Integrating Transaction Fraud Detection and SME Credit-Risk Prediction Through Drift-Aware Machine Learning

Abstract

Transaction fraud detection and small and medium-sized enterprise (SME) loan-distress prediction are managed, in most institutions, as entirely separate operational functions, yet the two problems share a common methodological core: both involve rare adverse outcomes, delayed and slowly maturing labels, a predictor-outcome relationship that changes over time, and asymmetric costs attached to a false alarm versus a missed event. At the same time, the two problems differ in ways that make naively combining them into a single pooled model a genuine risk rather than a convenience: fraud is typically assessed at the level of an individual transaction with near-real-time latency requirements, while SME distress is assessed at the level of a borrower or facility over a materially longer horizon, and a transaction can be fraudulent without implying anything about the originating borrower's underlying solvency. This article proposes a task-aware integration architecture that shares data-quality monitoring, drift reporting, model-version tracking, and governance infrastructure across the two functions while deliberately retaining separate prediction services, separate outcome definitions, and separate evaluation criteria for fraud and for credit distress. The architecture draws on a recently proposed multi-institution validation design for drift-resilient early-warning models spanning both SME loan distress and transaction fraud, and on a leakage-safe, chronologically evaluated approach to fraud-specific drift detection under severe class imbalance, synthesizing both into a four-layer structure comprising task-specific prediction services, a shared monitoring layer, a risk-orchestration layer, and a governance and audit layer. The proposed evaluation methodology specifies chronological validation within each task, task-specific performance measures that are never averaged across fraud and credit risk, cross-institution testing, alert-routing rules, privacy and data-minimization controls, and an integration-level evaluation that treats the operational benefit of sharing infrastructure as an empirical question rather than an assumption. The article argues explicitly against pooling fraud and credit-distress labels into one undifferentiated score, on the grounds that doing so would discard exactly the distinctions that make each task's evaluation meaningful. We implement the architecture on two public datasets, the European credit-card fraud stream and 375,261 SBA small-business loans, with separate task services and one shared monitoring layer running identical code. A single universal alert threshold proved unworkable: a population stability index of 0.25 fired in 100 percent of no-shift comparisons for fraud and 0 percent for distress, and missed every cross-sector shift in the distress task, while task-calibrated thresholds behaved sensibly. The shared data-integrity screen raised no false alarms in either task and caught all four injected defects. Separate task models performed as well as a pooled joint model. Cross-task signals could not be tested, because no public dataset links a firm's transactions to its loans, and the architecture has not been validated in a live deployment.