A first-digit test ranks customers whose amounts bunch below round limits; the statistic is the start of the review, not the alert.
Count the first digit of every amount, compare the shares with Benford's expected 30.1 per cent of 1s down to 4.6 per cent of 9s, and measure the gap with a chi-square test and the mean absolute deviation (MAD). On an illustrative business account with 1,200 outgoing payments, a chi-square of 58.53 against a 15.51 critical value and a MAD of 0.0151 flag nonconformity, and 88.7 per cent of the chi-square comes from two digits: 9 and 4. That is the finding, not the statistic: payments are bunching just below round limits.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
In many naturally occurring sets of amounts that span several orders of magnitude, the leading digit is 1 far more often than 9: the expected share of digit d is log10(1 + 1/d). Invoices, supplier payments and transfer amounts usually follow it, because they are the product of prices, quantities and rates. Amounts that people choose to stay under a limit do not, which is why the test is useful in transaction monitoring as a review tool for a customer's whole history.
It does not apply to everything. Data with a fixed range (salaries in one band, a product sold at one price), assigned numbers, or a hard minimum will fail for innocent reasons. Use it on populations of a few hundred amounts or more that range over at least two or three orders of magnitude, and treat a failure as a reason to look, never as evidence on its own.
A fictional wholesale company's current account: 1,200 outgoing transfers to suppliers over twelve months, from a few hundred euros to six figures. The bank's monitoring flagged nothing individually.
Expected share of digit d = log10(1 + 1/d) Excel: =LOG10(1+1/A2)
First digit of an amount: =VALUE(LEFT(TEXT(ABS(B2),"0"),1))
Chi-square = Σ (observed − expected)2 ÷ expected, 8 degrees of freedom
MAD = average over the nine digits of |observed share − expected share|
| Digit | Benford share | Expected count | Observed | Observed share | Chi-square contribution |
|---|---|---|---|---|---|
| 1 | 30.1% | 361.2 | 330 | 27.5% | 2.70 |
| 2 | 17.6% | 211.3 | 195 | 16.2% | 1.26 |
| 3 | 12.5% | 149.9 | 140 | 11.7% | 0.66 |
| 4 | 9.7% | 116.3 | 150 | 12.5% | 9.77 |
| 5 | 7.9% | 95.0 | 88 | 7.3% | 0.52 |
| 6 | 6.7% | 80.3 | 72 | 6.0% | 0.87 |
| 7 | 5.8% | 69.6 | 64 | 5.3% | 0.45 |
| 8 | 5.1% | 61.4 | 58 | 4.8% | 0.19 |
| 9 | 4.6% | 54.9 | 103 | 8.6% | 42.12 |
| Total | 100% | 1,200 | 1,200 | 100% | 58.53 |
Step 1, the chi-square. 58.53 against critical values of 15.51 at 5 per cent and 20.09 at 1 per cent, with 8 degrees of freedom. The p-value is below 0.0001.
Step 2, the MAD. 0.0151. Nigrini's thresholds for the first digit are 0.006 for close conformity, 0.012 for acceptable and 0.015 for marginal; above that is nonconformity. The account is just over the line.
Step 3, find the digits. Digits 9 and 4 contribute 51.89 of the 58.53. Without them the chi-square would be 6.64, comfortably conforming. There are 48 more payments starting with 9 than expected and 34 more starting with 4. Digit-level z-tests confirm it: 6.57 for the 9s and 3.24 for the 4s, both well above 1.96.
Step 4, go to the amounts. Pull the 9s and 4s and look at the first two digits. If they sit at 9,000 to 9,999 and 4,000 to 4,999, the pattern points to limits at 10,000 and 5,000: a bank reporting or approval threshold, or the company's own dual-signature rule. That is a question for the customer and for the second-line review, using the methods in how to detect cash structuring below a 10,000 euro threshold.
The chi-square grows in proportion to the number of amounts; the MAD does not. That decides which statistic to trust.
| Account | Payments | Chi-square | MAD | Reading |
|---|---|---|---|---|
| Case, 120 payments | 120 | 5.85 | 0.0151 | Chi-square passes, p 0.664 |
| Case | 1,200 | 58.53 | 0.0151 | Both flag |
| Case, ten times the volume | 12,000 | 585.26 | 0.0151 | Both flag |
| Clean account | 1,200 | 1.82 | 0.0037 | Both pass |
| Clean account, ten times the volume | 12,000 | 18.22 | 0.0037 | Chi-square fails, p 0.020 |
With 120 payments the same distortion is invisible to the chi-square. With 12,000, a clean account in close conformity fails it. On large populations, such as a bank's whole payment file, the chi-square rejects almost everything and the MAD is the measure to rank customers on.
Treating the test result as the alert. A chi-square of 58.53 says the distribution is unusual, not why. Retailers with standard prices, firms paying fixed instalments or rent, and payroll accounts all fail Benford honestly. The value is in step 3: the digits that drive the score, and then the amounts behind them. The second mistake is running it on a population that cannot conform, such as cash deposits capped by a machine limit, and then tuning thresholds to silence the noise.
Document the population, the period, the statistic used and the MAD band in the case file. A reviewer should be able to reproduce the 58.53 and see why digits 9 and 4 were pulled.
The EU AML Handbook covers the AMLR, AMLD6 and AMLA and what institutions have to build; the free workbook for this case sizes the review effort. For setting the rule that turns a score into an alert, see how to set an AML transaction monitoring threshold.
Under Nigrini's thresholds for first digits, a mean absolute deviation up to 0.006 is close conformity, up to 0.012 acceptable, up to 0.015 marginal, and above 0.015 nonconformity. The illustrative account scores 0.0151. Unlike the chi-square, the MAD does not grow with the number of amounts, so it is the better ranking measure on large files.
A few hundred at least. With 120 payments, the illustrative account's distortion gives a chi-square of only 5.85, p 0.664, and passes. With 1,200 the same shares give 58.53 and fail. On very large files the opposite happens: a clean account with 12,000 payments fails the chi-square at 18.22.
No. It shows the amounts are not naturally distributed. Fixed prices, rent, instalments and payroll all fail for innocent reasons. The useful step is finding which digits drive the score: in the illustrative case digits 9 and 4 explain 51.89 of a 58.53 chi-square, which points to amounts kept under 10,000 and 5,000.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 1340 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.