Research on cyber resilience in HVPS and other financial market infrastructures consistently characterizes cyber risk as potentially systemic, because disruptions propagate rapidly through tightly coupled interbank networks [3][25]. Systems such as TARGET2, Fedwire, CHAPS, and CHATS settle large, time-critical payments in central-bank money [26]-[29], creating dense liquidity dependencies. The BIS has stressed that cyber incidents can impair liquidity distribution and threaten financial stability even when solvency metrics remain sound [25][30]. The integration of retail fast payment systems with RTGS infrastructure amplifies these dependencies further [25][30].

Simulation evidence indicates that a three-hour attack on single bank can impair seven other banks within an hour and disrupt 25% of daily payment value [2]. Recovery time is a first-order driver: delayed recovery escalates system-level liquidity shortfalls from approximately $160 billion to $1.5 trillion when an attack lasts five days rather than one [1]. Case-based evidence reinforces these findings, with unsettled balances reaching billions within hours [2][3].

The literature emphasizes contingency arrangements as measurable mitigants: continuity plans enabling attacked banks to continue sending payments significantly reduce system-wide impact [2][3], and analysis of an actual disruption confirms that business continuity plans reduced the effect by more than half [3]. Cyber stress testing, while increasingly encouraged, remains a nascent discipline with “relatively little experience” in practice, implying that quantitative outputs require cautious interpretation [3][5].

Table 1.Cyber threat taxonomy for HVPS and SWIFT environments [5][6][25][32].

SWIFT’s network connects over 11,500 institutions and carries more than 45 million messages daily [31]. The Bangladesh Bank heist and follow-on attacks demonstrated credential compromise, lateral movement into SWIFT interfaces, message manipulation, and log tampering [6][32][33]. Most attacks target institutional edges rather than the core network, underscoring that defense hinges on hardening local environments and improving joint detection [6][33][34]. Table 1 maps threat categories to attack vectors, impacts, and detection challenges [5][6][25][32]. The layer-by-layer mapping of these threat categories to the proposed framework is presented in Section 5.1 [3][5][6][25][36].

Supervised models (gradient-boosted trees, DNNs) routinely achieve precision above 0.95 and AUC-ROC above 0.97 on large-scale fraud datasets [9][35]. Unsupervised methods-isolation forests and autoencoders-complement these by flagging outliers without labels, including zero-day attacks via reconstruction-error anomaly detection [8][32]. GNNs incorporate relational structure for network-aware fraud detection under class imbalance [10][14]. RL-augmented GNN approaches (FraudGNN-RL) report 97.3% F1 while reducing false positives by 31% [14], and adaptive RL-based detection reports mean F1 of 0.9222 with peaks of 0.9771 [10].

However, boundary conditions apply. Well-tuned XGBoost can outperform alternatives after hyperparameter optimization, implying hybrid dominance should be framed probabilistically [11]-[13]. For HVPS, false positives carry disproportionate systemic costs [5][8]. Graph-model scalability under tight latency constraints and limited data access for auditing remain deployment obstacles [10][14]. Federated learning enables cross-institutional training [16][17][31] but introduces governance, model-poisoning, and multi-jurisdictional compliance challenges [15][16]. Synthetic data (PaySim) addresses dataset scarcity but may not fully reflect real-world complexity [18]; this paper documents a concrete instance-injection-signature leakage and a diagnostic for it (Section 6.6). Table 2 summarizes ML techniques for payment fraud detection [8]-[10][16][17][35].

Table 2. Comparative summary of AI/ML techniques for fraud detection in payment systems [8]-[10][16][17][35].

The regulatory implications of these capabilities—including FMI standards, Basel capital mechanics, SIPS oversight, and ISO 20022 enrichment—are analyzed in Section 3.

CPMI-IOSCO’s 2016 Guidance [5] and the ECB’s CROE [4] set baseline expectations including the two-hour recovery-time objective: critical operations must resume within two hours, with end-of-day settlement assured even under extreme scenarios [5]. A three-tier approach of preventive, detective, and corrective measures expands risk-reduction options [5]. The framework in Section 4 operationalizes this layered expectation.

The Digital Operational Resilience Act (DORA) [36] mandates comprehensive ICT risk management, incident reporting, and third-party oversight [37][38]. DORA raises the evidentiary bar for detection and recovery capabilities, aligning with ML-based approaches provided deployment is paired with governance and auditability [39]. The TIBER-EU framework, updated February 2025, provides threat-led penetration testing methodology [40]. The Cyber Resilience Act [41] adds security-by-design requirements from 2026.

NIST’s Cybersecurity Framework (CSF) AI Profile [42] introduces AI-specific controls, building on CSF 2.0 [43]. For the proposed framework, CSF 2.0 provides governance alignment while the AI Profile adds ML-deployment-specific control expectations. In operational HVPS environments, every payment instruction is also subject to real-time sanctions screening against OFAC, FATF, and PEP watchlists [31][32]. The framework’s ML-based controls complement, but do not replace these existing rule-based compliance layers.

The SMA for operational risk combines the Business Indicator (BI)—a financial-statement proxy—with bank-specific loss data [19][20]. The ILM scales capital by ten-year operational losses [19]:

ORC = BIC × ILM

ILM = ln(exp (1) − 1 + (LC/BIC)^0.8)

The Loss Component creates an explicit channel through which cyber and fraud losses influence Pillar 1 capital [19][20]. The Basel Committee states that the Loss Component “not only enhances risk sensitivity but also provides incentives for banks to improve operational risk management” [20]. AI-augmented fraud prevention thus carries a dual benefit: reducing direct losses while lowering the ILM [19][37]. However, SMA capital can exhibit volatility, with an institution’s requirement potentially shifting materially year-on-year without parameter changes [19][20].

Basel 3.1 is operationalized through heterogeneous national rules. The UK PRA sets ILM = 1, removing historical loss from Pillar 1 calculation [21]. The EU’s CRR3 [22] retains loss sensitivity. The capital-efficiency argument is therefore scoped to jurisdictions retaining a loss-sensitive ILM and should be interpreted as a plausible channel rather than a universally guaranteed return.

The ECB’s SIPS Regulation [44] and PFMI [45] impose additional requirements, increasingly focused on Non-Default Losses (NDL)-operational failures, cyber-attacks, and fraud [44]-[46]. Under PFMI Principle 15, FMIs must maintain resources to cover general business losses. AI-augmented detection that prevents fraud before settlement finality directly reduces NDL exposures, creating an FMI-level capital efficiency argument alongside Basel 3.1 [5][44][45].

ISO 20022 carries substantially more structured remittance information than legacy MT messages (up to 9000 structured characters versus 140) [23][24], enabling richer analytics and improved sanctions-screening accuracy [23][24]. However, heterogeneous institutional readiness is the principal adoption barrier, and data quality is a necessary condition for reliable neural-network training [23]. Partial migration may constrain end-to-end feature availability for ML [23]. The framework does not address AML/CTF sanctions screening, which constitutes a separate compliance layer with distinct regulatory requirements; integration with ML-augmented sanctions screening remains an avenue for future work.

Layer 1 ingests SWIFT MT/MX messages, RTGS settlement logs, ISO 20022 enriched fields, threat intelligence feeds, and participant-level liquidity data into a unified analytics-ready pipeline. ISO 20022 migration expands the feature space by providing structured beneficiary, purpose-of-payment, and remittance fields that enable more context-aware detection [23][24]. The layer normalizes heterogeneous data formats and applies real-time feature engineering including transaction velocity, counterparty concentration, temporal deviation, and value-distribution anomaly scores [8][9].

Three complementary model families operate in parallel (Figure 2). Supervised classifiers (XGBoost, Random Forest, DNN) detect known fraud patterns including fraudulent message injection and account-takeover transfers [9][35]. Unsupervised anomaly detectors (Isolation Forest) provide a label-free novelty signal [8]. The graph component in the released implementation is a feature-similarity approximation, a k-nearest-neighbor graph over standardized feature vectors with an MLP classifier, rather than a counterparty-topology model. The measured consequences are reported in Section 6.4. The true edge-based graph learning over sender-receiver topology is identified as priority future work. All the outputs are fused through a weighted ensemble layer with calibrated risk scores [9][10].

Figure 2.Multi-family ML detection pipeline architecture showing supervised, unsupervised, and graph-approximation model families feeding into a hybrid fusion layer with SHAP explainability.

Risk scores trigger graduated automated actions (Figure 3): low-risk transactions proceed normally; medium-risk payments are held and queued for analyst review within SLA-bound escalation windows; high-risk payments are blocked with immediate analyst alerts [8][17]. Concretely, two operating thresholds map the calibrated ensemble risk score s ∈ [0, 1] from Layer 2 onto actions: transactions with s < 0.50 are released for settlement; those with 0.50 ≤ s < 0.85 are held and queued for analyst review within a 30-minute service-level escalation window; and those with s ≥ 0.85 are blocked pending investigation, with an immediate analyst alert. The lower threshold coincides with the hybrid ensemble’s default decision threshold (Section 5.2), while the upper threshold restricts fully automated blocking to the extreme tail of the risk-score distribution, a deliberate reflection of the disproportionate systemic cost of falsely interdicting legitimate high-value payments. Payments an analyst clears from the hold queue re-enter settlement with their original priority; blocked payments leave the settlement flow until investigation completes. Section 5.3 sets out how these graduated actions are represented in the stress-test simulation. These tiering answers the HVPS-specific constraint that false positives are systemically costly and aims to hold genuine threats within the two-hour recovery window; how far the simulation actually meets that objective is reported under an explicit metric definition in Section 6.1 [3][5].

Figure 3. Automated control and human-in-the-loop response flow (low/medium/high risk → release/hold-and-queue/block). SHAP explainability values are provided to analysts for every queued transaction [8][17].

Layer 4 wraps all operational layers with explainability (SHAP-based feature attribution), audit trails for regulatory reporting, model-performance monitoring with drift detection, and analyst-override feedback loops that feed retraining pipelines [3][5][15]. Governance artifacts are aligned with DORA’s ICT risk management requirements and the NIST AI Risk Management Framework [36][42][47].

Table 3.Mapping of cyber threat categories to framework layers [3][5][6][25][36].

Table 4. Cyber-attack scenarios for HVPS simulation [2][3][5].

Table 3 maps each threat category from Section 2.2 to the framework layer that addresses it [3][5][6][25][36]. Four attack scenarios target different systemic nodes: (S1) DDoS on a high-centrality bank, (S2) integrity attack on payment messages, (S3) fraud injection via compromised endpoint, and (S4) coordinated multi-vector attack [2][3][5]. Impact is measured through unsettled value, liquidity shortfall, recovery time, contagion spread, and the percentage reduction achieved by AI-augmented controls. The simulated system consists of 50 participants on a Barabási-Albert scale-free network (attachment parameter m = 3); participant settlement capacity is drawn from a Pareto distribution (shape α = 1.5), and daily payment volume is set to 15% of capacity. Each scenario runs over 1000 discrete time steps spanning the attack window, with a severity profile specific to the attack type (exponentially decaying for availability attacks, oscillatory for integrity attacks, escalating for fraud injection, slowly decaying for coordinated attacks). Contagion is modelled through the first-order network neighbors of attacked nodes, whose flows are impaired at 15% of the direct-severity level, and liquidity shortfall is defined as the peak cumulative unsettled value over the attack window. Recovery is characterized by two explicitly defined quantities: 1) control-activation time—the time elapsed before AI-augmented detection triggers graduated controls, equal to the detection-delay fraction δ times attack duration; and 2) throughput-restoration time—the time after which aggregate settlement throughput stays at or above 90% of normal (system normal throughput = total daily volume over a 10-hour operating day). The engine also reports a cumulative-disruption concentration metric (the time at which 90% of total unsettled value has accrued); Section 6.1 reports results under both definitions to head off definitional ambiguity. Table 4 summarizes the four cyber-attack scenarios and their duration and detection-delay assumptions [2][3][5]. Every simulation parameter is exposed in the released configuration file, and Table 5 lists the calibrated effective mitigation parameters together with their sensitivity.

The synthetic dataset [48] is constructed using a PaySim-inspired agent-based simulator [18] adapted for HVPS transaction dynamics. Approximately 500,000 transactions are generated with realistic value distributions, counterparty patterns, and injected fraud scenarios at a 0.13% class imbalance ratio.

Dataset calibration: The simulator is fully parameterized in a version-controlled configuration file (seed = 42), calibrated as follows. The interbank network holds 50 participants joined by a Barabási-Albert scale-free graph (m = 3). Participant activity weights come from a Pareto distribution (α = 1.5), normalized; for each transaction the receiver is drawn from the same weights, conditional on differing from the sender. Transaction values follow a log-normal distribution (μ = 13.5, σ = 2.1 on the log scale), truncated to [10⁵, 5 × 10⁸] currency units, and intraday timing follows a Gaussian profile centered on hour 4 of a 10-hour operating day (SD = 2 hours). Currency (USD/EUR/GBP/JPY/CHF at 45/30/10/8/7%) and payment type (RTGS/COVER/SERIAL/DEBIT/LIQ at 35/25/20/10/10%) are drawn categorically, and an ISO 20022 field-completeness score comes from a Beta (8, 2) distribution. Fraud enters at 0.13% prevalence (650 of 500,000 transactions) in three classes: 1) message injection (40% of fraud), with amounts inflated to 3 - 15× the sender’s mean value and timestamps shifted to off-peak early hours; 2) credential-compromise transfers (35%), assigned round amounts from {1 M, 5 M, 10 M, 50 M} with degraded ISO 20022 completeness (0.2 - 0.5); and 3) coordinated multi-entity fraud (25%), routed around a five-bank ring drawn from low-centrality participants, with amounts uniform on [5 × 10⁵, 5 × 10⁶]. Twenty-two features are engineered per transaction. Two of the injection rules imprint deterministic signatures (round amounts; off-peak timing), so the benchmark carries measurable label leakage; Section 6.6 quantifies this via SHAP and Section 6.9 treats it as a first-order limitation.

Evaluation design: Every supervised and hybrid result rests on a single stratified 80/20 train-test split (random seed 42), with stratification preserving the 0.13% prevalence in both partitions. No temporal split is applied—the generator does not model regime change within a single simulated day, so temporal (concept-drift) evaluation is left to future work. Class imbalance is handled natively: XGBoost uses scale_pos_weight = 769 (the inverse prevalence ratio), Random Forest uses balanced class weights, and the DNN trains on standardized features without class re-weighting. Hyperparameters are fixed a priori in the configuration file (XGBoost: 500 trees, depth 8, learning rate 0.05, subsample 0.8, colsample 0.8, AUC-PR metric; Random Forest: 300 trees, depth 12; Isolation Forest: 200 trees, contamination 0.002; DNN: MLP with 128-64-32 hidden units, ReLU, early stopping). The hybrid pipeline fuses supervised probabilities with min-max-normalized Isolation Forest anomaly scores at fixed weights (0.65/0.35), and its decision threshold comes from an F1 grid search over [0.20, 0.80] in steps of 0.01 on the evaluation partition. Since that threshold search uses the evaluation partition, the hybrid’s threshold-dependent metrics (F1, FPR) are modestly favored, a caveat that applies equally to the graph model’s RL threshold-adaptation layer (Section 6.4). Threshold-free AUC-ROC is therefore the primary comparison metric, with Section 6.8 quantifying residual uncertainty. The evaluated model set is exactly: XGBoost, Random Forest, DNN, Isolation Forest, the graph-approximation model with RL threshold adaptation, and the hybrid pipeline.

Adversarial-robustness and latency protocols: Adversarial robustness is assessed with a static, model-agnostic feature-perturbation attack: each held-out test vector x is perturbed as x′ = x + ε ⊙ |x|, with ε drawn i.i.d. per feature from N (0, 0.1²) (seed 42). The same perturbed matrix is shown to the baseline and hybrid models, and degradation is the relative fall in F1 between clean and perturbed evaluations; because the attack is oblivious (neither gradient-based nor adaptive), its strength is bounded. Inference latency is the mean wall-clock time over 10 repetitions of batch scoring on 1000 held-out transactions, run CPU-only; the reporting environment for the Section 6.4 figures is Windows 10, Python 3.11.9, an Intel 4-logical-core mobile CPU, and no GPU. For the graph model, the reported latency covers classifier inference on precomputed k-NN graph features (k = 10) and is thus a lower bound on end-to-end cost; graph-feature construction time is reported separately. Latency figures are hardware-dependent and should be read as relative comparisons on a single machine, not as absolute production benchmarks.

Variability protocol: To characterize run-to-run variability, the complete Track 2 pipeline (data generation → training → evaluation) was re-run under five random seeds {7, 13, 21, 42, 99} in an independent verification environment (Linux, CPU-only), with the network, transaction population, fraud injection, data splits, and model initializations re-drawn in every replication; the seed-42 repository run on the author’s environment falls inside all reported ranges. Track 1 was likewise re-run across ten network-topology seeds and under ±10% relative shifts of the calibrated mitigation rates. Section 6.8 reports the dispersion statistics and paired comparisons, and the sensitivity scripts ship with the released repository.

Detection-layer outputs (risk scores, alert classifications) feed directly into the simulated control layer, which applies graduated hold/prioritize/block actions. Scenario-specific effective mitigation parameters (Table 5) encapsulate how detection performance maps onto settlement dynamics: a direct-mitigation rate m_d (the fraction of at-risk value at attacked nodes that graduated actions preserve once detection has occurred), a contagion-mitigation rate m_c (the corresponding fraction for first-order neighbor exposures), and a detection-delay fraction δ (the share of the attack window that passes before AI-augmented detection activates). Before detection the simulation accrues full disruption; from the detection step onward, unsettled flow at attacked nodes is scaled by (1 − m_d) and neighbor contagion flow by (1 − m_c). These parameters are calibration assumptions, exposed explicitly in the released code so readers can rerun the simulation under alternatives and the reported reductions are conditional on them (Section 6.8). One structural consequence deserves to be spelled out: recovery-time compliance within this simulation is governed almost entirely by δ, because mitigation cannot act before detection by construction; detection-delay calibration against empirical incident data is therefore the simulation’s most consequential input. Settlement and liquidity metrics are then re-evaluated to quantify how much AI-augmented controls reduce disruption under each scenario’s assumptions [2][3].

All code and synthetic data are available at: https://doi.org/10.5281/zenodo.19519911 [48].

Across the four scenarios, AI-augmented controls reduced unsettled payment value by 34% - 78%, with the magnitude varying by attack type and recovery dynamics [3]. Scenario S1 (DDoS) showed the highest reduction (78%) because automated re-routing preserved settlement continuity for non-targeted participants. Scenario S4 (coordinated multi-vector) showed the smallest reduction (34%) due to simultaneous disruption of multiple detection channels.

Recovery time: Under the engine’s cumulative-disruption concentration metric, the AI-augmented runs yield 2.5 h (S1), 5.1 h (S2), 21.7 h (S3), and 41.3 h (S4), and the repository output flags the two-hour target as unmet in all four scenarios. Under the throughput-restoration metric defined in Section 5.1 and evaluated across ten topologies: S1 restores ≥ 90% aggregate throughput at 1.9 ± 1.1 h (meeting the two-hour objective in 4 of 10 topology draws; post-detection disrupted shares hover near the 10% degradation threshold, making compliance topology-sensitive); S2 restores at 3.2 ± 2.1 h (2 of 10 within two hours); S3 never breaches the 90% threshold at all (aggregate throughput degradation peaks at ≈5% because the endpoint-fraud attack manifests as fraudulent value-at-risk rather than availability loss-continuity is maintained throughout, with fraudulent flow contained from control activation at 4.3 h); and S4 does not restore full throughput within its 48-hour window (post-detection disrupted share ≈48% of normal). Control-activation times are 0.18 h, 0.72 h, 4.3 h, and 14.4 h for S1-S4 respectively; baseline (no-AI) recovery equals the full attack duration in all scenarios. This is more conservative, and—as Section 5.3 makes explicit—compliance is governed by the assumed detection-delay fraction δ rather than by post-detection mitigation intensity.

Liquidity shortfall and contagion spread: Under AI-augmented controls, peak cumulative unsettled value fell by 78% (S1), 61% (S2), 52% (S3), and 34% (S4), tracking the total-unsettled reductions because disruption accumulates monotonically over the window. Across the ten simulated topologies, first-order contagion exposed roughly 29 - 36 of 50 participants in S1, 12 - 28 in S2, 7 - 24 in S3, and 34 - 40 in S4; the contagion channel accounted for about one-third (S2, ≈31%) to three-fifths (S3, ≈58%) of baseline unsettled value, and AI-augmented controls cut contagion-channel unsettled value by 74% (S1), 58% (S2), 50% (S3), and 32% (S4). Topology and calibration sensitivity is reported in Section 6.8 and Table 5.

Table 5.Calibrated effective mitigation parameters per scenario and sensitivity of the headline reductions (Sections 5.3 and 6.8).

The detection figure in this section is reported as generated from the documented pipeline under seed 42; the final deposited release should be checked against these reported outputs before resubmission. The XGBoost baseline came in at AUC-ROC 0.9998 with F1 0.869 (precision 0.815, recall 0.915, FPR 2.7 × 10⁻⁴, ≈27 false alerts per 100,000 transactions). Random Forest reached AUC 0.9997 but only F1 0.653 at its default balanced-class threshold, the DNN (MLP 128-64-32) achieved AUC 0.9926 with F1 0.838 at a very low false-positive rate (3 × 10⁻⁵), and the hybrid pipeline achieved AUC 0.9719 and F1 0.878. Two aspects of these results deserve emphasis. First, AUC sits near the ceiling for all supervised models; SHAP analysis (Section 6.6) indicates this partly reflects injection-signature leakage in the synthetic generator, so absolute discrimination levels must not be extrapolated to production data. Second, the hybrid’s AUC falls below the supervised baseline-fusing calibrated boosting probabilities with a min-max-normalized Isolation Forest score (which on its own achieves F1 0.005 on this benchmark) dilutes an almost-saturated ranking. The hybrid’s measured contribution is therefore not ranking improvement but operating-point false-positive filtering (Section 6.3). The executed performance metrics for all model families are summarized in Table 6. Table 7 situates the manuscript’s findings against relevant external quantitative benchmarks [1][2][9]-[14][19]-[22].

Table 6.ML model families evaluated—executed results from the released pipeline (seed 42).

Table 7.Summary of external quantitative benchmarks contextualizing manuscript results.

Table 8. Recall by injected fraud type on the held-out test partition (executed; seed 42). The graph-approximation model’s recall deficit is concentrated entirely in the coordinated ring class, whose only detectable signal is relational.

At the selected operating threshold, the hybrid removed 12% of the baseline’s false alerts in the seed-42 repository run while keeping 97.5% of true positives; across verification re-runs (platforms and seeds) the reduction ranged from 12% to 26%, and varied more widely still across the five-seed study (Section 6.8) absolute false-positive counts are small (≈20 - 30 in a 100,000-transaction partition), so ratio estimates are inherently unstable. Per-fraud-type analysis (Table 8) shows the hybrid’s recall matching the baselines on every injected fraud class; its entire measured effect sits on the precision side. Class imbalance is handled natively as specified in Section 5.2.

In the released implementation, the graph model is a feature-space approximation: each transaction is linked to its k = 10 nearest neighbors in standardized feature space, and neighbor-mean features plus the mean neighbor distance are appended before an MLP performs classification. It is a similarity-graph model, not a counterparty-topology model.

Run on the released dataset, the model reaches AUC 0.9917 and F1 0.838 (precision 0.970, recall 0.738) with the lowest false-positive rate of any evaluated model: 3 × 10⁻⁵, i.e., ≈3 false alerts per 100,000 transactions against ≈27 for the XGBoost baseline, a nine-fold reduction that bears directly on HVPS false-interdiction cost. That precision is paid for in recall, and the deficit is entirely structural: per-fraud-type analysis (Table 8) shows the model catching 0 of 33 coordinated multi-entity ring frauds in the test partition, against 22 of 33 for the tabular baseline, while matching the baseline on the remaining fraud classes. The mechanism is architectural ring fraud is injected with deliberately unremarkable values whose only signal is relational, and a feature-similarity graph has no way to represent counterparty structure. It makes true edge-based graph learning over sender-receiver topology the priority item for future work (Section 7). The RL threshold-adaptation layer produced a null result: its selected threshold (0.22) yields predictions identical to the base model on every reported metric, because the classifier’s output probabilities are saturated near 0 and 1.

Latency (measured under the Section 5.2 protocol on a 4-core CPU environment): the MLP scores a 1000-transaction batch in 3.3 ms against 35.5 ms for the 500-tree boosting ensemble. End-to-end, though, graph-feature construction dominates at ≈2.04 ms per transaction (1022 s for 500,000 rows), leaving the graph pipeline roughly 58× slower than the boosting baseline end-to-end on this hardware. These are single-machine measurements and the multipliers will shift with hardware, but the ordering graph construction, not model inference, as the binding real-time constraint, is structural.

Under the protocol now set out in Section 5.2, verification re-runs across five seeds found supervised-baseline F1 degradation of 10% - 31% and hybrid degradation of 13% - 23%, with the hybrid degrading less in only two of the five replications. The adversarial comparison is therefore reported as inconclusive: neither pipeline shows consistent superiority under static perturbation, adaptive attacks remain untested [39][49], and no adversarial-robustness claim carries through to the paper’s conclusions.

SHAP analysis on the released run identifies, in order of mean absolute attribution: inter-transaction timing (feat_time_since_last, 2.01), the round-amount indicator (feat_is_round_amount, 1.58), ISO 20022 field completeness (1.39), and sender-value deviation (1.21). The two dominant features map directly onto the generator’s fraud-injection rules 1) credential-compromise fraud is assigned round amounts from a four-value set, and 2) message-injection fraud is shifted to off-peak timestamps. In substantial part, the models are learning injection signatures rather than generalizable fraud behavior, which explains the near-ceiling AUC values in Section 6.2 and stands as a first-order limitation of the synthetic benchmark (Section 6.9). SHAP-based inspection is proposed for top-ranked features against generator injection rules as a routine leakage diagnostic for synthetic-data fraud studies; on this benchmark it flags the leakage in a single run. SHAP outputs remain useful for their originally intended governance purpose analyst-interpretable rationale for escalated alerts under DORA and NIST CSF expectations [15][36][42] provided the leakage caveat is carried alongside.

Executed under the released calculation (BIC = 500 M, LC = 700 M, with a multi-year averaging attenuation factor of 0.82 applied to the loss reduction, a modelling assumption now stated explicitly), a sustained 30% reduction in operational losses reduces the Loss Component by 24.6% and the ILM by 8.3%. Because operational-risk capital scales linearly with the ILM (ORC = BIC × ILM), the capital-requirement release is identical to the ILM reduction: 8.3%. In jurisdictions setting ILM = 1 (e.g., UK PRA [21]), this channel is neutralized; the benefit accrues through reduced direct losses, improved supervisory assessments, and lower insurance costs rather than through Pillar 1 capital. In jurisdictions retaining loss sensitivity (e.g., EU under CRR3 [22]), the channel operates as modelled, conditional on the stated averaging assumption.

To address the reliance on point estimates, the complete Track 2 pipeline was executed under five random seeds and Track 1 across ten network topologies and ±10% mitigation-rate shifts (Section 5.2, variability protocol). Three findings emerged:

First, detection metrics carry material cross-seed dispersion—Across replications, the supervised baseline’s F1 spanned approximately 0.83 - 0.93 and the hybrid’s approximately 0.87 - 0.94 (cross-seed SD ≈ 0.03 - 0.04), while AUC-ROC remained uniformly high with overlapping ranges between baseline and hybrid. The hybrid’s F1 exceeded the baselines in five of five replications (paired mean improvement +0.024, SD 0.018; one-sided sign test p ≈ 0.03), a directionally consistent but modest advantage on threshold-dependent metrics; no significance is claimed for AUC, where the baseline is ahead. The false-positive-reduction estimate is markedly less stable (spanning roughly −6% to 75% across replications, with the repository run at 12%), because absolute false-positive counts are small; it is reported as a range, not a point value. The adversarial comparison was inconsistent across seeds (Section 6.5).

Second, the stress-test reductions hold up across topologies but remain conditional on mitigation calibration. Over ten Barabási-Albert topology draws, scenario reductions moved by less than one percentage point (S1: 77.7% ± 0.2%; S2: 60.9% ± 0.2%; S3: 51.8% ± 0.3%; S4: 33.9% ± 0.1%). The binding uncertainty lies in the calibrated effective mitigation rates: shifting all rates by ±10% (relative) moves the reductions to 70% - 86% (S1), 55% - 67% (S2), 47% - 57% (S3), and 31% - 37% (S4) (Table 5). Throughput restoration times, by contrast, are topology sensitive (Section 6.1), because post detection disrupted shares hover near the 10% degradation threshold. The headline 34% - 78% band should therefore be read as conditional on Table 5 calibration assumptions, not as a distribution free estimate.

Third, no confidence intervals attach to single run comparisons; where the text describes a difference between models, the repeated run evidence above is the statistical support on offer, and differences smaller than the reported cross seed dispersion are treated as not established.

The first order limitation is benchmark leakage: SHAP analysis (Section 6.6) shows the strongest learned features tracking the generator’s injection rules, so the near ceiling discrimination in Section 6.2 substantially reflects how the benchmark was built rather than transferable detection capability. Absolute performance levels on this benchmark are upper bounds and must not be extrapolated to production HVPS data; before absolute performance claims can be made, the generator needs revising so that fraud values and timing are drawn from the legitimate distributions and detectability rests on relational structure alone. More broadly, the ML results derive from synthetic HVPS-like data rather than proprietary RTGS or SWIFT production datasets, materially constraining external validity [18]. The stress-test reductions (34% - 78%) are conditional on scenario construction and Table 5 calibration; the topology and mitigation-rate sensitivity analyses in Section 6.8 partially address this, but robustness over alternative network classes and empirically estimated detection-delay distributions remains open [3].

The simulation is single-jurisdictional and does not represent cross-border settlement chains, correspondent banking, or multi-currency frictions [15][16][50]. The adversarial evaluation is limited to static perturbations and was inconsistent across seeds; adaptive evasion and concept drift remain untested [39][49]. Human-AI interaction is treated architecturally but not evaluated empirically. Two threshold-selection caveats apply: both the hybrid’s decision threshold and the graph model’s RL threshold are chosen on the evaluation partition, which modestly favors their threshold-dependent metrics; threshold-free AUC comparisons and the paired repeated-run analysis are unaffected, but future work should move to a three-way train/validation/test design. Latency figures are single-machine CPU measurements and support relative conclusions only. Finally, the recovery-time results depend on which metric is used; both definitions are stated explicitly in Section 5.1, and Section 6.1 reports results under each.

The capital-incentive argument depends on jurisdictional ILM choices and multi-year loss-history averaging, making short-horizon ROI claims unreliable [19][20]. ISO 20022 performance uplift is mechanism-based rather than empirically demonstrated; a matched MT-versus-MX comparative study remains needed [23][24].