Work / Yaspa

Yaspa: identifying gambling operators by behaviour, not by name

Navi Insights built Yaspa a way to read a merchant's spend shape, the pattern of its transaction amounts, instead of its name. On a 524-merchant benchmark, spend shape alone identified 78.7 per cent of gambling transaction volume, with no name matching.

Client: Yaspa
Sector: Open banking
Status: Delivered, benchmarked on 524 merchants

The problem

Merchants do not announce themselves consistently in transaction data. One merchant can appear as a dozen name variants: across the dataset, 158,141 distinct name strings sat behind a few tens of thousands of actual businesses. Merchants have to be counted correctly before they can be classified.

Merchant categorisation relied on the name and category fields. Risk-relevant categories such as gambling almost never self-declare in the merchant name, and the more a merchant obscures itself, the less a name field tells you.

Of 53 known obscure gambling-adjacent payment processors checked by name, only one was tagged as gambling. An approach based on the name and category fields was blind to the other 52.

So Navi Insights first counted the merchants correctly, then started reading their spend shapes instead of their names.

The scope

What the work covered

01Resolve the raw name strings, so that each merchant is counted once
02Identify gambling operators by their spending behaviour
03Stress-test the method against a benchmark built to include the hard cases on purpose

How it was solved

How Navi Insights built the merchant fingerprint

Part 1 of 3 · Resolving 158,141 raw strings into 21,449 merchants

Navi Insights started by cleaning the merchant universe itself. Payment-facilitator prefixes on a hand-built list were stripped first. Trailing branch numbers were stripped next, but only when two or more real merchants shared the same root; a one-off number was left alone rather than guessed at. What remained was clustered by a DBSCAN pass over a text-and-spend-pattern embedding, so near-miss spellings and reworded branches fell into the same group without a rule being written for every one.

158,141 raw strings ingested; 148,446 after noise stripped; 21,449 distinct merchants resolved. Areas drawn to scale. The Tesco strings are an illustrative example of one raw string moving through the pipeline: facilitator wrapper stripped, branch number stripped, then clustered with its family.

Part 2 of 3 · Spend-shape fingerprinting with a Fourier transform

Navi Insights then moved from reading names to reading behaviour. A merchant's transaction amounts are binned into a histogram and its Fourier transform is taken, so that a spending habit turns into a shape. No merchant name enters this calculation at any point.

A supermarket basket costs whatever it costs: the amounts are close to continuous, so the spectrum decays smoothly. A gambling deposit tends to land on a round number, such as £10, £20 or £50. When that happens often enough, the histogram develops a periodic structure, which a Fourier transform turns into sharp peaks.

Illustrative. The curve with sharp peaks is the fingerprint a gambling operator leaves; the curve that decays smoothly is what an ordinary retailer leaves instead.

Spend shapes are compared using cosine similarity: a score where 1.00 means an identical shape, and lower scores mean two shapes are less alike. As a check on the method, the shapes of 24 known brands were compared with one another, pair by pair. Ten confirmed gambling operators form the reference signature, the shape other merchants are measured against; 797 real operators were scored on how closely they matched it.

Part 3 of 3 · Testing the signal against a 524-merchant benchmark

Navi Insights then built a benchmark to try to break the signal: 524 real merchants across six deliberately uneven buckets. They include high-volume operators, tiny ones with barely enough transactions to form a shape, and a grey-market tier of obscure payment processors that gambling money is sometimes routed through instead of a recognisable brand.

That grey-market tier is the case shape-based detection exists for: the harder a merchant is to name, the more its spending pattern is all that is left to go on.

Against that benchmark, spend shape alone, measured as cosine similarity to the reference signature, was the strongest single signal tested. A second, independent check was layered on top to drive false positives down. This payout check tested whether a merchant also pays out constantly, the way a real bookmaker does.

The result

What Navi Insights delivered

The 78.7 per cent figure was measured against the 524-merchant benchmark: real merchants, independently confirmed labels, deliberately including thin and obscure cases.

Merchant resolution158,141 → 21,449Raw strings resolved to real merchants

SPEND SHAPE ALONE78.7%Of gambling transaction volume identified on the benchmark, with no name matching

OPTIONAL PAYOUT CHECK102 → 0False positives on two separate validation pools, from as high as 102 down to 0. Tested at scale, the check also turned away real gambling operators with naturally quiet payout histories.

The payout check earns its keep for precision, not recall. In the benchmark, 44 per cent of confirmed gambling merchants never pay out enough to have a payout shape at all, so no threshold can make that check see them.

Spend-shape similarity is the method Navi Insights recommends running everywhere. The payout check is reserved for the moments when a false positive is unacceptable.

Stack

DBSCAN
Text-and-spend-pattern embedding
FFT of transaction-amount histograms
Cosine similarity
Payment-facilitator prefix list
IAM-authenticated analytics clone

DBSCAN over a text-and-spend-pattern embedding resolved merchants without a rule being hand-written for each one. FFT of transaction-amount histograms and cosine similarity were chosen for spend-shape fingerprinting and comparison because behaviour is far harder to disguise than a name. The pipeline runs on a live, governed, daily-refreshed analytics clone, with IAM-authenticated access, no long-lived credentials and no production access. A legacy connection for querying the data already existed. A parity check against it matched 515 of 515 operators exactly, confirming that the new pipeline sees what that connection did.

Next case