How Q-FENCE can help protect financial data in the digital age and explore ways for banks to detect money laundering together, while keeping customers’ data private.
Every time you pay rent, receive your salary or send money to a friend, your bank invokes a complex infrastructure which is not only responsible for protecting your money and keeping sensitive financial information confidential, but also for identifying fraud and money laundering.
This targets two seemingly opposing goals: data privacy for honest users and data analysis for detection against criminals. Both of these are important goals in the real world and we’d like to give a glimpse into how Q-FENCE can help strengthen both interests.
Financial Data Protection in the Quantum Age
Cryptography plays a fundamental role in keeping your financial data confidential. Communication between financial institutions and data at rest is encrypted and accesses are authenticated to prevent unauthorised access to sensitive information.
Much of today’s digital infrastructure for this relies on cryptographic algorithms that are extremely difficult to break using conventional computers.
However, sufficiently powerful quantum computers could fundamentally change this situation. Certain mathematical problems that protect widely used public-key cryptographic systems could become efficiently solvable, threatening technologies used for secure communication, digital signatures, and authentication.
Although such quantum computers are not yet available, preparing financial infrastructure for this transition cannot wait until they arrive.
Financial information may remain sensitive for many years. An attacker could intercept encrypted communications today, store them, and attempt to decrypt them in the future using more powerful technology. This is known as the Harvest Now, Decrypt Later threat.
To address these risks, researchers are developing Post-Quantum Cryptography (PQC): cryptographic techniques designed to remain secure against attacks from both conventional and quantum computers.
Q-FENCE contributes to this transition by investigating quantum-resistant cryptographic technologies and their integration into real-world applications, including critical financial infrastructure.
However, protecting financial information from future attacks is only part of the challenge.
How Can Banks Detect Financial Crime?
All transactions handled by banks are checked for signs of money laundering. Banks use various tools for this purpose, ranging from traditional transaction-monitoring rules to advanced machine learning systems.
These checks matter: laundered money finances drug trafficking, fraud and terrorism. However, when each bank only runs detection on its own data, a loophole persists, which is regularly exploited by criminals in the real world.
Imagine a criminal attempting to disguise the origin of illegally obtained money. Instead of transferring the money directly within your bank, they move it through a series of accounts at different banks, making the flow of funds increasingly difficult to follow.
The fundamental limitation becomes clear: each bank sees only part of the picture.
A bank may recognise suspicious activity among its own customers, but it cannot freely inspect the transactions and customer records held by other institutions. Consequently, a sequence of transfers that appears harmless to each bank individually might reveal suspicious activity when considered as a whole.
This fragmentation leads to a big load in practice: more than 90% of the alerts raised by traditional money laundering monitoring turn out to be false alarms, and estimates suggest that less than 0.1% of criminal money is ever intercepted.
Collaborative Data Sharing
Simply collecting everyone’s financial information in a central database would provide comprehensive measures against financial fraud, however, it would pose serious privacy, security, and regulatory concerns.
What if, instead, banks could analyse information together without revealing their private data to one another?
Within Q-FENCE, an interdisciplinary team of researchers led by a team at the University of Luxembourg, are exploring this option.
The Cryptographic Solution: Computing Without Revealing
One particularly promising technique is Fully Homomorphic Encryption (FHE).
Normally, encrypted information needs to be decrypted before it can be processed. FHE makes it possible to perform computations directly on encrypted data, without revealing its contents.
You can imagine this technique by a simple visual example: imagine you are in a jeweller’s workshop. A client provides a valuable ring, which is put into an opaque glovebox where only the client has the key to take the ring out again. Now workers can modify the ring by reaching inside the gloves and performing operations on the ring without being able to take it out.
Similarly, operations on encrypted financial data become possible using FHE. The key to open up the results is distributed into partial keys for each bank, such that only when all banks participating come together, they can learn the modified information in the protocol.
Imagine that two banks want to combine information about suspicious financial activity.
Such techniques open the door to collaborative financial analysis that would otherwise be difficult to reconcile with confidentiality requirements.
Importantly, modern FHE constructions rely on lattice-based mathematical assumptions, which are believed to be resistant to quantum attacks. This makes them particularly relevant to Q-FENCE’s mission of developing security technologies for the post-quantum era.
Our Research
Specifically, our vision is:
- A scoring system that runs inside an encrypted FHE layer and produces account-based risk assessments informed by incoming transactions from multiple partner banks.
- A system that can run continuously and allows banks to request decryption of scores for selected accounts.
- A collaborative decryption process requiring the participation of all participating banks, with checks and balances, that outputs only a risk estimate to the requesting bank, ensuring maximum data privacy. No raw client scores are ever revealed to other banks.
