d/

[5] Salam, M.A. et al. (2024). Federated learning model for credit card fraud detection with data balancing techniques. Neural Computing and Applications, 117 citations.
Available: https://consensus.app/papers/details/1dde28a6fae853458bb8ac2edb067525/

[6] Suzumura, T. et al. (2022). Federated Learning for Collaborative Financial Crimes Detection. [Federated graph learning for cross-institutional AML — demonstrates federated model outperforms local model by 20% on FCA TechSprint data.]
Available: https://consensus.app/papers/details/5310bb2604cf5839b1f97f19ae05c204/

[7] Aljunaid, S.K. et al. (2025). Secure and Transparent Banking: Explainable AI-Driven Federated Learning Model for Financial Fraud Detection. Journal of Risk and Financial Management, 69 citations.
Available: https://consensus.app/papers/details/35ea4afe49325677b980129f929b4551/

[8] Dupont, C. et al. (2026). Federated Learning Approaches to Collaborative Fraud Detection Across Financial Institutions. Frontiers in Applied Physics and Mathematics. [Review demonstrating FL achieves detection accuracy improvements of up to 20% over isolated institutional models.]
Available: https://consensus.app/papers/details/1bb9a744804d5c0ea03d494f923a5f39/

[9] Kumar, V. (2025). Federated Learning Framework for Privacy-Preserving Cross-Bank Fraud Detection. International Journal of AI, Data Science, and Machine Learning. [Demonstrates 15-30% increase in fraud detection rates over stand-alone models.]
Available: https://consensus.app/papers/details/9092dfac29ce55e6bb122d67b90e706c/

[10] Yuan, T. et al. (2025). Enhancing Anti-Money Laundering Detection with Self-Attention Graph Neural Networks. Applied and Computational Engineering, 5 citations. [GNN captures relational and structural dependencies in transaction networks for AML.]
Available:
https://consensus.app/papers/details/0f47e7d1ed925b7ea15b25b4aaea16f1/

[11] Olaniyi, O.M. et al. (2026). Graph Neural Networks for Multi-Layered Financial Crime Network Detection: An Explainable AI Framework for AML. Journal of Engineering Research and Reports. [Heterogeneous GAT achieves AUC-ROC of 0.874; relational features account for over 51% of
predictive contribution.]
Available: https://consensus.app/papers/details/8b10cfedd4a55af4877a36e3262e2d5f/

[12] Xu, H. et al. (2024). Intelligent Anti-Money Laundering Transaction Pattern Recognition System Based on Graph Neural Networks. Journal of AI-Powered Medical Innovations, 4 citations. [GNN captures smurfing operations and cross-bank deposits in AML case studies.]
Available: https://consensus.app/papers/details/6e1049a6391452fbb868cae925f3c4c4/

[13] Marasi, S. et al. (2024). Anti-Money Laundering in Cryptocurrencies Through Graph Neural Networks: A Comparative Study. IEEE CCNC 2024, 10 citations. [GCN, GAT, GraphSAGE comparison for AML; ChebNet and GraphSAGE outperform on F1 and recall.]
Available: https://consensus.app/papers/details/006a7ac759465c66b4b319d54c872ed5/

[14] Lu, S. (2025). Graph Neural Network Model in Financial Fraud Detection. ICICR 2025. [GCN + GAT achieves higher accuracy, precision, recall, and F1 than traditional ML on IEEE-CIS dataset.]
Available: https://consensus.app/papers/details/f683653b54f4592ebb1e7bb8e9377f86/

[15] Tulasi, A. et al. (2025). Addressing Data Heterogeneity in Federated Learning: A Comparative Study of FedAvg and FedProx under IID and Non-IID Scenarios. International Scientific Journal of Engineering and Management. [FedProx outperforms FedAvg in Non-IID settings; FedAvg
optimal for homogeneous distributions.]
Available:
https://consensus.app/papers/details/cb7c7722fb685483861b894f26056942/

[16] Efthymiadis, F. et al. (2024). Advanced Optimization Techniques for Federated Learning on Non-IID Data. Future Internet, 18 citations. [Non-IID data can reduce FL accuracy by up to 29%; combined optimization strategies recover approximately 36%.]
Available: https://consensus.app/papers/details/72ee5225bd705faa98346dd77f6d639f/

[17] Yin, H. et al. (2022). Do Gradient Inversion Attacks Make Federated Learning Unsafe? IEEE Transactions on Medical Imaging, 122 citations. [Establishes gradient inversion as a real but practically limited risk; differential privacy and BN statistics sharing reduce attack efficacy.]
Available:
https://consensus.app/papers/details/f452023f425e57c2af7aee283db739d6/

[18] Huang, Y. et al. (2021). Evaluating Gradient Inversion Attacks and Defenses in Federated Learning. arXiv. 381 citations. [Systematic evaluation of gradient inversion attacks and defences; combining DP with gradient compression mitigates risk with minor utility loss.]
Available:
https://consensus.app/papers/details/0316c78197cd594cbeb581a312e87706/

[19] Digital Personal Data Protection Act, 2023. Ministry of Electronics and Information Technology, Government of India. [Primary regulatory framework governing data privacy in Indian banking and financial services.]

[20] Reserve Bank of India. Guidelines on Mule Accounts and Fraud Risk Management. RBI Master Direction / Circular, 2024. [Regulatory basis for bank obligations regarding mule account detection and reporting in India.]

[21] Park, D.Y. et al. (2025). Federated Gradient Boosting for Financial Fraud Detection: An Empirical Study in the Banking Sector. Proceedings of the 34th ACM International Conference on Information and Knowledge Management. [First empirical study of federated gradient boosting on real banking fraud data; highlights Non-IID vulnerability and bank join/dropout instability.]
Available:
https://consensus.app/papers/details/639f2cc91e2a58b78ce8e87e6c4a61fe/

[22] Geiping, J. et al. (2020). Inverting Gradients — How easy is it to break privacy in federated learning? arXiv:2003.14053. 1,643 citations. [Demonstrates that shared gradients can be inverted to faithfully reconstruct private training images at high resolution, even for trained deep networks
— establishing that parameter sharing is not inherently safe without additional privacy protections.]
Available: https://consensus.app/papers/details/9b42ce313e285f78bc8276d2fb54ffdd/

[23] Zhao, J.C. et al. (2023). Loki: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulation. IEEE Symposium on Security and Privacy 2024. 65 citations. [Shows that even with FedAvg and aggregation across 100 clients, 76–86% of training data samples can be reconstructed in a single round through a carefully designed attack —
underscoring the need for secure aggregation and differential privacy in production FL deployments.]
Available:
https://consensus.app/papers/details/02d476b534d85a299e576a5c90bc4ce3/

Appendix A: Dataset Summary

Appendix B: Terno AI Session References & Datasets

Session 1 — EDA, Feature Engineering & GNN Training:
https://supriya.app.terno.ai/chat/share/6278deb8-0753-4806-9a4d-cb718edc012f?ui_version=v2
Session 2 — FedProx, Diagnostics & Privacy Analysis:
https://supriya.app.terno.ai/chat/share/85daa8f4-e9e4-4c5c-8882-9974f005f9c2?ui_version=v2

Dataset link: https://drive.google.com/drive/folders/1GYNwPo2zQD-y4AdqV8phc13RGGkPkhmL