A method, computer system, and computer program for determining suspect entities engaged in financial transactions. A focus entity and peripheral entities are selected such that each peripheral entity has financial transactions with F within a period of time that is subsequently partitioned into at least two time intervals. Directed graphs are generated for each time interval. Each directed graph consists of a focus node, a plurality of peripheral nodes, and edges between the focus node and the peripheral nodes. The focus node represents F. Each peripheral node represents one of the peripheral entities. Each edge has a weight that is a function of the financial transaction between F and the peripheral node within the time interval. Out-of-norm edges are determined from the directed graphs using edge-selection criteria. Potential suspect entities are identified from the out-of-norm edges. The suspect entities are determined from the potential suspect entities.